diff --git a/pkgs/development/libraries/libidn2/default.nix b/pkgs/development/libraries/libidn2/default.nix
index d8294f56adc..933bafa429f 100644
--- a/pkgs/development/libraries/libidn2/default.nix
+++ b/pkgs/development/libraries/libidn2/default.nix
@@ -16,6 +16,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-dpQM1Od46Ak1eanRlbJf/16Tbp3GJCBoUotDenZ2T5E=";
   };
 
+  # Beware: non-bootstrap libidn2 is overridden by ./hack.nix
   outputs = [ "bin" "dev" "out" "info" "devdoc" ];
 
   patches = optional stdenv.isDarwin ./fix-error-darwin.patch;
diff --git a/pkgs/development/libraries/libidn2/no-bootstrap-reference.nix b/pkgs/development/libraries/libidn2/no-bootstrap-reference.nix
new file mode 100644
index 00000000000..e5922073437
--- /dev/null
+++ b/pkgs/development/libraries/libidn2/no-bootstrap-reference.nix
@@ -0,0 +1,30 @@
+{ stdenv, lib, libidn2, libunistring, runCommandLocal, patchelf }:
+# Construct a copy of libidn2.* where all (transitive) libc references (in .bin)
+# get replaced by a new one, so that there's no reference to bootstrap tools.
+runCommandLocal
+  "${libidn2.pname}-${libidn2.version}"
+  {
+    outputs = [ "bin" "dev" "out" ];
+    passthru = {
+      inherit (libidn2) out info devdoc; # no need to touch these store paths
+    };
+  }
+  ''
+    cp -r '${libidn2.bin}' "$bin"
+    chmod +w "$bin"/bin/*
+    patchelf \
+      --set-interpreter '${stdenv.cc.bintools.dynamicLinker}' \
+      --set-rpath '${lib.concatMapStringsSep ":" (p: lib.getLib p + "/lib")
+                      [ stdenv.cc.libc libunistring libidn2 ]}' \
+      "$bin"/bin/*
+
+    cp -r '${libidn2.dev}' "$dev"
+    chmod +w "$dev"/nix-support/propagated-build-inputs
+    substituteInPlace "$dev"/nix-support/propagated-build-inputs \
+      --replace '${libidn2.bin}' "$bin"
+    substituteInPlace "$dev"/lib/pkgconfig/libidn2.pc \
+      --replace '${libidn2.dev}' "$dev"
+
+    ln -s '${libidn2.out}' "$out" # it's hard to be without any $out
+  ''
+
diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index 64c21fa105d..d5b220b8520 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -432,8 +432,16 @@ in
         inherit (prevStage)
           gzip bzip2 xz bash coreutils diffutils findutils gawk
           gnumake gnused gnutar gnugrep gnupatch patchelf
-          attr acl zlib pcre libunistring libidn2;
+          attr acl zlib pcre libunistring;
         ${localSystem.libc} = getLibc prevStage;
+
+        # Hack: avoid libidn2.{bin,dev} referencing bootstrap tools.  There's a logical cycle.
+        libidn2 = import ../../development/libraries/libidn2/no-bootstrap-reference.nix {
+          inherit lib;
+          inherit (prevStage) libidn2;
+          inherit (self) stdenv runCommandLocal patchelf libunistring;
+        };
+
       } // lib.optionalAttrs (super.stdenv.targetPlatform == localSystem) {
         # Need to get rid of these when cross-compiling.
         inherit (prevStage) binutils binutils-unwrapped;