diff --git a/pkgs/build-support/grsecurity/default.nix b/pkgs/build-support/grsecurity/default.nix
index 18719e6e22ba..6c2e98b9cc1d 100644
--- a/pkgs/build-support/grsecurity/default.nix
+++ b/pkgs/build-support/grsecurity/default.nix
@@ -114,16 +114,10 @@ let
          "-${grkern.grversion}-${grkern.revision}";
 
     grsecurityOverrider = args: grkern: {
-      # Apparently as of gcc 4.6, gcc-plugin headers (which are needed by PaX plugins)
-      # include libgmp headers, so we need these extra tweaks
-      # As of gcc5 we also need libmpc
-      buildInputs = args.buildInputs ++ [ pkgs.gmp pkgs.libmpc pkgs.mpfr ];
-      preConfigure = ''
-        extraIncludes="-I${pkgs.gmp}/include -I${pkgs.libmpc}/include -I${pkgs.mpfr}/include"
-        ${args.preConfigure or ""}
-        sed -i "s|-I|$extraIncludes -I|" scripts/gcc-plugin.sh
-        sed -i "s|HOST_EXTRACFLAGS +=|HOST_EXTRACFLAGS += $extraIncludes|" tools/gcc/Makefile
-        sed -i "s|HOST_EXTRACXXFLAGS +=|HOST_EXTRACXXFLAGS += $extraIncludes|" tools/gcc/Makefile
+      # additional build inputs for gcc plugins, required by some PaX/grsec features
+      nativeBuildInputs = args.nativeBuildInputs ++ (with pkgs; [ gmp libmpc mpfr ]);
+
+      preConfigure = args.preConfigure or "" + ''
         rm localversion-grsec
         echo ${localver grkern} > localversion-grsec
       '';