Certain packages failing to build when cross-compiling config for raspberry pi

I’ve built a flake to run nix on a raspberry pi using raspberry-pi-nix, and it works fine. The only problem is that some packages fail when I try to install or enable them. The base flake is as follows:

{
  description = "NixOS Raspberry Pi configuration";

  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
    raspberry-pi-nix.url =
      "github:nix-community/raspberry-pi-nix/v0.4.0"; # Ensure this is correct
  };

  nixConfig = {
    extra-substituters = [ "https://nix-community.cachix.org" ];
    extra-trusted-public-keys = [
      "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
    ];
  };

  outputs = { self, nixpkgs, raspberry-pi-nix }:
    let
      # inherit (nixpkgs.lib) nixosSystem;
      basic-config = { pkgs, lib, ... }: {
        # bcm2711 for rpi 3, 3+, 4, zero 2 w
        # bcm2712 for rpi 5
        # See the docs at:

        # https://www.raspberrypi.com/documentation/computers/linux_kernel.html#native-build-configuration
        raspberry-pi-nix.board = "bcm2711";
        time.timeZone = "Europe/London";
        users.users.root.initialPassword = "root";
        hardware = {
          bluetooth.enable = true;
          raspberry-pi = {
            config = {
              all = {
                base-dt-params = {
                  # enable autoprobing of bluetooth driver
                  # https://github.com/raspberrypi/linux/blob/c8c99191e1419062ac8b668956d19e788865912a/arch/arm/boot/dts/overlays/README#L222-L224
                  krnbt = {
                    enable = true;
                    value = "on";
                  };
                };
              };
            };
          };
        };
      };

    in {
      nixosConfigurations.rpi = nixpkgs.lib.nixosSystem {
        system = "x86_64-linux";
        modules = [
          ./config
          raspberry-pi-nix.nixosModules.raspberry-pi
          basic-config
          {
            nixpkgs.crossSystem = {
              # target platform
              system = "aarch64-linux";
            };
          }
        ];
      };
    };
}

and builds / deploys fine, but when I try to add e.g. services.devmon.enable = true;, I get an error that looks like this:

error: builder for '/nix/store/m1zj0a7qcawy895pir5fv12zp584s56r-volume_key-aarch64-unknown-linux-gnu-0.3.11.drv' failed with exit code 2;
       last 10 log lines:
       > libtool: compile:  aarch64-unknown-linux-gnu-gcc -DHAVE_CONFIG_H -I. -I/nix/store/a0fdyhwp28c0j671lh75ifll6xjd5w6w-util-linux-aarch64-unknown-linux-gnu-2.39.4-dev/include/blkid -I/nix/store/10wq36rsqgx5qagidjrxbl9qb5ryivv6-glib-aarch64-unknown-linux-gnu-2.80.4-dev/include/glib-2.0 -I/nix/store/5iq6phwlyfzn2q8b33gsm72zx3am4dnm-glib-aarch64-unknown-linux-gnu-2.80.4/lib/glib-2.0/include -I/nix/store/4jk67yxb0slhfjxb81sb8zhnlrswdpnk-gpgme-aarch64-unknown-linux-gnu-1.23.2-dev/include -I/nix/store/gcdy6f9p0hs7d5mqwwc8mnvsqzvidak5-libassuan-aarch64-unknown-linux-gnu-2.5.7-dev/include -I/nix/store/1a2lhm1fnzyaj2qvdb4kgbgdx7jis7kg-libgpg-error-aarch64-unknown-linux-gnu-1.50-dev/include -I/nix/store/q5whilgh7wihqhfjw09grbn287shp9s8-cryptsetup-aarch64-unknown-linux-gnu-2.7.3-dev/include -I/nix/store/zqmrb0jdspkgxd6mvhb7x14h82ylnmfv-nss-aarch64-unknown-linux-gnu-3.101.2-dev/include/nss -I/nix/store/prmpc54j96gkv7y5fbfcvzhls6dr2j5c-nspr-aarch64-unknown-linux-gnu-4.35-dev/include -g -O2 -Wall -W -Wcast-align -Wmissing-noreturn -Wnested-externs -Wpointer-arith -Wshadow -Wundef -Wwrite-strings -c python/volume_key_wrap.c  -fPIC -DPIC -o python/.libs/_volume_key_la-volume_key_wrap.o
       > python/volume_key_wrap.c:198:11: fatal error: Python.h: No such file or directory
       >   198 | # include <Python.h>
       >       |           ^~~~~~~~~~
       > compilation terminated.
       > make[2]: *** [Makefile:1097: python/_volume_key_la-volume_key_wrap.lo] Error 1
       > make[2]: Leaving directory '/build/volume_key'
       > make[1]: *** [Makefile:1240: all-recursive] Error 1
       > make[1]: Leaving directory '/build/volume_key'
       > make: *** [Makefile:751: all] Error 2
       For full logs, run 'nix log /nix/store/m1zj0a7qcawy895pir5fv12zp584s56r-volume_key-aarch64-unknown-linux-gnu-0.3.11.drv'.
error: 1 dependencies of derivation '/nix/store/nf5cvmcbwjvaxkd9bh6gigclxkyi4d2m-libblockdev-aarch64-unknown-linux-gnu-3.1.1.drv' failed to build
error (ignored): error: cannot unlink '/tmp/nix-build-liburcu-aarch64-unknown-linux-gnu-0.14.0.drv-0/build': Directory not empty
error: 1 dependencies of derivation '/nix/store/ljvsk5afaqr03ivx317cqqxkd29fmgr4-etc.drv' failed to build
error (ignored): error: cannot unlink '/tmp/nix-build-gtk+3-aarch64-unknown-linux-gnu-3.24.43.drv-1/build': Directory not empty
error: 1 dependencies of derivation '/nix/store/8xni5ch7wcz87canjg2x9r2y5cb3imkd-udisks-aarch64-unknown-linux-gnu-2.10.1.drv' failed to build
error: 1 dependencies of derivation '/nix/store/bmg1pv91vp9arzlxnik9w9fzhlqvhas1-nixos-system-gpteahouse-24.11.20240910.1355a0c.drv' failed to build
error: 1 dependencies of derivation '/nix/store/r80h5ykzyd5g98vzav6vw6nrwvmnm7gz-ext4-fs.img.zst-aarch64-unknown-linux-gnu.drv' failed to build
error: 1 dependencies of derivation '/nix/store/1d8j783qwcf6jgmrxga14rm0knhm92y3-nixos-sd-image-24.11.20240910.1355a0c-aarch64-linux.img-aarch64-unknown-linux-gnu.drv' failed to build

The same error comes up when I disable devmon and install specifically volume_key. I also had a similar error when trying to install networkmanager, where vpnc was failing to build. I fixed that with networking.networkmanager.plugins = lib.mkForce [ ]; to simply avoid installing it, and I could conceivably do without devmon, but this seems like some weird greater thing where some packages are failing to build for aarch64-linux, even though nixpkgs claims that they’re fine to use on those platforms.

It feels like there’s some weird bit of configuration I’ve missed, or perhaps an overlay that I should apply, but I’m really very lost about where to find it.

As a note, using emulation to compile does work, but is obviously slower, and doesn’t seem like it should be necessary here since I specify the target etc correctly.