diff --git a/pkgs/os-specific/linux/paxctl/default.nix b/pkgs/os-specific/linux/paxctl/default.nix
index 270be695f03..52e4c512f9a 100644
--- a/pkgs/os-specific/linux/paxctl/default.nix
+++ b/pkgs/os-specific/linux/paxctl/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, stdenv }:
+{ fetchurl, stdenv, elf-header }:
 
 stdenv.mkDerivation rec {
   name = "paxctl-${version}";
@@ -9,7 +9,17 @@ stdenv.mkDerivation rec {
     sha256 = "0biw882fp1lmgs6kpxznp1v6758r7dg9x8iv5a06k0b82bcdsc53";
   };
 
-  preBuild = ''
+  # TODO Always do first way next mass rebuild.
+  buildInputs = stdenv.lib.optional
+    (!stdenv.hostPlatform.isLinux || !stdenv.buildPlatform.isLinux)
+    elf-header;
+
+  # TODO Always do first way next mass rebuild.
+  preBuild = if !stdenv.hostPlatform.isLinux || !stdenv.buildPlatform.isLinux then ''
+    sed -i Makefile \
+      -e 's|--owner 0 --group 0||g' \
+      -e '/CC:=gcc/d'
+  '' else ''
     sed "s|--owner 0 --group 0||g" -i Makefile
   '';
 
@@ -24,7 +34,7 @@ stdenv.mkDerivation rec {
     description = "A tool for controlling PaX flags on a per binary basis";
     homepage    = "https://pax.grsecurity.net";
     license     = licenses.gpl2;
-    platforms   = platforms.linux;
+    platforms   = platforms.all;
     maintainers = with maintainers; [ thoughtpolice ];
   };
 }
diff --git a/pkgs/stdenv/cross/default.nix b/pkgs/stdenv/cross/default.nix
index d1efa360237..daa9f66615c 100644
--- a/pkgs/stdenv/cross/default.nix
+++ b/pkgs/stdenv/cross/default.nix
@@ -53,6 +53,9 @@ in lib.init bootStages ++ [
            else buildPackages.gcc;
 
       extraNativeBuildInputs = old.extraNativeBuildInputs
+        ++ lib.optionals
+             (hostPlatform.isLinux && !buildPlatform.isLinux)
+             [ buildPackages.patchelf buildPackages.paxctl ]
         ++ lib.optional
              (let f = p: !p.isx86 || p.libc == "musl"; in f hostPlatform && !(f buildPlatform))
              buildPackages.updateAutotoolsGnuConfigScriptsHook