diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index a7a4c2fbacdb4..b77c450bdec1f 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -133,7 +133,9 @@ stdenv.mkDerivation ({
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ bison ];
-  buildInputs = lib.optionals withGd [ gd libpng ];
+  # TODO make linuxHeaders unconditional next mass rebuild
+  buildInputs = lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) linuxHeaders
+    ++ lib.optionals withGd [ gd libpng ];
 
   # Needed to install share/zoneinfo/zone.tab.  Set to impure /bin/sh to
   # prevent a retained dependency on the bootstrap tools in the stdenv-linux
diff --git a/pkgs/os-specific/linux/kernel-headers/default.nix b/pkgs/os-specific/linux/kernel-headers/default.nix
index 09fa4fbfd3a73..55a6f7e28cd1e 100644
--- a/pkgs/os-specific/linux/kernel-headers/default.nix
+++ b/pkgs/os-specific/linux/kernel-headers/default.nix
@@ -1,9 +1,10 @@
 { stdenvNoCC, lib, buildPackages
-, fetchurl, perl
+, fetchurl, fetchpatch, perl
+, elf-header
 }:
 
 let
-  common = { version, sha256, patches ? null }: stdenvNoCC.mkDerivation {
+  common = { version, sha256, patches ? [] }: stdenvNoCC.mkDerivation ({
     name = "linux-headers-${version}";
 
     src = fetchurl {
@@ -16,20 +17,57 @@ let
     # It may look odd that we use `stdenvNoCC`, and yet explicit depend on a cc.
     # We do this so we have a build->build, not build->host, C compiler.
     depsBuildBuild = [ buildPackages.stdenv.cc ];
-    nativeBuildInputs = [ perl ];
+    # TODO make unconditional next mass rebuild
+    nativeBuildInputs = [ perl ] ++ lib.optional
+      (stdenvNoCC.hostPlatform != stdenvNoCC.buildPlatform)
+      elf-header;
 
     extraIncludeDirs = lib.optional stdenvNoCC.hostPlatform.isPowerPC ["ppc"];
 
-    # "patches" array defaults to 'null' to avoid changing hash
-    # and causing mass rebuild
-    inherit patches;
+    # TODO no null hack next mass rebuild
+    patches =
+      if patches == [] && stdenvNoCC.hostPlatform == stdenvNoCC.buildPlatform
+      then null
+      else patches;
 
-    buildPhase = ''
+    # TODO avoid native hack next rebuild
+    makeFlags = if stdenvNoCC.hostPlatform == stdenvNoCC.buildPlatform then null else [
+      "SHELL=bash"
+      # Avoid use of runtime build->host compilers for checks. These
+      # checks only cared to work around bugs in very old compilers, so
+      # these changes should be safe.
+      "cc-version:=9999"
+      "cc-fullversion:=999999"
+      # `$(..)` expanded by make alone
+      "HOSTCC:=$(BUILD_CC)"
+      "HOSTCXX:=$(BUILD_CXX)"
+    ];
+
+    # TODO avoid native hack next rebuild
+    # Skip clean on darwin, case-sensitivity issues.
+    buildPhase = if stdenvNoCC.hostPlatform == stdenvNoCC.buildPlatform then ''
       make mrproper headers_check SHELL=bash
+    '' else lib.optionalString (!stdenvNoCC.buildPlatform.isDarwin) ''
+      make mrproper $makeFlags
+    ''
+    # For some reason, doing `make install_headers` twice, first without
+    # INSTALL_HDR_PATH=$out then with, is neccessary to get this to work
+    # for darwin cross. @Ericson2314 has no idea why.
+    + ''
+      make headers_install $makeFlags
+    '';
+
+    # TODO avoid native hack next rebuild
+    checkPhase = if stdenvNoCC.hostPlatform == stdenvNoCC.buildPlatform then null else ''
+      make headers_check $makeFlags
     '';
 
-    installPhase = ''
+    # TODO avoid native hack next rebuild
+    installPhase = (if stdenvNoCC.hostPlatform == stdenvNoCC.buildPlatform then ''
       make INSTALL_HDR_PATH=$out headers_install
+    '' else ''
+      make headers_install INSTALL_HDR_PATH=$out $makeFlags
+    '') + ''
 
       # Some builds (e.g. KVM) want a kernel.release.
       mkdir -p $out/include/config
@@ -41,11 +79,19 @@ let
       license = licenses.gpl2;
       platforms = platforms.linux;
     };
-  };
+  } // lib.optionalAttrs (stdenvNoCC.hostPlatform != stdenvNoCC.buildPlatform) {
+    # TODO Make unconditional next mass rebuild
+    hardeningDisable = lib.optional stdenvNoCC.buildPlatform.isDarwin "format";
+  });
 in {
 
   linuxHeaders = common {
     version = "4.15";
     sha256 = "0sd7l9n9h7vf9c6gd6ciji28hawda60yj0llh17my06m0s4lf9js";
+    # TODO make unconditional next mass rebuild
+    patches = lib.optionals (stdenvNoCC.hostPlatform != stdenvNoCC.buildPlatform) [
+       ./no-relocs.patch # for building x86 kernel headers on non-ELF platforms
+       ./no-dynamic-cc-version-check.patch # so we can use `stdenvNoCC`, see `makeFlags` above
+    ];
   };
 }
diff --git a/pkgs/os-specific/linux/kernel-headers/no-dynamic-cc-version-check.patch b/pkgs/os-specific/linux/kernel-headers/no-dynamic-cc-version-check.patch
new file mode 100644
index 0000000000000..b69dc65e1587a
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel-headers/no-dynamic-cc-version-check.patch
@@ -0,0 +1,16 @@
+diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include
+index 065324a8046f..d09c67194549 100644
+--- a/scripts/Kbuild.include
++++ b/scripts/Kbuild.include
+@@ -216,11 +216,8 @@ cc-disable-warning = $(call try-run-cached,\
+ cc-name = $(call shell-cached,$(CC) -v 2>&1 | grep -q "clang version" && echo clang || echo gcc)
+ 
+ # cc-version
+-cc-version = $(call shell-cached,$(CONFIG_SHELL) $(srctree)/scripts/gcc-version.sh $(CC))
+ 
+ # cc-fullversion
+-cc-fullversion = $(call shell-cached,$(CONFIG_SHELL) \
+-	$(srctree)/scripts/gcc-version.sh -p $(CC))
+ 
+ # cc-ifversion
+ # Usage:  EXTRA_CFLAGS += $(call cc-ifversion, -lt, 0402, -O1)
diff --git a/pkgs/os-specific/linux/kernel-headers/no-relocs.patch b/pkgs/os-specific/linux/kernel-headers/no-relocs.patch
new file mode 100644
index 0000000000000..67e8b19e23bda
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel-headers/no-relocs.patch
@@ -0,0 +1,13 @@
+diff --git a/arch/x86/Makefile b/arch/x86/Makefile
+index fad55160dcb9..a48c8331cbb2 100644
+--- a/arch/x86/Makefile
++++ b/arch/x86/Makefile
+@@ -239,7 +239,7 @@ ifdef CONFIG_RETPOLINE
+ endif
+ 
+ archscripts: scripts_basic
+-	$(Q)$(MAKE) $(build)=arch/x86/tools relocs
++	$(Q)$(MAKE) $(build)=arch/x86/tools
+ 
+ ###
+ # Syscall table generation
diff --git a/pkgs/top-level/release-cross.nix b/pkgs/top-level/release-cross.nix
index 0d15d817a66c1..89a8af6794f68 100644
--- a/pkgs/top-level/release-cross.nix
+++ b/pkgs/top-level/release-cross.nix
@@ -2,7 +2,7 @@
 */
 
 { # The platforms *from* which we cross compile.
-  supportedSystems ? [ "x86_64-linux" "x86_64-darwin" ]
+  supportedSystems ? [ "x86_64-linux" "x86_64-darwin" "aarch64-linux" ]
 , # Strip most of attributes when evaluating to spare memory usage
   scrubJobs ? true
 }:
@@ -10,7 +10,7 @@
 with import ./release-lib.nix { inherit supportedSystems scrubJobs; };
 
 let
-  nativePlatforms = linux;
+  nativePlatforms = all;
 
   common = {
     buildPackages.binutils = nativePlatforms;