diff --git a/pkgs/by-name/sa/sage/package.nix b/pkgs/by-name/sa/sage/package.nix
index 27103794432c..49ed64329c6b 100644
--- a/pkgs/by-name/sa/sage/package.nix
+++ b/pkgs/by-name/sa/sage/package.nix
@@ -1,6 +1,5 @@
 {
   pkgs,
-  stdenv,
   withDoc ? false,
   requireSageTests ? true,
   extraPythonPackages ? ps: [ ],
diff --git a/pkgs/by-name/sa/sage/sage-src.nix b/pkgs/by-name/sa/sage/sage-src.nix
index 6acfd64676d1..5707ccfb275f 100644
--- a/pkgs/by-name/sa/sage/sage-src.nix
+++ b/pkgs/by-name/sa/sage/sage-src.nix
@@ -1,6 +1,7 @@
 {
-  stdenv,
   lib,
+  stdenv,
+  bashNonInteractive,
   fetchFromGitHub,
   fetchpatch2,
   fetchurl,
@@ -11,17 +12,25 @@
 # This is done because multiple derivations rely on these sources and they should
 # all get the same sources with the same patches applied.
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   version = "10.9";
   pname = "sage-src";
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   src = fetchFromGitHub {
     owner = "sagemath";
     repo = "sage";
-    rev = version;
+    tag = finalAttrs.version;
     hash = "sha256-8IBCQYdmL7ane7/WOoogArbwgqPDtL8ecz9GIzuEfOU=";
   };
 
+  # The shipped scripts (e.g. build/bin/sage-site) use `#!/usr/bin/env bash`.
+  # With `strictDeps`, patchShebangs only searches HOST_PATH, so bash has to be
+  # a buildInput for those to get patched.
+  buildInputs = [ bashNonInteractive ];
+
   # contains essential files (e.g., setup.cfg) generated by the bootstrap script.
   # TODO: investigate https://github.com/sagemath/sage/pull/35950
   configure-src = fetchurl {
@@ -160,7 +169,7 @@ stdenv.mkDerivation rec {
     ./patches/scipy-1_18-workaround.patch
   ];
 
-  patches = nixPatches ++ bugfixPatches ++ packageUpgradePatches;
+  patches = finalAttrs.nixPatches ++ finalAttrs.bugfixPatches ++ finalAttrs.packageUpgradePatches;
 
   # do not create .orig backup files if patch applies with fuzz
   patchFlags = [
@@ -195,11 +204,11 @@ stdenv.mkDerivation rec {
   '';
 
   buildPhase = ''
-    tar xzf ${configure-src}
+    tar xzf ${finalAttrs.configure-src}
     rm configure
   '';
 
   installPhase = ''
     cp -r . "$out"
   '';
-}
+})