diff --git a/pkgs/development/compilers/graalvm/community-edition/repository.nix b/pkgs/development/compilers/graalvm/community-edition/repository.nix
index 50a3b53c579..b532fe8cb5d 100644
--- a/pkgs/development/compilers/graalvm/community-edition/repository.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/repository.nix
@@ -130,37 +130,53 @@ let
       unpack_jar ''${arr[4]}
     '';
 
-    installPhase = {
-      "8-linux-amd64" = ''
+    outputs = [ "out" "lib" ];
+
+    installPhase = let
+      nativePRNGWorkaround = path: ''
         # BUG workaround http://mail.openjdk.java.net/pipermail/graal-dev/2017-December/005141.html
-        substituteInPlace $out/jre/lib/security/java.security \
+        substituteInPlace ${path} \
           --replace file:/dev/random    file:/dev/./urandom \
           --replace NativePRNGBlocking  SHA1PRNG
-
+      '';
+      copyClibrariesToOut = basepath: ''
         # provide libraries needed for static compilation
         for f in ${glibc}/lib/* ${glibc.static}/lib/* ${zlib.static}/lib/*; do
-          ln -s $f $out/jre/lib/svm/clibraries/${platform}/$(basename $f)
+          ln -s $f ${basepath}/${platform}/$(basename $f)
         done
+      '';
+
+      copyClibrariesToLib = ''
+        # add those libraries to $lib output too, so we can use them with
+        # `native-image -H:CLibraryPath=''${graalvm11-ce.lib}/lib ...` and reduce
+        # closure size by not depending on GraalVM $out (that is much bigger)
+        mkdir -p $lib/lib
+        for f in ${glibc}/lib/*; do
+          ln -s $f $lib/lib/$(basename $f)
+        done
+      '';
+    in {
+      "8-linux-amd64" = ''
+        ${nativePRNGWorkaround "$out/jre/lib/security/java.security"}
+
+        ${copyClibrariesToOut "$out/jre/lib/svm/clibraries"}
+
+        ${copyClibrariesToLib}
 
         # allow using external truffle-api.jar and languages not included in the distrubution
         rm $out/jre/lib/jvmci/parentClassLoader.classpath
       '';
       "11-linux-amd64" = ''
-        # BUG workaround http://mail.openjdk.java.net/pipermail/graal-dev/2017-December/005141.html
-        substituteInPlace $out/conf/security/java.security \
-          --replace file:/dev/random    file:/dev/./urandom \
-          --replace NativePRNGBlocking  SHA1PRNG
+        ${nativePRNGWorkaround "$out/conf/security/java.security"}
 
-        # provide libraries needed for static compilation
-        for f in ${glibc}/lib/* ${glibc.static}/lib/* ${zlib.static}/lib/*; do
-          ln -s $f $out/lib/svm/clibraries/${platform}/$(basename $f)
-        done
+        ${copyClibrariesToOut "$out/lib/svm/clibraries"}
+
+        ${copyClibrariesToLib}
       '';
       "11-darwin-amd64" = ''
-        # BUG workaround http://mail.openjdk.java.net/pipermail/graal-dev/2017-December/005141.html
-        substituteInPlace $out/conf/security/java.security \
-          --replace file:/dev/random    file:/dev/./urandom \
-          --replace NativePRNGBlocking  SHA1PRNG
+        # create empty $lib/lib to avoid breaking builds
+        mkdir -p $lib/lib
+        ${nativePRNGWorkaround "$out/conf/security/java.security"}
       '';
     }.${javaVersionPlatform} + ''
       # jni.h expects jni_md.h to be in the header search path.
diff --git a/pkgs/development/interpreters/clojure/babashka.nix b/pkgs/development/interpreters/clojure/babashka.nix
index b167a4e9b12..df75a233fff 100644
--- a/pkgs/development/interpreters/clojure/babashka.nix
+++ b/pkgs/development/interpreters/clojure/babashka.nix
@@ -23,6 +23,7 @@ stdenv.mkDerivation rec {
 
     # https://github.com/babashka/babashka/blob/v0.6.1/script/compile#L41-L52
     args=("-jar" "$BABASHKA_JAR"
+          "-H:CLibraryPath=${graalvm11-ce.lib}/lib"
           # Required to build babashka on darwin. Do not remove.
           "${lib.optionalString stdenv.isDarwin "-H:-CheckToolchain"}"
           "-H:Name=$BABASHKA_BINARY"
diff --git a/pkgs/development/tools/clj-kondo/default.nix b/pkgs/development/tools/clj-kondo/default.nix
index 45348b562c1..c4b90813a33 100644
--- a/pkgs/development/tools/clj-kondo/default.nix
+++ b/pkgs/development/tools/clj-kondo/default.nix
@@ -4,12 +4,6 @@ stdenv.mkDerivation rec {
   pname = "clj-kondo";
   version = "2021.09.25";
 
-  reflectionJson = fetchurl {
-    name = "reflection.json";
-    url = "https://raw.githubusercontent.com/clj-kondo/${pname}/v${version}/reflection.json";
-    sha256 = "sha256-C4QYk5lLienCHKnWXXZPcKmsCTMtIIkXOkvCrZfyIhA=";
-  };
-
   src = fetchurl {
     url = "https://github.com/clj-kondo/${pname}/releases/download/v${version}/${pname}-${version}-standalone.jar";
     sha256 = "sha256-kS6bwsYH/cbjJlIeiDAy6QsAw+D1uHp26d4NBLfStjg=";
@@ -20,21 +14,21 @@ stdenv.mkDerivation rec {
   buildInputs = [ graalvm11-ce ];
 
   buildPhase = ''
-    native-image  \
-      -jar ${src} \
-      -H:Name=clj-kondo \
-      ${lib.optionalString stdenv.isDarwin ''-H:-CheckToolchain''} \
-      -H:+ReportExceptionStackTraces \
-      -J-Dclojure.spec.skip-macros=true \
-      -J-Dclojure.compiler.direct-linking=true \
-      "-H:IncludeResources=clj_kondo/impl/cache/built_in/.*" \
-      -H:ReflectionConfigurationFiles=${reflectionJson} \
-      --initialize-at-build-time  \
-      -H:Log=registerResource: \
-      --verbose \
-      --no-fallback \
-      --no-server \
-      "-J-Xmx3g"
+    runHook preBuild
+
+    # https://github.com/clj-kondo/clj-kondo/blob/v2021.09.25/script/compile#L17-L21
+    args=("-jar" "$src"
+          "-H:CLibraryPath=${graalvm11-ce.lib}/lib"
+          # Required to build babashka on darwin. Do not remove.
+          "${lib.optionalString stdenv.isDarwin "-H:-CheckToolchain"}"
+          "-H:+ReportExceptionStackTraces"
+          "--verbose"
+          "--no-fallback"
+          "-J-Xmx3g")
+
+     native-image ''${args[@]}
+
+     runHook postBuild
   '';
 
   installPhase = ''
@@ -47,6 +41,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/clj-kondo/clj-kondo";
     license = licenses.epl10;
     platforms = graalvm11-ce.meta.platforms;
-    maintainers = with maintainers; [ jlesquembre bandresen ];
+    maintainers = with maintainers; [ jlesquembre bandresen thiagokokada ];
   };
 }
diff --git a/pkgs/development/tools/misc/clojure-lsp/default.nix b/pkgs/development/tools/misc/clojure-lsp/default.nix
index 160c1b560ee..30028375420 100644
--- a/pkgs/development/tools/misc/clojure-lsp/default.nix
+++ b/pkgs/development/tools/misc/clojure-lsp/default.nix
@@ -25,7 +25,16 @@ stdenv.mkDerivation rec {
   buildPhase = with lib; ''
     runHook preBuild
 
-    bash ./graalvm/native-unix-compile.sh
+    # https://github.com/clojure-lsp/clojure-lsp/blob/2021.09.30-15.28.01/graalvm/native-unix-compile.sh#L19-L24
+    args=("-jar" "$CLOJURE_LSP_JAR"
+          "-H:CLibraryPath=${graalvm11-ce.lib}/lib"
+          "-H:+ReportExceptionStackTraces"
+          "--verbose"
+          "--no-fallback"
+          "--native-image-info"
+          "$CLOJURE_LSP_XMX")
+
+    native-image ''${args[@]}
 
     runHook postBuild
   '';
diff --git a/pkgs/development/tools/zprint/default.nix b/pkgs/development/tools/zprint/default.nix
index 266ac83b80d..f00d9c29a48 100644
--- a/pkgs/development/tools/zprint/default.nix
+++ b/pkgs/development/tools/zprint/default.nix
@@ -24,6 +24,7 @@ stdenv.mkDerivation rec {
     -H:Name=${pname} \
     -H:EnableURLProtocols=https,http \
     -H:+ReportExceptionStackTraces \
+    -H:CLibraryPath=${graalvm11-ce.lib}/lib \
     ${lib.optionalString stdenv.isDarwin ''-H:-CheckToolchain''} \
     --report-unsupported-elements-at-runtime \
     --initialize-at-build-time \