Well, on second thought, I guess I'm not sure how I would call "stdenv.needsPax" from a stdenv setup hook?
Although that function is quite trivial currently, I guess I could duplicate it in bash as long as I could find out which OS I'm running under (which I'm not sure how to do either?)...