diff --git a/lib/default.nix b/lib/default.nix
index d7a05fec8338e..b07be9d5cb888 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -97,7 +97,7 @@ let
       appendToName mapDerivationAttrset lowPrio lowPrioSet hiPrio
       hiPrioSet;
     inherit (sources) pathType pathIsDirectory cleanSourceFilter
-      cleanSource sourceByRegex sourceFilesBySuffices
+      cleanSource cleanSourceForImport sourceByRegex sourceFilesBySuffices
       commitIdFromGitRepo cleanSourceWith pathHasContext
       canCleanSource;
     inherit (modules) evalModules closeModules unifyModuleSyntax
diff --git a/lib/sources.nix b/lib/sources.nix
index 1a9f3f7d1f343..dca78a11589cd 100644
--- a/lib/sources.nix
+++ b/lib/sources.nix
@@ -32,6 +32,18 @@ rec {
   #          cleanSource ./.
   cleanSource = src: cleanSourceWith { filter = cleanSourceFilter; inherit src; };
 
+  # Cleans the source if not operating in restrict-eval. This will make
+  # it possible to import from the cleaned source.
+  #
+  # Example:
+  #          cleanSourceForImport ./..
+  cleanSourceForImport = src:
+    # This is using a very ugly hack to know whether we're evaluating in restrict-mode.
+    # Please don't do this at home.
+    if builtins.pathExists "/"
+    then cleanSource src
+    else src;
+
   # Like `builtins.filterSource`, except it will compose with itself,
   # allowing you to chain multiple calls together without any
   # intermediate copies being put in the nix store.
diff --git a/nixos/release-combined.nix b/nixos/release-combined.nix
index 66b253c230f1d..e3af9477c58ae 100644
--- a/nixos/release-combined.nix
+++ b/nixos/release-combined.nix
@@ -2,7 +2,7 @@
 # and nixos-14.04). The channel is updated every time the ‘tested’ job
 # succeeds, and all other jobs have finished (they may fail).
 
-{ nixpkgs ? { outPath = (import ../lib).cleanSource ./..; revCount = 56789; shortRev = "gfedcba"; }
+{ nixpkgs ? { outPath = (import ../lib).cleanSourceForImport ./..; revCount = 654321; shortRev = "gfedcba"; }
 , stableBranch ? false
 , supportedSystems ? [ "x86_64-linux" ]
 , limitedSupportedSystems ? [ "i686-linux" ]
diff --git a/nixos/release-small.nix b/nixos/release-small.nix
index 4bfb9a423f7d5..a4c714ac0ac27 100644
--- a/nixos/release-small.nix
+++ b/nixos/release-small.nix
@@ -2,7 +2,7 @@
 # small subset of Nixpkgs, mostly useful for servers that need fast
 # security updates.
 
-{ nixpkgs ? { outPath = (import ../lib).cleanSource ./..; revCount = 56789; shortRev = "gfedcba"; }
+{ nixpkgs ? { outPath = (import ../lib).cleanSourceForImport ./..; revCount = 654321; shortRev = "gfedcba"; }
 , stableBranch ? false
 , supportedSystems ? [ "x86_64-linux" ] # no i686-linux
 }:
diff --git a/nixos/release.nix b/nixos/release.nix
index e6abd003e881e..fde5c98da482e 100644
--- a/nixos/release.nix
+++ b/nixos/release.nix
@@ -1,6 +1,8 @@
 with import ../lib;
 
-{ nixpkgs ? { outPath = cleanSource ./..; revCount = 130979; shortRev = "gfedcba"; }
+# `revCount` and `shortRev` are placeholders, that should be filled
+# automatically for releases by passing the `nixpkgs` argument
+{ nixpkgs ? { outPath = cleanSourceForImport ./..; revCount = 654321; shortRev = "gfedcba"; }
 , stableBranch ? false
 , supportedSystems ? [ "x86_64-linux" "aarch64-linux" ]
 , configuration ? {}