diff --git a/lib/systems/default.nix b/lib/systems/default.nix
index f60ece0c8f5c1..2567b0252d56f 100644
--- a/lib/systems/default.nix
+++ b/lib/systems/default.nix
@@ -206,6 +206,7 @@ let
               windows = "Windows";
               cygwin = "CYGWIN_NT";
               darwin = "Darwin";
+              ios = "Darwin";
               netbsd = "NetBSD";
               freebsd = "FreeBSD";
               openbsd = "OpenBSD";
@@ -354,10 +355,24 @@ let
         darwinPlatform =
           if final.isMacOS then
             "macos"
+          else if final.isiOSSimulator then
+            "ios-simulator"
           else if final.isiOS then
             "ios"
           else
             null;
+
+        xcodePlatform =
+          args.xcodePlatform or (
+            if final.isMacOS then
+              "MacOSX"
+            else if final.isiOSSimulator then
+              "iPhoneSimulator"
+            else if final.isiOS then
+              "iPhoneOS"
+            else
+              null
+          );
         # The canonical name for this attribute is darwinSdkVersion, but some
         # platforms define the old name "sdkVer".
         darwinSdkVersion = final.sdkVer or "14.4";
@@ -507,6 +522,8 @@ let
                 # TODO: Somehow ensure that Rust actually *uses* the correct ABI, and not just a libc-based default.
                 if (lib.strings.hasPrefix "powerpc" cpu.name) && (lib.strings.hasPrefix "gnuabielfv" abi.name) then
                   "gnu"
+                else if abi.name == "simulator" then
+                  "sim"
                 else
                   abi.name;
 
diff --git a/lib/systems/examples.nix b/lib/systems/examples.nix
index 14693ca44e97f..e3d251c125427 100644
--- a/lib/systems/examples.nix
+++ b/lib/systems/examples.nix
@@ -316,21 +316,17 @@ rec {
 
   iphone64 = {
     config = "arm64-apple-ios";
-    # config = "aarch64-apple-darwin14";
     darwinSdkVersion = "14.3";
+    darwinMinVersion = "14";
     xcodeVer = "12.3";
-    xcodePlatform = "iPhoneOS";
-    useiOSPrebuilt = true;
+    # useiOSPrebuilt = true;
   };
 
   iphone64-simulator = {
-    config = "x86_64-apple-ios";
-    # config = "x86_64-apple-darwin14";
+    config = "aarch64-apple-ios-simulator";
     darwinSdkVersion = "14.3";
     xcodeVer = "12.3";
-    xcodePlatform = "iPhoneSimulator";
-    darwinPlatform = "ios-simulator";
-    useiOSPrebuilt = true;
+    # useiOSPrebuilt = true;
   };
 
   aarch64-darwin = {
diff --git a/lib/systems/inspect.nix b/lib/systems/inspect.nix
index 36a4036f210a4..cf5102d77009a 100644
--- a/lib/systems/inspect.nix
+++ b/lib/systems/inspect.nix
@@ -326,6 +326,10 @@ rec {
     isiOS = {
       kernel = kernels.ios;
     };
+    isiOSSimulator = {
+      kernel = kernels.ios;
+      abi = abis.simulator;
+    };
     isLinux = {
       kernel = kernels.linux;
     };
diff --git a/lib/systems/parse.nix b/lib/systems/parse.nix
index 626b5bcb41aca..6f12424edba42 100644
--- a/lib/systems/parse.nix
+++ b/lib/systems/parse.nix
@@ -758,6 +758,8 @@ rec {
     };
     uclibc = { };
 
+    simulator = { };
+
     unknown = { };
   };
 
diff --git a/pkgs/build-support/bintools-wrapper/default.nix b/pkgs/build-support/bintools-wrapper/default.nix
index b97eb905bd31c..a134b79555c3b 100644
--- a/pkgs/build-support/bintools-wrapper/default.nix
+++ b/pkgs/build-support/bintools-wrapper/default.nix
@@ -477,6 +477,7 @@ stdenvNoCC.mkDerivation {
       darwinMinVersion
       darwinMinVersionVariable
       ;
+    xcodePlatform = targetPlatform.xcodePlatform or "MacOSX";
   }
   // lib.optionalAttrs (stdenvNoCC.targetPlatform.isDarwin && apple-sdk != null) {
     # Wrapped compilers should do something useful even when no SDK is provided at `DEVELOPER_DIR`.
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 10175e91a0708..32da2e10d9437 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -997,6 +997,7 @@ stdenvNoCC.mkDerivation {
   // lib.mapAttrs (_: lib.optionalString targetPlatform.isDarwin) {
     # These will become empty strings when not targeting Darwin.
     inherit (targetPlatform) darwinMinVersion darwinMinVersionVariable;
+    xcodePlatform = targetPlatform.xcodePlatform or "MacOSX";
   }
   // lib.optionalAttrs (stdenvNoCC.targetPlatform.isDarwin && apple-sdk != null) {
     # Wrapped compilers should do something useful even when no SDK is provided at `DEVELOPER_DIR`.
diff --git a/pkgs/build-support/cc-wrapper/setup-hook.sh b/pkgs/build-support/cc-wrapper/setup-hook.sh
index 1c8b26061b034..5b51d8a59ec70 100644
--- a/pkgs/build-support/cc-wrapper/setup-hook.sh
+++ b/pkgs/build-support/cc-wrapper/setup-hook.sh
@@ -123,5 +123,12 @@ export CXX${role_post}=@named_cxx@
 : ${NIX_HARDENING_ENABLE="@default_hardening_flags_str@"}
 export NIX_HARDENING_ENABLE
 
+# Export Darwin deployment target (e.g. IPHONEOS_DEPLOYMENT_TARGET) so tools
+# like cc-rs that invoke the compiler directly can see the correct minimum
+# version without going through the wrapper.
+if [[ -n "@darwinMinVersionVariable@" ]]; then
+    export @darwinMinVersionVariable@=${@darwinMinVersionVariable@:-@darwinMinVersion@}
+fi
+
 # No local scope in sourced file
 unset -v role_post
diff --git a/pkgs/build-support/wrapper-common/darwin-sdk-setup.bash b/pkgs/build-support/wrapper-common/darwin-sdk-setup.bash
index 3b31a4aa69815..85ee57e92fad8 100644
--- a/pkgs/build-support/wrapper-common/darwin-sdk-setup.bash
+++ b/pkgs/build-support/wrapper-common/darwin-sdk-setup.bash
@@ -4,13 +4,26 @@ accumulateRoles
 # which is a signal that we're targetting darwin.
 if [[ "@darwinMinVersion@" ]]; then
     # `DEVELOPER_DIR` is used to dynamically locate libSystem (and the SDK frameworks) based on the SDK at that path.
-    mangleVarSingle DEVELOPER_DIR ${role_suffixes[@]+"${role_suffixes[@]}"}
-
     # Allow wrapped compilers to do something useful when no `DEVELOPER_DIR` is set, which can happen when
     # the compiler is run outside of a stdenv or intentionally in an environment with no environment variables set.
-    export DEVELOPER_DIR=${DEVELOPER_DIR_@suffixSalt@:-@fallback_sdk@}
+    export DEVELOPER_DIR=${DEVELOPER_DIR_@suffixSalt@:-${DEVELOPER_DIR:-@fallback_sdk@}}
+
+    # When cross-compiling (e.g. macOS → iOS), the environment may have DEVELOPER_DIR set to a
+    # different platform's SDK (e.g. iPhoneOS). If the expected platform directory doesn't exist
+    # in DEVELOPER_DIR, fall back to the hardcoded SDK for this wrapper.
+    if [[ ! -d "$DEVELOPER_DIR/Platforms/@xcodePlatform@.platform" ]]; then
+        export DEVELOPER_DIR=@fallback_sdk@
+    fi
+
+    # Only mangle DEVELOPER_DIR after resolving the correct value, so that
+    # mangleVarSingle stores the final (platform-correct) SDK path, not a
+    # polluted value from a cross-compilation peer SDK's setup hook.
+    mangleVarSingle DEVELOPER_DIR ${role_suffixes[@]+"${role_suffixes[@]}"}
 
     # xcbuild needs `SDKROOT` to be the name of the SDK, which it sets in its own wrapper,
     # but compilers expect it to point to the absolute path.
-    export SDKROOT="$DEVELOPER_DIR/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk"
+    export SDKROOT="$DEVELOPER_DIR/Platforms/@xcodePlatform@.platform/Developer/SDKs/@xcodePlatform@.sdk"
+
+    # Export the deployment target (e.g. IPHONEOS_DEPLOYMENT_TARGET, MACOSX_DEPLOYMENT_TARGET)
+    export @darwinMinVersionVariable@=${@darwinMinVersionVariable@:-@darwinMinVersion@}
 fi
diff --git a/pkgs/by-name/ap/apple-sdk/common/derivation-options.nix b/pkgs/by-name/ap/apple-sdk/common/derivation-options.nix
index 9c99206a59e35..14fed7e0183a4 100644
--- a/pkgs/by-name/ap/apple-sdk/common/derivation-options.nix
+++ b/pkgs/by-name/ap/apple-sdk/common/derivation-options.nix
@@ -1,13 +1,17 @@
-{ lib, config }:
+{
+  lib,
+  config,
+  sdkPlatform,
+}:
 
 self: super: {
   preBuild = super.preBuild or "" + ''
-    platformPath=$out/Platforms/MacOSX.platform
+    platformPath=$out/Platforms/${sdkPlatform}.platform
     sdkpath=$platformPath/Developer/SDKs
   '';
 
   preInstall = super.preInstall or "" + ''
-    platformPath=$out/Platforms/MacOSX.platform
+    platformPath=$out/Platforms/${sdkPlatform}.platform
     sdkpath=$platformPath/Developer/SDKs
   '';
 }
diff --git a/pkgs/by-name/ap/apple-sdk/common/fetch-ios-sdk.nix b/pkgs/by-name/ap/apple-sdk/common/fetch-ios-sdk.nix
new file mode 100644
index 0000000000000..f3aa00252c31e
--- /dev/null
+++ b/pkgs/by-name/ap/apple-sdk/common/fetch-ios-sdk.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  stdenvNoCC,
+  buildPackages,
+}:
+
+{
+  sdkPlatform,
+  version,
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "${sdkPlatform}-SDK";
+  inherit version;
+
+  src = buildPackages.darwin.xcode;
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    sdkPath="Contents/Developer/Platforms/${sdkPlatform}.platform/Developer/SDKs/${sdkPlatform}.sdk"
+
+    # Extract the iOS SDK from the nested Xcode.app such that it
+    # matches the fetched macOS SDKs
+    if [ ! -d "$sdkPath" ]; then
+      echo "Error: iOS SDK not found at $sdkPath in Xcode.app"
+      echo "Available platforms:"
+      ls -la Contents/Developer/Platforms/ || true
+      exit 1
+    fi
+
+    mkdir -p "$out"
+    cp -rd "$sdkPath"/* "$out/"
+    rm -rf "$out/usr/bin" "$out/usr/share" 2>/dev/null || true
+
+    runHook postInstall
+  '';
+}
diff --git a/pkgs/by-name/ap/apple-sdk/common/propagate-inputs.nix b/pkgs/by-name/ap/apple-sdk/common/propagate-inputs.nix
index f9551b5b9bad1..d959789dce303 100644
--- a/pkgs/by-name/ap/apple-sdk/common/propagate-inputs.nix
+++ b/pkgs/by-name/ap/apple-sdk/common/propagate-inputs.nix
@@ -2,12 +2,10 @@
   lib,
   cups,
   darwin,
-  db,
   libiconv,
   ncurses,
   stdenv,
   stdenvNoCC,
-  xcbuild,
 }:
 
 let
@@ -28,7 +26,11 @@ let
     buildInputs = [ darwin.libresolv ]; # The `configure` script requires libresolv headers.
 
     # CUPS’s configure script fails to find `ar` when cross-compiling.
-    configureFlags = [ "ac_cv_path_AR=${stdenv.cc.targetPrefix}ar" ];
+    configureFlags = [
+      "ac_cv_path_AR=${stdenv.cc.targetPrefix}ar"
+    ]
+    # headers-only install, ios cross-compile cannot find tls libraries.
+    ++ lib.optional stdenv.hostPlatform.isiOS "--with-tls=no";
 
     installTargets = [ "install-headers" ];
 
diff --git a/pkgs/by-name/ap/apple-sdk/common/propagate-xcrun.nix b/pkgs/by-name/ap/apple-sdk/common/propagate-xcrun.nix
index ff0094df60e06..e65f2dac7a7e8 100644
--- a/pkgs/by-name/ap/apple-sdk/common/propagate-xcrun.nix
+++ b/pkgs/by-name/ap/apple-sdk/common/propagate-xcrun.nix
@@ -4,12 +4,13 @@
   stdenv,
   stdenvNoCC,
   sdkVersion,
+  sdkPlatform,
 }:
 
 let
   plists = import ./plists.nix {
     inherit lib stdenvNoCC sdkVersion;
-    xcodePlatform = if stdenvNoCC.hostPlatform.isMacOS then "MacOSX" else "iPhoneOS";
+    xcodePlatform = sdkPlatform;
   };
   inherit (pkgsBuildHost) darwin cctools xcbuild;
 in
diff --git a/pkgs/by-name/ap/apple-sdk/package.nix b/pkgs/by-name/ap/apple-sdk/package.nix
index 761ebb903e8f4..7150ce0d87be6 100644
--- a/pkgs/by-name/ap/apple-sdk/package.nix
+++ b/pkgs/by-name/ap/apple-sdk/package.nix
@@ -17,6 +17,7 @@ in
 
   # Required by various phases
   callPackage,
+  buildPackages,
   jq,
   llvm,
 }:
@@ -28,11 +29,15 @@ let
   sdkVersion = sdkInfo.version;
 
   fetchSDK = callPackage ./common/fetch-sdk.nix { };
+  sdkPlatform =
+    if stdenv.hostPlatform.xcodePlatform != null then stdenv.hostPlatform.xcodePlatform else "MacOSX";
 
   phases = lib.composeManyExtensions (
-    [
+    lib.optionals stdenv.hostPlatform.isMacOS [
       (callPackage ./common/add-core-symbolication.nix { })
-      (callPackage ./common/derivation-options.nix { })
+    ]
+    ++ [
+      (callPackage ./common/derivation-options.nix { inherit sdkPlatform; })
       (callPackage ./common/passthru-private-frameworks.nix { inherit sdkVersion; })
       (callPackage ./common/passthru-source-release-files.nix { })
       (callPackage ./common/remove-disallowed-packages.nix { })
@@ -41,7 +46,7 @@ let
     # Avoid infinite recursions by not propagating certain packages, so they can themselves build with the SDK.
     ++ lib.optionals (!enableBootstrap) [
       (callPackage ./common/propagate-inputs.nix { })
-      (callPackage ./common/propagate-xcrun.nix { inherit sdkVersion; })
+      (callPackage ./common/propagate-xcrun.nix { inherit sdkVersion sdkPlatform; })
     ]
     # This has to happen last.
     ++ [
@@ -54,7 +59,14 @@ stdenvNoCC.mkDerivation (
     pname = "apple-sdk";
     inherit (sdkInfo) version;
 
-    src = fetchSDK sdkInfo;
+    src =
+      if stdenv.hostPlatform.isiOS then
+        (callPackage ./common/fetch-ios-sdk.nix { }) {
+          inherit sdkPlatform;
+          version = sdkVersion;
+        }
+      else
+        fetchSDK sdkInfo;
 
     dontConfigure = true;
 
@@ -72,13 +84,17 @@ stdenvNoCC.mkDerivation (
           "--subst-var-by"
           "sdkVersion"
           (lib.escapeShellArgs (lib.splitVersion sdkVersion))
+          "--subst-var-by"
+          "sdkPlatform"
+          (lib.escapeShellArgs (lib.splitVersion sdkPlatform))
+
         ];
       })
     ];
 
     installPhase =
       let
-        sdkName = "MacOSX${lib.versions.majorMinor sdkVersion}.sdk";
+        sdkName = "${sdkPlatform}${lib.versions.majorMinor sdkVersion}.sdk";
         sdkMajor = lib.versions.major sdkVersion;
       in
       ''
@@ -87,8 +103,8 @@ stdenvNoCC.mkDerivation (
         mkdir -p "$sdkpath"
 
         cp -rd . "$sdkpath/${sdkName}"
-        ln -s "${sdkName}" "$sdkpath/MacOSX${sdkMajor}.sdk"
-        ln -s "${sdkName}" "$sdkpath/MacOSX.sdk"
+        ln -s "${sdkName}" "$sdkpath/${sdkPlatform}${sdkMajor}.sdk"
+        ln -s "${sdkName}" "$sdkpath/${sdkPlatform}.sdk"
 
         # Swift adds these locations to its search paths. Avoid spurious warnings by making sure they exist.
         mkdir -p "$platformPath/Developer/Library/Frameworks"
@@ -99,7 +115,8 @@ stdenvNoCC.mkDerivation (
       '';
 
     passthru = {
-      sdkroot = finalAttrs.finalPackage + "/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk";
+      sdkroot =
+        finalAttrs.finalPackage + "/Platforms/${sdkPlatform}.platform/Developer/SDKs/${sdkPlatform}.sdk";
     };
 
     __structuredAttrs = true;
diff --git a/pkgs/by-name/ap/apple-sdk/setup-hooks/sdk-hook.sh b/pkgs/by-name/ap/apple-sdk/setup-hooks/sdk-hook.sh
index 62fa8b339a711..016d12f0023e6 100644
--- a/pkgs/by-name/ap/apple-sdk/setup-hooks/sdk-hook.sh
+++ b/pkgs/by-name/ap/apple-sdk/setup-hooks/sdk-hook.sh
@@ -4,6 +4,7 @@ getHostRole
 local sdkVersionVar=NIX_APPLE_SDK_VERSION${role_post}
 local developerDirVar=DEVELOPER_DIR${role_post}
 
+local platformVar=(@sdkPlatform@)
 local sdkVersionArr=(@sdkVersion@)
 local sdkVersion
 sdkVersion=$(printf "%02d%02d%02d" "${sdkVersionArr[0]-0}" "${sdkVersionArr[1]-0}" "${sdkVersionArr[2]-0}")
@@ -11,7 +12,7 @@ sdkVersion=$(printf "%02d%02d%02d" "${sdkVersionArr[0]-0}" "${sdkVersionArr[1]-0
 if [ "$sdkVersion" -gt "${!sdkVersionVar-000000}" ]; then
     export "$developerDirVar"='@out@'
     export "$sdkVersionVar"="$sdkVersion"
-    export "SDKROOT${role_post}"="${!developerDirVar}/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk"
+    export "SDKROOT${role_post}"="${!developerDirVar}/Platforms/${platformVar}.platform/Developer/SDKs/${platformVar}.sdk"
 fi
 
 unset -v role_post developerDirVar sdkVersion sdkVersionArr sdkVersionVar
diff --git a/pkgs/by-name/gn/gnu-config/package.nix b/pkgs/by-name/gn/gnu-config/package.nix
index 80baba133a064..ab1335845bd25 100644
--- a/pkgs/by-name/gn/gnu-config/package.nix
+++ b/pkgs/by-name/gn/gnu-config/package.nix
@@ -11,23 +11,23 @@
 # files.
 
 let
-  rev = "948ae97ca5703224bd3eada06b7a69f40dd15a02";
+  rev = "a2287c3041a3f2a204eb942e09c015eab00dc7dd";
 
   # Don't use fetchgit as this is needed during Aarch64 bootstrapping
   configGuess = fetchurl {
     name = "config.guess-${builtins.substring 0 7 rev}";
     url = "https://git.savannah.gnu.org/cgit/config.git/plain/config.guess?id=${rev}";
-    hash = "sha256-ZByuPAx0xJNU0+3gCfP+vYD+vhUBp3wdn6yNQsxFtss=";
+    hash = "sha256-UCBc8+xcdhWxf5N6Cle6v07FzQqt49ezzMvl8b+Rp+8=";
   };
   configSub = fetchurl {
     name = "config.sub-${builtins.substring 0 7 rev}";
     url = "https://git.savannah.gnu.org/cgit/config.git/plain/config.sub?id=${rev}";
-    hash = "sha256-/jovMvuv9XhIcyVJ9I2YP9ZSYCTsLw9ancdcL0NZo6Y=";
+    hash = "sha256-JrhS91pjdEg2CpVpMUOffoGL9jFQ6q25uFSENHYo0f0=";
   };
 in
 stdenv.mkDerivation {
   pname = "gnu-config";
-  version = "2024-01-01";
+  version = "2025-07-09";
 
   unpackPhase = ''
     runHook preUnpack
diff --git a/pkgs/by-name/sq/sqlcipher/package.nix b/pkgs/by-name/sq/sqlcipher/package.nix
index ce04088a97abc..57969d9933eef 100644
--- a/pkgs/by-name/sq/sqlcipher/package.nix
+++ b/pkgs/by-name/sq/sqlcipher/package.nix
@@ -29,36 +29,61 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
-    readline
     ncurses
     openssl
     zlib
-  ];
+  ]
+  # readline's interactive CLI depends on terminal APIs unavailable on iOS.
+  ++ lib.optionals (!stdenv.hostPlatform.isiOS) [ readline ];
 
   depsBuildBuild = [
     buildPackages.stdenv.cc
   ];
 
+  # autosetup/ uses an autosetup- prefix, outside the default
+  # updateAutotoolsGnuConfigScriptsHook glob — refresh manually for new triples.
+  postPatch = ''
+    for script in config.sub config.guess; do
+      if [ -f "autosetup/autosetup-$script" ]; then
+        cp -f "${buildPackages.gnu-config}/$script" "autosetup/autosetup-$script"
+      fi
+    done
+  '';
+
   configureFlags = [
     "--enable-threadsafe"
-    "--with-readline-inc=-I${lib.getDev readline}/include"
     "--enable-load-extension"
-  ];
+    (
+      if stdenv.hostPlatform.isiOS then
+        "--disable-readline"
+      else
+        "--with-readline-inc=-I${lib.getDev readline}/include"
+    )
+  ]
+  # Tcl needs to be runnable at build time; disable when build can't exec host.
+  ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [ "--disable-tcl" ];
 
   env = {
-    NIX_CFLAGS_COMPILE = toString [
-      # We want feature parity with sqlite
-      sqlite.NIX_CFLAGS_COMPILE
-      "-DSQLITE_HAS_CODEC"
-      "-DSQLITE_EXTRA_INIT=sqlcipher_extra_init"
-      "-DSQLITE_EXTRA_SHUTDOWN=sqlcipher_extra_shutdown"
-      "-DSQLITE_TEMP_STORE=3"
-    ];
+    NIX_CFLAGS_COMPILE = toString (
+      [
+        # We want feature parity with sqlite
+        sqlite.NIX_CFLAGS_COMPILE
+        "-DSQLITE_HAS_CODEC"
+        "-DSQLITE_EXTRA_INIT=sqlcipher_extra_init"
+        "-DSQLITE_EXTRA_SHUTDOWN=sqlcipher_extra_shutdown"
+        "-DSQLITE_TEMP_STORE=3"
+      ]
+      # iOS forbids system(3); sqlite's upstream knob compiles out every call
+      # site plus the .edit/.shell/.system/xdg-open CLI features that use them.
+      ++ lib.optional stdenv.hostPlatform.isiOS "-DSQLITE_NOHAVE_SYSTEM"
+    );
     LDFLAGS = toString [
       "-lssl"
       "-lcrypto"
     ];
     BUILD_CC = "$(CC_FOR_BUILD)";
+  }
+  // lib.optionalAttrs (stdenv.buildPlatform.canExecute stdenv.hostPlatform) {
     TCLLIBDIR = "${placeholder "out"}/lib/tcl${lib.versions.majorMinor tcl.version}";
   };
 
@@ -70,6 +95,7 @@ stdenv.mkDerivation (finalAttrs: {
     mv $out/include/sqlite3ext.h $out/include/sqlcipher/sqlite3ext.h
     mv $out/lib/lib{sqlite3,sqlcipher}.a
     rm -f $out/lib/libsqlite3.0.dylib $out/lib/libsqlite3.dylib $out/lib/libsqlite3.so $out/lib/libsqlite3.so.0
+    find $out/lib -maxdepth 1 -type l -name 'libsqlite3*' -delete
     rename libsqlite3 libsqlcipher $out/lib/libsqlite3*
     mv $out/lib/pkgconfig/{sqlite3,sqlcipher}.pc
     mv $out/share/man/man1/{sqlite3,sqlcipher}.1
@@ -78,7 +104,7 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail "-lz" "-lz -lcrypto" \
       --replace-fail "includedir}" "includedir}/sqlcipher"
   ''
-  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+  + lib.optionalString (stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isiOS) ''
     f=$(echo $out/lib/libsqlcipher.*.dylib)
     ln --symbolic --force "$f" $out/lib/libsqlcipher.0.dylib
     ln --symbolic --force "$f" $out/lib/libsqlcipher.dylib
@@ -88,6 +114,13 @@ stdenv.mkDerivation (finalAttrs: {
     f=$(echo $out/lib/libsqlcipher.so.*)
     ln --symbolic --force "$f" $out/lib/libsqlcipher.so.0
     ln --symbolic --force "$f" $out/lib/libsqlcipher.so
+  ''
+  + lib.optionalString stdenv.hostPlatform.isiOS ''
+    # iOS ships the versioned .so as libsqlcipher.<version>.so (no .so.<version>).
+    f=$(echo $out/lib/libsqlcipher.*.so)
+    ln -sf "$f" $out/lib/libsqlcipher.0.so
+    ln -sf "$f" $out/lib/libsqlcipher.so
+    ln -sf "$f" $out/lib/libsqlite3.so
   '';
 
   meta = {
diff --git a/pkgs/development/compilers/llvm/common/compiler-rt/default.nix b/pkgs/development/compilers/llvm/common/compiler-rt/default.nix
index 12e989a2b0d54..7b4fcdd28f29c 100644
--- a/pkgs/development/compilers/llvm/common/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/common/compiler-rt/default.nix
@@ -57,8 +57,24 @@ let
   # use clean up the `cmakeFlags` rats nest below.
   haveLibcxx = stdenv.cc.libcxx != null;
   isDarwinStatic = stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isStatic;
-  inherit (stdenv.hostPlatform) isMusl isAarch64 isWindows;
-  noSanitizers = !haveLibc || bareMetal || isMusl || isDarwinStatic || isWindows;
+  inherit (stdenv.hostPlatform)
+    isMusl
+    isAarch64
+    isWindows
+    isiOS
+    isiOSSimulator
+    ;
+  # Long form (iphoneos / iphonesimulator / macosx) = lowercased xcodePlatform.
+  # Short form (ios / iossim / osx) = LLVM's compiler-rt DARWIN_<X>_* vocabulary.
+  darwinLongPlatform = lib.toLower (stdenv.hostPlatform.xcodePlatform or "MacOSX");
+  darwinCmakePlatform =
+    {
+      iphoneos = "ios";
+      iphonesimulator = "iossim";
+      macosx = "osx";
+    }
+    .${darwinLongPlatform};
+  noSanitizers = !haveLibc || bareMetal || isMusl || isDarwinStatic || isWindows || isiOS;
 in
 
 stdenv.mkDerivation (finalAttrs: {
@@ -155,12 +171,15 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals noSanitizers [
     (lib.cmakeBool "COMPILER_RT_BUILD_SANITIZERS" false)
   ]
-  ++ lib.optionals ((useLLVM && !haveLibcxx) || !haveLibc || bareMetal || isMusl || isDarwinStatic) [
-    (lib.cmakeBool "COMPILER_RT_BUILD_XRAY" false)
-    (lib.cmakeBool "COMPILER_RT_BUILD_LIBFUZZER" false)
-    (lib.cmakeBool "COMPILER_RT_BUILD_MEMPROF" false)
-    (lib.cmakeBool "COMPILER_RT_BUILD_ORC" false) # may be possible to build with musl if necessary
-  ]
+  ++
+    lib.optionals
+      ((useLLVM && !haveLibcxx) || !haveLibc || bareMetal || isMusl || isDarwinStatic || isiOS)
+      [
+        (lib.cmakeBool "COMPILER_RT_BUILD_XRAY" false)
+        (lib.cmakeBool "COMPILER_RT_BUILD_LIBFUZZER" false)
+        (lib.cmakeBool "COMPILER_RT_BUILD_MEMPROF" false)
+        (lib.cmakeBool "COMPILER_RT_BUILD_ORC" false) # may be possible to build with musl if necessary
+      ]
   ++ lib.optionals (!haveLibc || bareMetal) [
     (lib.cmakeBool "COMPILER_RT_BUILD_PROFILE" false)
     (lib.cmakeBool "CMAKE_C_COMPILER_WORKS" true)
@@ -191,13 +210,27 @@ stdenv.mkDerivation (finalAttrs: {
       # Darwin support, so force it to be enabled during the first stage of the compiler-rt bootstrap.
       (lib.cmakeBool "COMPILER_RT_HAS_G_FLAG" true)
     ]
-    ++ [
+    ++ lib.optionals stdenv.hostPlatform.isMacOS [
       (lib.cmakeFeature "DARWIN_osx_ARCHS" stdenv.hostPlatform.darwinArch)
       (lib.cmakeFeature "DARWIN_osx_BUILTIN_ARCHS" stdenv.hostPlatform.darwinArch)
       (lib.cmakeFeature "SANITIZER_MIN_OSX_VERSION" stdenv.hostPlatform.darwinMinVersion)
+    ]
+    ++ [
       # `COMPILER_RT_DEFAULT_TARGET_ONLY` does not apply to Darwin:
       # https://github.com/llvm/llvm-project/blob/27ef42bec80b6c010b7b3729ed0528619521a690/compiler-rt/cmake/base-config-ix.cmake#L153
-      (lib.cmakeBool "COMPILER_RT_ENABLE_IOS" false)
+      (lib.cmakeBool "COMPILER_RT_ENABLE_IOS" stdenv.hostPlatform.isiOS)
+      (lib.cmakeBool "COMPILER_RT_ENABLE_TVOS" false)
+      (lib.cmakeBool "COMPILER_RT_ENABLE_WATCHOS" false)
+    ]
+    # iOS cross: force the active DARWIN_<plat>_ARCHS and zero osx so
+    # compiler-rt doesn't try to build a fat macOS slice. The inactive
+    # iOS sibling (iossim when building ios, and vice versa) is implicitly
+    # skipped because its SYSROOT isn't set in preConfigure.
+    ++ lib.optionals stdenv.hostPlatform.isiOS [
+      (lib.cmakeFeature "DARWIN_osx_ARCHS" "")
+      (lib.cmakeFeature "DARWIN_osx_BUILTIN_ARCHS" "")
+      (lib.cmakeFeature "DARWIN_${darwinCmakePlatform}_ARCHS" stdenv.hostPlatform.darwinArch)
+      (lib.cmakeFeature "DARWIN_${darwinCmakePlatform}_BUILTIN_ARCHS" stdenv.hostPlatform.darwinArch)
     ]
   )
   ++ lib.optionals (noSanitizers && lib.versionAtLeast release_version "19") [
@@ -253,18 +286,41 @@ stdenv.mkDerivation (finalAttrs: {
         ''
           substituteInPlace cmake/Modules/AddCompilerRT.cmake \
             --replace-fail 'find_program(CODESIGN codesign)' ""
-        '';
+        ''
+    + lib.optionalString isiOS ''
+      substituteInPlace cmake/config-ix.cmake \
+        --replace-fail 'set(DARWIN_ios_MIN_VER 9.0)' \
+                       'set(DARWIN_ios_MIN_VER ${stdenv.hostPlatform.darwinMinVersion})'
+    '';
 
-  preConfigure = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    cmakeFlagsArray+=(
-      "-DDARWIN_macosx_CACHED_SYSROOT=$SDKROOT"
-      "-DDARWIN_macosx_OVERRIDE_SDK_VERSION=$(jq -r .Version "$SDKROOT/SDKSettings.json")"
-    )
-  '';
+  preConfigure = lib.optionalString stdenv.hostPlatform.isDarwin (
+    let
+      sdkVersion = ''$(jq -r .Version "$SDKROOT/SDKSettings.json")'';
+    in
+    # Set CACHED_SYSROOT for the active platform, plus OVERRIDE_SDK_VERSION for
+    # all platforms compiler-rt probes (it checks macosx even when targeting iOS).
+    ''
+      cmakeFlagsArray+=(
+        "-DDARWIN_${darwinLongPlatform}_CACHED_SYSROOT=$SDKROOT"
+        "-DDARWIN_${darwinLongPlatform}_OVERRIDE_SDK_VERSION=${sdkVersion}"
+    ''
+    + lib.optionalString isiOS ''
+      "-DDARWIN_macosx_OVERRIDE_SDK_VERSION=${sdkVersion}"
+    ''
+    + lib.optionalString (!isiOSSimulator && isiOS) ''
+      "-DDARWIN_iphonesimulator_OVERRIDE_SDK_VERSION=${sdkVersion}"
+    ''
+    + lib.optionalString isiOSSimulator ''
+      "-DDARWIN_iphoneos_OVERRIDE_SDK_VERSION=${sdkVersion}"
+    ''
+    + ''
+      )
+    ''
+  );
 
   # Hack around weird upstream RPATH bug
   postInstall =
-    lib.optionalString (stdenv.hostPlatform.isDarwin) ''
+    lib.optionalString stdenv.hostPlatform.isMacOS ''
       ln -s "$out/lib"/*/* "$out/lib"
     ''
     + lib.optionalString (useLLVM && stdenv.hostPlatform.isLinux) ''
diff --git a/pkgs/development/libraries/ncurses/default.nix b/pkgs/development/libraries/ncurses/default.nix
index 5055401e15fcc..52643500a395b 100644
--- a/pkgs/development/libraries/ncurses/default.nix
+++ b/pkgs/development/libraries/ncurses/default.nix
@@ -7,7 +7,8 @@
   ncurses,
   pkg-config,
   abiVersion ? "6",
-  enableStatic ? stdenv.hostPlatform.isStatic,
+  # iOS: configure rejects apple-ios triples for shared libs; default to static.
+  enableStatic ? stdenv.hostPlatform.isStatic || stdenv.hostPlatform.isiOS,
   # Disabled for static FreeBSD: libc++ headers come after C library headers,
   # breaking C++ compilation. No current consumers need the C++ bindings.
   withCxx ?
@@ -70,6 +71,14 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optional (!withCxx) "--without-cxx"
   ++ lib.optional (abiVersion == "5") "--with-abi-version=5"
   ++ lib.optional stdenv.hostPlatform.isNetBSD "--enable-rpath"
+  # iOS: SDK marks system(3) unavailable (skip progs/tests) and doesn't ship
+  # <sys/ttydev.h> (--with-ospeed=int turns off NCURSES_OSPEED_COMPAT which
+  # is the only consumer of that header).
+  ++ lib.optionals stdenv.hostPlatform.isiOS [
+    "--without-progs"
+    "--without-tests"
+    "--with-ospeed=int"
+  ]
   ++ lib.optional withTermlib "--with-termlib"
   ++ lib.optionals stdenv.hostPlatform.isWindows [
     "--enable-sp-funcs"
diff --git a/pkgs/development/libraries/pcre2/default.nix b/pkgs/development/libraries/pcre2/default.nix
index 88d6cedb39f59..c58cbfeffbcea 100644
--- a/pkgs/development/libraries/pcre2/default.nix
+++ b/pkgs/development/libraries/pcre2/default.nix
@@ -23,7 +23,8 @@ stdenv.mkDerivation rec {
     "--enable-pcre2-16"
     "--enable-pcre2-32"
     # only enable jit on supported platforms which excludes Apple Silicon, see https://github.com/zherczeg/sljit/issues/51
-    "--enable-jit=${if stdenv.hostPlatform.isS390x then "no" else "auto"}"
+    # pthread_jit_write_protect_np is not available on iOS
+    "--enable-jit=${if stdenv.hostPlatform.isS390x || stdenv.hostPlatform.isiOS then "no" else "auto"}"
   ]
   # fix pcre jit in systemd units that set MemoryDenyWriteExecute=true like gitea
   ++ lib.optional withJitSealloc "--enable-jit-sealloc";
diff --git a/pkgs/development/libraries/readline/8.3.nix b/pkgs/development/libraries/readline/8.3.nix
index f32bf7c36a596..3927a421222c3 100644
--- a/pkgs/development/libraries/readline/8.3.nix
+++ b/pkgs/development/libraries/readline/8.3.nix
@@ -90,6 +90,14 @@ stdenv.mkDerivation (finalAttrs: {
     ];
   };
 
+  # readline configure refuses shared libs on *-apple-ios; stdenv default
+  # --disable-static would then leave Makefile with no targets. iOS only.
+  dontDisableStatic = if stdenv.hostPlatform.isiOS then true else null;
+  configureFlags = lib.optionals stdenv.hostPlatform.isiOS [
+    "--enable-static"
+    "--disable-shared"
+  ];
+
   # This install error is caused by a very old libtool. We can't autoreconfHook this package,
   # so this is the best we've got!
   postInstall = lib.optionalString stdenv.hostPlatform.isOpenBSD ''
diff --git a/pkgs/os-specific/darwin/by-name/co/copyfile/package.nix b/pkgs/os-specific/darwin/by-name/co/copyfile/package.nix
index f76e5beaa7663..2943cfa3e2420 100644
--- a/pkgs/os-specific/darwin/by-name/co/copyfile/package.nix
+++ b/pkgs/os-specific/darwin/by-name/co/copyfile/package.nix
@@ -1,4 +1,5 @@
 {
+  lib,
   mkAppleDerivation,
   sourceRelease,
   stdenvNoCC,
@@ -70,6 +71,19 @@ mkAppleDerivation {
 
   xcodeHash = "sha256-SYW6pBlCQkcbkBqCq+W/mDYZZ7/co2HlPZwXzgh/LnI=";
 
+  # iOS: decmpfs.h transitively pulls in <sys/kdebug.h>, <sys/kernel_types.h>,
+  # and <sys/vnode.h>, all missing from the iOS SDK. Upstream includes
+  # <TargetConditionals.h> after the DECMPFS block; move it above so
+  # TARGET_OS_IPHONE discriminates correctly. Skipping decmpfs.h also loses
+  # the <stdbool.h> it pulls in transitively, so include it directly.
+  postPatch = lib.optionalString stdenvNoCC.hostPlatform.isiOS ''
+    substituteInPlace copyfile.c \
+      --replace-fail '#ifdef VOL_CAP_FMT_DECMPFS_COMPRESSION' \
+                     '#include <TargetConditionals.h>
+    #include <stdbool.h>
+    #if defined(VOL_CAP_FMT_DECMPFS_COMPRESSION) && !TARGET_OS_IPHONE'
+  '';
+
   env.NIX_CFLAGS_COMPILE = "-I${privateHeaders}/include";
 
   meta.description = "Darwin file copying library";
diff --git a/pkgs/os-specific/darwin/by-name/li/libresolv/package.nix b/pkgs/os-specific/darwin/by-name/li/libresolv/package.nix
index 1ff3f3b704740..5b48edfba59e3 100644
--- a/pkgs/os-specific/darwin/by-name/li/libresolv/package.nix
+++ b/pkgs/os-specific/darwin/by-name/li/libresolv/package.nix
@@ -31,6 +31,15 @@ let
       substituteInPlace "$out/include/mach-o/dyld_priv.h" \
         --replace-fail ', bridgeos(3.0)' "" \
         --replace-fail '//@VERSION_DEFS@' 'const dyld_build_version_t dyld_2024_SU_E_os_versions = { 1 /* macOS */, 150400 };'
+
+      # dyld_priv.h references TARGET_OS_EXCLAVEKIT (added in newer Xcode) under
+      # -Werror=undef-prefix=TARGET_OS_. SDKs in nixpkgs don't define it yet.
+      # Default to 0 (not an ExclaveKit target) to satisfy the compile.
+      {
+        printf '#ifndef TARGET_OS_EXCLAVEKIT\n#define TARGET_OS_EXCLAVEKIT 0\n#endif\n'
+        cat "$out/include/mach-o/dyld_priv.h"
+      } > "$out/include/mach-o/dyld_priv.h.new"
+      mv "$out/include/mach-o/dyld_priv.h.new" "$out/include/mach-o/dyld_priv.h"
     '';
   };
 in
diff --git a/pkgs/os-specific/darwin/by-name/li/libutil/meson.build.in b/pkgs/os-specific/darwin/by-name/li/libutil/meson.build.in
index fa7f3610f5327..62b3cc73a074c 100644
--- a/pkgs/os-specific/darwin/by-name/li/libutil/meson.build.in
+++ b/pkgs/os-specific/darwin/by-name/li/libutil/meson.build.in
@@ -10,32 +10,44 @@ cc = meson.get_compiler('c')
 cxx = meson.get_compiler('cpp')
 
 
+# Sources portable across macOS and iOS.
+sources = [
+    'ExtentManager.cpp',
+    'expand_number.c',
+    'getmntopts.c',
+    'humanize_number.c',
+    'pidfile.c',
+    'realhostname.c',
+    'reexec_to_match_kernel.c',
+    'trimdomain.c',
+]
+
+# macOS-only: wipefs.cpp needs <sys/disk.h>, tzbootuuid.c needs <tzfile.h>,
+# tzlink.c uses xpc SPIs unavailable on iOS. Nixpkgs cross-file maps iOS -> 'ios'.
+if host_machine.system() == 'darwin'
+    sources += [
+        'wipefs.cpp',
+        'tzbootuuid.c',
+        'tzlink.c',
+        'tzlink.h',
+    ]
+endif
+
 # Libraries
 libutil = library(
     'util',
     darwin_versions : '1',
     install : true,
-    sources : [
-        'ExtentManager.cpp',
-        'expand_number.c',
-        'getmntopts.c',
-        'humanize_number.c',
-        'pidfile.c',
-        'realhostname.c',
-        'reexec_to_match_kernel.c',
-        'trimdomain.c',
-        'tzbootuuid.c',
-        'tzlink.c',
-        'tzlink.h',
-        'wipefs.cpp',
-    ],
+    sources : sources,
 )
 install_headers(
     'libutil.h',
     'mntopts.h',
-    'tzlink.h',
-    'wipefs.h',
 )
+# wipefs.h / tzlink.h declare symbols not compiled on iOS.
+if host_machine.system() == 'darwin'
+    install_headers('wipefs.h', 'tzlink.h')
+endif
 install_man(
     'expand_number.3',
     'getmntopts.3',
diff --git a/pkgs/shells/bash/5.nix b/pkgs/shells/bash/5.nix
index 5e89c04d4934e..f0c9137547179 100644
--- a/pkgs/shells/bash/5.nix
+++ b/pkgs/shells/bash/5.nix
@@ -27,6 +27,16 @@ let
       inherit sha256;
     }
   );
+
+  # iOS: getentropy is private API (App Store reject). strchrnul needs iOS 18.4;
+  # bash's AC_RUN_IFELSE cross-compile fallback already marks it unavailable, so
+  # only the clang availability warning needs silencing pre-18.4.
+  isIos = stdenv.hostPlatform.isiOS;
+  iosBelow = v: isIos && lib.versionOlder (stdenv.hostPlatform.darwinMinVersion or "0") v;
+
+  iosCflags = lib.optionalString (iosBelow "18.4") "-Wno-unguarded-availability-new";
+
+  iosConfigureFlags = lib.optionals isIos [ "ac_cv_func_getentropy=no" ];
 in
 lib.warnIf (withDocs != null)
   ''
@@ -87,7 +97,8 @@ lib.warnIf (withDocs != null)
     # this hack should be removed.
     + lib.optionalString stdenv.cc.isClang ''
       -std=c23
-    '';
+    ''
+    + iosCflags;
 
     patchFlags = [ "-p0" ];
 
@@ -132,7 +143,8 @@ lib.warnIf (withDocs != null)
       # /dev/fd is optional on FreeBSD. we need it to work when built on a system
       # with it and transferred to a system without it! This includes linux cross.
       "bash_cv_dev_fd=absent"
-    ];
+    ]
+    ++ iosConfigureFlags;
 
     strictDeps = true;
     # Note: Bison is needed because the patches above modify parse.y.
diff --git a/pkgs/tools/text/gnugrep/default.nix b/pkgs/tools/text/gnugrep/default.nix
index 9f0ecedd87928..9afcfd189b3e2 100644
--- a/pkgs/tools/text/gnugrep/default.nix
+++ b/pkgs/tools/text/gnugrep/default.nix
@@ -33,7 +33,11 @@ stdenv.mkDerivation {
     # https://lists.gnu.org/archive/html/bug-gnulib/2025-07/msg00021.html
     # Multiple upstream commits squashed with adjustments, see header
     ./gnulib-float-h-tests-port-to-C23-PowerPC-GCC.patch
-  ];
+  ]
+  # gnulib stackvma.c's macOS arm #includes <libc.h>/<nlist.h> — macOS-only
+  # BSD convenience headers nothing in the function body actually uses.
+  # Dropping them lets the file compile on iOS; no-op on macOS.
+  ++ lib.optional stdenv.hostPlatform.isiOS ./patches/ios-stackvma-drop-dead-includes.patch;
 
   # Some gnulib tests fail
   # - on Musl: https://github.com/NixOS/nixpkgs/pull/228714
diff --git a/pkgs/tools/text/gnugrep/patches/ios-stackvma-drop-dead-includes.patch b/pkgs/tools/text/gnugrep/patches/ios-stackvma-drop-dead-includes.patch
new file mode 100644
index 0000000000000..d7b24a65821f3
--- /dev/null
+++ b/pkgs/tools/text/gnugrep/patches/ios-stackvma-drop-dead-includes.patch
@@ -0,0 +1,16 @@
+gnulib lib/stackvma.c's macOS arm #includes <libc.h> and <nlist.h>, but
+nothing in the function body actually references symbols from either.
+Removing them lets the file compile on iOS
+(where neither header exists) with no behavior change on macOS.
+
+--- a/lib/stackvma.c
++++ b/lib/stackvma.c
+@@ -1363,8 +1363,6 @@
+ 
+ #elif (defined __APPLE__ && defined __MACH__) /* macOS */
+ 
+-#include <libc.h>
+-#include <nlist.h>
+ #include <mach/mach.h>
+ #include <mach/machine/vm_param.h>
+