diff --git a/guix/build-system/cmake.scm b/guix/build-system/cmake.scm
index c5cd0672c9..8b6d0ef487 100644
--- a/guix/build-system/cmake.scm
+++ b/guix/build-system/cmake.scm
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2013-2015, 2020-2022 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2013-2015, 2020-2022, 2026 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2013 Cyril Roelandt <tipecaml@gmail.com>
 ;;; Copyright © 2017 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2020 Efraim Flashner <efraim@flashner.co.il>
@@ -123,7 +123,6 @@
   "Return a bag for NAME."
   (define private-keywords
     `(#:cmake #:inputs #:native-inputs
-      #:implicit-inputs? #:implicit-cross-inputs?
       ,@(if target '() '(#:target))))
 
   (bag
@@ -162,7 +161,10 @@
 
 (define* (cmake-build name inputs
                       #:key guile source
-                      (outputs '("out")) (configure-flags ''())
+                      (outputs '("out"))
+                      (implicit-inputs? #t)
+                      (implicit-cross-inputs? #t)
+                      (configure-flags ''())
                       (search-paths '())
                       (make-flags ''())
                       (out-of-source? #t)
@@ -231,7 +233,11 @@ provides a 'CMakeLists.txt' file as its build system."
                       #:graft? #f
                       #:substitutable? substitutable?
                       #:allowed-references allowed-references
-                      #:disallowed-references disallowed-references
+                      #:disallowed-references
+                      (or disallowed-references
+                          (and implicit-inputs?
+                               (not allowed-references)
+                               (default-disallowed-references system)))
                       #:guile-for-build guile)))
 
 
@@ -244,6 +250,8 @@ provides a 'CMakeLists.txt' file as its build system."
                             target
                             build-inputs target-inputs host-inputs
                             source guile
+                            (implicit-inputs? #t)
+                            (implicit-cross-inputs? #t)
                             (outputs '("out"))
                             (configure-flags ''())
                             (search-paths '())
diff --git a/guix/build-system/gnu.scm b/guix/build-system/gnu.scm
index f0c261034f..49e393b459 100644
--- a/guix/build-system/gnu.scm
+++ b/guix/build-system/gnu.scm
@@ -37,6 +37,7 @@
             gnu-build-system
             standard-packages
             standard-cross-packages
+            default-disallowed-references
             package-with-explicit-inputs
             package-with-extra-configure-variable
             static-libgcc-package
@@ -275,6 +276,20 @@ standard packages used as implicit inputs of the GNU build system."
   (let ((distro (resolve-module '(gnu packages commencement))))
     ((module-ref distro '%final-inputs) system)))
 
+(define default-disallowed-references
+  (mlambda (system)
+    "Return the set of disallowed references for SYSTEM--i.e., build-time
+dependencies that build outputs should not refer to by default."
+    ;; XXX: Ideally we would mark all of them but this is too ambitious at
+    ;; this stage: many packages keep a reference to coreutils, grep, etc.
+    (filter-map (match-lambda
+                  (("gcc" gcc) gcc)
+                  (("binutils" binutils) binutils)
+                  (("ld-wrapper" ld-wrapper) ld-wrapper)
+                  (("libc:static" libc "static") (gexp-input libc "static"))
+                  (_ #f))
+                (standard-packages system))))
+
 (define* (lower name
                 #:key source inputs native-inputs outputs target
                 (implicit-inputs? #t) (implicit-cross-inputs? #t)
@@ -284,7 +299,6 @@ standard packages used as implicit inputs of the GNU build system."
   "Return a bag for NAME from the given arguments."
   (define private-keywords
     `(#:inputs #:native-inputs #:outputs
-      #:implicit-inputs? #:implicit-cross-inputs?
       ,@(if target '() '(#:target))))
 
   (bag
@@ -341,6 +355,8 @@ standard packages used as implicit inputs of the GNU build system."
                     guile source
                     (outputs '("out"))
                     (search-paths '())
+                    (implicit-inputs? #t)
+                    (implicit-cross-inputs? #t)
                     (bootstrap-scripts %bootstrap-scripts)
                     (configure-flags ''())
                     (make-flags ''())
@@ -433,7 +449,11 @@ are allowed to refer to."
                       #:graft? #f
                       #:substitutable? substitutable?
                       #:allowed-references allowed-references
-                      #:disallowed-references disallowed-references
+                      #:disallowed-references
+                      (or disallowed-references
+                          (and implicit-inputs?
+                               (not allowed-references)
+                               (default-disallowed-references system)))
                       #:guile-for-build guile)))
 
 
@@ -478,6 +498,8 @@ is one of `host' or `target'."
                           target
                           build-inputs target-inputs host-inputs
                           guile source
+                          (implicit-inputs? #t)
+                          (implicit-cross-inputs? #t)
                           (outputs '("out"))
                           (search-paths '())
                           (native-search-paths '())