diff --git a/pkgs/shells/yash/default.nix b/pkgs/shells/yash/default.nix
index 01340df5e9a..773801eca17 100644
--- a/pkgs/shells/yash/default.nix
+++ b/pkgs/shells/yash/default.nix
@@ -6,15 +6,15 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://osdn.net/dl/yash/yash-${version}.tar.xz";
-    sha256 = "sha256:1jdmj4cyzwxxyyqf20y1zi578h7md860ryffp02qi143zpppn4sm";
+    hash = "sha256-VRN77/2DhIgFuM75DAxq9UB0SvzBA+Gw973z7xmRtck=";
   };
 
   strictDeps = true;
   buildInputs = [ gettext ncurses ];
 
   meta = with lib; {
-    description = "Yet another POSIX-compliant shell";
     homepage = "https://yash.osdn.jp/index.html.en";
+    description = "Yet another POSIX-compliant shell";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ qbit ];
     platforms = platforms.all;
diff --git a/pkgs/test/cuda/cuda-samples/generic.nix b/pkgs/test/cuda/cuda-samples/generic.nix
index c5a9e24abd4..eeb3d6fcb52 100644
--- a/pkgs/test/cuda/cuda-samples/generic.nix
+++ b/pkgs/test/cuda/cuda-samples/generic.nix
@@ -1,20 +1,16 @@
-{ addOpenGLRunpath
-, cudatoolkit
+{ lib
+, stdenv
 , fetchFromGitHub
 , fetchpatch
-, lib
+, addOpenGLRunpath
+, cudatoolkit
 , pkg-config
 , sha256
-, stdenv
 }:
 
-let
+stdenv.mkDerivation rec {
   pname = "cuda-samples";
   version = lib.versions.majorMinor cudatoolkit.version;
-in
-
-stdenv.mkDerivation {
-  inherit pname version;
 
   src = fetchFromGitHub {
     owner = "NVIDIA";
@@ -31,7 +27,7 @@ stdenv.mkDerivation {
   patches = lib.optionals (version == "11.3") [
     (fetchpatch {
       url = "https://github.com/NVIDIA/cuda-samples/commit/5c3ec60faeb7a3c4ad9372c99114d7bb922fda8d.patch";
-      sha256 = "sha256:15bydf59scmfnldz5yawbjacdxafi50ahgpzq93zlc5xsac5sz6i";
+      sha256 = "sha256-0XxdmNK9MPpHwv8+qECJTvXGlFxc+fIbta4ynYprfpU=";
     })
   ];
 
diff --git a/pkgs/test/dhall/buildDhallUrl/default.nix b/pkgs/test/dhall/buildDhallUrl/default.nix
index d2e214fb977..a75101a303d 100644
--- a/pkgs/test/dhall/buildDhallUrl/default.nix
+++ b/pkgs/test/dhall/buildDhallUrl/default.nix
@@ -9,6 +9,6 @@
 dhallPackages.buildDhallUrl {
   url = "https://raw.githubusercontent.com/cdepillabout/example-dhall-nix/e6a675c72ecd4dd23d254a02aea8181fe875747f/mydhallfile.dhall";
   hash = "sha256-434x+QjHRzuprBdw0h6wmwB1Zj6yZqQb533me8XdO4c=";
-  dhallHash = "sha256:e37e31f908c7473ba9ac1770d21eb09b0075663eb266a41be77de67bc5dd3b87";
+  dhallHash = "sha256-434x+QjHRzuprBdw0h6wmwB1Zj6yZqQb533me8XdO4c=";
   source = true;
 }
diff --git a/pkgs/tools/graphics/asymptote/default.nix b/pkgs/tools/graphics/asymptote/default.nix
index 657d215147c..eef97b55cca 100644
--- a/pkgs/tools/graphics/asymptote/default.nix
+++ b/pkgs/tools/graphics/asymptote/default.nix
@@ -16,14 +16,14 @@ stdenv.mkDerivation rec {
     owner = "vectorgraphics";
     repo = pname;
     rev = version;
-    sha256 = "sha256:1lawj2gf0985clzbyym26s5mxxp2syl1dqqxfzk0sq9s30l2rj3l";
+    hash = "sha256-dMgsKBg6YQ3mdx3jFqjX4vZeizaier8+ZQUl4J6QXNE=";
   };
 
   patches =
     (lib.optional (lib.versionOlder version "2.68")
       (fetchpatch {
         url = "https://github.com/vectorgraphics/asymptote/commit/3361214340d58235f4dbb8f24017d0cd5d94da72.patch";
-        sha256 = "sha256:1z2b41x8v7683myd45lq6niixpdjy0b185x0xl61130vrijhq5nm";
+        hash = "sha256-1RYMZcwbjBAM7aAXFBbwst0eozWYFtJ8HcicjXogS/w=";
       }))
   ;
 
diff --git a/pkgs/tools/misc/flexoptix-app/default.nix b/pkgs/tools/misc/flexoptix-app/default.nix
index 507fbb7dcc7..4438d9d637b 100644
--- a/pkgs/tools/misc/flexoptix-app/default.nix
+++ b/pkgs/tools/misc/flexoptix-app/default.nix
@@ -6,12 +6,12 @@
   src = fetchurl {
     name = "${name}.AppImage";
     url = "https://flexbox.reconfigure.me/download/electron/linux/x64/FLEXOPTIX%20App.${version}.AppImage";
-    sha256 = "sha256:1hzdb2fbkwpsf0d3ws4z32blk6549jwhf1lrlqmcxhzqfvkr4gin";
+    hash = "sha256-Nj6S53b4w84qppkGB7lMpJhJlxifaD4acPryuZxY7cM=";
   };
 
   udevRules = fetchurl {
     url = "https://www.flexoptix.net/skin/udev_rules/99-tprogrammer.rules";
-    sha256 = "0mr1bhgvavq1ax4206z1vr2y64s3r676w9jjl9ysziklbrsvk5rr";
+    hash = "sha256-OZe5dV50xq99olImbo7JQxPjRd7hGyBIVwFvtR9cIVc=";
   };
 
   appimageContents = (appimageTools.extract { inherit name src; }).overrideAttrs (oA: {
diff --git a/pkgs/tools/misc/octofetch/default.nix b/pkgs/tools/misc/octofetch/default.nix
index e0cf9d98d65..3d2d2919aa5 100644
--- a/pkgs/tools/misc/octofetch/default.nix
+++ b/pkgs/tools/misc/octofetch/default.nix
@@ -1,9 +1,9 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, rustPlatform
-, pkg-config
 , openssl
+, pkg-config
+, rustPlatform
 , Security
 }:
 
@@ -18,15 +18,16 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-/AXE1e02NfxQzJZd0QX6gJDjmFFmuUTOndulZElgIMI=";
   };
 
-  cargoSha256 = "sha256:1ddyzbpsiy54r13nb9yrm64cbbifixnhkskwg5fvhhzj4ri4ks4a";
+  cargoSha256 = "sha256-iuhJYibyQ7hdeXzqCW2PLq7FiKnZp2VHyKT4qO/6vrU=";
 
   nativeBuildInputs = [ pkg-config ];
+
   buildInputs = lib.optionals stdenv.isLinux [ openssl ]
     ++ lib.optionals stdenv.isDarwin [ Security ];
 
   meta = with lib; {
-    description = "Github user information on terminal";
     homepage = "https://github.com/azur1s/octofetch";
+    description = "Github user information on terminal";
     license = licenses.mit;
     maintainers = with maintainers; [ jyooru ];
   };
diff --git a/pkgs/tools/misc/precice-config-visualizer/default.nix b/pkgs/tools/misc/precice-config-visualizer/default.nix
index 7605f49b153..be6e7f0a9bb 100644
--- a/pkgs/tools/misc/precice-config-visualizer/default.nix
+++ b/pkgs/tools/misc/precice-config-visualizer/default.nix
@@ -1,4 +1,7 @@
-{ lib, python3Packages, fetchFromGitHub}:
+{ lib
+, python3Packages
+, fetchFromGitHub
+}:
 
 python3Packages.buildPythonApplication rec {
   pname = "config-visualizer";
@@ -8,15 +11,16 @@ python3Packages.buildPythonApplication rec {
     owner = "precice";
     repo = pname;
     rev = "60f2165f25352c8261f370dc4ceb64a8b422d4ec";
-    sha256 = "sha256:0mqzp2qdvbqbxaczlvc9xxxdz6hclraznbmc08ldx11xwy8yknfr";
+    hash = "sha256-2dnpkec9hN4oAqwu+1WmDJrfeu+JbfqZ6guv3bC4H1c=";
   };
 
   propagatedBuildInputs = with python3Packages; [ lxml pydot ];
+
   doCheck = false;
 
   meta = with lib; {
-    description = "Small python tool for visualizing the preCICE xml configuration ";
     homepage = "https://github.com/precice/config-visualizer";
+    description = "Small python tool for visualizing the preCICE xml configuration ";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ Scriptkiddi ];
   };
diff --git a/pkgs/tools/networking/openapi-generator-cli/example.nix b/pkgs/tools/networking/openapi-generator-cli/example.nix
index f59173b9744..047c02a9a91 100644
--- a/pkgs/tools/networking/openapi-generator-cli/example.nix
+++ b/pkgs/tools/networking/openapi-generator-cli/example.nix
@@ -4,7 +4,7 @@ runCommand "openapi-generator-cli-test" {
   nativeBuildInputs = [ openapi-generator-cli ];
   petstore = fetchurl {
     url = "https://raw.githubusercontent.com/OAI/OpenAPI-Specification/14c0908becbccd78252be49bd92be8c53cd2b9e3/examples/v3.0/petstore.yaml";
-    sha256 = "sha256:1mgdbzv42alv0b1a18dqbabqyvyhrg3brynr5hqsrm3qljfzaq5b";
+    hash = "sha256-q2D1naR41KwxLNn6vMbL0G+Pl1q4oaDCApsqQfZf7dU=";
   };
   config = builtins.toJSON {
     elmVersion = "0.19";
diff --git a/pkgs/tools/networking/vpnc-scripts/default.nix b/pkgs/tools/networking/vpnc-scripts/default.nix
index f0d5991d34b..a3b6b0f738a 100644
--- a/pkgs/tools/networking/vpnc-scripts/default.nix
+++ b/pkgs/tools/networking/vpnc-scripts/default.nix
@@ -1,15 +1,24 @@
-{ lib, stdenv, fetchgit
+{ lib
+, stdenv
+, fetchgit
+, coreutils
+, gawk
+, gnugrep
+, iproute2
 , makeWrapper
-, nettools, gawk, systemd, openresolv, coreutils, gnugrep, iproute2
+, nettools
+, openresolv
+, systemd
 }:
 
 stdenv.mkDerivation {
   pname = "vpnc-scripts";
   version = "unstable-2021-09-24";
+
   src = fetchgit {
     url = "https://gitlab.com/openconnect/vpnc-scripts.git";
     rev = "b749c2cadc2f32e2efffa69302861f9a7d4a4e5f";
-    sha256 = "sha256:19aj6mfkclbkx6ycyd4xm7id1bq78ismw0y6z23f6s016k3sjc8c";
+    sha256 = "sha256-DDGpxzQBaOOG+MYDXnVEB6/Q4qmdNM+86XNRNl01UqU=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -32,8 +41,8 @@ stdenv.mkDerivation {
   '';
 
   meta = with lib; {
-    description = "script for vpnc to configure the network routing and name service";
     homepage = "https://www.infradead.org/openconnect/";
+    description = "Script for vpnc to configure the network routing and name service";
     license = licenses.gpl2Only;
     maintainers = with maintainers; [ jerith666 ];
     platforms = platforms.linux ++ platforms.darwin;
diff --git a/pkgs/tools/security/pcsclite/default.nix b/pkgs/tools/security/pcsclite/default.nix
index db3ddd167a6..bcc7163bec2 100644
--- a/pkgs/tools/security/pcsclite/default.nix
+++ b/pkgs/tools/security/pcsclite/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://pcsclite.apdu.fr/files/pcsc-lite-${version}.tar.bz2";
-    sha256 = "sha256:024x0hadn0kc0m9yz3l2pqzc5mdqyza9lmckg0bn4xak6frzkqwy";
+    hash = "sha256-nuP5szNTdWIXeJNVmtT3uNXCPr6Cju9TBWwC2xQEnQg=";
   };
 
   patches = [ ./no-dropdir-literals.patch ];
diff --git a/pkgs/tools/security/pomerium-cli/default.nix b/pkgs/tools/security/pomerium-cli/default.nix
index 7dc7e3a7a90..9463e085189 100644
--- a/pkgs/tools/security/pomerium-cli/default.nix
+++ b/pkgs/tools/security/pomerium-cli/default.nix
@@ -9,15 +9,17 @@ let
 in
 buildGoModule rec {
   pname = "pomerium-cli";
-  version = pomerium.version;
+  inherit (pomerium) version;
+
   src = fetchFromGitHub {
     owner = "pomerium";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256:0230b22xjnpykj8bcdahzzlsvlrd63z2cmg6yb246c5ngjs835q1";
+    hash = "sha256-AZeBtHy2MEPE8uZVJv4wLdOt6f9QNbaQnP5a2YVYYAg=";
   };
 
-  vendorSha256 = "sha256:0xx22lmh6wip1d1bjrp4lgab3q9yilw54v4lg24lf3xhbsr5si9b";
+  vendorSha256 = "sha256-K0Vdsl6wD0eJeJRsUjiNPuGx1KPkZrlCCzdyAysVonc=";
+
   subPackages = [
     "cmd/pomerium-cli"
   ];
@@ -45,7 +47,11 @@ buildGoModule rec {
   ];
 
   installPhase = ''
+    runHook preInstall
+
     install -Dm0755 $GOPATH/bin/pomerium-cli $out/bin/pomerium-cli
+
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/security/softhsm/default.nix b/pkgs/tools/security/softhsm/default.nix
index 873cfdbbb05..b218a3241f9 100644
--- a/pkgs/tools/security/softhsm/default.nix
+++ b/pkgs/tools/security/softhsm/default.nix
@@ -7,7 +7,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://dist.opendnssec.org/source/${pname}-${version}.tar.gz";
-    hash = "sha256:1wkmyi6n3z2pak1cj5yk6v6bv9w0m24skycya48iikab0mrr8931";
+    hash = "sha256-YSSUcwVLzRgRUZ75qYmogKe9zDbTF8nCVFf8YU30dfI=";
   };
 
   configureFlags = [
diff --git a/pkgs/tools/system/retry/default.nix b/pkgs/tools/system/retry/default.nix
index 48125d2df37..2dcd1aa3766 100644
--- a/pkgs/tools/system/retry/default.nix
+++ b/pkgs/tools/system/retry/default.nix
@@ -1,23 +1,30 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, which, txt2man }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, autoreconfHook
+, txt2man
+, which
+}:
+
 stdenv.mkDerivation rec {
   pname = "retry";
   version = "1.0.4";
 
-  nativeBuildInputs = [ autoreconfHook which txt2man ];
-
   src = fetchFromGitHub {
     owner = "minfrin";
     repo = "retry";
     rev = "${pname}-${version}";
-    sha256 = "sha256:0jrx4yrwlf4fn3309kxraj7zgwk7gq6rz5ibswq3w3b3jfvxi8qb";
+    hash = "sha256-C6PYt5NjDT4w1yuWnw1+Z/L3j1S5zwTGsI44yrMnPUs=";
   };
 
+  nativeBuildInputs = [ autoreconfHook txt2man which ];
+
   meta = with lib; {
     homepage = "https://github.com/minfrin/retry";
     description = "Retry a command until the command succeeds";
-    platforms = platforms.all;
     license = licenses.asl20;
     maintainers = with maintainers; [ gfrascadorio ];
+    platforms = platforms.all;
   };
 }
 
diff --git a/pkgs/tools/text/cidrgrep/default.nix b/pkgs/tools/text/cidrgrep/default.nix
index cfbfee48938..c636eef3c46 100644
--- a/pkgs/tools/text/cidrgrep/default.nix
+++ b/pkgs/tools/text/cidrgrep/default.nix
@@ -8,10 +8,10 @@ buildGoModule {
     owner = "tomdoherty";
     repo = "cidrgrep";
     rev = "8ad5af533e8dc33ea18ff19b7c6a41550748fe0e";
-    sha256 = "sha256:0jvwm9jq5jd270b6l9nkvc5pr3rgf158sw83lrprmwmz7r4mr786";
+    hash = "sha256-Bp1cST6/8ppvpgNxjUpwL498C9vTJmoWOKLJgmWqfEs=";
   };
 
-  vendorSha256 = "sha256:0sjjj9z1dhilhpc8pq4154czrb79z9cm044jvn75kxcjv6v5l2m5";
+  vendorSha256 = "sha256-pQpattmS9VmO3ZIQUFn66az8GSmB4IvYhTTCFn6SUmo=";
 
   postInstall = ''
     mv $out/bin/cmd $out/bin/cidrgrep
@@ -19,7 +19,7 @@ buildGoModule {
 
   meta = {
     description = "Like grep but for IPv4 CIDRs";
-    maintainers = with lib.maintainers; [ das_j ];
     license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ das_j ];
   };
 }
diff --git a/pkgs/tools/typesetting/coq2html/default.nix b/pkgs/tools/typesetting/coq2html/default.nix
index 924eea3c0a8..267309e2e35 100644
--- a/pkgs/tools/typesetting/coq2html/default.nix
+++ b/pkgs/tools/typesetting/coq2html/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation  rec {
     owner = "xavierleroy";
     repo = "coq2html";
     rev = "v${version}";
-    sha256 = "sha256:1ad825yifn518wk1c2y2ji10q3m468r8ajjgw2nzzy7d608nx7yq";
+    hash = "sha256-2J9uETDt+P+t4E9KhTIypA4MQpTCCxYmR6FYF30RqKk=";
   };
 
   nativeBuildInputs = [ ocaml ];