diff --git a/pkgs/applications/networking/browsers/chromium/default.nix b/pkgs/applications/networking/browsers/chromium/default.nix
index c0c5e485e59c..bf870e144e56 100644
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@@ -64,17 +64,20 @@ let
 in stdenv.mkDerivation {
   name = "chromium${suffix}-${chromium.browser.version}";
 
-  buildInputs = [ makeWrapper ];
+  buildInputs = [ makeWrapper ] ++ chromium.plugins.enabledPlugins;
 
   buildCommand = let
     browserBinary = "${chromium.browser}/libexec/chromium/chromium";
-    getWrapperFlags = plugin: "$(< \"${plugin}/nix-support/wrapper-flags\")";
+    mkEnvVar = key: val: "--set '${key}' '${val}'";
+    envVars = chromium.plugins.settings.envVars or {};
+    flags = chromium.plugins.settings.flags or [];
   in with stdenv.lib; ''
     mkdir -p "$out/bin" "$out/share/applications"
 
     ln -s "${chromium.browser}/share" "$out/share"
-    eval makeWrapper "${browserBinary}" "$out/bin/chromium" \
-      ${concatMapStringsSep " " getWrapperFlags chromium.plugins.enabled}
+    makeWrapper "${browserBinary}" "$out/bin/chromium" \
+      ${concatStrings (mapAttrsToList mkEnvVar envVars)} \
+      --add-flags "${concatStringsSep " " flags}"
 
     ln -s "$out/bin/chromium" "$out/bin/chromium-browser"
     ln -s "${chromium.browser}/share/icons" "$out/share/icons"
diff --git a/pkgs/applications/networking/browsers/chromium/plugins.nix b/pkgs/applications/networking/browsers/chromium/plugins.nix
index dda976905610..0b0e5bd08382 100644
--- a/pkgs/applications/networking/browsers/chromium/plugins.nix
+++ b/pkgs/applications/networking/browsers/chromium/plugins.nix
@@ -8,34 +8,6 @@
 with stdenv.lib;
 
 let
-  # Generate a shell fragment that emits flags appended to the
-  # final makeWrapper call for wrapping the browser's main binary.
-  #
-  # Note that this is shell-escaped so that only the variable specified
-  # by the "output" attribute is substituted.
-  mkPluginInfo = { output ? "out", allowedVars ? [ output ]
-                 , flags ? [], envVars ? {}
-                 }: let
-    shSearch = ["'"] ++ map (var: "\$${var}") allowedVars;
-    shReplace = ["'\\''"] ++ map (var: "'\"\${${var}}\"'") allowedVars;
-    # We need to triple-escape "val":
-    #  * First because makeWrapper doesn't do any quoting of its arguments by
-    #    itself.
-    #  * Second because it's passed to the makeWrapper call separated by IFS but
-    #    not by the _real_ arguments, for example the Widevine plugin flags
-    #    contain spaces, so they would end up as separate arguments.
-    #  * Third in order to be correctly quoted for the "echo" call below.
-    shEsc = val: "'${replaceStrings ["'"] ["'\\''"] val}'";
-    mkSh = val: "'${replaceStrings shSearch shReplace (shEsc val)}'";
-    mkFlag = flag: ["--add-flags" (shEsc flag)];
-    mkEnvVar = key: val: ["--set" (shEsc key) (shEsc val)];
-    envList = mapAttrsToList mkEnvVar envVars;
-    quoted = map mkSh (flatten ((map mkFlag flags) ++ envList));
-  in ''
-    mkdir -p "''$${output}/nix-support"
-    echo ${toString quoted} > "''$${output}/nix-support/wrapper-flags"
-  '';
-
   plugins = stdenv.mkDerivation {
     name = "chromium-binary-plugins";
 
@@ -89,29 +61,40 @@ let
 
       install -vD PepperFlash/libpepflashplayer.so \
         "$flash/lib/libpepflashplayer.so"
-
-      ${mkPluginInfo {
-        output = "flash";
-        allowedVars = [ "flash" "flashVersion" ];
-        flags = [
-          "--ppapi-flash-path=$flash/lib/libpepflashplayer.so"
-          "--ppapi-flash-version=$flashVersion"
-        ];
-      }}
+      mkdir -p "$flash/nix-support"
+      cat > "$flash/nix-support/chromium-plugin.nix" <<NIXOUT
+        { flags = [
+            "--ppapi-flash-path='$flash/lib/libpepflashplayer.so'"
+            "--ppapi-flash-version=$flashVersion"
+          ];
+        }
+      NIXOUT
 
       install -vD libwidevinecdm.so \
         "$widevine/lib/libwidevinecdm.so"
       install -vD libwidevinecdmadapter.so \
         "$widevine/lib/libwidevinecdmadapter.so"
-
-      ${mkPluginInfo {
-        output = "widevine";
-        flags = [ "--register-pepper-plugins=${wvModule}${wvInfo}" ];
-        envVars.NIX_CHROMIUM_PLUGIN_PATH_WIDEVINE = "$widevine/lib";
-      }}
+      mkdir -p "$widevine/nix-support"
+      cat > "$widevine/nix-support/chromium-plugin.nix" <<NIXOUT
+        { flags = [ "--register-pepper-plugins='${wvModule}${wvInfo}'" ];
+          envVars.NIX_CHROMIUM_PLUGIN_PATH_WIDEVINE = "$widevine/lib";
+        }
+      NIXOUT
     '';
 
-    passthru.enabled = optional enablePepperFlash plugins.flash
+    passthru = let
+      enabledPlugins = optional enablePepperFlash plugins.flash
                     ++ optional enableWideVine    plugins.widevine;
+      getNix = plugin: import "${plugin}/nix-support/chromium-plugin.nix";
+      mergeAttrsets = let
+        f = v: if all isAttrs v then mergeAttrsets v
+          else if all isList  v then concatLists   v
+          else if tail v == []  then head          v
+          else head (tail v);
+      in fold (l: r: zipAttrsWith (_: f) [ l r ]) {};
+    in {
+      inherit enabledPlugins;
+      settings = mergeAttrsets (map getNix enabledPlugins);
+    };
   };
 in plugins