diff --git a/src/libexpr/lexer-helpers.hh b/src/libexpr/lexer-helpers.hh
index caba6e18f48..d40f7b874e8 100644
--- a/src/libexpr/lexer-helpers.hh
+++ b/src/libexpr/lexer-helpers.hh
@@ -1,5 +1,13 @@
 #pragma once
 
+#include <cstddef>
+
+// inluding the generated headers twice leads to errors
+#ifndef BISON_HEADER
+#  include "lexer-tab.hh"
+#  include "parser-tab.hh"
+#endif
+
 namespace nix::lexer::internal {
 
 void initLoc(YYLTYPE * loc);
diff --git a/src/libexpr/nixexpr.hh b/src/libexpr/nixexpr.hh
index 2950ff1fd7c..a7ad580d2df 100644
--- a/src/libexpr/nixexpr.hh
+++ b/src/libexpr/nixexpr.hh
@@ -168,7 +168,7 @@ struct ExprVar : Expr
        the set stored in the environment that is `level` levels up
        from the current one.*/
     Level level;
-    Displacement displ;
+    Displacement displ = 0;
 
     ExprVar(Symbol name) : name(name) { };
     ExprVar(const PosIdx & pos, Symbol name) : pos(pos), name(name) { };
@@ -242,7 +242,7 @@ struct ExprAttrs : Expr
         Kind kind;
         Expr * e;
         PosIdx pos;
-        Displacement displ; // displacement
+        Displacement displ = 0; // displacement
         AttrDef(Expr * e, const PosIdx & pos, Kind kind = Kind::Plain)
             : kind(kind), e(e), pos(pos) { };
         AttrDef() { };
diff --git a/src/libexpr/print-options.hh b/src/libexpr/print-options.hh
index 080ba26b86c..9ad54e5323c 100644
--- a/src/libexpr/print-options.hh
+++ b/src/libexpr/print-options.hh
@@ -5,6 +5,7 @@
  */
 
 #include <limits>
+#include <stddef.h>
 
 namespace nix {
 
diff --git a/src/libstore/path-regex.hh b/src/libstore/path-regex.hh
index 56c2cfc1db5..e34a305c5f9 100644
--- a/src/libstore/path-regex.hh
+++ b/src/libstore/path-regex.hh
@@ -1,6 +1,8 @@
 #pragma once
 ///@file
 
+#include <string_view>
+
 namespace nix {
 
 
diff --git a/src/libstore/windows/pathlocks.cc b/src/libstore/windows/pathlocks.cc
index 00761a8c33c..197f5a1c46d 100644
--- a/src/libstore/windows/pathlocks.cc
+++ b/src/libstore/windows/pathlocks.cc
@@ -2,10 +2,12 @@
 #include "pathlocks.hh"
 #include "signals.hh"
 #include "util.hh"
-#include <errhandlingapi.h>
-#include <fileapi.h>
-#include <windows.h>
-#include "windows-error.hh"
+
+#ifdef WIN32
+#  include <errhandlingapi.h>
+#  include <fileapi.h>
+#  include <windows.h>
+#  include "windows-error.hh"
 
 namespace nix {
 
@@ -154,3 +156,4 @@ FdLock::FdLock(Descriptor desc, LockType lockType, bool wait, std::string_view w
 }
 
 }
+#endif
diff --git a/src/libutil/callback.hh b/src/libutil/callback.hh
index 26c386d8078..c2cada2f682 100644
--- a/src/libutil/callback.hh
+++ b/src/libutil/callback.hh
@@ -1,6 +1,7 @@
 #pragma once
 ///@file
 
+#include <cassert>
 #include <future>
 #include <functional>
 
diff --git a/src/libutil/config-impl.hh b/src/libutil/config-impl.hh
index c3aa61ddb95..94c2cb2e4b8 100644
--- a/src/libutil/config-impl.hh
+++ b/src/libutil/config-impl.hh
@@ -13,6 +13,7 @@
  */
 
 #include "config.hh"
+#include "args.hh"
 
 namespace nix {
 
diff --git a/src/libutil/regex-combinators.hh b/src/libutil/regex-combinators.hh
index 87d6aa6785f..75ccd4e6cf0 100644
--- a/src/libutil/regex-combinators.hh
+++ b/src/libutil/regex-combinators.hh
@@ -2,6 +2,8 @@
 ///@file
 
 #include <string_view>
+#include <string>
+#include <sstream>
 
 namespace nix::regex {
 
@@ -10,22 +12,23 @@ namespace nix::regex {
 
 static inline std::string either(std::string_view a, std::string_view b)
 {
-    return std::string { a } + "|" + b;
+    std::stringstream ss;
+    ss << a << "|" << b;
+    return ss.str();
 }
 
 static inline std::string group(std::string_view a)
 {
-    return std::string { "(" } + a + ")";
-}
-
-static inline std::string many(std::string_view a)
-{
-    return std::string { "(?:" } + a + ")*";
+    std::stringstream ss;
+    ss << "(" << a << ")";
+    return ss.str();
 }
 
 static inline std::string list(std::string_view a)
 {
-    return std::string { a } + many(group("," + a));
+    std::stringstream ss;
+    ss << a << "(," << a << ")*";
+    return ss.str();
 }
 
 }
diff --git a/src/libutil/unix/signals-impl.hh b/src/libutil/unix/signals-impl.hh
index 2193922be4c..037416e7d6b 100644
--- a/src/libutil/unix/signals-impl.hh
+++ b/src/libutil/unix/signals-impl.hh
@@ -14,6 +14,7 @@
 #include "error.hh"
 #include "logging.hh"
 #include "ansicolor.hh"
+#include "signals.hh"
 
 #include <sys/types.h>
 #include <sys/stat.h>
diff --git a/src/libutil/windows/environment-variables.cc b/src/libutil/windows/environment-variables.cc
index 5ce8a139537..308a432e4d8 100644
--- a/src/libutil/windows/environment-variables.cc
+++ b/src/libutil/windows/environment-variables.cc
@@ -1,6 +1,7 @@
 #include "environment-variables.hh"
 
-#include "processenv.h"
+#ifdef WIN32
+#  include "processenv.h"
 
 namespace nix {
 
@@ -43,3 +44,4 @@ int setEnvOs(const OsString & name, const OsString & value)
 }
 
 }
+#endif
diff --git a/src/libutil/windows/file-descriptor.cc b/src/libutil/windows/file-descriptor.cc
index 7b8a712e879..71f53ccb886 100644
--- a/src/libutil/windows/file-descriptor.cc
+++ b/src/libutil/windows/file-descriptor.cc
@@ -5,6 +5,7 @@
 #include "windows-error.hh"
 #include "file-path.hh"
 
+#ifdef WIN32
 #include <fileapi.h>
 #include <error.h>
 #include <namedpipeapi.h>
@@ -152,3 +153,4 @@ Path windows::handleToPath(HANDLE handle) {
 #endif
 
 }
+#endif
diff --git a/src/libutil/windows/file-system.cc b/src/libutil/windows/file-system.cc
index b15355efe88..53271cef3da 100644
--- a/src/libutil/windows/file-system.cc
+++ b/src/libutil/windows/file-system.cc
@@ -1,5 +1,6 @@
 #include "file-system.hh"
 
+#ifdef WIN32
 namespace nix {
 
 Descriptor openDirectory(const std::filesystem::path & path)
@@ -15,3 +16,4 @@ Descriptor openDirectory(const std::filesystem::path & path)
 }
 
 }
+#endif
diff --git a/src/libutil/windows/muxable-pipe.cc b/src/libutil/windows/muxable-pipe.cc
index 91a321f7cfa..af7e987e9f2 100644
--- a/src/libutil/windows/muxable-pipe.cc
+++ b/src/libutil/windows/muxable-pipe.cc
@@ -1,9 +1,10 @@
-#include <ioapiset.h>
-#include "windows-error.hh"
+#ifdef WIN32
+#  include <ioapiset.h>
+#  include "windows-error.hh"
 
-#include "logging.hh"
-#include "util.hh"
-#include "muxable-pipe.hh"
+#  include "logging.hh"
+#  include "util.hh"
+#  include "muxable-pipe.hh"
 
 namespace nix {
 
@@ -68,3 +69,4 @@ void MuxablePipePollState::iterate(
 }
 
 }
+#endif
diff --git a/src/libutil/windows/os-string.cc b/src/libutil/windows/os-string.cc
index 7507f9030da..26ad9cba0c8 100644
--- a/src/libutil/windows/os-string.cc
+++ b/src/libutil/windows/os-string.cc
@@ -7,6 +7,8 @@
 #include "file-path-impl.hh"
 #include "util.hh"
 
+#ifdef WIN32
+
 namespace nix {
 
 std::string os_string_to_string(PathViewNG::string_view path)
@@ -22,3 +24,5 @@ std::filesystem::path::string_type string_to_os_string(std::string_view s)
 }
 
 }
+
+#endif
diff --git a/src/libutil/windows/processes.cc b/src/libutil/windows/processes.cc
index 7f34c5632e8..e69f1ed45a5 100644
--- a/src/libutil/windows/processes.cc
+++ b/src/libutil/windows/processes.cc
@@ -23,6 +23,8 @@
 #include <sys/types.h>
 #include <unistd.h>
 
+#ifdef WIN32
+
 #define WIN32_LEAN_AND_MEAN
 #include <windows.h>
 
@@ -386,3 +388,5 @@ int execvpe(const wchar_t * file0, const wchar_t * const argv[], const wchar_t *
 }
 
 }
+
+#endif
diff --git a/src/libutil/windows/users.cc b/src/libutil/windows/users.cc
index db6c42df381..2780e45f4a1 100644
--- a/src/libutil/windows/users.cc
+++ b/src/libutil/windows/users.cc
@@ -4,6 +4,7 @@
 #include "file-system.hh"
 #include "windows-error.hh"
 
+#ifdef WIN32
 #define WIN32_LEAN_AND_MEAN
 #include <windows.h>
 
@@ -50,3 +51,4 @@ bool isRootUser() {
 }
 
 }
+#endif
diff --git a/src/libutil/windows/windows-async-pipe.cc b/src/libutil/windows/windows-async-pipe.cc
index 4fa57ca3672..13b56351029 100644
--- a/src/libutil/windows/windows-async-pipe.cc
+++ b/src/libutil/windows/windows-async-pipe.cc
@@ -1,6 +1,8 @@
 #include "windows-async-pipe.hh"
 #include "windows-error.hh"
 
+#ifdef WIN32
+
 namespace nix::windows {
 
 void AsyncPipe::createAsyncPipe(HANDLE iocp)
@@ -47,3 +49,5 @@ void AsyncPipe::close()
 }
 
 }
+
+#endif
diff --git a/src/libutil/windows/windows-async-pipe.hh b/src/libutil/windows/windows-async-pipe.hh
index 8f554e403f3..277336ed76a 100644
--- a/src/libutil/windows/windows-async-pipe.hh
+++ b/src/libutil/windows/windows-async-pipe.hh
@@ -2,6 +2,7 @@
 ///@file
 
 #include "file-descriptor.hh"
+#ifdef WIN32
 
 namespace nix::windows {
 
@@ -25,3 +26,4 @@ public:
 };
 
 }
+#endif
diff --git a/src/libutil/windows/windows-error.cc b/src/libutil/windows/windows-error.cc
index aead4af2378..4cf4274dae7 100644
--- a/src/libutil/windows/windows-error.cc
+++ b/src/libutil/windows/windows-error.cc
@@ -1,5 +1,6 @@
 #include "windows-error.hh"
 
+#ifdef WIN32
 #include <error.h>
 #define WIN32_LEAN_AND_MEAN
 #include <windows.h>
@@ -29,3 +30,4 @@ std::string WinError::renderError(DWORD lastError)
 }
 
 }
+#endif
diff --git a/src/libutil/windows/windows-error.hh b/src/libutil/windows/windows-error.hh
index 624b4c4cb0b..4e48ee8599c 100644
--- a/src/libutil/windows/windows-error.hh
+++ b/src/libutil/windows/windows-error.hh
@@ -1,6 +1,7 @@
 #pragma once
 ///@file
 
+#ifdef WIN32
 #include <errhandlingapi.h>
 
 #include "error.hh"
@@ -49,3 +50,4 @@ private:
 };
 
 }
+#endif
diff --git a/src/nix/self-exe.hh b/src/nix/self-exe.hh
index 3161553ecfa..91e260f0b79 100644
--- a/src/nix/self-exe.hh
+++ b/src/nix/self-exe.hh
@@ -2,6 +2,8 @@
 ///@file
 
 #include <filesystem>
+#include <optional>
+#include <string_view>
 
 namespace nix {
 
diff --git a/tests/nixos/ca-fd-leak/sender.c b/tests/nixos/ca-fd-leak/sender.c
index 75e54fc8f52..8356b2479a6 100644
--- a/tests/nixos/ca-fd-leak/sender.c
+++ b/tests/nixos/ca-fd-leak/sender.c
@@ -49,8 +49,8 @@ int main(int argc, char **argv) {
     msg.msg_controllen = CMSG_SPACE(sizeof(int));
 
     // Write a single null byte too.
-    msg.msg_iov = malloc(sizeof(struct iovec));
-    msg.msg_iov[0].iov_base = "";
+    msg.msg_iov = (struct iovec*) malloc(sizeof(struct iovec));
+    msg.msg_iov[0].iov_base = (void*) "";
     msg.msg_iov[0].iov_len = 1;
     msg.msg_iovlen = 1;
 
diff --git a/tests/nixos/ca-fd-leak/smuggler.c b/tests/nixos/ca-fd-leak/smuggler.c
index 82acf37e68e..3f89af5bbe6 100644
--- a/tests/nixos/ca-fd-leak/smuggler.c
+++ b/tests/nixos/ca-fd-leak/smuggler.c
@@ -16,7 +16,7 @@ int main(int argc, char **argv) {
     struct sockaddr_un data;
     data.sun_family = AF_UNIX;
     data.sun_path[0] = 0;
-    strcpy(data.sun_path + 1, argv[1]);
+    strncpy(data.sun_path + 1, argv[1], sizeof(data.sun_path) - 1);
     int res = bind(sock, (const struct sockaddr *)&data,
         offsetof(struct sockaddr_un, sun_path)
         + strlen(argv[1])
@@ -57,10 +57,11 @@ int main(int argc, char **argv) {
     // Wait for a second connection, which will tell us that the build is
     // done
     a = accept(sock, 0, 0);
+    if (a < 0) perror("accept");
     fprintf(stderr, "%s\n", "Got a second connection, rewriting the file");
     // Write a new content to the file
     if (ftruncate(smuggling_fd, 0)) perror("ftruncate");
-    char * new_content = "Pwned\n";
+    const char * new_content = "Pwned\n";
     int written_bytes = write(smuggling_fd, new_content, strlen(new_content));
     if (written_bytes != strlen(new_content)) perror("write");
 }