diff --git a/src/libstore/build.cc b/src/libstore/build.cc
index 3c9c973d3..9dc824ecb 100644
--- a/src/libstore/build.cc
+++ b/src/libstore/build.cc
@@ -1382,7 +1382,7 @@ void DerivationGoal::inputsRealised()
 
     /* Don't repeat fixed-output derivations since they're already
        verified by their output hash.*/
-    nrRounds = DtAxisFixed & derivationType ? 1 : settings.buildRepeat + 1;
+    nrRounds = derivationIsFixed(derivationType) ? 1 : settings.buildRepeat + 1;
 
     /* Okay, try to build.  Note that here we don't wait for a build
        slot to become available, since we don't need one if there is a
@@ -1760,7 +1760,7 @@ void DerivationGoal::buildDone()
             st =
                 dynamic_cast<NotDeterministic*>(&e) ? BuildResult::NotDeterministic :
                 statusOk(status) ? BuildResult::OutputRejected :
-                DtAxisImpure & derivationType || diskFull ? BuildResult::TransientFailure :
+                derivationIsImpure(derivationType) || diskFull ? BuildResult::TransientFailure :
                 BuildResult::PermanentFailure;
         }
 
@@ -1966,7 +1966,7 @@ void DerivationGoal::startBuilder()
         else if (settings.sandboxMode == smDisabled)
             useChroot = false;
         else if (settings.sandboxMode == smRelaxed)
-            useChroot = !(DtAxisImpure & derivationType) && !noChroot;
+            useChroot = !(derivationIsImpure(derivationType)) && !noChroot;
     }
 
     if (worker.store.storeDir != worker.store.realStoreDir) {
@@ -2132,7 +2132,7 @@ void DerivationGoal::startBuilder()
                 "nogroup:x:65534:\n") % sandboxGid).str());
 
         /* Create /etc/hosts with localhost entry. */
-        if (!(DtAxisImpure & derivationType))
+        if (!(derivationIsImpure(derivationType)))
             writeFile(chrootRootDir + "/etc/hosts", "127.0.0.1 localhost\n::1 localhost\n");
 
         /* Make the closure of the inputs available in the chroot,
@@ -2341,7 +2341,7 @@ void DerivationGoal::startBuilder()
            us.
         */
 
-        if (!(DtAxisImpure & derivationType))
+        if (!(derivationIsImpure(derivationType)))
             privateNetwork = true;
 
         userNamespaceSync.create();
@@ -2542,7 +2542,7 @@ void DerivationGoal::initEnv()
        derivation, tell the builder, so that for instance `fetchurl'
        can skip checking the output.  On older Nixes, this environment
        variable won't be set, so `fetchurl' will do the check. */
-    if (DtAxisFixed & derivationType) env["NIX_OUTPUT_CHECKED"] = "1";
+    if (derivationIsFixed(derivationType)) env["NIX_OUTPUT_CHECKED"] = "1";
 
     /* *Only* if this is a fixed-output derivation, propagate the
        values of the environment variables specified in the
@@ -2553,7 +2553,7 @@ void DerivationGoal::initEnv()
        to the builder is generally impure, but the output of
        fixed-output derivations is by definition pure (since we
        already know the cryptographic hash of the output). */
-    if (derivationType & DtAxisImpure) {
+    if (derivationIsImpure(derivationType)) {
         for (auto & i : parsedDrv->getStringsAttr("impureEnvVars").value_or(Strings()))
             env[i] = getEnv(i).value_or("");
     }
@@ -3167,7 +3167,7 @@ void DerivationGoal::runChild()
             /* Fixed-output derivations typically need to access the
                network, so give them access to /etc/resolv.conf and so
                on. */
-            if (DtAxisImpure & derivationType) {
+            if (derivationIsImpure(derivationType)) {
                 ss.push_back("/etc/resolv.conf");
 
                 // Only use nss functions to resolve hosts and
@@ -3408,7 +3408,7 @@ void DerivationGoal::runChild()
 
                 sandboxProfile += "(import \"sandbox-defaults.sb\")\n";
 
-                if (DtAxisImpure & derivationType)
+                if (derivationIsImpure(derivationType))
                     sandboxProfile += "(import \"sandbox-network.sb\")\n";
 
                 /* Our rwx outputs */
diff --git a/src/libstore/derivations.cc b/src/libstore/derivations.cc
index e99515bb5..224637e64 100644
--- a/src/libstore/derivations.cc
+++ b/src/libstore/derivations.cc
@@ -37,6 +37,32 @@ void DerivationOutput::parseHashInfo(FileIngestionMethod & recursive, Hash & has
 }
 
 
+bool derivationIsCA(DerivationType dt) {
+    switch (dt) {
+    case DerivationType::Regular: return false;
+    case DerivationType::CAFixed: return true;
+    };
+    // Since enums can have non-variant values, but making a `default:` would
+    // disable exhaustiveness warnings.
+    abort();
+}
+
+bool derivationIsFixed(DerivationType dt) {
+    switch (dt) {
+    case DerivationType::Regular: return false;
+    case DerivationType::CAFixed: return true;
+    };
+    abort();
+}
+
+bool derivationIsImpure(DerivationType dt) {
+    switch (dt) {
+    case DerivationType::Regular: return false;
+    case DerivationType::CAFixed: return true;
+    };
+    abort();
+}
+
 BasicDerivation::BasicDerivation(const BasicDerivation & other)
     : platform(other.platform)
     , builder(other.builder)
@@ -344,7 +370,7 @@ DerivationType BasicDerivation::type() const
         outputs.begin()->first == "out" &&
         outputs.begin()->second.hash != "")
     {
-        return DtCAFixed;
+        return DerivationType::CAFixed;
     }
 
     auto const algo = outputs.begin()->second.hashAlgo;
@@ -359,7 +385,7 @@ DerivationType BasicDerivation::type() const
             throw Error("Invalid mix of CA and regular outputs");
         }
     }
-    return DtRegular;
+    return DerivationType::Regular;
 }
 
 
@@ -390,7 +416,7 @@ Hash hashDerivationModulo(Store & store, const Derivation & drv, bool maskOutput
 {
     /* Return a fixed hash for fixed-output derivations. */
     switch (drv.type()) {
-    case DtCAFixed: {
+    case DerivationType::CAFixed: {
         DerivationOutputs::const_iterator i = drv.outputs.begin();
         return hashString(htSHA256, "fixed:out:"
             + i->second.hashAlgo + ":"
diff --git a/src/libstore/derivations.hh b/src/libstore/derivations.hh
index 5a8d0d69c..1e0ee719d 100644
--- a/src/libstore/derivations.hh
+++ b/src/libstore/derivations.hh
@@ -34,21 +34,24 @@ typedef std::map<StorePath, StringSet> DerivationInputs;
 
 typedef std::map<string, string> StringPairs;
 
-// Bit:
-//  7: regular vs ca
-//  6: floating vs fixed hash if ca, regular always floating
-//  5: pure vs impure if ca, regular always pure
-//  _: Unassigned
-enum DerivationTypeAxis : uint8_t {
-    DtAxisCA = 0b10000000,
-    DtAxisFixed = 0b01000000,
-    DtAxisImpure = 0b00100000,
-};
-enum DerivationType : uint8_t {
-    DtRegular = 0b0000000,
-    DtCAFixed = 0b11100000,
+enum struct DerivationType : uint8_t {
+    Regular,
+    CAFixed,
 };
 
+/* Do the outputs of the derivation have paths calculated from their content,
+   or from the derivation itself? */
+bool derivationIsCA(DerivationType);
+
+/* Is the content of the outputs fixed a-priori via a hash? Never true for
+   non-CA derivations. */
+bool derivationIsFixed(DerivationType);
+
+/* Is the derivation impure and needs to access non-deterministic resources, or
+   pure and can be sandboxed? Note that whether or not we actually sandbox the
+   derivation is controlled separately. Never true for non-CA derivations. */
+bool derivationIsImpure(DerivationType);
+
 struct BasicDerivation
 {
     DerivationOutputs outputs; /* keyed on symbolic IDs */