diff --git a/pkgs/development/interpreters/lua-5/build-luarocks-package.nix b/pkgs/development/interpreters/lua-5/build-luarocks-package.nix
index bc79b674b472..8209abaeced0 100644
--- a/pkgs/development/interpreters/lua-5/build-luarocks-package.nix
+++ b/pkgs/development/interpreters/lua-5/build-luarocks-package.nix
@@ -1,10 +1,12 @@
 # Generic builder for lua packages
 {
   lib,
+  stdenv,
   lua,
   wrapLua,
   luarocks_bootstrap,
   writeTextFile,
+  buildPackages,
 
   # Whether the derivation provides a lua module or not.
   luarocksCheckHook,
@@ -236,6 +238,12 @@ let
           runHook postShell
         '';
 
+        disallowedReferences = lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+          buildPackages.bash
+          lua.luaOnBuild
+          lua.luaOnBuild.pkgs.luarocks_bootstrap
+        ];
+
         passthru = {
           inherit lua;
         }
diff --git a/pkgs/development/interpreters/lua-5/default.nix b/pkgs/development/interpreters/lua-5/default.nix
index 1147893e5e43..50843b9a6583 100644
--- a/pkgs/development/interpreters/lua-5/default.nix
+++ b/pkgs/development/interpreters/lua-5/default.nix
@@ -90,6 +90,13 @@ let
         inherit packageOverrides;
         self = luaOnBuild;
       };
+      inherit
+        luaOnBuildForBuild
+        luaOnBuildForHost
+        luaOnBuildForTarget
+        luaOnHostForHost
+        luaOnTargetForTarget
+        ;
 
       tests = callPackage ./tests {
         lua = self;
diff --git a/pkgs/development/interpreters/lua-5/wrap-lua.nix b/pkgs/development/interpreters/lua-5/wrap-lua.nix
index 1f074b04425d..94e546bf3125 100644
--- a/pkgs/development/interpreters/lua-5/wrap-lua.nix
+++ b/pkgs/development/interpreters/lua-5/wrap-lua.nix
@@ -9,6 +9,8 @@
 makeSetupHook {
   name = "wrap-lua-hook";
   propagatedBuildInputs = [ makeWrapper ];
-  substitutions.executable = lua.interpreter;
-  substitutions.lua = lua;
+  substitutions.luaBuild = lua.luaOnBuildForHost;
+  substitutions.luaHost = lua.luaOnHostForHost;
+  substitutions.luarocksBuild = lua.luaOnBuildForHost.pkgs.luarocks_bootstrap;
+  substitutions.luarocksHost = lua.luaOnHostForHost.pkgs.luarocks_bootstrap;
 } ./wrap.sh
diff --git a/pkgs/development/interpreters/lua-5/wrap.sh b/pkgs/development/interpreters/lua-5/wrap.sh
index f6868e6faac5..47b82279c17c 100644
--- a/pkgs/development/interpreters/lua-5/wrap.sh
+++ b/pkgs/development/interpreters/lua-5/wrap.sh
@@ -3,7 +3,7 @@
 # variable is passed in from the buildLuarocksPackage function.
 set -e
 
-source @lua@/nix-support/utils.sh
+source @luaBuild@/nix-support/utils.sh
 
 wrapLuaPrograms() {
   wrapLuaProgramsIn "$out/bin" "$out $luaPath"
@@ -28,10 +28,16 @@ wrapLuaProgramsIn() {
 
   # Find all regular files in the output directory that are executable.
   find "$dir" -type f -perm -0100 -print0 | while read -d "" f; do
-    # Rewrite "#! .../env lua" to "#! /nix/store/.../lua".
-    # Lua to use besides one with this hook anyway.
-    if head -n1 "$f" | grep -q '#!.*/env.*\(lua\)'; then
-      sed -i "$f" -e "1 s^.*/env[ ]*\(lua\)[^ ]*^#! @executable@^"
+    if head -n1 "$f" | grep -q '#!.*'; then
+        # Cross-compilation hack: exec '/nix/store/...-lua-.../bin/lua' execute
+        # the host lua
+        substituteInPlace "$f" \
+          --replace-fail "@luaBuild@" "@luaHost@"
+        # Build platform's Luarocks writes scripts that reference luarocks
+        # itself in them, so we fix these references to reference the host
+        # platform's luarocks.
+        substituteInPlace "$f" \
+          --replace-fail "@luarocksBuild@" "@luarocksHost@"
     fi
 
     # wrapProgram creates the executable shell script described
@@ -52,5 +58,9 @@ wrapLuaProgramsIn() {
     # see setup-hooks/make-wrapper.sh
     wrapProgram "${wrapProgramArgs[@]}"
 
+    # Same as above, but now for the wrapper script
+    substituteInPlace "$f" \
+      --replace-fail "@luarocksBuild@" "@luarocksHost@"
+
   done
 }