diff --git a/pkgs/build-support/fetchurl/boot.nix b/pkgs/build-support/fetchurl/boot.nix
index 8f8c78b7a454a..718e0f164b867 100644
--- a/pkgs/build-support/fetchurl/boot.nix
+++ b/pkgs/build-support/fetchurl/boot.nix
@@ -1,20 +1,26 @@
 let mirrors = import ./mirrors.nix; in
 
-{ system }:
+{ system
+, stdenv
+, fetchurl }:
 
 { url ? builtins.head urls
 , urls ? []
 , sha256 ? ""
 , hash ? ""
 , name ? baseNameOf (toString url)
-}:
+, postFetch ? null
+, impure ? false
+}@args:
 
-# assert exactly one hash is set
-assert hash != "" || sha256 != "";
+# assert at most one hash is set
 assert hash != "" -> sha256 == "";
+assert sha256 != "" -> hash == "";
 
-import <nix/fetchurl.nix> {
+if postFetch==null
+then import ./nix-fetchurl.nix {
   inherit system hash sha256 name;
+  inherit impure;
 
   url =
     # Handle mirror:// URIs. Since <nix/fetchurl.nix> currently
@@ -23,3 +29,21 @@ import <nix/fetchurl.nix> {
     if m == null then url
     else builtins.head (mirrors.${builtins.elemAt m 0}) + (builtins.elemAt m 1);
 }
+else stdenv.mkDerivation {
+  inherit name;
+  srcs = [ ];
+  unpackPhase = ''
+    runHook preUnpack
+    cp '${fetchurl (args // { postFetch = null; impure = true; hash = ""; sha256 = ""; })}' $out
+    chmod +w $out
+    runHook postUnpack
+  '';
+  installPhase = ''
+    runHook preInstall
+  '' + postFetch + ''
+    runHook postInstall
+  '';
+  outputHash = if hash != "" then hash else sha256;
+  outputHashAlgo = if hash != "" then "" else "sha256";
+  outputHashMode = "flat";
+}
diff --git a/pkgs/build-support/fetchurl/nix-fetchurl.nix b/pkgs/build-support/fetchurl/nix-fetchurl.nix
new file mode 100644
index 0000000000000..ea1a7a402fc3e
--- /dev/null
+++ b/pkgs/build-support/fetchurl/nix-fetchurl.nix
@@ -0,0 +1,44 @@
+# this file was copied from https://github.com/NixOS/nix and modified to
+# add support for marking fetches as __impure derivations.
+
+{ system ? "" # obsolete
+, url
+, hash ? "" # an SRI hash
+
+# Legacy hash specification
+, md5 ? "", sha1 ? "", sha256 ? "", sha512 ? ""
+, outputHash ?
+    if hash != "" then hash else if sha512 != "" then sha512 else if sha1 != "" then sha1 else if md5 != "" then md5 else sha256
+, outputHashAlgo ?
+    if hash != "" then "" else if sha512 != "" then "sha512" else if sha1 != "" then "sha1" else if md5 != "" then "md5" else "sha256"
+
+, executable ? false
+, unpack ? false
+, name ? baseNameOf (toString url)
+, impure ? false
+}:
+
+derivation ({
+  builder = "builtin:fetchurl";
+
+  # New-style output content requirements.
+  outputHashMode = if unpack || executable then "recursive" else "flat";
+
+  inherit name url executable unpack;
+
+  system = "builtin";
+
+  # No need to double the amount of network traffic
+  preferLocalBuild = true;
+
+  impureEnvVars = [
+    # We borrow these environment variables from the caller to allow
+    # easy proxy configuration.  This is impure, but a fixed-output
+    # derivation like fetchurl is allowed to do so since its result is
+    # by definition pure.
+    "http_proxy" "https_proxy" "ftp_proxy" "all_proxy" "no_proxy"
+  ];
+
+  # To make "nix-prefetch-url" work.
+  urls = [ url ];
+} // (if impure then { __impure = true; } else { inherit outputHashAlgo outputHash; }))
diff --git a/pkgs/development/tools/misc/binutils/default.nix b/pkgs/development/tools/misc/binutils/default.nix
index e5ecc365d48bf..7579eec5769e5 100644
--- a/pkgs/development/tools/misc/binutils/default.nix
+++ b/pkgs/development/tools/misc/binutils/default.nix
@@ -9,6 +9,7 @@ in
 , buildPackages
 , fetchFromGitHub
 , fetchurl
+, fetchpatch
 , flex
 , gettext
 , lib
@@ -68,11 +69,25 @@ stdenv.mkDerivation {
     # Make binutils output deterministic by default.
     ./deterministic.patch
 
-
     # Breaks nm BSD flag detection, heeds an upstream fix:
     #   https://sourceware.org/PR29547
     ./0001-Revert-libtool.m4-fix-the-NM-nm-over-here-B-option-w.patch
-    ./0001-Revert-libtool.m4-fix-nm-BSD-flag-detection.patch
+
+    # If the following patch is ever dropped, please ensure that at
+    # least one other patch in binutils uses `fetchpatch`, and move
+    # this comment to that patch.  Having a `fetchpatch` in binutils
+    # serves as a regression test to ensure that there are no
+    # dependency cycles preventing it from being used in even the
+    # earliest stages of stdenv bootstrapping.
+    #./0001-Revert-libtool.m4-fix-nm-BSD-flag-detection.patch
+    (fetchpatch {
+      # Breaks nm BSD flag detection
+      name = "0001-Revert-libtool.m4-fix-nm-BSD-flag-detection.patch";
+      url = "https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=bef9ef8ca0f941d743c77cc55b5fe7985990b2a7";
+      revert = true;
+      excludes = [ "ChangeLog" ];
+      hash = "sha256-FcTkFK9FfbgDR6iS+H6w7KRpPo/mFJ+0u7v5EvIlecQ=";
+    })
 
     # Required for newer macos versions
     ./0001-libtool.m4-update-macos-version-detection-block.patch
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index ff56f1de02261..cdc4339a2655b 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -186,6 +186,8 @@ rec {
 
         fetchurlBoot = import ../../build-support/fetchurl {
           inherit lib;
+          inherit (prevStage) stdenv;
+          fetchurl = thisStdenv.fetchurlBoot;
           stdenvNoCC = stage0.stdenv;
           curl = bootstrapTools;
         };
@@ -208,6 +210,18 @@ rec {
 
   stage0 = stageFun 0 null {
     overrides = self: super: with stage0; {
+
+      fetchpatch = import ../../build-support/fetchpatch/default.nix {
+        inherit lib;
+        buildPackages.patchutils_0_3_3 = prevStage.patchutils_0_3_3.override {
+          forStdenvBootstrap = true;
+          # the parts of patchutils used by fetchpatch do not
+          # require perl, so we could eliminate this by patching
+          # patchutils' build scripts...
+          perl = bootstrapTools;
+        };
+      };
+
       coreutils = stdenv.mkDerivation {
         name = "bootstrap-stage0-coreutils";
         buildCommand = ''
diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index 6e61b6f12be11..feb7a01c97ab3 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -104,6 +104,8 @@ let
 
         fetchurlBoot = import ../../build-support/fetchurl/boot.nix {
           inherit system;
+          inherit (prevStage) stdenv;
+          fetchurl = thisStdenv.fetchurlBoot;
         };
 
         cc = if prevStage.gcc-unwrapped == null
@@ -188,6 +190,17 @@ in
       };
       coreutils = bootstrapTools;
       gnugrep = bootstrapTools;
+
+      fetchpatch = import ../../build-support/fetchpatch/default.nix {
+        inherit lib;
+        buildPackages.patchutils_0_3_3 = prevStage.patchutils_0_3_3.override {
+          forStdenvBootstrap = true;
+          # the parts of patchutils used by fetchpatch do not
+          # require perl, so we could eliminate this by patching
+          # patchutils' build scripts...
+          perl = bootstrapTools;
+        };
+      };
     };
   })
 
diff --git a/pkgs/tools/text/patchutils/generic.nix b/pkgs/tools/text/patchutils/generic.nix
index d1cd4334e1196..51628f0c8005f 100644
--- a/pkgs/tools/text/patchutils/generic.nix
+++ b/pkgs/tools/text/patchutils/generic.nix
@@ -1,5 +1,6 @@
 { lib, stdenv, fetchurl, perl, makeWrapper
 , version, sha256, patches ? [], extraBuildInputs ? []
+, forStdenvBootstrap ? false
 , ...
 }:
 stdenv.mkDerivation rec {
@@ -11,14 +12,14 @@ stdenv.mkDerivation rec {
     inherit sha256;
   };
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = lib.optionals (!forStdenvBootstrap) [ makeWrapper ];
   buildInputs = [ perl ] ++ extraBuildInputs;
   hardeningDisable = [ "format" ];
 
   # tests fail when building in parallel
   enableParallelBuilding = false;
 
-  postInstall = ''
+  postInstall = lib.optionalString (!forStdenvBootstrap) ''
     for bin in $out/bin/{splitdiff,rediff,editdiff,dehtmldiff}; do
       wrapProgram "$bin" \
         --prefix PATH : "$out/bin"