diff --git a/tests/functional/add.sh b/tests/functional/add.sh
index 328b14831..3b37ee7d4 100755
--- a/tests/functional/add.sh
+++ b/tests/functional/add.sh
@@ -31,9 +31,7 @@ test "$hash1" = "sha256:$hash2"
 
 #### New style commands
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 (
     path1=$(nix store add ./dummy)
diff --git a/tests/functional/binary-cache-build-remote.sh b/tests/functional/binary-cache-build-remote.sh
index 17e8bdcc1..5046d0064 100755
--- a/tests/functional/binary-cache-build-remote.sh
+++ b/tests/functional/binary-cache-build-remote.sh
@@ -4,7 +4,7 @@ source common.sh
 
 TODO_NixOS
 
-clearStore
+clearStoreIfPossible
 clearCacheCache
 
 # Fails without remote builders
diff --git a/tests/functional/build-delete.sh b/tests/functional/build-delete.sh
index 2ebf1fd3d..18841509d 100755
--- a/tests/functional/build-delete.sh
+++ b/tests/functional/build-delete.sh
@@ -2,9 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 # https://github.com/NixOS/nix/issues/6572
 issue_6572_independent_outputs() {
diff --git a/tests/functional/build.sh b/tests/functional/build.sh
index db759b6e9..9de953d8c 100755
--- a/tests/functional/build.sh
+++ b/tests/functional/build.sh
@@ -2,9 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 # Make sure that 'nix build' returns all outputs by default.
 nix build -f multiple-outputs.nix --json a b --no-link | jq --exit-status '
diff --git a/tests/functional/check-refs.sh b/tests/functional/check-refs.sh
index 26790c11b..5c3ac915e 100755
--- a/tests/functional/check-refs.sh
+++ b/tests/functional/check-refs.sh
@@ -45,13 +45,18 @@ nix-build -o "$RESULT" check-refs.nix -A test7
 # test10 should succeed (no disallowed references).
 nix-build -o "$RESULT" check-refs.nix -A test10
 
-if isDaemonNewer 2.12pre20230103; then
-    if ! isDaemonNewer 2.16.0; then
-        enableFeatures discard-references
-        restartDaemon
+if ! isTestOnNixOS; then
+    # If we have full control over our store, we can test some more things.
+
+    if isDaemonNewer 2.12pre20230103; then
+        if ! isDaemonNewer 2.16.0; then
+            enableFeatures discard-references
+            restartDaemon
+        fi
+
+        # test11 should succeed.
+        test11=$(nix-build -o "$RESULT" check-refs.nix -A test11)
+        [[ -z $(nix-store -q --references "$test11") ]]
     fi
 
-    # test11 should succeed.
-    test11=$(nix-build -o "$RESULT" check-refs.nix -A test11)
-    [[ -z $(nix-store -q --references "$test11") ]]
 fi
diff --git a/tests/functional/check-reqs.sh b/tests/functional/check-reqs.sh
index bb91bacde..34eb133db 100755
--- a/tests/functional/check-reqs.sh
+++ b/tests/functional/check-reqs.sh
@@ -2,9 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 RESULT=$TEST_ROOT/result
 
diff --git a/tests/functional/common/vars-and-functions.sh b/tests/functional/common/vars-and-functions.sh
index 4b0fee5b2..8237d853f 100644
--- a/tests/functional/common/vars-and-functions.sh
+++ b/tests/functional/common/vars-and-functions.sh
@@ -82,11 +82,25 @@ clearProfiles() {
     rm -rf "$profiles"
 }
 
+# Clear the store, but do not fail if we're in an environment where we can't.
+# This allows the test to run in a NixOS test environment, where we use the system store.
+# See doc/manual/src/contributing/testing.md / Running functional tests on NixOS.
+clearStoreIfPossible() {
+    if isTestOnNixOS; then
+        echo "clearStoreIfPossible: Not clearing store, because we're on NixOS. Moving on."
+    else
+        doClearStore
+    fi
+}
+
 clearStore() {
     if isTestOnNixOS; then
-      die "clearStore: not supported when testing on NixOS. Is it really needed? If so add conditionals; e.g. if ! isTestOnNixOS; then ..."
+      die "clearStore: not supported when testing on NixOS. If not essential, call clearStoreIfPossible. If really needed, add conditionals; e.g. if ! isTestOnNixOS; then ..."
     fi
+    doClearStore
+}
 
+doClearStore() {
     echo "clearing store..."
     chmod -R +w "$NIX_STORE_DIR"
     rm -rf "$NIX_STORE_DIR"
diff --git a/tests/functional/compression-levels.sh b/tests/functional/compression-levels.sh
index f51c3f509..399265f9c 100755
--- a/tests/functional/compression-levels.sh
+++ b/tests/functional/compression-levels.sh
@@ -2,9 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 clearCache
 
 outPath=$(nix-build dependencies.nix --no-out-link)
diff --git a/tests/functional/debugger.sh b/tests/functional/debugger.sh
index 178822d79..b96b7e5d3 100755
--- a/tests/functional/debugger.sh
+++ b/tests/functional/debugger.sh
@@ -2,9 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 # regression #9932
 echo ":env" | expect 1 nix eval --debugger --expr '(_: throw "oh snap") 42'
diff --git a/tests/functional/dependencies.sh b/tests/functional/dependencies.sh
index bb01b3988..972bc5a9b 100755
--- a/tests/functional/dependencies.sh
+++ b/tests/functional/dependencies.sh
@@ -2,9 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 drvPath=$(nix-instantiate dependencies.nix)
 
@@ -67,6 +65,8 @@ drvPath2=$(nix-instantiate dependencies.nix --argstr hashInvalidator yay)
 # now --valid-derivers returns both
 test "$(nix-store -q --valid-derivers "$outPath" | sort)" = "$(sort <<< "$drvPath"$'\n'"$drvPath2")"
 
+TODO_NixOS # The following --delete fails, because it seems to be still alive. This might be caused by a different test using the same path. We should try make the derivations unique, e.g. naming after tests, and adding a timestamp that's constant for that test script run.
+
 # check that nix-store --valid-derivers only returns existing drv
 nix-store --delete "$drvPath"
 test "$(nix-store -q --valid-derivers "$outPath")" = "$drvPath2"
diff --git a/tests/functional/eval.sh b/tests/functional/eval.sh
index ba335d73a..27cdce478 100755
--- a/tests/functional/eval.sh
+++ b/tests/functional/eval.sh
@@ -2,9 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 testStdinHeredoc=$(nix eval -f - <<EOF
 {
diff --git a/tests/functional/fetchGit.sh b/tests/functional/fetchGit.sh
index 130b620bf..78925b5cd 100755
--- a/tests/functional/fetchGit.sh
+++ b/tests/functional/fetchGit.sh
@@ -4,9 +4,7 @@ source common.sh
 
 requireGit
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 # Intentionally not in a canonical form
 # See https://github.com/NixOS/nix/issues/6195
diff --git a/tests/functional/fetchGitRefs.sh b/tests/functional/fetchGitRefs.sh
index 6d1f67e48..ee054fabc 100755
--- a/tests/functional/fetchGitRefs.sh
+++ b/tests/functional/fetchGitRefs.sh
@@ -4,9 +4,7 @@ source common.sh
 
 requireGit
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 repo="$TEST_ROOT/git"
 
diff --git a/tests/functional/fetchGitSubmodules.sh b/tests/functional/fetchGitSubmodules.sh
index 3726ee689..4a3e4c347 100755
--- a/tests/functional/fetchGitSubmodules.sh
+++ b/tests/functional/fetchGitSubmodules.sh
@@ -6,9 +6,7 @@ set -u
 
 requireGit
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 rootRepo=$TEST_ROOT/gitSubmodulesRoot
 subRepo=$TEST_ROOT/gitSubmodulesSub
diff --git a/tests/functional/fetchGitVerification.sh b/tests/functional/fetchGitVerification.sh
index 57a317bcd..4012d8229 100755
--- a/tests/functional/fetchGitVerification.sh
+++ b/tests/functional/fetchGitVerification.sh
@@ -7,9 +7,7 @@ requireGit
 
 enableFeatures "verified-fetches"
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 repo="$TEST_ROOT/git"
 
diff --git a/tests/functional/flakes/search-root.sh b/tests/functional/flakes/search-root.sh
index c61ae3bfa..1ee29fac4 100755
--- a/tests/functional/flakes/search-root.sh
+++ b/tests/functional/flakes/search-root.sh
@@ -2,9 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 writeSimpleFlake "$TEST_HOME"
 cd "$TEST_HOME"
diff --git a/tests/functional/fmt.sh b/tests/functional/fmt.sh
index 114aba396..b29fe64d6 100755
--- a/tests/functional/fmt.sh
+++ b/tests/functional/fmt.sh
@@ -2,9 +2,9 @@
 
 source common.sh
 
-TODO_NixOS
+TODO_NixOS # Provide a `shell` variable. Try not to `export` it, perhaps.
 
-clearStore
+clearStoreIfPossible
 rm -rf $TEST_HOME/.cache $TEST_HOME/.config $TEST_HOME/.local
 
 cp ./simple.nix ./simple.builder.sh ./fmt.simple.sh ./config.nix $TEST_HOME
@@ -33,5 +33,3 @@ EOF
 nix fmt ./file ./folder | grep 'Formatting: ./file ./folder'
 nix flake check
 nix flake show | grep -P "package 'formatter'"
-
-clearStore
diff --git a/tests/functional/git-hashing/common.sh b/tests/functional/git-hashing/common.sh
index 639da16ce..29c518fea 100644
--- a/tests/functional/git-hashing/common.sh
+++ b/tests/functional/git-hashing/common.sh
@@ -1,6 +1,6 @@
 source ../common.sh
 
-TODO_NixOS
+TODO_NixOS # Need to enable git hashing feature and make sure test is ok for store we don't clear
 
 clearStore
 clearCache
diff --git a/tests/functional/help.sh b/tests/functional/help.sh
index 1bb8e9f9f..61efc1cb2 100755
--- a/tests/functional/help.sh
+++ b/tests/functional/help.sh
@@ -2,10 +2,6 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
-
 # test help output
 
 nix-build --help
diff --git a/tests/functional/import-derivation.sh b/tests/functional/import-derivation.sh
index be28b1604..68ddcfa4a 100755
--- a/tests/functional/import-derivation.sh
+++ b/tests/functional/import-derivation.sh
@@ -2,9 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 if nix-instantiate --readonly-mode ./import-derivation.nix; then
     echo "read-only evaluation of an imported derivation unexpectedly failed"
diff --git a/tests/functional/impure-derivations.sh b/tests/functional/impure-derivations.sh
index 475dba732..5dea220fe 100755
--- a/tests/functional/impure-derivations.sh
+++ b/tests/functional/impure-derivations.sh
@@ -9,7 +9,7 @@ TODO_NixOS
 enableFeatures "ca-derivations impure-derivations"
 restartDaemon
 
-clearStore
+clearStoreIfPossible
 
 # Basic test of impure derivations: building one a second time should not use the previous result.
 printf 0 > $TEST_ROOT/counter
diff --git a/tests/functional/multiple-outputs.sh b/tests/functional/multiple-outputs.sh
index c4af56f0b..35a78d152 100755
--- a/tests/functional/multiple-outputs.sh
+++ b/tests/functional/multiple-outputs.sh
@@ -4,7 +4,7 @@ source common.sh
 
 TODO_NixOS
 
-clearStore
+clearStoreIfPossible
 
 rm -f $TEST_ROOT/result*
 
diff --git a/tests/functional/nix-build.sh b/tests/functional/nix-build.sh
index cfba7f020..091e429e0 100755
--- a/tests/functional/nix-build.sh
+++ b/tests/functional/nix-build.sh
@@ -4,7 +4,7 @@ source common.sh
 
 TODO_NixOS
 
-clearStore
+clearStoreIfPossible
 
 outPath=$(nix-build dependencies.nix -o $TEST_ROOT/result)
 test "$(cat $TEST_ROOT/result/foobar)" = FOOBAR
diff --git a/tests/functional/nix-shell.sh b/tests/functional/nix-shell.sh
index 66aece388..2c94705de 100755
--- a/tests/functional/nix-shell.sh
+++ b/tests/functional/nix-shell.sh
@@ -2,9 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 if [[ -n ${CONTENT_ADDRESSED:-} ]]; then
     shellDotNix="$PWD/ca-shell.nix"
diff --git a/tests/functional/optimise-store.sh b/tests/functional/optimise-store.sh
index f010c5549..0bedafc43 100755
--- a/tests/functional/optimise-store.sh
+++ b/tests/functional/optimise-store.sh
@@ -2,13 +2,14 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 outPath1=$(echo 'with import ./config.nix; mkDerivation { name = "foo1"; builder = builtins.toFile "builder" "mkdir $out; echo hello > $out/foo"; }' | nix-build - --no-out-link --auto-optimise-store)
 outPath2=$(echo 'with import ./config.nix; mkDerivation { name = "foo2"; builder = builtins.toFile "builder" "mkdir $out; echo hello > $out/foo"; }' | nix-build - --no-out-link --auto-optimise-store)
 
+TODO_NixOS # ignoring the client-specified setting 'auto-optimise-store', because it is a restricted setting and you are not a trusted user
+  # TODO: only continue when trusted user or root
+
 inode1="$(stat --format=%i $outPath1/foo)"
 inode2="$(stat --format=%i $outPath2/foo)"
 if [ "$inode1" != "$inode2" ]; then
diff --git a/tests/functional/pass-as-file.sh b/tests/functional/pass-as-file.sh
index 0b5605d05..6487bfffd 100755
--- a/tests/functional/pass-as-file.sh
+++ b/tests/functional/pass-as-file.sh
@@ -2,9 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 outPath=$(nix-build --no-out-link -E "
 with import ./config.nix;
diff --git a/tests/functional/placeholders.sh b/tests/functional/placeholders.sh
index d4e09a91b..33ec0c2b7 100755
--- a/tests/functional/placeholders.sh
+++ b/tests/functional/placeholders.sh
@@ -2,9 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 nix-build --no-out-link -E '
   with import ./config.nix;
diff --git a/tests/functional/pure-eval.sh b/tests/functional/pure-eval.sh
index 8a18dec6e..250381099 100755
--- a/tests/functional/pure-eval.sh
+++ b/tests/functional/pure-eval.sh
@@ -2,9 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 nix eval --expr 'assert 1 + 2 == 3; true'
 
diff --git a/tests/functional/readfile-context.sh b/tests/functional/readfile-context.sh
index 0ef549c8d..cb9ef6234 100755
--- a/tests/functional/readfile-context.sh
+++ b/tests/functional/readfile-context.sh
@@ -2,7 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
+TODO_NixOS # NixOS doesn't provide $NIX_STATE_DIR (and shouldn't)
 
 clearStore
 
diff --git a/tests/functional/recursive.sh b/tests/functional/recursive.sh
index 6b255e81a..640fb92d2 100755
--- a/tests/functional/recursive.sh
+++ b/tests/functional/recursive.sh
@@ -2,7 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
+TODO_NixOS # can't enable a sandbox feature easily
 
 enableFeatures 'recursive-nix'
 restartDaemon
diff --git a/tests/functional/restricted.sh b/tests/functional/restricted.sh
index 917a554c5..915d973b0 100755
--- a/tests/functional/restricted.sh
+++ b/tests/functional/restricted.sh
@@ -2,9 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 nix-instantiate --restrict-eval --eval -E '1 + 2'
 (! nix-instantiate --eval --restrict-eval ./restricted.nix)
diff --git a/tests/functional/search.sh b/tests/functional/search.sh
index 1195c2a06..3fadecd02 100755
--- a/tests/functional/search.sh
+++ b/tests/functional/search.sh
@@ -2,9 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 clearCache
 
 (( $(nix search -f search.nix '' hello | wc -l) > 0 ))
diff --git a/tests/functional/selfref-gc.sh b/tests/functional/selfref-gc.sh
index a5e368b51..518aea66b 100755
--- a/tests/functional/selfref-gc.sh
+++ b/tests/functional/selfref-gc.sh
@@ -4,9 +4,7 @@ source common.sh
 
 requireDaemonNewerThan "2.6.0pre20211215"
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 nix-build --no-out-link -E '
   with import ./config.nix;
diff --git a/tests/functional/signing.sh b/tests/functional/signing.sh
index d268fd116..890d1446f 100755
--- a/tests/functional/signing.sh
+++ b/tests/functional/signing.sh
@@ -2,9 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 clearCache
 
 nix-store --generate-binary-cache-key cache1.example.org $TEST_ROOT/sk1 $TEST_ROOT/pk1
@@ -18,6 +16,7 @@ outPath=$(nix-build dependencies.nix --no-out-link --secret-key-files "$TEST_ROO
 # Verify that the path got signed.
 info=$(nix path-info --json $outPath)
 echo $info | jq -e '.[] | .ultimate == true'
+TODO_NixOS # looks like an actual bug? Following line fails on NixOS:
 echo $info | jq -e '.[] | .signatures.[] | select(startswith("cache1.example.org"))'
 echo $info | jq -e '.[] | .signatures.[] | select(startswith("cache2.example.org"))'
 
diff --git a/tests/functional/structured-attrs.sh b/tests/functional/structured-attrs.sh
index 32d4c9957..ec1282668 100755
--- a/tests/functional/structured-attrs.sh
+++ b/tests/functional/structured-attrs.sh
@@ -6,9 +6,7 @@ source common.sh
 # tests for the older versions
 requireDaemonNewerThan "2.4pre20210712"
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 rm -f $TEST_ROOT/result
 
@@ -23,6 +21,8 @@ env NIX_PATH=nixpkgs=shell.nix nix-shell structured-attrs-shell.nix \
 
 nix develop -f structured-attrs-shell.nix -c bash -c 'test "3" = "$(jq ".my.list|length" < $NIX_ATTRS_JSON_FILE)"'
 
+TODO_NixOS # following line fails.
+
 # `nix develop` is a slightly special way of dealing with environment vars, it parses
 # these from a shell-file exported from a derivation. This is to test especially `outputs`
 # (which is an associative array in thsi case) being fine.
diff --git a/tests/functional/suggestions.sh b/tests/functional/suggestions.sh
index 1140e4f78..8db6f7b97 100755
--- a/tests/functional/suggestions.sh
+++ b/tests/functional/suggestions.sh
@@ -2,9 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 cd "$TEST_HOME"
 
diff --git a/tests/functional/tarball.sh b/tests/functional/tarball.sh
index eb541f3bb..a2824cd12 100755
--- a/tests/functional/tarball.sh
+++ b/tests/functional/tarball.sh
@@ -2,9 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 rm -rf $TEST_HOME
 
diff --git a/tests/functional/why-depends.sh b/tests/functional/why-depends.sh
index 1ce66f154..ce53546d8 100755
--- a/tests/functional/why-depends.sh
+++ b/tests/functional/why-depends.sh
@@ -2,9 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 cp ./dependencies.nix ./dependencies.builder0.sh ./config.nix $TEST_HOME