It turned out to be ansible... which is a pure python tool. Beats me.
There's also some cases where it wants to build Android Studio from source. I've just removed it and now run it in a VM.
I'm sure I'm doing it wrong, and I'm sure nixos-rebuild has a reason to build things from source, and maybe I'm not RTFMing hard enough. But good god, I just need my system to update.