diff --git a/CHANGELOG.md b/CHANGELOG.md
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,38 @@
 # Revision History for cabal2nix
 
+## 2.21.0
+
+* In expressions generated by `cabal2nix --shell`, use the `inNixShell`
+  function argument instead of `pkgs.lib.inNixShell`. Note that this
+  requires [Nix 2.4 or later](https://github.com/NixOS/nix/pull/3168)
+  or Lix.
+  
+  _Warning_: This only works correctly if the generated expression is
+  the top level expression. If you want to use a wrapper expression,
+  make sure it has an `inNixShell` argument and pass that through
+  to the generated one.
+* Valid Hackage package names that are not valid Nix identifiers (like
+  `4Blocks` or `assert`) are escaped by prefixing them with an `_` now.
+  This makes it possible to generate expressions that depend on such
+  packages without manual intervention.
+  See also [#672](https://github.com/NixOS/cabal2nix/pull/672) and
+  [nixpkgs#453366](https://github.com/NixOS/nixpkgs/pull/453366).
+* Added library name mappings for various packages.
+* Removed library name mappings for `pkgs.webkitgtk_4_0`, `pkgs.opencv3`
+  and `pkgs.devil` all of which have been removed from Nixpkgs for 25.11.
+* Removed expression post processing hooks for `pandoc`, `pandoc-citeproc`,
+  `liquid-fixpoint` and `GlomeVec`.
+* Stop resolving the `nix-store`, `nix-hash` etc. executables in `build-tools`
+  to a `nix` package input. As of 2025-10-16, this clashes with a Hackage
+  package causing the input to stop working as intended. Users who relied
+  on this resolution, will need to pass in `pkgs.nix` manually via overrides
+  going forward.
+* LLVM related packages are no longer resolved to the version GHC uses for
+  `-fllvm` since such a match is usually not required. Instead, it resolves
+  to the global default version Nixpkgs uses unless overridden.
+* Use `lib.licensesSpdx` to express licenses specified using SPDX identifiers
+  when possible.
+
 ## 2.20.1
 
 * Add support for Cabal `== 3.14.*` in the test suite.
diff --git a/cabal2nix.cabal b/cabal2nix.cabal
--- a/cabal2nix.cabal
+++ b/cabal2nix.cabal
@@ -1,5 +1,5 @@
 name:               cabal2nix
-version:            2.20.1
+version:            2.21.0
 synopsis:           Convert Cabal files into Nix build instructions.
 description:
   Convert Cabal files into Nix build instructions. Users of Nix can install the latest
@@ -12,7 +12,7 @@
 -- list all contributors: git log --pretty='%an' | sort | uniq
 maintainer:         sternenseemann <sternenseemann@systemli.org>
 stability:          stable
-tested-with:        GHC == 8.10.7 || == 9.0.2 || == 9.2.8 || == 9.4.8 || == 9.6.7 || == 9.8.4 || == 9.10.1 || == 9.12.2
+tested-with:        GHC == 8.10.7 || == 9.0.2 || == 9.2.8 || == 9.4.8 || == 9.6.7 || == 9.8.4 || == 9.10.2 || == 9.12.2
 category:           Distribution, Nix
 homepage:           https://github.com/nixos/cabal2nix#readme
 bug-reports:        https://github.com/nixos/cabal2nix/issues
@@ -55,7 +55,6 @@
                     , Cabal                >= 3.0
                     , aeson                > 1
                     , ansi-terminal
-                    , ansi-wl-pprint
                     , bytestring
                     , containers           >= 0.5.9
                     , deepseq              >= 1.4
@@ -69,6 +68,7 @@
                     , lens
                     , optparse-applicative
                     , pretty               >= 1.1.2
+                    , prettyprinter
                     , process
                     , split
                     , text
@@ -107,7 +107,7 @@
                     , distribution-nixpkgs >= 1.7 && < 1.8
                     , filepath
                     , hopenssl             >= 2
-                    , language-nix
+                    , language-nix         >= 2.3.0
                     , lens
                     , monad-par
                     , monad-par-extras
diff --git a/hackage2nix/HackageGit.hs b/hackage2nix/HackageGit.hs
--- a/hackage2nix/HackageGit.hs
+++ b/hackage2nix/HackageGit.hs
@@ -11,6 +11,7 @@
 import Control.Monad
 import Data.Aeson
 import qualified Data.ByteString.Char8 as BS
+import qualified Data.List as List
 import Data.Map as Map
 import Data.Set as Set
 import Data.String
@@ -38,7 +39,7 @@
 getSubDirs :: FilePath -> IO [FilePath]
 getSubDirs path = do
   let isDirectory p = doesDirectoryExist (path </> p)
-  getDirectoryContents path >>= filterM isDirectory . Prelude.filter (\x -> head x /= '.')
+  getDirectoryContents path >>= filterM isDirectory . Prelude.filter (not . List.isPrefixOf ".")
 
 type SHA256Hash = String
 
diff --git a/hackage2nix/Main.hs b/hackage2nix/Main.hs
--- a/hackage2nix/Main.hs
+++ b/hackage2nix/Main.hs
@@ -22,6 +22,7 @@
 import Distribution.Nixpkgs.Haskell.FromCabal
 import Distribution.Nixpkgs.Haskell.FromCabal.Configuration as Config
 import Distribution.Nixpkgs.Haskell.FromCabal.Flags
+import Distribution.Nixpkgs.Haskell.FromCabal.Name (toNixName)
 import Distribution.Nixpkgs.Haskell.Platform ( parsePlatformFromSystemLenient )
 import Distribution.Nixpkgs.Haskell.OrphanInstances ( )
 import Distribution.Nixpkgs.Meta
@@ -80,12 +81,8 @@
   config <- sconcat <$> mapM (\file -> readConfiguration (nixpkgsRepository </> file)) configFiles
   nixpkgs <- readNixpkgPackageMap nixpkgsRepository (Just "{ config = { allowAliases = false; }; }")
   preferredVersions <- readPreferredVersions (fromMaybe (hackageRepository </> "preferred-versions") preferredVersionsFile)
-  let fixup = Map.delete "acme-everything"      -- TODO: https://github.com/NixOS/cabal2nix/issues/164
-            . Map.delete "type"                 -- TODO: https://github.com/NixOS/cabal2nix/issues/163
-            . Map.delete "control-invariants"   -- TODO: depends on "assert"
-            . Map.delete "ConcurrentUtils"      -- TODO: depends on "assert"
-            . Map.delete "with"                 -- TODO: https://github.com/NixOS/cabal2nix/issues/164
-            . over (at "hermes") (fmap (set (contains "1.3.4.3") False))  -- TODO: https://github.com/haskell/hackage-server/issues/436
+  let fixup = Map.delete "acme-everything" -- TODO(@wolfgangwalther): remove after https://github.com/NixOS/cabal2nix/pull/667
+              . over (at "hermes") (fmap (set (contains "1.3.4.3") False))  -- TODO: https://github.com/haskell/hackage-server/issues/436
   hackage <- fixup <$> readHackage hackageRepository
   let
       hackagePackagesFile :: FilePath
@@ -152,8 +149,8 @@
           flagAssignment :: FlagAssignment                  -- We don't use the flags from Stackage Nightly here, because
           flagAssignment = configureCabalFlags pkgId        -- they are chosen specifically for GHC 7.10.2.
 
-          attr :: String
-          attr = if isInDefaultPackageSet then unPackageName name else mangle pkgId
+          attr :: Identifier
+          attr = if isInDefaultPackageSet then toNixName name else mangle pkgId
 
           drv :: Derivation
           drv = fromGenericPackageDescription haskellResolver nixpkgsResolver targetPlatform (compilerInfo config) flagAssignment [] descr
@@ -171,7 +168,7 @@
           overrides :: Doc
           overrides = fcat $ punctuate space [ pPrint b <> semi | b <- Set.toList (view (dependencies . each) drv `Set.union` view extraFunctionArgs drv), not (isFromHackage b) ]
       return $ render $ nest 2 $
-        hang (doubleQuotes (text  attr) <+> equals <+> text "callPackage") 2 (parens (pPrint drv)) <+> (braces overrides <> semi)
+        hang (pPrint attr <+> equals <+> text "callPackage") 2 (parens (pPrint drv)) <+> (braces overrides <> semi)
 
     return (intercalate "\n\n" defs)
 
@@ -215,5 +212,7 @@
   , not (Set.null vset)         = Just (Set.findMax vset)
   | otherwise                   = Nothing
 
-mangle :: PackageIdentifier -> String
-mangle (PackageIdentifier name v) = unPackageName name ++ '_' : [ if c == '.' then '_' else c | c <- display v ]
+mangle :: PackageIdentifier -> Identifier
+mangle (PackageIdentifier name v) =
+  -- Appending a legal Nix identifier to a legal identifier always produces another legal one.
+  toNixName name & ident %~ (++ '_' : [ if c == '.' then '_' else c | c <- display v ])
diff --git a/src/Cabal2nix.hs b/src/Cabal2nix.hs
--- a/src/Cabal2nix.hs
+++ b/src/Cabal2nix.hs
@@ -38,7 +38,7 @@
 import Paths_cabal2nix ( version )
 import System.Environment ( getArgs )
 import System.IO ( hFlush, stdout, stderr )
-import qualified Text.PrettyPrint.ANSI.Leijen as P2
+import qualified Prettyprinter as P2
 import Text.PrettyPrint.HughesPJClass ( Doc, Pretty(..), text, vcat, hcat, semi, render, prettyShow )
 
 {-# ANN module ("HLint: ignore Use Just" :: String) #-}
@@ -148,16 +148,16 @@
         (  fullDesc
         <> header "cabal2nix converts Cabal files into build instructions for Nix."
         <> progDescDoc (Just (P2.vcat
-                     [ P2.text ""
-                     , P2.text "Recognized URI schemes:"
-                     , P2.text ""
-                     , P2.text "  cabal://pkgname-pkgversion     download the specified package from Hackage"
-                     , P2.text "  cabal://pkgname                download latest version of this package from Hackage"
-                     , P2.text "  file:///local/path             load the Cabal file from the local disk"
-                     , P2.text "  /local/path                    abbreviated version of file URI"
-                     , P2.text "  <git/svn/bzr/hg URL>           download the source from the specified repository"
-                     , P2.text ""
-                     , P2.fillSep (map P2.text (words (  "If the URI refers to a cabal file, information for building the package "
+                     [ ""
+                     , "Recognized URI schemes:"
+                     , ""
+                     , "  cabal://pkgname-pkgversion     download the specified package from Hackage"
+                     , "  cabal://pkgname                download latest version of this package from Hackage"
+                     , "  file:///local/path             load the Cabal file from the local disk"
+                     , "  /local/path                    abbreviated version of file URI"
+                     , "  <git/svn/bzr/hg URL>           download the source from the specified repository"
+                     , ""
+                     , P2.fillSep (map P2.pretty (words (  "If the URI refers to a cabal file, information for building the package "
                                                       ++ "will be retrieved from that file, but hackage will be used as a source "
                                                       ++ "for the derivation. Otherwise, the supplied URI will be used to as the "
                                                       ++ "source for the derivation and the information is taken from the cabal file "
@@ -234,7 +234,7 @@
 
       shell :: Doc
       shell = vcat
-              [ text "{ nixpkgs ? import <nixpkgs> {}, compiler ? \"default\", doBenchmark ? false }:"
+              [ text "{ nixpkgs ? import <nixpkgs> {}, compiler ? \"default\", doBenchmark ? false, inNixShell ? false }:"
               , text ""
               , text "let"
               , text ""
@@ -252,7 +252,7 @@
               , text ""
               , text "in"
               , text ""
-              , text "  if pkgs.lib.inNixShell then drv.env else drv"
+              , text "  if inNixShell then drv.env else drv"
               ]
   pure $ if optNixShellOutput then Left shell else Right deriv
 
diff --git a/src/Distribution/Nixpkgs/Fetch.hs b/src/Distribution/Nixpkgs/Fetch.hs
--- a/src/Distribution/Nixpkgs/Fetch.hs
+++ b/src/Distribution/Nixpkgs/Fetch.hs
@@ -258,12 +258,12 @@
                        []     -> error "This can't happen, but GHC doesn't know that."
                        (x:xs) -> (x,xs)
             buf'   = BS.unlines (reverse ls)
-        case length ls of
-          0 -> return Nothing
-          1 -> return (Just (DerivationSource { derivKind = Just kind
+        case ls of
+          [] -> return Nothing
+          [hash] -> return (Just (DerivationSource { derivKind = Just kind
                                               , derivUrl = sourceUrl source
                                               , derivRevision = ""
-                                              , derivHash = BS.unpack (head ls)
+                                              , derivHash = BS.unpack hash
                                               , derivSubmodule = Nothing
                                               }
                             , BS.unpack l))
diff --git a/src/Distribution/Nixpkgs/Haskell/FromCabal.hs b/src/Distribution/Nixpkgs/Haskell/FromCabal.hs
--- a/src/Distribution/Nixpkgs/Haskell/FromCabal.hs
+++ b/src/Distribution/Nixpkgs/Haskell/FromCabal.hs
@@ -29,10 +29,12 @@
 import Distribution.Types.PackageVersionConstraint
 import Distribution.Text ( display )
 import Distribution.Types.ComponentRequestedSpec as Cabal
+#if !MIN_VERSION_Cabal(3,8,1)
 import Distribution.Types.ExeDependency as Cabal
 import Distribution.Types.LegacyExeDependency as Cabal
 import Distribution.Types.PkgconfigDependency as Cabal
 import Distribution.Types.UnqualComponentName as Cabal
+#endif
 import Distribution.Utils.ShortText ( fromShortText )
 import Distribution.Version
 import Language.Nix
@@ -170,11 +172,6 @@
 
     resolveInNixpkgs :: Identifier -> Binding
     resolveInNixpkgs i
-      | i `elem` ["clang","lldb","llvm"] = binding # (i, path # ["self","llvmPackages",i])     -- TODO: evil!
-      | i == "gtk2"                      = binding # (i, path # ["pkgs","gtk2"])               -- TODO: these cases should not be necessary
-      | i == "gtk3"                      = binding # (i, path # ["pkgs","gtk3"])
-      | i == "gtksourceview3"            = binding # (i, path # ["pkgs","gtksourceview3"])
-      | i == "vte_291"                   = binding # (i, path # ["pkgs","vte"])
       | Just p <- nixpkgsResolver i, init (view (reference . path) p) `Set.member` goodScopes = p
       | otherwise                        = bindNull i
 
diff --git a/src/Distribution/Nixpkgs/Haskell/FromCabal/Configuration.hs b/src/Distribution/Nixpkgs/Haskell/FromCabal/Configuration.hs
--- a/src/Distribution/Nixpkgs/Haskell/FromCabal/Configuration.hs
+++ b/src/Distribution/Nixpkgs/Haskell/FromCabal/Configuration.hs
@@ -25,7 +25,6 @@
 import Distribution.Nixpkgs.Haskell.Constraint
 import Distribution.Nixpkgs.Meta
 import Distribution.Package
-import Distribution.System
 import GHC.Generics ( Generic )
 import Language.Nix.Identifier
 
diff --git a/src/Distribution/Nixpkgs/Haskell/FromCabal/Flags.hs b/src/Distribution/Nixpkgs/Haskell/FromCabal/Flags.hs
--- a/src/Distribution/Nixpkgs/Haskell/FromCabal/Flags.hs
+++ b/src/Distribution/Nixpkgs/Haskell/FromCabal/Flags.hs
@@ -46,7 +46,6 @@
                                 = [enable "system-lua", disable "use-pkgconfig"]
  | name == "idris"              = [enable "gmp", enable "ffi", enable "curses", ("execonly", version `withinRange` orLaterVersion (mkVersion [1,1,1])) ]
  | name == "io-streams"         = [enable "NoInteractiveTests"]
- | name == "liquid-fixpoint"    = [enable "build-external"]
  | name == "lua" && version >= mkVersion [2,0,0]
                                 = [enable "system-lua", disable "use-pkgconfig"]
  | name == "pandoc"             = [disable "trypandoc"]
diff --git a/src/Distribution/Nixpkgs/Haskell/FromCabal/License.hs b/src/Distribution/Nixpkgs/Haskell/FromCabal/License.hs
--- a/src/Distribution/Nixpkgs/Haskell/FromCabal/License.hs
+++ b/src/Distribution/Nixpkgs/Haskell/FromCabal/License.hs
@@ -53,107 +53,7 @@
     SPDX.ELicense simpl Nothing ->
       -- Not handled: license exceptions
       case simpl of
-        SPDX.ELicenseId lid ->
-          case lid of
-            SPDX.AFL_2_1 -> Known "lib.licenses.afl21"
-            SPDX.AFL_3_0 -> Known "lib.licenses.afl3"
-            SPDX.AGPL_3_0_only -> Known "lib.licenses.agpl3Only"
-            SPDX.AGPL_3_0_or_later -> Known "lib.licenses.agpl3Plus"
-            SPDX.APSL_2_0 -> Known "lib.licenses.apsl20"
-            SPDX.Artistic_1_0 -> Known "lib.licenses.artistic1"
-            SPDX.Artistic_2_0 -> Known "lib.licenses.artistic2"
-            SPDX.Apache_2_0 -> Known "lib.licenses.asl20"
-            SPDX.BSL_1_0 -> Known "lib.licenses.boost"
-            SPDX.Beerware -> Known "lib.licenses.beerware"
-            SPDX.NullBSD -> Known "lib.licenses.bsd0"
-            SPDX.BSD_2_Clause -> Known "lib.licenses.bsd2"
-            SPDX.BSD_3_Clause -> Known "lib.licenses.bsd3"
-            SPDX.BSD_4_Clause -> Known "lib.licenses.bsdOriginal"
-            SPDX.ClArtistic -> Known "lib.licenses.clArtistic"
-            SPDX.CC0_1_0 -> Known "lib.licenses.cc0"
-            SPDX.CC_BY_NC_SA_2_0 -> Known "lib.licenses.cc-by-nc-sa-20"
-            SPDX.CC_BY_NC_SA_2_5 -> Known "lib.licenses.cc-by-nc-sa-25"
-            SPDX.CC_BY_NC_SA_3_0 -> Known "lib.licenses.cc-by-nc-sa-30"
-            SPDX.CC_BY_NC_SA_4_0 -> Known "lib.licenses.cc-by-nc-sa-40"
-            SPDX.CC_BY_NC_4_0 -> Known "lib.licenses.cc-by-nc-40"
-            SPDX.CC_BY_ND_3_0 -> Known "lib.licenses.cc-by-nd-30"
-            SPDX.CC_BY_SA_2_5 -> Known "lib.licenses.cc-by-sa-25"
-            SPDX.CC_BY_3_0 -> Known "lib.licenses.cc-by-30"
-            SPDX.CC_BY_SA_3_0 -> Known "lib.licenses.cc-by-sa-30"
-            SPDX.CC_BY_4_0 -> Known "lib.licenses.cc-by-40"
-            SPDX.CC_BY_SA_4_0 -> Known "lib.licenses.cc-by-sa-40"
-            SPDX.CDDL_1_0 -> Known "lib.licenses.cddl"
-            SPDX.CECILL_2_0 -> Known "lib.licenses.cecill20"
-            SPDX.CECILL_B -> Known "lib.licenses.cecill-b"
-            SPDX.CECILL_C -> Known "lib.licenses.cecill-c"
-            SPDX.CPAL_1_0 -> Known "lib.licenses.cpal10"
-            SPDX.CPL_1_0 -> Known "lib.licenses.cpl10"
-            SPDX.Curl -> Known "lib.licenses.curl"
-            SPDX.DOC -> Known "lib.licenses.doc"
-            SPDX.EFL_1_0 -> Known "lib.licenses.efl10"
-            SPDX.EFL_2_0 -> Known "lib.licenses.efl20"
-            SPDX.EPL_1_0 -> Known "lib.licenses.epl10"
-            SPDX.EPL_2_0 -> Known "lib.licenses.epl20"
-            SPDX.EUPL_1_1 -> Known "lib.licenses.eupl11"
-            SPDX.GFDL_1_2_only -> Known "lib.licenses.fdl12Only"
-            SPDX.GFDL_1_3_only -> Known "lib.licenses.fdl13Only"
-            SPDX.GPL_1_0_only -> Known "lib.licenses.gpl1Only"
-            SPDX.GPL_1_0_or_later -> Known "lib.licenses.gpl1Plus"
-            SPDX.GPL_2_0_only -> Known "lib.licenses.gpl2Only"
-            SPDX.GPL_2_0_or_later -> Known "lib.licenses.gpl2Plus"
-            SPDX.GPL_3_0_only -> Known "lib.licenses.gpl3Only"
-            SPDX.GPL_3_0_or_later -> Known "lib.licenses.gpl3Plus"
-            SPDX.HPND -> Known "lib.licenses.hpnd"
-            SPDX.IJG -> Known "lib.licenses.ijg"
-            SPDX.ImageMagick -> Known "lib.licenses.imagemagick"
-            SPDX.IPA -> Known "lib.licenses.ipa"
-            SPDX.IPL_1_0 -> Known "lib.licenses.ipl10"
-            SPDX.ISC -> Known "lib.licenses.isc"
-            SPDX.LGPL_2_0_only -> Known "lib.licenses.lgpl2Only"
-            SPDX.LGPL_2_0_or_later -> Known "lib.licenses.lgpl2Plus"
-            SPDX.LGPL_2_1_only -> Known "lib.licenses.lgpl21Only"
-            SPDX.LGPL_2_1_or_later -> Known "lib.licenses.lgpl21Plus"
-            SPDX.LGPL_3_0_only -> Known "lib.licenses.lgpl3Only"
-            SPDX.LGPL_3_0_or_later -> Known "lib.licenses.lgpl3Plus"
-            SPDX.Libpng -> Known "lib.licenses.libpng"
-            SPDX.Libtiff -> Known "lib.licenses.libtiff"
-            SPDX.LPPL_1_2 -> Known "lib.licenses.lppl12"
-            SPDX.LPPL_1_3c -> Known "lib.licenses.lppl13c"
-            SPDX.LPL_1_02 -> Known "lib.licenses.lpl-102"
-            SPDX.MIT -> Known "lib.licenses.mit"
-            SPDX.MPL_1_0 -> Known "lib.licenses.mpl10"
-            SPDX.MPL_1_1 -> Known "lib.licenses.mpl11"
-            SPDX.MPL_2_0 -> Known "lib.licenses.mpl20"
-            SPDX.MS_PL -> Known "lib.licenses.mspl"
-            SPDX.NCSA -> Known "lib.licenses.ncsa"
-            SPDX.NPOSL_3_0 -> Known "lib.licenses.nposl3"
-            SPDX.OFL_1_1 -> Known "lib.licenses.ofl"
-            SPDX.OLDAP_2_8 -> Known "lib.licenses.openldap"
-            SPDX.OpenSSL -> Known "lib.licenses.openssl"
-            SPDX.OSL_2_1 -> Known "lib.licenses.osl21"
-            SPDX.OSL_3_0 -> Known "lib.licenses.osl3"
-            SPDX.PHP_3_01 -> Known "lib.licenses.php201"
-            SPDX.PostgreSQL -> Known "lib.licenses.postgresql"
-            SPDX.Python_2_0 -> Known "lib.licenses.psfl"
-            SPDX.QPL_1_0 -> Known "lib.licenses.qpl"
-            SPDX.Ruby -> Known "lib.licenses.ruby"
-            SPDX.Sendmail -> Known "lib.licenses.sendmail"
-            SPDX.SGI_B_2_0 -> Known "lib.licenses.sgi-b-0"
-            SPDX.Sleepycat -> Known "lib.licenses.sleepycat"
-            SPDX.TCL -> Known "lib.licenses.tcltx"
-            SPDX.Unlicense -> Known "lib.licenses.unlicense"
-            SPDX.Vim -> Known "lib.licenses.vim"
-            SPDX.VSL_1_0 -> Known "lib.licenses.vsl10"
-            SPDX.Watcom_1_0 -> Known "lib.licenses.watcom"
-            SPDX.W3C -> Known "lib.licenses.w3c"
-            SPDX.WTFPL -> Known "lib.licenses.wtfpl"
-            SPDX.Zlib -> Known "lib.licenses.zlib"
-            SPDX.ZPL_2_0 -> Known "lib.licenses.zpl20"
-            SPDX.ZPL_2_1 -> Known "lib.licenses.zpl21"
-            _ ->
-              -- Licence is not in Nixpkgs.
-              -- Use the SPDX expression as a free-form license string.
-              Unknown (Just $ prettyShow expr)
+        SPDX.ELicenseId lid -> Known ("lib.licensesSpdx.\"" ++ prettyShow lid ++ "\"")
         _ ->
           -- Not handed: the '+' suffix and user-defined licences references.
           -- Use the SPDX expression as a free-form license string.
diff --git a/src/Distribution/Nixpkgs/Haskell/FromCabal/Name.hs b/src/Distribution/Nixpkgs/Haskell/FromCabal/Name.hs
--- a/src/Distribution/Nixpkgs/Haskell/FromCabal/Name.hs
+++ b/src/Distribution/Nixpkgs/Haskell/FromCabal/Name.hs
@@ -8,10 +8,81 @@
 import Distribution.Text
 import Language.Nix
 
--- | Map Cabal names to Nix attribute names.
+-- | Map Cabal names to Nix identifiers that don't need to be quoted.
+--
+--   Currently this only supports 'PackageName's that consist of nothing but ASCII
+--   characters (as needs to be the case with all Hackage packages).
+--   Cabal package names are not changed if they already are a Nix identifier
+--   that doesn't need quoting (with some notable exceptions). If they would need
+--   quoting, they are prefixed with an underscore.
+--
+--   >>> toNixName $ mkPackageName "cabal2nix"
+--   Identifier "cabal2nix"
+--   >>> toNixName $ mkPackageName "4Blocks"
+--   Identifier "_4Blocks"
+--   >>> toNixName $ mkPackageName "assert"
+--   Identifier "_assert"
+--
+--   Package names that clash with attribute names that have a special meaning
+--   to the Nix evaluator are also prefixed (e.g.
+--   [@type@ is evaluated eagerly]((https://github.com/NixOS/cabal2nix/issues/163)).
+--
+--   The mapping is intended to be reversible, but this isn't implemented by
+--   @cabal2nix@ yet (and untested). It also should not be considered
+--   stable yet, in particular the following may be changed:
+--
+--   - Future versions of @cabal2nix@ may prefix more 'PackageName's.
+--   - The mapping may be extended to support all possible 'PackageName's.
+--
+--   See also:
+--
+--   - [Cabal documentation on the package name field](https://cabal.readthedocs.io/en/stable/cabal-package-description-file.html#pkg-field-name)
+--   - "Language.Nix.Identifier"
+--   - [Nix documentation on identifiers](https://nix.dev/manual/nix/2.30/language/identifiers.html#identifier)
 toNixName :: PackageName -> Identifier
-toNixName "" = error "toNixName: invalid empty package name"
-toNixName n  = fromString (unPackageName n)
+toNixName n = fromString $
+  case unPackageName n of
+    "" -> error "toNixName: BUG: received empty package name"
+    '_':_ -> error "toNixName: BUG: PackageName starts with an underscore, but shouldn't"
+    name
+      -- From the Cabal documentation:
+      --
+      --   A valid package name comprises an alphanumeric ‘word’; or two or more
+      --   such words separated by a hyphen character (-). A word cannot be
+      --   comprised only of the digits 0 to 9.
+      --
+      -- Cabal also latin unicode characters while Hackage enforces that package
+      -- names are ASCII.
+      --
+      -- If the package name comes from Hackage, the set of legal characters
+      -- ([a-zA-Z0-9-]) is a subset of those permissible as a Nix identifier
+      -- without quoting ([a-zA-Z0-9_'-]). The main difference are the rules
+      -- governing what may go where. In the following cases a Hackage package
+      -- name is not a simple identifier and 'needsQuoting' returns True:
+      --
+      -- - if the first “word” of the package name starts with a number, e.g. 4Blocks.
+      -- - if the package name is the same one of the 'nixKeywords'.
+      --
+      -- If we prefix these strings with an underscore, they no longer need quoting.
+      -- Because Cabal 'PackageName's may not contain underscores this mapped name
+      -- can never clash. (Reversing the mapping is very simple at the moment as
+      -- a result.)
+      --
+      -- We additionally prefix perfectly usable identifiers like type and
+      -- recurseForDerivations if they have special meaning to the Nix evaluator
+      -- (or Hydra etc.) since it may cause evaluation failures if we expose a
+      -- package under haskellPackages instead of whatever value(s) Nix may
+      -- expect.
+      --
+      -- TODO: Add mapping for non-ASCII 'PackageName's, using __ prefix (?)
+      | needsQuoting name || name `elem` haveSpecialSemantics -> '_':name
+      | otherwise -> name
+  where
+    -- Special attributes that affect the behavior of the Nix evaluator in some way.
+    -- See https://github.com/NixOS/cabal2nix/issues/163.
+    -- We can ignore underscore prefixed attrs like __toString, __functor.
+    -- Only type is the name of a real package at the moment.
+    haveSpecialSemantics = [ "type", "outPath", "recurseForDerivations" ]
 
 -- | Map library names specified in Cabal files to Nix package identifiers.
 --
@@ -37,6 +108,8 @@
 libNixName "cairo-pdf"                          = return "cairo"
 libNixName "cairo-ps"                           = return "cairo"
 libNixName "cairo-svg"                          = return "cairo"
+libNixName "clang"                              = return "libclang"
+libNixName "clang-3.8"                          = return "libclang"  -- TODO: guessNixIdentifier before libNixName…
 libNixName "crypt"                              = return "libxcrypt" -- starting with NixOS 22.11, glibc's libcrypt will no longer be built
 libNixName "crypto"                             = return "openssl"
 libNixName "curses"                             = return "ncurses"
@@ -102,13 +175,11 @@
 libNixName "icuio"                              = return "icu"
 libNixName "icuuc"                              = return "icu"
 libNixName "idn"                                = return "libidn"
-libNixName "IL"                                 = return "libdevil"
 libNixName "ImageMagick"                        = return "imagemagick"
 libNixName "Imlib2"                             = return "imlib2"
 libNixName "iw"                                 = return "wirelesstools"
 libNixName "jack"                               = return "libjack2"
 libNixName "javascriptcoregtk"                  = return "webkitgtk"
-libNixName "javascriptcoregtk-4.0"              = return "webkitgtk_4_0"
 libNixName "javascriptcoregtk-4.1"              = return "webkitgtk_4_1"
 libNixName "javascriptcoregtk-6.0"              = return "webkitgtk_6_0"
 libNixName "jpeg"                               = return "libjpeg"
@@ -120,6 +191,8 @@
 libNixName "libbrotlienc"                       = return "brotli"
 libNixName "libbrotlidec"                       = return "brotli"
 libNixName "libcurl"                            = return "curl"
+libNixName "libcrypto"                          = return "openssl"
+libNixName "libglog"                            = return "glog"
 libNixName "libgsasl"                           = return "gsasl"
 libNixName "liblzma"                            = return "xz"
 libNixName "libnm"                              = return "networkmanager"
@@ -137,9 +210,11 @@
 libNixName "libsystemd"                         = return "systemd"
 libNixName "libudev"                            = return "systemd"
 libNixName "libxml-2.0"                         = return "libxml2"
+libNixName "libxxhash"                          = return "xxHash"
 libNixName "libzip"                             = return "libzip"
 libNixName "libzmq"                             = return "zeromq"
 libNixName "liquid"                             = return "liquid-dsp"
+libNixName "llama"                              = return "llama-cpp"
 libNixName "lzma"                               = return "xz"
 libNixName "m"                                  = []  -- in stdenv
 libNixName "magic"                              = return "file"
@@ -150,9 +225,18 @@
 libNixName "ncursesw"                           = return "ncurses"
 libNixName "netsnmp"                            = return "net-snmp"
 libNixName "nix-cmd"                            = return "nix"
+libNixName "nix-expr-c"                         = return "nix"
 libNixName "nix-expr"                           = return "nix"
+libNixName "nix-fetchers-c"                     = return "nix"
+libNixName "nix-fetchers"                       = return "nix"
+libNixName "nix-flake-c"                        = return "nix"
+libNixName "nix-flake"                          = return "nix"
+libNixName "nix-main-c"                         = return "nix"
 libNixName "nix-main"                           = return "nix"
+libNixName "nix-store-c"                        = return "nix"
 libNixName "nix-store"                          = return "nix"
+libNixName "nix-util-c"                         = return "nix"
+libNixName "nix-util"                           = return "nix"
 libNixName "notify"                             = return "libnotify"
 libNixName "odbc"                               = return "unixODBC"
 libNixName "openblas"                           = return "openblasCompat"
@@ -161,6 +245,7 @@
 libNixName "pcap"                               = return "libpcap"
 libNixName "pfs-1.2"                            = return "pfstools"
 libNixName "png"                                = return "libpng"
+libNixName "poppler-cpp"                        = return "poppler"
 libNixName "poppler-glib"                       = return "poppler_gi"
 libNixName "pq"                                 = return "libpq"
 libNixName "pthread"                            = []
@@ -197,7 +282,7 @@
 libNixName "tensorflow"                         = return "libtensorflow"
 libNixName "udev"                               = return "systemd";
 libNixName "uuid"                               = return "libossp_uuid";
-libNixName "vte-2.91"                           = return "vte_291"
+libNixName "vte-2.91"                           = return "vte"
 libNixName "vulkan"                             = return "vulkan-loader"
 libNixName "wayland-client"                     = return "wayland"
 libNixName "wayland-cursor"                     = return "wayland"
@@ -205,10 +290,8 @@
 libNixName "wayland-server"                     = return "wayland"
 libNixName "webkit"                             = return "webkitgtk" -- this is an alias, so it only works for downstream expressions not in hackage-packages.nix
 libNixName "webkit2gtk"                         = return "webkitgtk"
-libNixName "webkit2gtk-4.0"                     = return "webkitgtk_4_0"
 libNixName "webkit2gtk-4.1"                     = return "webkitgtk_4_1"
 libNixName "webkit2gtk-6.0"                     = return "webkitgtk_6_0"
-libNixName "webkit2gtk-web-extension-4.0"       = return "webkitgtk_4_0"
 libNixName "webkit2gtk-web-extension-4.1"       = return "webkitgtk_4_1"
 libNixName "webkit2gtk-web-extension-6.0"       = return "webkitgtk_6_0"
 libNixName "wxGTK"                              = return "wxGTK32"
@@ -313,11 +396,6 @@
 buildToolNixName "gtk2hsHookGenerator"          = return "gtk2hs-buildtools"
 buildToolNixName "gtk2hsTypeGen"                = return "gtk2hs-buildtools"
 buildToolNixName "hsc2hs"                       = []
-buildToolNixName "nix-build"                    = return "nix"
-buildToolNixName "nix-env"                      = return "nix"
-buildToolNixName "nix-hash"                     = return "nix"
-buildToolNixName "nix-instantiate"              = return "nix"
-buildToolNixName "nix-store"                    = return "nix"
 buildToolNixName "utillinux"                    = return "util-linux"
 buildToolNixName x                              = return (fromString x)
 
diff --git a/src/Distribution/Nixpkgs/Haskell/FromCabal/Normalize.hs b/src/Distribution/Nixpkgs/Haskell/FromCabal/Normalize.hs
--- a/src/Distribution/Nixpkgs/Haskell/FromCabal/Normalize.hs
+++ b/src/Distribution/Nixpkgs/Haskell/FromCabal/Normalize.hs
@@ -6,6 +6,7 @@
 import qualified Data.Set as Set
 import Data.String
 import Distribution.Nixpkgs.Haskell
+import Distribution.Nixpkgs.Haskell.FromCabal.Name (toNixName)
 import Distribution.Nixpkgs.Meta
 import Distribution.Package
 import Language.Nix hiding ( quote )
@@ -21,8 +22,8 @@
 
 normalizeBuildInfo :: PackageName -> BuildInfo -> BuildInfo
 normalizeBuildInfo pname bi = bi
-  & haskell %~ Set.filter (\b -> view localName b /= fromString (unPackageName pname))
-  & tool %~ Set.filter (\b -> view localName b /= fromString (unPackageName pname))
+  & haskell %~ Set.filter (\b -> view localName b /= toNixName pname)
+  & tool %~ Set.filter (\b -> view localName b /= toNixName pname)
 
 normalizeMeta :: Meta -> Meta
 normalizeMeta meta = meta
diff --git a/src/Distribution/Nixpkgs/Haskell/FromCabal/PostProcess.hs b/src/Distribution/Nixpkgs/Haskell/FromCabal/PostProcess.hs
--- a/src/Distribution/Nixpkgs/Haskell/FromCabal/PostProcess.hs
+++ b/src/Distribution/Nixpkgs/Haskell/FromCabal/PostProcess.hs
@@ -112,7 +112,6 @@
   , ("git-annex >= 6.20170925 && < 6.20171214", set doCheck False)      -- some versions of git-annex require their test suite to be run inside of a git checkout
   , ("github-backup", set (executableDepends . tool . contains (pkg "git")) True)
   , ("GLFW", over (libraryDepends . system) (Set.union (Set.fromList [bind "pkgs.xorg.libXext", bind "pkgs.xorg.libXfixes"])))
-  , ("GlomeVec", set (libraryDepends . pkgconfig . contains (bind "self.llvmPackages.llvm")) True)
   , ("graphviz", set (testDepends . system . contains (pkg "graphviz")) True)
   , ("gtk3", gtk3Hook)
   , ("gtkglext", gtkglextHook)
@@ -137,7 +136,6 @@
   , ("js-jquery", set doCheck False)            -- attempts to access the network
   , ("libconfig", over (libraryDepends . system) (replace "config = null" (pkg "libconfig")))
   , ("libxml", set (configureFlags . contains "--extra-include-dir=${lib.getDev libxml2}/include/libxml2") True)
-  , ("liquid-fixpoint", set (testDepends . system . contains (pkg "z3")) True . set (testDepends . system . contains (pkg "nettools")) True . set (testDepends . system . contains (pkg "git")) True . set doCheck False)
   , ("liquidhaskell", set (testDepends . system . contains (pkg "z3")) True)
   , ("lua >= 2.0.0 && < 2.2.0", over (libraryDepends . system) (replace (pkg "lua") (pkg "lua5_3")))
   , ("lua >= 2.2.0", over (libraryDepends . system) (replace (pkg "lua") (pkg "lua5_4")))
@@ -147,11 +145,6 @@
   , ("mysql", set (libraryDepends . system . contains (pkg "libmysqlclient")) True)
   , ("network-attoparsec", set doCheck False) -- test suite requires network access
   , ("numeric-qq", set doCheck False) -- test suite doesn't finish even after 1+ days
-  , ("opencv", opencvOverrides)
-  , ("pandoc >= 1.16.0.2 && < 2.5", set doCheck False) -- https://github.com/jgm/pandoc/issues/2709 and https://github.com/fpco/stackage/issues/1332
-  , ("pandoc < 2.6", pandocPre26Overrides)
-  , ("pandoc >= 2.6 && < 3.1.10", pandocPre3110Overrides) -- https://github.com/jgm/pandoc/commit/55227a20273267c236ec039c3e6559287a1dca45
-  , ("pandoc-citeproc", set doCheck False) -- https://github.com/jgm/pandoc-citeproc/issues/369
   , ("purescript", set doCheck False) -- test suite doesn't cope with Nix build env
   , ("proto-lens-protobuf-types", set (libraryDepends . tool . contains (pkg "protobuf")) True)
   , ("proto-lens-protoc", set (libraryDepends . tool . contains (pkg "protobuf")) True)
@@ -322,10 +315,6 @@
   . set (metaSection . platforms) (Just $ Set.singleton (NixpkgsPlatformGroup (ident # "darwin")))
   . over (libraryDepends . haskell) (Set.union (Set.fromList (map bind ["self.base", "self.cereal", "self.mtl", "self.text", "self.bytestring"])))
 
-opencvOverrides :: Derivation -> Derivation
-opencvOverrides = set phaseOverrides "hardeningDisable = [ \"bindnow\" ];"
-                . over (libraryDepends . pkgconfig) (replace (pkg "opencv") (pkg "opencv3"))
-
 hspecCoreOverrides :: Derivation -> Derivation   -- https://github.com/hspec/hspec/issues/330
 hspecCoreOverrides = set testFlags [ "--skip", "'Test.Hspec.Core.Runner.hspecResult runs specs in parallel'" ]
 
@@ -348,24 +337,6 @@
                     , "pkgs.xorg.libXt"
                     , "pkgs.xorg.libXmu"
                     ]
-
-pandocPre26Overrides :: Derivation -> Derivation
-pandocPre26Overrides = set phaseOverrides postInstall
-  where
-    postInstall = unlines [ "postInstall = ''"
-                          , "  mkdir -p $out/share"
-                          , "  mv $data/*/*/man $out/share/"
-                          , "'';"
-                          ]
-
-pandocPre3110Overrides :: Derivation -> Derivation
-pandocPre3110Overrides = set phaseOverrides postInstall
-  where
-    postInstall = unlines [ "postInstall = ''"
-                          , "  mkdir -p $out/share/man/man1"
-                          , "  mv \"man/\"*.1 $out/share/man/man1/"
-                          , "'';"
-                          ]
 
 bustleOverrides :: Derivation -> Derivation
 bustleOverrides = set (libraryDepends . pkgconfig . contains "system-glib = pkgs.glib") True
diff --git a/test/golden-test-cases/nix-paths.nix.golden b/test/golden-test-cases/nix-paths.nix.golden
--- a/test/golden-test-cases/nix-paths.nix.golden
+++ b/test/golden-test-cases/nix-paths.nix.golden
@@ -1,10 +1,14 @@
-{ mkDerivation, base, lib, nix, process }:
+{ mkDerivation, base, lib, nix-build, nix-env, nix-hash
+, nix-instantiate, nix-store, process
+}:
 mkDerivation {
   pname = "nix-paths";
   version = "1.0.1";
   sha256 = "deadbeef";
   libraryHaskellDepends = [ base process ];
-  libraryToolDepends = [ nix ];
+  libraryToolDepends = [
+    nix-build nix-env nix-hash nix-instantiate nix-store
+  ];
   homepage = "https://github.com/peti/nix-paths";
   description = "Knowledge of Nix's installation directories";
   license = lib.licenses.bsd3;
diff --git a/test/golden-test-cases/opencv.nix.golden b/test/golden-test-cases/opencv.nix.golden
--- a/test/golden-test-cases/opencv.nix.golden
+++ b/test/golden-test-cases/opencv.nix.golden
@@ -1,7 +1,7 @@
 { mkDerivation, aeson, base, base64-bytestring, bindings-DSL
 , bytestring, Cabal, containers, criterion, data-default, deepseq
 , directory, Glob, haskell-src-exts, inline-c, inline-c-cpp
-, JuicyPixels, lens, lib, linear, opencv3, primitive, QuickCheck
+, JuicyPixels, lens, lib, linear, opencv, primitive, QuickCheck
 , repa, tasty, tasty-hunit, tasty-quickcheck, template-haskell
 , text, transformers, vector
 }:
@@ -15,7 +15,7 @@
     data-default deepseq inline-c inline-c-cpp JuicyPixels linear
     primitive repa template-haskell text transformers vector
   ];
-  libraryPkgconfigDepends = [ opencv3 ];
+  libraryPkgconfigDepends = [ opencv ];
   testHaskellDepends = [
     base bytestring containers data-default directory Glob
     haskell-src-exts JuicyPixels lens linear primitive QuickCheck repa
@@ -23,7 +23,6 @@
     transformers vector
   ];
   benchmarkHaskellDepends = [ base bytestring criterion repa ];
-  hardeningDisable = [ "bindnow" ];
   homepage = "https://github.com/LumiGuide/haskell-opencv";
   description = "Haskell binding to OpenCV-3.x";
   license = lib.licenses.bsd3;
diff --git a/test/golden-test-cases/pandoc.nix.golden b/test/golden-test-cases/pandoc.nix.golden
--- a/test/golden-test-cases/pandoc.nix.golden
+++ b/test/golden-test-cases/pandoc.nix.golden
@@ -47,12 +47,8 @@
   benchmarkHaskellDepends = [
     base bytestring deepseq mtl tasty-bench text
   ];
-  postInstall = ''
-    mkdir -p $out/share/man/man1
-    mv "man/"*.1 $out/share/man/man1/
-  '';
   homepage = "https://pandoc.org";
   description = "Conversion between markup formats";
-  license = lib.licenses.gpl2Plus;
+  license = lib.licensesSpdx."GPL-2.0-or-later";
   mainProgram = "pandoc";
 }
