Not only can you do that in NixOS, but you can even do something lighter weight and apply a patch to an existing package. This has the advantage that the patch often persists through software updates.

For example, I used to patch OpenSSH to increase the minimum field size for DH key exchanges [1]. Eventually OpenSSH did update their minimum field sizes so I do not use this patch anymore.

[1] https://r6.ca/blog/20150111T040537Z.html

For those interested, patching OpenSSH in NixOS involves adding the following to one's system configuration:

    nixpkgs.config.packageOverrides = oldpkgs: {
      openssh = pkgs.lib.overrideDerivation oldpkgs.openssh (oldAttrs: {
        patches = oldAttrs.patches ++ [ ./openssh-dh-grp-min.patch ];
      });
    };

where openssh-dh-grp-min.patch is the patch file you want to apply.