diff --git a/pkgs/applications/misc/hello/default.nix b/pkgs/applications/misc/hello/default.nix
index b446fe6223df..9f1e89c0df6b 100644
--- a/pkgs/applications/misc/hello/default.nix
+++ b/pkgs/applications/misc/hello/default.nix
@@ -1,7 +1,9 @@
 { lib
 , stdenv
 , fetchurl
+, nixos
 , testVersion
+, testEqualDerivation
 , hello
 }:
 
@@ -16,8 +18,15 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  passthru.tests.version =
-    testVersion { package = hello; };
+  passthru.tests = {
+    version = testVersion { package = hello; };
+
+    invariant-under-noXlibs =
+      testEqualDerivation
+        "hello must not be rebuilt when environment.noXlibs is set."
+        hello
+        (nixos { environment.noXlibs = true; }).pkgs.hello;
+  };
 
   meta = with lib; {
     description = "A program that produces a familiar, friendly greeting";
diff --git a/pkgs/build-support/test-equal-derivation.nix b/pkgs/build-support/test-equal-derivation.nix
new file mode 100644
index 000000000000..5d2185ce1652
--- /dev/null
+++ b/pkgs/build-support/test-equal-derivation.nix
@@ -0,0 +1,43 @@
+{ lib, runCommand, emptyFile, nix-diff }:
+
+/*
+  Checks that two packages produce the exact same build instructions.
+
+  This can be used to make sure that a certain difference of configuration,
+  such as the presence of an overlay does not cause a cache miss.
+
+  When the derivations are equal, the return value is an empty file.
+  Otherwise, the build log explains the difference via `nix-diff`.
+
+  Example:
+
+      testEqualDerivation
+        "The hello package must stay the same when enabling checks."
+        hello
+        (hello.overrideAttrs(o: { doCheck = true; }))
+
+*/
+assertion: a: b:
+let
+  drvA = builtins.unsafeDiscardOutputDependency a.drvPath or (throw "testEqualDerivation second argument must be a package");
+  drvB = builtins.unsafeDiscardOutputDependency b.drvPath or (throw "testEqualDerivation third argument must be a package");
+  name =
+    if a?name
+    then lib.strings.sanitizeDerivationName "testEqualDerivation-${a.name}"
+    else "testEqualDerivation";
+in
+if drvA == drvB then
+  emptyFile
+else
+  runCommand name
+    {
+      inherit assertion drvA drvB;
+      nativeBuildInputs = [ nix-diff ];
+    } ''
+      echo "$assertion"
+      echo "However, the derivations differ:"
+      echo
+      echo nix-diff $drvA $drvB
+      nix-diff $drvA $drvB
+      exit 1
+    ''
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3978163a631e..74e4f74822e4 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10136,6 +10136,8 @@ with pkgs;
 
   termplay = callPackage ../tools/misc/termplay { };
 
+  testEqualDerivation = callPackage ../build-support/test-equal-derivation.nix { };
+
   tetrd = callPackage ../applications/networking/tetrd { };
 
   tewisay = callPackage ../tools/misc/tewisay { };