diff --git a/nix-meson-build-support/common/meson.build b/nix-meson-build-support/common/meson.build
index 179268d80..b9140256a 100644
--- a/nix-meson-build-support/common/meson.build
+++ b/nix-meson-build-support/common/meson.build
@@ -10,6 +10,7 @@ add_project_arguments(
   '-Werror=suggest-override',
   '-Werror=switch',
   '-Werror=switch-enum',
+  '-Werror=undef',
   '-Werror=unused-result',
   '-Werror=sign-compare',
   '-Wignored-qualifiers',
diff --git a/src/build-remote/build-remote.cc b/src/build-remote/build-remote.cc
index b4eaa389b..60247b735 100644
--- a/src/build-remote/build-remote.cc
+++ b/src/build-remote/build-remote.cc
@@ -5,7 +5,7 @@
 #include <memory>
 #include <tuple>
 #include <iomanip>
-#if __APPLE__
+#ifdef __APPLE__
 #include <sys/time.h>
 #endif
 
@@ -225,7 +225,7 @@ static int main_build_remote(int argc, char * * argv)
                     break;
                 }
 
-#if __APPLE__
+#ifdef __APPLE__
                 futimes(bestSlotLock.get(), NULL);
 #else
                 futimens(bestSlotLock.get(), NULL);
diff --git a/src/libexpr-tests/main.cc b/src/libexpr-tests/main.cc
index 6fdaa9178..66afc2272 100644
--- a/src/libexpr-tests/main.cc
+++ b/src/libexpr-tests/main.cc
@@ -27,7 +27,7 @@ int main (int argc, char **argv) {
     settings.sandboxBuildDir = "/test-build-dir-instead-of-usual-build-dir";
     #endif
 
-    #if __APPLE__
+    #ifdef __APPLE__
     // Avoid this error, when already running in a sandbox:
     // sandbox-exec: sandbox_apply: Operation not permitted
     settings.sandboxMode = smDisabled;
diff --git a/src/libexpr/eval-gc.cc b/src/libexpr/eval-gc.cc
index 6fc5ac334..bec668001 100644
--- a/src/libexpr/eval-gc.cc
+++ b/src/libexpr/eval-gc.cc
@@ -10,7 +10,7 @@
 #if NIX_USE_BOEHMGC
 
 #  include <pthread.h>
-#  if __FreeBSD__
+#  ifdef __FreeBSD__
 #    include <pthread_np.h>
 #  endif
 
diff --git a/src/libmain/shared.cc b/src/libmain/shared.cc
index 65bfcfbd5..7ff93f6d9 100644
--- a/src/libmain/shared.cc
+++ b/src/libmain/shared.cc
@@ -26,7 +26,7 @@
 #include "nix/util/strings.hh"
 
 #include "main-config-private.hh"
-
+#include "nix/expr/config.hh"
 
 namespace nix {
 
@@ -144,7 +144,7 @@ void initNix(bool loadConfig)
     if (sigaction(SIGUSR1, &act, 0)) throw SysError("handling SIGUSR1");
 #endif
 
-#if __APPLE__
+#ifdef __APPLE__
     /* HACK: on darwin, we need can’t use sigprocmask with SIGWINCH.
      * Instead, add a dummy sigaction handler, and signalHandlerThread
      * can handle the rest. */
diff --git a/src/libstore-tests/s3-binary-cache-store.cc b/src/libstore-tests/s3-binary-cache-store.cc
index be338084f..dbb414f2b 100644
--- a/src/libstore-tests/s3-binary-cache-store.cc
+++ b/src/libstore-tests/s3-binary-cache-store.cc
@@ -1,3 +1,4 @@
+#include "store-tests-config.hh"
 #if ENABLE_S3
 
 #  include <gtest/gtest.h>
diff --git a/src/libstore/filetransfer.cc b/src/libstore/filetransfer.cc
index bf58cb2b3..b82fbb09c 100644
--- a/src/libstore/filetransfer.cc
+++ b/src/libstore/filetransfer.cc
@@ -8,6 +8,7 @@
 #include "nix/util/callback.hh"
 #include "nix/util/signals.hh"
 
+#include "store-config-private.hh"
 #if ENABLE_S3
 #include <aws/core/client/ClientConfiguration.h>
 #endif
diff --git a/src/libstore/globals.cc b/src/libstore/globals.cc
index a3633b084..6b93e34bb 100644
--- a/src/libstore/globals.cc
+++ b/src/libstore/globals.cc
@@ -25,7 +25,7 @@
 # include <dlfcn.h>
 #endif
 
-#if __APPLE__
+#ifdef __APPLE__
 # include "nix/util/processes.hh"
 #endif
 
@@ -90,7 +90,7 @@ Settings::Settings()
 #endif
 
     /* chroot-like behavior from Apple's sandbox */
-#if __APPLE__
+#ifdef __APPLE__
     sandboxPaths = tokenizeString<StringSet>("/System/Library/Frameworks /System/Library/PrivateFrameworks /bin/sh /bin/bash /private/tmp /private/var/tmp /usr/lib");
     allowedImpureHostPrefixes = tokenizeString<StringSet>("/System/Library /usr/lib /dev /bin/sh");
 #endif
@@ -151,7 +151,7 @@ unsigned int Settings::getDefaultCores()
       return concurrency;
 }
 
-#if __APPLE__
+#ifdef __APPLE__
 static bool hasVirt() {
 
     int hasVMM;
@@ -190,7 +190,7 @@ StringSet Settings::getDefaultSystemFeatures()
         features.insert("kvm");
     #endif
 
-    #if __APPLE__
+    #ifdef __APPLE__
     if (hasVirt())
         features.insert("apple-virt");
     #endif
@@ -374,7 +374,7 @@ void initLibStore(bool loadConfig) {
        [1] https://github.com/apple-oss-distributions/objc4/blob/01edf1705fbc3ff78a423cd21e03dfc21eb4d780/runtime/objc-initialize.mm#L614-L636
     */
     curl_global_init(CURL_GLOBAL_ALL);
-#if __APPLE__
+#ifdef __APPLE__
     /* On macOS, don't use the per-session TMPDIR (as set e.g. by
        sshd). This breaks build users because they don't have access
        to the TMPDIR, in particular in ‘nix-store --serve’. */
diff --git a/src/libstore/include/nix/store/globals.hh b/src/libstore/include/nix/store/globals.hh
index 4c4395e05..38757bcd4 100644
--- a/src/libstore/include/nix/store/globals.hh
+++ b/src/libstore/include/nix/store/globals.hh
@@ -708,7 +708,7 @@ public:
     Setting<PathSet> allowedImpureHostPrefixes{this, {}, "allowed-impure-host-deps",
         "Which prefixes to allow derivations to ask for access to (primarily for Darwin)."};
 
-#if __APPLE__
+#ifdef __APPLE__
     Setting<bool> darwinLogSandboxViolations{this, false, "darwin-log-sandbox-violations",
         "Whether to log Darwin sandbox access violations to the system log."};
 #endif
diff --git a/src/libstore/include/nix/store/s3.hh b/src/libstore/include/nix/store/s3.hh
index c49fa3fb8..5ac5b9a9f 100644
--- a/src/libstore/include/nix/store/s3.hh
+++ b/src/libstore/include/nix/store/s3.hh
@@ -1,6 +1,6 @@
 #pragma once
 ///@file
-
+#include "store-config-private.hh"
 #if ENABLE_S3
 
 #include "nix/util/ref.hh"
diff --git a/src/libstore/optimise-store.cc b/src/libstore/optimise-store.cc
index 17e13758b..277795053 100644
--- a/src/libstore/optimise-store.cc
+++ b/src/libstore/optimise-store.cc
@@ -13,6 +13,7 @@
 #include <stdio.h>
 #include <regex>
 
+#include "store-config-private.hh"
 
 namespace nix {
 
@@ -96,7 +97,7 @@ void LocalStore::optimisePath_(Activity * act, OptimiseStats & stats,
 
     auto st = lstat(path);
 
-#if __APPLE__
+#ifdef __APPLE__
     /* HFS/macOS has some undocumented security feature disabling hardlinking for
        special files within .app dirs. Known affected paths include
        *.app/Contents/{PkgInfo,Resources/\*.lproj,_CodeSignature} and .DS_Store.
diff --git a/src/libstore/posix-fs-canonicalise.cc b/src/libstore/posix-fs-canonicalise.cc
index df51ba307..aeb35eab5 100644
--- a/src/libstore/posix-fs-canonicalise.cc
+++ b/src/libstore/posix-fs-canonicalise.cc
@@ -58,7 +58,7 @@ static void canonicalisePathMetaData_(
 {
     checkInterrupt();
 
-#if __APPLE__
+#ifdef __APPLE__
     /* Remove flags, in particular UF_IMMUTABLE which would prevent
        the file from being garbage-collected. FIXME: Use
        setattrlist() to remove other attributes as well. */
diff --git a/src/libstore/s3-binary-cache-store.cc b/src/libstore/s3-binary-cache-store.cc
index e76a508ba..4e51e728a 100644
--- a/src/libstore/s3-binary-cache-store.cc
+++ b/src/libstore/s3-binary-cache-store.cc
@@ -1,3 +1,4 @@
+#include "store-config-private.hh"
 #if ENABLE_S3
 
 #include <assert.h>
diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc
index 5616b605b..915b8b1d8 100644
--- a/src/libstore/unix/build/local-derivation-goal.cc
+++ b/src/libstore/unix/build/local-derivation-goal.cc
@@ -61,7 +61,7 @@
 # include "nix/store/personality.hh"
 #endif
 
-#if __APPLE__
+#ifdef __APPLE__
 #include <spawn.h>
 #include <sys/sysctl.h>
 #include <sandbox.h>
@@ -77,6 +77,8 @@ extern "C" int sandbox_init_with_parameters(const char *profile, uint64_t flags,
 #include "nix/util/strings.hh"
 #include "nix/util/signals.hh"
 
+#include "store-config-private.hh"
+
 namespace nix {
 
 struct LocalDerivationGoal : DerivationGoal, RestrictionContext
@@ -496,7 +498,7 @@ Goal::Co LocalDerivationGoal::tryLocalBuild()
             if (drvOptions->noChroot)
                 throw Error("derivation '%s' has '__noChroot' set, "
                     "but that's not allowed when 'sandbox' is 'true'", worker.store.printStorePath(drvPath));
-#if __APPLE__
+#ifdef __APPLE__
             if (drvOptions->additionalSandboxProfile != "")
                 throw Error("derivation '%s' specifies a sandbox profile, "
                     "but this is only allowed when 'sandbox' is 'relaxed'", worker.store.printStorePath(drvPath));
@@ -890,7 +892,7 @@ void LocalDerivationGoal::startBuilder()
     /* Create a temporary directory where the build will take
        place. */
     topTmpDir = createTempDir(settings.buildDir.get().value_or(""), "nix-build-" + std::string(drvPath.name()), false, false, 0700);
-#if __APPLE__
+#ifdef __APPLE__
     if (false) {
 #else
     if (useChroot) {
@@ -1168,7 +1170,7 @@ void LocalDerivationGoal::startBuilder()
 #else
         if (drvOptions->useUidRange(*drv))
             throw Error("feature 'uid-range' is not supported on this platform");
-        #if __APPLE__
+        #ifdef __APPLE__
             /* We don't really have any parent prep work to do (yet?)
                All work happens in the child, instead. */
         #else
@@ -1248,7 +1250,7 @@ void LocalDerivationGoal::startBuilder()
         if (chown(slaveName.c_str(), buildUser->getUID(), 0))
             throw SysError("changing owner of pseudoterminal slave");
     }
-#if __APPLE__
+#ifdef __APPLE__
     else {
         if (grantpt(builderOut.get()))
             throw SysError("granting access to pseudoterminal slave");
@@ -2015,7 +2017,7 @@ void LocalDerivationGoal::runChild()
             for (auto & i : pathsInChroot) {
                 if (i.second.source == "/proc") continue; // backwards compatibility
 
-                #if HAVE_EMBEDDED_SANDBOX_SHELL
+                #ifdef HAVE_EMBEDDED_SANDBOX_SHELL
                 if (i.second.source == "__embedded_sandbox_shell__") {
                     static unsigned char sh[] = {
                         #include "embedded-sandbox-shell.gen.hh"
@@ -2169,7 +2171,7 @@ void LocalDerivationGoal::runChild()
                 throw SysError("setuid failed");
         }
 
-#if __APPLE__
+#ifdef __APPLE__
         /* This has to appear before import statements. */
         std::string sandboxProfile = "(version 1)\n";
 
@@ -2340,7 +2342,7 @@ void LocalDerivationGoal::runChild()
         for (auto & i : drv->args)
             args.push_back(rewriteStrings(i, inputRewrites));
 
-#if __APPLE__
+#ifdef __APPLE__
         posix_spawnattr_t attrp;
 
         if (posix_spawnattr_init(&attrp))
diff --git a/src/libutil/archive.cc b/src/libutil/archive.cc
index 143d01085..487873ce6 100644
--- a/src/libutil/archive.cc
+++ b/src/libutil/archive.cc
@@ -17,7 +17,7 @@ namespace nix {
 struct ArchiveSettings : Config
 {
     Setting<bool> useCaseHack{this,
-        #if __APPLE__
+        #ifdef __APPLE__
             true,
         #else
             false,
diff --git a/src/libutil/file-descriptor.cc b/src/libutil/file-descriptor.cc
index 042edbf55..4fc0f06cd 100644
--- a/src/libutil/file-descriptor.cc
+++ b/src/libutil/file-descriptor.cc
@@ -98,7 +98,7 @@ void AutoCloseFD::fsync() const
         result =
 #ifdef _WIN32
             ::FlushFileBuffers(fd)
-#elif __APPLE__
+#elif defined(__APPLE__)
             ::fcntl(fd, F_FULLFSYNC)
 #else
             ::fsync(fd)
diff --git a/src/libutil/file-system.cc b/src/libutil/file-system.cc
index 769c477ed..39b03268d 100644
--- a/src/libutil/file-system.cc
+++ b/src/libutil/file-system.cc
@@ -576,7 +576,7 @@ Path createTempDir(const Path & tmpRoot, const Path & prefix,
                     , mode
 #endif
                     ) == 0) {
-#if __FreeBSD__
+#ifdef __FreeBSD__
             /* Explicitly set the group of the directory.  This is to
                work around around problems caused by BSD's group
                ownership semantics (directories inherit the group of
diff --git a/src/libutil/fs-sink.cc b/src/libutil/fs-sink.cc
index aa46b3cd2..7b8fc3b2a 100644
--- a/src/libutil/fs-sink.cc
+++ b/src/libutil/fs-sink.cc
@@ -4,7 +4,7 @@
 #include "nix/util/config-global.hh"
 #include "nix/util/fs-sink.hh"
 
-#if _WIN32
+#ifdef _WIN32
 # include <fileapi.h>
 # include "nix/util/file-path.hh"
 # include "nix/util/windows-error.hh"
diff --git a/src/libutil/include/nix/util/file-descriptor.hh b/src/libutil/include/nix/util/file-descriptor.hh
index 2e8b4ce10..4f13a9a8f 100644
--- a/src/libutil/include/nix/util/file-descriptor.hh
+++ b/src/libutil/include/nix/util/file-descriptor.hh
@@ -18,7 +18,7 @@ struct Source;
  * Operating System capability
  */
 using Descriptor =
-#if _WIN32
+#ifdef _WIN32
     HANDLE
 #else
     int
@@ -26,7 +26,7 @@ using Descriptor =
     ;
 
 const Descriptor INVALID_DESCRIPTOR =
-#if _WIN32
+#ifdef _WIN32
     INVALID_HANDLE_VALUE
 #else
     -1
diff --git a/src/libutil/terminal.cc b/src/libutil/terminal.cc
index 77766fae1..fa0f7e871 100644
--- a/src/libutil/terminal.cc
+++ b/src/libutil/terminal.cc
@@ -2,7 +2,7 @@
 #include "nix/util/environment-variables.hh"
 #include "nix/util/sync.hh"
 
-#if _WIN32
+#ifdef _WIN32
 # include <io.h>
 # define WIN32_LEAN_AND_MEAN
 # include <windows.h>
diff --git a/src/libutil/unix/processes.cc b/src/libutil/unix/processes.cc
index c436076ee..4df0a7777 100644
--- a/src/libutil/unix/processes.cc
+++ b/src/libutil/unix/processes.cc
@@ -78,7 +78,7 @@ int Pid::kill()
         /* On BSDs, killing a process group will return EPERM if all
            processes in the group are zombies (or something like
            that). So try to detect and ignore that situation. */
-#if __FreeBSD__ || __APPLE__
+#if defined(__FreeBSD__) || defined(__APPLE__)
         if (errno != EPERM || ::kill(pid, 0) != 0)
 #endif
             logError(SysError("killing process %d", pid).info());
diff --git a/src/nix/crash-handler.cc b/src/nix/crash-handler.cc
index 17d346ecc..d65773fa0 100644
--- a/src/nix/crash-handler.cc
+++ b/src/nix/crash-handler.cc
@@ -8,7 +8,7 @@
 #include <sstream>
 
 // Darwin and FreeBSD stdenv do not define _GNU_SOURCE but do have _Unwind_Backtrace.
-#if __APPLE__ || __FreeBSD__
+#if defined(__APPLE__) || defined(__FreeBSD__)
 #  define BOOST_STACKTRACE_GNU_SOURCE_NOT_REQUIRED
 #endif
 
diff --git a/src/nix/unix/daemon.cc b/src/nix/unix/daemon.cc
index 4e60ba102..1acf2bd5b 100644
--- a/src/nix/unix/daemon.cc
+++ b/src/nix/unix/daemon.cc
@@ -38,7 +38,7 @@
 #include "nix/util/cgroup.hh"
 #endif
 
-#if __APPLE__ || __FreeBSD__
+#if defined(__APPLE__) || defined(__FreeBSD__)
 #include <sys/ucred.h>
 #endif