diff --git a/Makefile b/Makefile
index 7bfa24d880a0..561aeb4b1e4f 100644
--- a/Makefile
+++ b/Makefile
@@ -36,8 +36,29 @@ DEFAULT_BOLTVERSION := 4b539711d4726f274482051150bc6612e370b4e2
 # Can be overridden on cmdline.
 BOLTVERSION := $(DEFAULT_BOLTVERSION)
 
+USER_FLAGS_VARS := CFLAGS CPPFLAGS LDFLAGS
+
+# config.vars takes precedence over make's environment, so remember any of
+# these flags given in the environment before including it.
+$(foreach v,$(USER_FLAGS_VARS),$(if $(filter environment,$(origin $(v))),$(eval MAKE_ENV_$(v) := $$($(v)))))
+
 -include config.vars
 
+# Save the user's flags before we start munging them: those recorded by
+# configure (or given on the command line, which replaces them), followed by
+# any different ones given in make's environment.  We prepend our own flags
+# below; "override" makes that work for command-line values too.
+define SAVE_USER_FLAGS_tmpl =
+$(1)_FROM_ENV := $$($(1))
+ifneq ($$(origin $(1)),command line)
+ifneq ($$(strip $$(MAKE_ENV_$(1))),$$(strip $$($(1))))
+$(1)_FROM_ENV += $$(MAKE_ENV_$(1))
+endif
+endif
+override $(1) =
+endef
+$(foreach v,$(USER_FLAGS_VARS),$(eval $(call SAVE_USER_FLAGS_tmpl,$(v))))
+
 # Homebrew lives in /opt/homebrew on Apple Silicon and /usr/local on Intel.
 # Ask brew rather than guessing, and use nothing from it if it isn't found
 # (e.g. in a nix build), so we don't pick up stray headers and tools.
@@ -294,32 +315,34 @@ ifneq ($(BREW_PREFIX),)
 OPENSSL_PREFIX := $(shell brew --prefix openssl@3 2>/dev/null || brew --prefix openssl 2>/dev/null || echo "")
 SQLITE_PREFIX := $(shell brew --prefix sqlite 2>/dev/null || echo "")
 ifneq ("$(OPENSSL_PREFIX)", "")
-LDFLAGS += -L$(OPENSSL_PREFIX)/lib
-CPPFLAGS += -I$(OPENSSL_PREFIX)/include
+override LDFLAGS += -L$(OPENSSL_PREFIX)/lib
+override CPPFLAGS += -I$(OPENSSL_PREFIX)/include
 endif
 ifneq ("$(SQLITE_PREFIX)", "")
-LDFLAGS += -L$(SQLITE_PREFIX)/lib
-CPPFLAGS += -I$(SQLITE_PREFIX)/include
+override LDFLAGS += -L$(SQLITE_PREFIX)/lib
+override CPPFLAGS += -I$(SQLITE_PREFIX)/include
 PKG_CONFIG_PATH := $(SQLITE_PREFIX)/lib/pkgconfig:$(PKG_CONFIG_PATH)
 endif
 endif
 endif
 
-CPPFLAGS += -DCLN_NEXT_VERSION="\"$(CLN_NEXT_VERSION)\"" -DPKGLIBEXECDIR="\"$(pkglibexecdir)\"" -DBINDIR="\"$(bindir)\"" -DPLUGINDIR="\"$(plugindir)\"" -DCCAN_TAL_NEVER_RETURN_NULL=1
-CFLAGS = $(CPPFLAGS) $(CWARNFLAGS) $(CDEBUGFLAGS) $(COPTFLAGS) -I $(CCANDIR) $(EXTERNAL_INCLUDE_FLAGS) -I . $(CPATH_CFLAGS) $(SQLITE3_CFLAGS) $(SODIUM_CFLAGS) $(POSTGRES_INCLUDE) $(FEATURES) $(COVFLAGS) $(DEV_CFLAGS) -DSHACHAIN_BITS=48 -DJSMN_PARENT_LINKS $(PIE_CFLAGS) $(COMPAT_CFLAGS) $(CSANFLAGS)
+# Put the environment-inherited flags *last* so the user has the final say.
+override CPPFLAGS += -DCLN_NEXT_VERSION="\"$(CLN_NEXT_VERSION)\"" -DPKGLIBEXECDIR="\"$(pkglibexecdir)\"" -DBINDIR="\"$(bindir)\"" -DPLUGINDIR="\"$(plugindir)\"" -DCCAN_TAL_NEVER_RETURN_NULL=1 -I$(CCANDIR) $(EXTERNAL_INCLUDE_FLAGS) -I. $(CPATH_CFLAGS) $(POSTGRES_INCLUDE) -DSHACHAIN_BITS=48 -DJSMN_PARENT_LINKS $(COMPAT_CFLAGS) $(CPPFLAGS_FROM_ENV)
+override CFLAGS = $(CWARNFLAGS) $(CDEBUGFLAGS) $(COPTFLAGS) $(SQLITE3_CFLAGS) $(SODIUM_CFLAGS) $(FEATURES) $(COVFLAGS) $(DEV_CFLAGS) $(PIE_CFLAGS) $(CSANFLAGS) $(CFLAGS_FROM_ENV)
+override LDFLAGS += $(PIE_LDFLAGS) $(LDFLAGS_FROM_ENV)
 
 # If CFLAGS is already set in the environment of make (to whatever value, it
 # does not matter) then it would export it to subprocesses with the above value
 # we set, including CWARNFLAGS which by default contains -Wall -Werror. This
 # breaks at least libwally-core which tries to switch off some warnings with
 # -Wno-whatever. So, tell make to not export our CFLAGS to subprocesses.
-unexport CFLAGS
+# The same goes for CPPFLAGS and LDFLAGS, which now hold our include paths,
+# defines and linker flags.
+unexport $(USER_FLAGS_VARS)
 
 # We can get configurator to run a different compile cmd to cross-configure.
 CONFIGURATOR_CC := $(CC)
 
-LDFLAGS += $(PIE_LDFLAGS) $(CSANFLAGS) $(COPTFLAGS)
-
 ifeq ($(STATIC),1)
 # For MacOS, Jacob Rapoport <jacob@rumblemonkey.com> changed this to:
 #  -L/usr/local/lib -lsqlite3 -lz -Wl,-lm -lpthread -ldl $(COVFLAGS)
@@ -329,10 +352,6 @@ else
 LDLIBS = $(LIBRARY_PATH_LDFLAGS) -lm $(SQLITE3_LDLIBS) $(COVFLAGS)
 endif
 
-ifeq ($(HAVE_FUNCTION_SECTIONS),1)
-LDLIBS += -Wl,--gc-sections
-endif
-
 # If we have the postgres client library we need to link against it as well
 ifeq ($(HAVE_POSTGRES),1)
 LDLIBS += $(POSTGRES_LDLIBS)
@@ -346,16 +365,19 @@ FORCE:
 endif
 
 show-flags: config.vars
-	@$(ECHO) "CC: $(CC) $(CFLAGS) -c -o"
-	@$(ECHO) "LD: $(LINK.o) $(filter-out %.a,$^) $(LOADLIBES) $(EXTERNAL_LDLIBS) $(LDLIBS) -o"
+	@$(ECHO) "CC: $(COMPILE.c) -o"
+	@$(ECHO) "LD: $(LINK.c) $(LOADLIBES) $(EXTERNAL_LDLIBS) $(LDLIBS) -o"
 
 # We will re-generate, but we won't generate for the first time!
 ccan/config.h config.vars &: configure ccan/tools/configurator/configurator.c
 	@if [ ! -f config.vars ]; then echo 'File config.vars not found: you must run ./configure before running make.' >&2; exit 1; fi
 	./configure --reconfigure
 
+%/:
+	@$(MKDIR_P) $(@D)
+
 %.o: %.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 
 # tools/update-mocks.sh does nasty recursive make, must not do this!
 ifeq ($(SUPPRESS_GENERATION),1)
@@ -815,7 +837,7 @@ $(ALL_TEST_PROGRAMS) $(ALL_FUZZ_TARGETS): %: %.o
 # (as per EXTERNAL_LDLIBS) so we filter them out here.  We have to put the other
 # .a files (if any) at the end of the link line.
 $(ALL_PROGRAMS) $(ALL_TEST_PROGRAMS):
-	@$(call VERBOSE, "ld $@", $(LINK.o) $(filter-out %.a,$^) $(filter-out external/%,$(filter %.a,$^)) $(LOADLIBES) $(EXTERNAL_LDLIBS) $(LDLIBS) $($(@)_LDLIBS) -o $@)
+	@$(call VERBOSE, "ld $@", $(LINK.c) $(filter-out %.a,$^) $(filter-out external/%,$(filter %.a,$^)) $(LOADLIBES) $(EXTERNAL_LDLIBS) $(LDLIBS) $($(@)_LDLIBS) -o $@)
 ifeq ($(OS),Darwin)
 	@$(call VERBOSE, "dsymutil $@", dsymutil $@)
 endif
@@ -836,7 +858,7 @@ endif
 endif
 
 $(ALL_FUZZ_TARGETS):
-	@$(call VERBOSE, "ld $@", $(LINK.o) $(filter-out %.a,$^) libcommon.a libccan.a $(LOADLIBES) $(EXTERNAL_LDLIBS) $(LDLIBS) $(FUZZ_LDFLAGS) -o $@)
+	@$(call VERBOSE, "ld $@", $(LINK.c) $(filter-out %.a,$^) libcommon.a libccan.a $(LOADLIBES) $(EXTERNAL_LDLIBS) $(LDLIBS) $(FUZZ_LDFLAGS) -o $@)
 ifeq ($(OS),Darwin)
 	@$(call VERBOSE, "dsymutil $@", dsymutil $@)
 endif
@@ -967,6 +989,30 @@ INSTALL = install
 INSTALL_PROGRAM = $(INSTALL)
 INSTALL_DATA = $(INSTALL) -m 644
 
+# $(1) = install command
+# $(2) = installation source file
+# $(3) = installation target file
+define INSTALL_RULE_tmpl =
+$(3): $(2) | $(dir $(3))
+	@$$(call VERBOSE,"install $$@",$(1) $$< $$|)
+endef
+
+# $(1) = install command
+# $(2) = installation source file
+# $(3) = installation target file
+# Expands to the installation target file, defining its rule as a side effect.
+INSTALL_TARGET_tmpl = $(eval $(call INSTALL_RULE_tmpl,$(1),$(2),$(3)))$(3)
+
+# $(1) = install command
+# $(2) = list of files to install to $(3)
+# $(3) = installation target directory
+install_targets = $(foreach f,$(2),$(call INSTALL_TARGET_tmpl,$(1),$(f),$(3)/$(notdir $(f))))
+
+# $(1) = list of files to install to $(2)
+# $(2) = installation target directory
+install_program_targets = $(call install_targets,$(INSTALL_PROGRAM),$(1),$(2))
+install_data_targets = $(call install_targets,$(INSTALL_DATA),$(1),$(2))
+
 # Tags needed by some package systems.
 PRE_INSTALL = :
 NORMAL_INSTALL = :
@@ -975,28 +1021,27 @@ PRE_UNINSTALL = :
 NORMAL_UNINSTALL = :
 POST_UNINSTALL = :
 
-# Target to create directories.
-installdirs:
-	@$(NORMAL_INSTALL)
-	$(MKDIR_P) $(DESTDIR)$(bindir)
-	$(MKDIR_P) $(DESTDIR)$(pkglibexecdir)
-	$(MKDIR_P) $(DESTDIR)$(plugindir)
-	$(MKDIR_P) $(DESTDIR)$(man1dir)
-	$(MKDIR_P) $(DESTDIR)$(man5dir)
-	$(MKDIR_P) $(DESTDIR)$(man7dir)
-	$(MKDIR_P) $(DESTDIR)$(man8dir)
-	$(MKDIR_P) $(DESTDIR)$(docdir)
+# clnrest and wss-proxy used to be Python plugins, installed as directories.
+# Remove such old directories (only if present) before installing the binaries.
+$(DESTDIR)$(plugindir)/clnrest: $(if $(wildcard $(DESTDIR)$(plugindir)/clnrest/.),uninstall-old-clnrest-plugin)
+uninstall-old-clnrest-plugin:
+	$(RM) -r $(DESTDIR)$(plugindir)/clnrest
+
+$(DESTDIR)$(plugindir)/wss-proxy: $(if $(wildcard $(DESTDIR)$(plugindir)/wss-proxy/.),uninstall-old-wss-proxy-plugin)
+uninstall-old-wss-proxy-plugin:
+	$(RM) -r $(DESTDIR)$(plugindir)/wss-proxy
+
+.PHONY: uninstall-old-clnrest-plugin uninstall-old-wss-proxy-plugin
 
 # $(PLUGINS) is defined in plugins/Makefile.
 
-install-program: installdirs $(BIN_PROGRAMS) $(PKGLIBEXEC_PROGRAMS) $(PLUGINS) $(PY_PLUGINS)
+INSTALL_PROGRAM_TARGETS := \
+	$(call install_program_targets,$(BIN_PROGRAMS),$(DESTDIR)$(bindir)) \
+	$(call install_program_targets,$(PKGLIBEXEC_PROGRAMS),$(DESTDIR)$(pkglibexecdir)) \
+	$(call install_program_targets,$(PLUGINS),$(DESTDIR)$(plugindir))
+
+install-program: $(INSTALL_PROGRAM_TARGETS)
 	@$(NORMAL_INSTALL)
-	$(INSTALL_PROGRAM) $(BIN_PROGRAMS) $(DESTDIR)$(bindir)
-	$(INSTALL_PROGRAM) $(PKGLIBEXEC_PROGRAMS) $(DESTDIR)$(pkglibexecdir)
-	@if [ -d "$(DESTDIR)$(plugindir)/clnrest" ]; then rm -rf $(DESTDIR)$(plugindir)/clnrest; fi
-	@if [ -d "$(DESTDIR)$(plugindir)/wss-proxy" ]; then rm -rf $(DESTDIR)$(plugindir)/wss-proxy; fi
-	[ -z "$(PLUGINS)" ] || $(INSTALL_PROGRAM) $(PLUGINS) $(DESTDIR)$(plugindir)
-	for PY in $(PY_PLUGINS); do DIR=`dirname $$PY`; DST=$(DESTDIR)$(plugindir)/`basename $$DIR`; if [ -d $$DST ]; then rm -rf $$DST; fi; $(INSTALL_PROGRAM) -d $$DIR; cp -a $$DIR $$DST ; done
 ifeq ($(OS),Darwin)
 	# Install dSYM bundles alongside binaries on macOS
 	for BIN in $(BIN_PROGRAMS); do if [ -d $$BIN.dSYM ]; then cp -a $$BIN.dSYM $(DESTDIR)$(bindir)/; fi; done
@@ -1010,13 +1055,15 @@ MAN7PAGES = $(filter %.7,$(MANPAGES))
 MAN8PAGES = $(filter %.8,$(MANPAGES))
 DOC_DATA = README.md LICENSE
 
-install-data: installdirs $(MAN1PAGES) $(MAN5PAGES) $(MAN7PAGES) $(MAN8PAGES) $(DOC_DATA)
+INSTALL_DATA_TARGETS := \
+	$(call install_data_targets,$(MAN1PAGES),$(DESTDIR)$(man1dir)) \
+	$(call install_data_targets,$(MAN5PAGES),$(DESTDIR)$(man5dir)) \
+	$(call install_data_targets,$(MAN7PAGES),$(DESTDIR)$(man7dir)) \
+	$(call install_data_targets,$(MAN8PAGES),$(DESTDIR)$(man8dir)) \
+	$(call install_data_targets,$(DOC_DATA),$(DESTDIR)$(docdir))
+
+install-data: $(INSTALL_DATA_TARGETS)
 	@$(NORMAL_INSTALL)
-	$(INSTALL_DATA) $(MAN1PAGES) $(DESTDIR)$(man1dir)
-	$(INSTALL_DATA) $(MAN5PAGES) $(DESTDIR)$(man5dir)
-	$(INSTALL_DATA) $(MAN7PAGES) $(DESTDIR)$(man7dir)
-	$(INSTALL_DATA) $(MAN8PAGES) $(DESTDIR)$(man8dir)
-	$(INSTALL_DATA) $(DOC_DATA) $(DESTDIR)$(docdir)
 
 install: install-program install-data
 
@@ -1036,44 +1083,21 @@ TESTPACK_EXTRAS :=			\
 testpack.tar.gz: all-programs all-fuzz-programs all-test-programs default-targets
 	(find * -path external -prune -o -path target -prune -o -newer config.vars -type f -print; ls $(TESTPACK_EXTRAS)) | tar --verbatim-files-from -T- -c --format=posix -f - | gzip -5 > $@
 
-uninstall:
+uninstall-program:
 	@$(NORMAL_UNINSTALL)
-	@for f in $(BIN_PROGRAMS); do \
-	  $(ECHO) rm -f $(DESTDIR)$(bindir)/`basename $$f`; \
-	  rm -f $(DESTDIR)$(bindir)/`basename $$f`; \
-	done
-	@for f in $(PLUGINS); do \
-	  $(ECHO) rm -f $(DESTDIR)$(plugindir)/`basename $$f`; \
-	  rm -f $(DESTDIR)$(plugindir)/`basename $$f`; \
-	done
-	@for f in $(PY_PLUGINS); do \
-	  $(ECHO) rm -rf $(DESTDIR)$(plugindir)/$$(basename $$(dirname $$f)); \
-	  rm -rf $(DESTDIR)$(plugindir)/$$(basename $$(dirname $$f)); \
-	done
-	@for f in $(PKGLIBEXEC_PROGRAMS); do \
-	  $(ECHO) rm -f $(DESTDIR)$(pkglibexecdir)/`basename $$f`; \
-	  rm -f $(DESTDIR)$(pkglibexecdir)/`basename $$f`; \
-	done
-	@for f in $(MAN1PAGES); do \
-	  $(ECHO) rm -f $(DESTDIR)$(man1dir)/`basename $$f`; \
-	  rm -f $(DESTDIR)$(man1dir)/`basename $$f`; \
-	done
-	@for f in $(MAN5PAGES); do \
-	  $(ECHO) rm -f $(DESTDIR)$(man5dir)/`basename $$f`; \
-	  rm -f $(DESTDIR)$(man5dir)/`basename $$f`; \
-	done
-	@for f in $(MAN7PAGES); do \
-	  $(ECHO) rm -f $(DESTDIR)$(man7dir)/`basename $$f`; \
-	  rm -f $(DESTDIR)$(man7dir)/`basename $$f`; \
-	done
-	@for f in $(MAN8PAGES); do \
-	  $(ECHO) rm -f $(DESTDIR)$(man8dir)/`basename $$f`; \
-	  rm -f $(DESTDIR)$(man8dir)/`basename $$f`; \
-	done
-	@for f in $(DOC_DATA); do \
-	  $(ECHO) rm -f $(DESTDIR)$(docdir)/`basename $$f`; \
-	  rm -f $(DESTDIR)$(docdir)/`basename $$f`; \
-	done
+ifneq ($(strip $(INSTALL_PROGRAM_TARGETS)),)
+	$(RM) $(INSTALL_PROGRAM_TARGETS)
+	rmdir $(DESTDIR)$(plugindir) $(DESTDIR)$(pkglibexecdir) 2>/dev/null || :
+endif
+
+uninstall-data:
+	@$(NORMAL_UNINSTALL)
+ifneq ($(strip $(INSTALL_DATA_TARGETS)),)
+	$(RM) $(INSTALL_DATA_TARGETS)
+	rmdir $(DESTDIR)$(docdir) 2>/dev/null || :
+endif
+
+uninstall: uninstall-program uninstall-data
 
 installcheck: all-programs
 	@rm -rf testinstall || true
@@ -1089,7 +1113,7 @@ installcheck: all-programs
 version:
 	@echo ${VERSION}
 
-.PHONY: installdirs install-program install-data install uninstall \
+.PHONY: install-program install-data install uninstall-program uninstall-data uninstall \
 	installcheck ncc bin-tarball show-flags version
 
 # Make a tarball of opt/clightning/, optionally with label for distribution.
@@ -1102,113 +1126,113 @@ clightning-$(VERSION)-$(DISTRO).tar.xz: install
 endif
 
 ccan-breakpoint.o: $(CCANDIR)/ccan/breakpoint/breakpoint.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-base64.o: $(CCANDIR)/ccan/base64/base64.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-tal.o: $(CCANDIR)/ccan/tal/tal.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-tal-str.o: $(CCANDIR)/ccan/tal/str/str.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-tal-link.o: $(CCANDIR)/ccan/tal/link/link.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-tal-path.o: $(CCANDIR)/ccan/tal/path/path.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-tal-grab_file.o: $(CCANDIR)/ccan/tal/grab_file/grab_file.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-take.o: $(CCANDIR)/ccan/take/take.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-list.o: $(CCANDIR)/ccan/list/list.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-asort.o: $(CCANDIR)/ccan/asort/asort.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-ptr_valid.o: $(CCANDIR)/ccan/ptr_valid/ptr_valid.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-read_write_all.o: $(CCANDIR)/ccan/read_write_all/read_write_all.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-str.o: $(CCANDIR)/ccan/str/str.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-opt.o: $(CCANDIR)/ccan/opt/opt.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-opt-helpers.o: $(CCANDIR)/ccan/opt/helpers.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-opt-parse.o: $(CCANDIR)/ccan/opt/parse.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-opt-usage.o: $(CCANDIR)/ccan/opt/usage.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-err.o: $(CCANDIR)/ccan/err/err.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-noerr.o: $(CCANDIR)/ccan/noerr/noerr.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-str-hex.o: $(CCANDIR)/ccan/str/hex/hex.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-crc32c.o: $(CCANDIR)/ccan/crc32c/crc32c.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-crypto-hmac.o: $(CCANDIR)/ccan/crypto/hmac_sha256/hmac_sha256.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-crypto-hkdf.o: $(CCANDIR)/ccan/crypto/hkdf_sha256/hkdf_sha256.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-crypto-shachain.o: $(CCANDIR)/ccan/crypto/shachain/shachain.c
-	@$(call VERBOSE, "cc $< -DSHACHAIN_BITS=48", $(CC) $(CFLAGS) -DSHACHAIN_BITS=48 -c -o $@ $<)
+	@$(call VERBOSE, "cc $< -DSHACHAIN_BITS=48", $(COMPILE.c) -DSHACHAIN_BITS=48 -o $@ $<)
 ccan-crypto-sha256.o: $(CCANDIR)/ccan/crypto/sha256/sha256.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-crypto-ripemd160.o: $(CCANDIR)/ccan/crypto/ripemd160/ripemd160.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-cdump.o: $(CCANDIR)/ccan/cdump/cdump.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-strmap.o: $(CCANDIR)/ccan/strmap/strmap.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-strset.o: $(CCANDIR)/ccan/strset/strset.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-crypto-siphash24.o: $(CCANDIR)/ccan/crypto/siphash24/siphash24.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-htable.o: $(CCANDIR)/ccan/htable/htable.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-ilog.o: $(CCANDIR)/ccan/ilog/ilog.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-intmap.o: $(CCANDIR)/ccan/intmap/intmap.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-isaac.o: $(CCANDIR)/ccan/isaac/isaac.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-isaac64.o: $(CCANDIR)/ccan/isaac/isaac64.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-time.o: $(CCANDIR)/ccan/time/time.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-timer.o: $(CCANDIR)/ccan/timer/timer.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-io-io.o: $(CCANDIR)/ccan/io/io.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-io-poll.o: $(CCANDIR)/ccan/io/poll.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-io-fdpass.o: $(CCANDIR)/ccan/io/fdpass/fdpass.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-pipecmd.o: $(CCANDIR)/ccan/pipecmd/pipecmd.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-mem.o: $(CCANDIR)/ccan/mem/mem.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-fdpass.o: $(CCANDIR)/ccan/fdpass/fdpass.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-bitops.o: $(CCANDIR)/ccan/bitops/bitops.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-rbuf.o: $(CCANDIR)/ccan/rbuf/rbuf.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-str-base32.o: $(CCANDIR)/ccan/str/base32/base32.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-utf8.o: $(CCANDIR)/ccan/utf8/utf8.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-bitmap.o: $(CCANDIR)/ccan/bitmap/bitmap.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-membuf.o: $(CCANDIR)/ccan/membuf/membuf.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-json_escape.o: $(CCANDIR)/ccan/json_escape/json_escape.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-json_out.o: $(CCANDIR)/ccan/json_out/json_out.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-closefrom.o: $(CCANDIR)/ccan/closefrom/closefrom.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-rune-rune.o: $(CCANDIR)/ccan/rune/rune.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 ccan-rune-coding.o: $(CCANDIR)/ccan/rune/coding.c
-	@$(call VERBOSE, "cc $<", $(CC) $(CFLAGS) -c -o $@ $<)
+	@$(call VERBOSE, "cc $<", $(COMPILE.c) -o $@ $<)
 
 canned-gossmap: devtools/gossmap-compress
 	DATE=`date +%Y-%m-%d` && devtools/gossmap-compress compress --output-node-map /tmp/gossip_store tests/data/gossip-store-$$DATE.compressed > tests/data/gossip-store-$$DATE-node-map && xz -9 tests/data/gossip-store-$$DATE-node-map && ls -l tests/data/gossip-store-$$DATE*
diff --git a/bitcoin/test/Makefile b/bitcoin/test/Makefile
index eadb3ed3585b..db7dc90e1a96 100644
--- a/bitcoin/test/Makefile
+++ b/bitcoin/test/Makefile
@@ -9,6 +9,6 @@ ALL_TEST_PROGRAMS += $(BITCOIN_TEST_PROGRAMS)
 ALL_C_SOURCES += $(BITCOIN_TEST_PROGRAMS:=.c)
 
 # This needs to know what level of optimization we're using.
-bitcoin/test/run-secret_eq_consttime.o: CFLAGS += -DCOPTFLAGS="\"${COPTFLAGS}\""
+bitcoin/test/run-secret_eq_consttime.o: CPPFLAGS += -DCOPTFLAGS="\"${COPTFLAGS}\""
 
 check-units: $(BITCOIN_TEST_PROGRAMS:%=unittest/%)
diff --git a/common/test/run-close_tx.c b/common/test/run-close_tx.c
index 42a1cea40f76..f5196d0817ac 100644
--- a/common/test/run-close_tx.c
+++ b/common/test/run-close_tx.c
@@ -7,7 +7,7 @@
 #include <common/close_tx.h>
 #include <common/setup.h>
 #include <common/utils.h>
-#include <external/libwally-core/include/wally_script.h>
+#include <wally_script.h>
 #include <stdio.h>
 
 static void test_create_simple_close_tx_basic(void)
diff --git a/configure b/configure
index 52792463642d..916bc3b06661 100755
--- a/configure
+++ b/configure
@@ -27,14 +27,19 @@ if [ -z "$IN_NIX_SHELL" ]; then
     fi
 fi
 
-: ${PKG_CONFIG=pkg-config}
-
-# You can set PG_CONFIG in the environment to direct configure to call
-# a specific 'pg_config' binary. If you set it to an empty string, then
-# PostgreSQL support will be explicitly disabled, even if a 'pg_config'
-# binary exists in your PATH. If you leave it unset, then the following
-# line enables the automagic detection that most users want.
-: ${PG_CONFIG=pg_config}
+: "${PKG_CONFIG=pkg-config}"
+
+# You can set PG_CONFIG in the environment to direct configure to call a
+# specific 'pg_config' binary. If you set it to an empty string, then automagic
+# detection of PostgreSQL will be explicitly disabled even if a 'pg_config'
+# binary exists in your PATH. However, fallback detection will still happen.
+# You can disable PostgreSQL support entirely by setting POSTGRES_LDLIBS to an
+# empty string, or you can set POSTGRES_INCLUDE and POSTGRES_LDLIBS (which
+# specify options to pass to the C preprocessor and linker respectively) to
+# attempt to build against a specific PostgreSQL installation. If you leave
+# all three variables unset, then the following line enables the automagic
+# detection that most users want.
+: "${PG_CONFIG=pg_config}"
 
 usage_with_default()
 {
@@ -147,12 +152,12 @@ check_command()
     name="$1"
     shift 1
 
-    echo -n "checking for $name... "
+    printf 'checking for %s... ' "${name}" >&2
     if "$@" >/dev/null 2>&1 </dev/null; then
-	echo 'found'
+	echo 'found' >&2
 	return 0
     fi
-    echo 'not found'
+    echo 'not found' >&2
     return 1
 }
 
@@ -183,10 +188,17 @@ set_defaults()
     # which matters since you might explicitly set of these blank.
     PREFIX=${PREFIX:-/usr/local}
     CC=${CC:-cc}
+    # Always select our C dialect, even when the user sets CPPFLAGS (as many
+    # packaging tools do), unless they chose a -std= option themselves. Put it
+    # first so that a later -std= in CPPFLAGS still wins.
+    case " $CPPFLAGS " in
+	*" -std="*) ;;
+	*) CPPFLAGS="-std=gnu11${CPPFLAGS:+ $CPPFLAGS}";;
+    esac
             # Detect macOS and use appropriate debug flags for libbacktrace compatibility
     if [ "$(uname -s)" = "Darwin" ]; then
         # Always override to avoid DWARF 5
-        CDEBUGFLAGS="-std=gnu11 -g -gdwarf-4 -fno-standalone-debug -fstack-protector-strong"
+        CDEBUGFLAGS="-g -gdwarf-4 -fno-standalone-debug -fstack-protector-strong"
         # Set SDKROOT for macOS
         SDKROOT="$(xcrun --sdk macosx --show-sdk-path)"
 
@@ -195,7 +207,7 @@ set_defaults()
             echo "Warning: dsymutil not found. Install Xcode Command Line Tools for better debug support."
         fi
     else
-        CDEBUGFLAGS=${CDEBUGFLAGS--std=gnu11 -g -fstack-protector-strong}
+        CDEBUGFLAGS=${CDEBUGFLAGS--g -fstack-protector-strong}
     fi
     DEBUGBUILD=${DEBUGBUILD:-0}
     COMPAT=${COMPAT:-1}
@@ -236,7 +248,7 @@ have_function_sections()
     TMPCFILE=$CONFIG_VAR_FILE.$$.c
     TMPOBJFILE=$CONFIG_VAR_FILE.$$.o
     
-    echo "int foo(void); int foo(void) { return 0; }" > $TMPCFILE
+    echo "int main(void); int main(void) { return 0; }" > $TMPCFILE
     # We *want* this to fail if we get a warning, hence use -Werror.
     $1 $2 -Werror -ffunction-sections -Wl,--gc-sections $TMPCFILE -o $TMPOBJFILE
 }
@@ -249,11 +261,14 @@ usage()
     set_defaults
     DEFAULT_COPTFLAGS="$(default_coptflags $DEBUGBUILD)"
     # We assume we have a modern gcc.
-    DEFAULT_CWARNFLAGS="$(default_cwarnflags ""$DEFAULT_COPTFLAGS"" 1 1 ""$DEBUGBUILD"")"
+    DEFAULT_CWARNFLAGS="$(default_cwarnflags "$DEFAULT_COPTFLAGS" 1 1 "$DEBUGBUILD")"
     usage_with_default "CC" "$CC"
     usage_with_default "CWARNFLAGS" "$DEFAULT_CWARNFLAGS"
     usage_with_default "COPTFLAGS" "$DEFAULT_COPTFLAGS"
     usage_with_default "CDEBUGFLAGS" "$CDEBUGFLAGS"
+    usage_with_default "CFLAGS" "$CFLAGS"
+    usage_with_default "CPPFLAGS" "$CPPFLAGS"
+    usage_with_default "LDFLAGS" "$LDFLAGS"
     if [ "$(uname -s)" = "Darwin" ]; then
         echo "    Note: On macOS, -g is used instead of -g3 for libbacktrace compatibility"
     fi
@@ -290,9 +305,9 @@ usage()
 add_var()
 {
     if [ -n "$2" ]; then
-        echo "Setting $1... $2"
+        echo "Setting $1... $2" >&2
     else
-        echo "$1 not found"
+        echo "$1 not found" >&2
     fi
     echo "$1=$2" >> $CONFIG_VAR_FILE.$$
     [ -z "$3" ] || echo "#define $1 $2" >> "$3"
@@ -327,6 +342,9 @@ for opt in "$@"; do
 	CWARNFLAGS=*) CWARNFLAGS="${opt#CWARNFLAGS=}";;
 	CDEBUGFLAGS=*) CDEBUGFLAGS="${opt#CDEBUGFLAGS=}";;
 	COPTFLAGS=*) COPTFLAGS="${opt#COPTFLAGS=}";;
+	CFLAGS=*) CFLAGS="${opt#CFLAGS=}";;
+	CPPFLAGS=*) CPPFLAGS="${opt#CPPFLAGS=}";;
+	LDFLAGS=*) LDFLAGS="${opt#LDFLAGS=}";;
 	PYTEST=*) PYTEST="${opt#PYTEST=}";;
 	--prefix=*) PREFIX="${opt#--prefix=}";;
 	--enable-debugbuild) DEBUGBUILD=1;;
@@ -347,10 +365,10 @@ for opt in "$@"; do
 	--disable-fuzzing) FUZZING=0;;
 	--enable-rust) RUST=1;;
 	--disable-rust) RUST=0;;
-	--help|-h) usage;;
+	--help|-h) usage >&2;;
 	*)
 	    echo "Unknown option '$opt'" >&2
-	    usage
+	    usage >&2
 	    ;;
     esac
 done
@@ -366,7 +384,7 @@ fi
 
 if [ "$ASAN" = "1" ]; then
     if [ "$VALGRIND" = "1" ]; then
-	echo "Address sanitizer (ASAN) and valgrind cannot be enabled at the same time"
+	echo "Address sanitizer (ASAN) and valgrind cannot be enabled at the same time" >&2
 	exit 1
     fi
 
@@ -390,26 +408,28 @@ EOF
 fi
 
 # We call this first, so we can make sure configurator runs with it as a sanity check!
-if have_function_sections $CC "${CWARNFLAGS-$BASE_WARNFLAGS} $CDEBUGFLAGS $COPTFLAGS"; then
-    HAVE_FUNCTION_SECTIONS=1
-    LDFLAGS="-Wl,--gc-sections"
-    COPTFLAGS="$COPTFLAGS -ffunction-sections"
-else
-    HAVE_FUNCTION_SECTIONS=0
-    LDFLAGS=
+if have_function_sections $CC "${CWARNFLAGS-$BASE_WARNFLAGS} $CDEBUGFLAGS $COPTFLAGS $CFLAGS $CPPFLAGS $LDFLAGS"; then
+    case "$LDFLAGS" in
+	*'--gc-sections'*) ;;
+	*) LDFLAGS="-Wl,--gc-sections $LDFLAGS";;
+    esac
+    case " $COPTFLAGS " in
+	*' -ffunction-sections '*) ;;
+	*) COPTFLAGS="$COPTFLAGS -ffunction-sections";;
+    esac
 fi
 
 # We assume warning flags don't affect congfigurator that much!
-echo -n "Compiling $CONFIGURATOR..."
-$CC ${CWARNFLAGS-$BASE_WARNFLAGS} $CDEBUGFLAGS $COPTFLAGS $LDFLAGS -o $CONFIGURATOR $CONFIGURATOR.c
-echo "done"
+printf 'Compiling %s...' "${CONFIGURATOR}" >&2
+$CC ${CWARNFLAGS-$BASE_WARNFLAGS} $CDEBUGFLAGS $COPTFLAGS $CFLAGS $CPPFLAGS $LDFLAGS -o $CONFIGURATOR $CONFIGURATOR.c
+echo "done" >&2
 
 if [ "$CLANG_COVERAGE" = "1" ]; then
 	case "$CC" in
 		(*"clang"*)
 			;;
 		(*)
-			echo "Clang coverage requires building with CC=clang."
+			echo "Clang coverage requires building with CC=clang." >&2
 			exit 1
 			;;
 	esac
@@ -420,32 +440,44 @@ if [ "$FUZZING" = "1" ]; then
 		(*"clang"*)
 			;;
 		(*)
-			echo "Fuzzing is currently only supported with clang."
+			echo "Fuzzing is currently only supported with clang." >&2
 			exit 1
 			;;
 	esac
 fi
 
 
-SQLITE3_CFLAGS=""
-SQLITE3_LDLIBS="-lsqlite3"
-if command -v "${PKG_CONFIG}" >/dev/null; then
-    SQLITE3_CFLAGS="$("${PKG_CONFIG}" --silence-errors --cflags sqlite3 || :)"
-    SQLITE3_LDLIBS="$("${PKG_CONFIG}" --silence-errors --libs sqlite3 || :)"
+# Setting SQLITE3_CFLAGS or SQLITE3_LDLIBS in the environment (even to an empty
+# string) disables automagic detection via pkg-config as well as the fallback
+# default values.
+if [ -z "${SQLITE3_CFLAGS+x}" ] && [ -z "${SQLITE3_LDLIBS+x}" ]; then
+    SQLITE3_LDLIBS="-lsqlite3"
+    if command -v "${PKG_CONFIG}" >/dev/null; then
+	SQLITE3_CFLAGS="$("${PKG_CONFIG}" --silence-errors --cflags sqlite3 || :)"
+	SQLITE3_LDLIBS="$("${PKG_CONFIG}" --silence-errors --libs sqlite3 || :)"
+    fi
 fi
 
-SODIUM_CFLAGS=""
-SODIUM_LDLIBS="-lsodium"
-if command -v "${PKG_CONFIG}" >/dev/null; then
-    SODIUM_CFLAGS="$("${PKG_CONFIG}" --silence-errors --cflags libsodium || :)"
-    SODIUM_LDLIBS="$("${PKG_CONFIG}" --silence-errors --libs libsodium || :)"
+# Setting SODIUM_CFLAGS or SODIUM_LDLIBS in the environment (even to an empty
+# string) disables automagic detection via pkg-config as well as the fallback
+# default values.
+if [ -z "${SODIUM_CFLAGS+x}" ] && [ -z "${SODIUM_LDLIBS+x}" ]; then
+    SODIUM_LDLIBS="-lsodium"
+    if command -v "${PKG_CONFIG}" >/dev/null; then
+	SODIUM_CFLAGS="$("${PKG_CONFIG}" --silence-errors --cflags libsodium || :)"
+	SODIUM_LDLIBS="$("${PKG_CONFIG}" --silence-errors --libs libsodium || :)"
+    fi
 fi
 
-POSTGRES_INCLUDE=""
-POSTGRES_LDLIBS=""
-if command -v "${PG_CONFIG}" >/dev/null; then
-    POSTGRES_INCLUDE="-I$("${PG_CONFIG}" --includedir)"
-    POSTGRES_LDLIBS="-L$("${PG_CONFIG}" --libdir) -lpq"
+# Setting POSTGRES_INCLUDE or POSTGRES_LDLIBS in the environment (even to an
+# empty string) disables automagic detection via pg_config as well as the
+# fallback default values.
+if [ -z "${POSTGRES_INCLUDE+x}" ] && [ -z "${POSTGRES_LDLIBS+x}" ]; then
+    POSTGRES_LDLIBS="-lpq"
+    if command -v "${PG_CONFIG}" >/dev/null; then
+	POSTGRES_INCLUDE="-I$("${PG_CONFIG}" --includedir)"
+	POSTGRES_LDLIBS="-L$("${PG_CONFIG}" --libdir) -lpq"
+    fi
 fi
 
 # Clean up on exit.
@@ -455,7 +487,7 @@ CONFIGURATOR_PATH_FLAGS=
 [ -z "$CPATH" ] || CONFIGURATOR_PATH_FLAGS="$CONFIGURATOR_PATH_FLAGS -I$CPATH"
 [ -z "$LIBRARY_PATH" ] || CONFIGURATOR_PATH_FLAGS="$CONFIGURATOR_PATH_FLAGS -L$LIBRARY_PATH"
 
-$CONFIGURATOR --extra-tests --autotools-style --var-file=$CONFIG_VAR_FILE.$$ --header-file=$CONFIG_HEADER.$$ --configurator-cc="$CONFIGURATOR_CC" --wrapper="$CONFIGURATOR_WRAPPER" "$CC" ${CWARNFLAGS-$BASE_WARNFLAGS} $CDEBUGFLAGS $COPTFLAGS $CSANFLAGS $CONFIGURATOR_PATH_FLAGS $SQLITE3_CFLAGS $SODIUM_CFLAGS $POSTGRES_INCLUDE <<EOF
+$CONFIGURATOR --extra-tests --autotools-style --var-file=$CONFIG_VAR_FILE.$$ --header-file=$CONFIG_HEADER.$$ --configurator-cc="$CONFIGURATOR_CC" --wrapper="$CONFIGURATOR_WRAPPER" "$CC" ${CWARNFLAGS-$BASE_WARNFLAGS} $CDEBUGFLAGS $COPTFLAGS $CSANFLAGS $SQLITE3_CFLAGS $SODIUM_CFLAGS $CFLAGS $CONFIGURATOR_PATH_FLAGS $POSTGRES_INCLUDE $CPPFLAGS $LDFLAGS <<EOF
 
 var=HAVE_ZLIB
 desc=zlib support
@@ -633,6 +665,9 @@ add_var CONFIGURATOR_CC "$CONFIGURATOR_CC"
 add_var CWARNFLAGS "$CWARNFLAGS"
 add_var CDEBUGFLAGS "$CDEBUGFLAGS"
 add_var COPTFLAGS "$COPTFLAGS"
+add_var CFLAGS "$CFLAGS"
+add_var CPPFLAGS "$CPPFLAGS"
+add_var LDFLAGS "$LDFLAGS"
 if [ -n "${SDKROOT:-}" ]; then
     add_var SDKROOT "$SDKROOT"
 fi
@@ -660,7 +695,6 @@ add_var FUZZING "$FUZZING"
 add_var RUST "$RUST"
 add_var PYTHON "$PYTHON"
 add_var SED "$SED"
-add_var HAVE_FUNCTION_SECTIONS "$HAVE_FUNCTION_SECTIONS"
 
 # Hack to avoid sha256 name clash with libwally: will be fixed when that
 # becomes a standalone shared lib.
diff --git a/lightningd/test/run-close_tx_check.c b/lightningd/test/run-close_tx_check.c
index 9b132647bc64..2ef9ff64551a 100644
--- a/lightningd/test/run-close_tx_check.c
+++ b/lightningd/test/run-close_tx_check.c
@@ -2,7 +2,7 @@
 #include "../simple_close_control.c"
 #include <common/close_tx.h>
 #include <common/setup.h>
-#include <external/libwally-core/include/wally_script.h>
+#include <wally_script.h>
 #include <stdio.h>
 
 /* AUTOGENERATED MOCKS START */
diff --git a/tools/Makefile b/tools/Makefile
index 2d86221df962..db3437db739f 100644
--- a/tools/Makefile
+++ b/tools/Makefile
@@ -11,13 +11,13 @@ ALL_PROGRAMS += $(TOOLS)
 # We force make to relink this every time, to detect version changes.
 # Do it atomically, otherwise parallel builds can get upset!
 tools/headerversions: $(FORCE) tools/headerversions.o libccan.a
-	@trap "rm -f $@.tmp.$$$$" EXIT; $(LINK.o) tools/headerversions.o libccan.a $(LOADLIBES) $(LDLIBS) -o $@.tmp.$$$$ && mv -f $@.tmp.$$$$ $@
+	@trap "rm -f $@.tmp.$$$$" EXIT; $(LINK.c) tools/headerversions.o libccan.a $(LOADLIBES) $(LDLIBS) -o $@.tmp.$$$$ && mv -f $@.tmp.$$$$ $@
 
 $(TOOLS): libcommon.a
 
 tools/headerversions.o: ccan/config.h
 tools/lightning-hsmtool: tools/lightning-hsmtool.o
-tools/lightning-downgrade.o: CFLAGS:=$(CFLAGS) -DCLN_PREV_VERSION=$(CLN_PREV_VERSION)
+tools/lightning-downgrade.o: CPPFLAGS += -DCLN_PREV_VERSION=$(CLN_PREV_VERSION)
 
 tools/lightning-downgrade:			\
 	db/exec.o				\
diff --git a/tools/update-mocks.sh b/tools/update-mocks.sh
index 40428cb0d0d6..60449536f0f9 100755
--- a/tools/update-mocks.sh
+++ b/tools/update-mocks.sh
@@ -13,8 +13,12 @@ START=$(grep -F -n '/* AUTOGENERATED MOCKS START */' "$FILE" | cut -d: -f1)
 END=$(grep -F -n '/* AUTOGENERATED MOCKS END */' "$FILE" | cut -d: -f1)
 
 function make_binary() {
+    local LDFLAGS
+    # Do not combine the following assignment with the preceding declaration, as that breaks the error logic.
+    LDFLAGS="$(sed -Ene 's/^LDFLAGS=(.*)$/\1/p' config.vars)" || exit
+    LDFLAGS+="${LDFLAGS:+ }-Wl,--no-gc-sections${*:+ $*}"
     # Make sure we don't optimize out options, and we use debug build
-    $MAKE SUPPRESS_GENERATION=1 "${FILE/%.c/}" DEBUGBUILD=1 COPTFLAGS="" HAVE_FUNCTION_SECTIONS=0 2> "${BASE}.err" >/dev/null
+    $MAKE SUPPRESS_GENERATION=1 "${FILE/%.c/}" DEBUGBUILD=1 COPTFLAGS= LDFLAGS="${LDFLAGS}" 2>"${BASE}.err" >/dev/null
 }
 
 if [ -n "$START" ]; then
@@ -29,7 +33,7 @@ if [ -n "$START" ]; then
 	# this in the output:
 	# ld: error: too many errors emitted, stopping now (use -error-limit=0 to see all errors)
 	if grep -q 'too many errors emitted.*-error-limit=0' "${BASE}.err"; then
-	    LDFLAGS=-Wl,-error-limit=0 make_binary || :
+	    make_binary -Wl,-error-limit=0 || :
 	fi
 	tools/mockup.sh "$FILE" < "${BASE}.err" >> "${BASE}.stubs"
 	# If there are no link errors, maybe compile fail for other reason?