diff --git a/pkgs/by-name/kn/knot-dns/package.nix b/pkgs/by-name/kn/knot-dns/package.nix
index 969b6aa87121..495bb909704e 100644
--- a/pkgs/by-name/kn/knot-dns/package.nix
+++ b/pkgs/by-name/kn/knot-dns/package.nix
@@ -64,6 +64,7 @@ stdenv.mkDerivation rec {
   # FIXME: sphinx is needed for now to get man-pages
   nativeBuildInputs = [
     pkg-config
+    protobufc # dnstap support
     autoreconfHook
     sphinx
   ];
@@ -94,6 +95,7 @@ stdenv.mkDerivation rec {
   ++ lib.optional stdenv.hostPlatform.isDarwin zlib; # perhaps due to gnutls
 
   enableParallelBuilding = true;
+  strictDeps = true;
 
   CFLAGS = [
     "-O2"
diff --git a/pkgs/by-name/xd/xdp-tools/package.nix b/pkgs/by-name/xd/xdp-tools/package.nix
index 06b08b520864..18f5a58c49b9 100644
--- a/pkgs/by-name/xd/xdp-tools/package.nix
+++ b/pkgs/by-name/xd/xdp-tools/package.nix
@@ -1,6 +1,7 @@
 {
   lib,
   stdenv,
+  buildPackages,
   fetchFromGitHub,
   libbpf,
   elfutils,
@@ -42,7 +43,6 @@ stdenv.mkDerivation rec {
   ];
   nativeBuildInputs = [
     bpftools
-    llvmPackages.clang
     llvmPackages.llvm
     pkg-config
     m4
@@ -55,6 +55,8 @@ stdenv.mkDerivation rec {
   hardeningDisable = [ "zerocallusedregs" ];
   # When building BPF, the default CC wrapper is interfering a bit too much.
   BPF_CFLAGS = "-fno-stack-protector -Wno-error=unused-command-line-argument";
+  # When cross compiling, configure prefers the unwrapped clang unless told otherwise.
+  CLANG = lib.getExe buildPackages.llvmPackages.clang;
 
   PRODUCTION = 1;
   DYNAMIC_LIBXDP = 1;