diff --git a/flake.lock b/flake.lock
index 655e86c9..fbdab2f2 100644
--- a/flake.lock
+++ b/flake.lock
@@ -1,5 +1,19 @@
 {
   "nodes": {
+    "flake-compat": {
+      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "revCount": 57,
+        "type": "tarball",
+        "url": "https://api.flakehub.com/f/pinned/edolstra/flake-compat/1.0.1/018afb31-abd1-7bff-a5e4-cff7e18efb7a/source.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://flakehub.com/f/edolstra/flake-compat/1.tar.gz"
+      }
+    },
     "flake-utils": {
       "inputs": {
         "systems": "systems"
@@ -20,11 +34,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1723703277,
-        "narHash": "sha256-nk0RaUB5f68BwtXAYy3WAjqFhVKqIl9Z89RGycTa2vk=",
+        "lastModified": 1724395761,
+        "narHash": "sha256-zRkDV/nbrnp3Y8oCADf5ETl1sDrdmAW6/bBVJ8EbIdQ=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "8b908192e64224420e2d59dfd9b2e4309e154c5d",
+        "rev": "ae815cee91b417be55d43781eb4b73ae1ecc396c",
         "type": "github"
       },
       "original": {
@@ -36,6 +50,7 @@
     },
     "root": {
       "inputs": {
+        "flake-compat": "flake-compat",
         "flake-utils": "flake-utils",
         "nixpkgs": "nixpkgs"
       }
diff --git a/flake.nix b/flake.nix
index 464f8804..68fffe1d 100644
--- a/flake.nix
+++ b/flake.nix
@@ -3,15 +3,24 @@
 
   inputs = {
     nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
+    flake-compat.url = "https://flakehub.com/f/edolstra/flake-compat/1.tar.gz";
     flake-utils.url = "github:numtide/flake-utils";
   };
 
-  outputs = { self, nixpkgs, flake-utils }: {
+  nixConfig = {
+    extra-substituters = [
+      "https://cache.kyouma.net"
+    ];
+    extra-trusted-public-keys = [
+      "cache.kyouma.net:Frjwu4q1rnwE/MnSTmX9yx86GNA/z3p/oElGvucLiZg="
+    ];
+  };
+
+  outputs = { self, nixpkgs, flake-utils, ... }: {
     hydraJobs = {
       inherit (self) packages;
     };
-  } // flake-utils.lib.eachDefaultSystem (system:
-  let 
+  } // flake-utils.lib.eachSystem [ "x86_64-linux" "aarch64-linux" ] (system: let
     pkgs = import nixpkgs {
       inherit system;
     };
@@ -20,7 +29,15 @@
       versiajs = pkgs.callPackage ./nix/package.nix {};
       default = self.packages.${system}.versiajs;
     };
-
+  }) // flake-utils.lib.eachDefaultSystem (system: let
+    pkgs = import nixpkgs {
+      inherit system;
+    };
+  in {
+    apps.update-modules = {
+      type = "app";
+      program = self.packages.${system}.versiajs.passthru.updateScript;
+    };
     devShells = {
       default = pkgs.mkShell {
         buildInputs = with pkgs; [
diff --git a/nix/nodeHashes.nix b/nix/nodeHashes.nix
deleted file mode 100644
index df2b68d4..00000000
--- a/nix/nodeHashes.nix
+++ /dev/null
@@ -1,6 +0,0 @@
-{ lib }: {
-  x86_64-linux = "sha256-T/U9altP5HFzmULtsuvHQIXQXDCmQEAau8KFN8J5i/8=";
-  x86_64-darwin = lib.fakeHash;
-  aarch64-linux = "sha256-6ZzrYI2G+7q9Efgu5iKhZB3bT2C7T5fk4I/t5glpQYA=";
-  aarch64-darwin = lib.fakeHash;
-}
diff --git a/nix/package.nix b/nix/package.nix
index 947f9732..7f37f675 100644
--- a/nix/package.nix
+++ b/nix/package.nix
@@ -1,24 +1,29 @@
 {
   lib,
   stdenv,
-  fetchFromGitHub,
   bun,
   callPackage,
-  nodeHashes ? callPackage ./nodeHashes.nix { inherit lib; },
+  modulesSrc ? callPackage ./source.nix {},
   nodePackages_latest,
   makeBinaryWrapper,
 }:
 
+assert lib.assertMsg (
+  with builtins; hashFile "sha256" ../bun.lockb == hashFile "sha256" "${modulesSrc.src}/bun.lockb"
+  ) "bun.lockb has changed. Please run 'nix run .#apps.x86_64-linux.update-modules'";
+
 stdenv.mkDerivation (finalAttrs: {
   pname = "versiajs";
   version = "0.7.0";
 
   src = ../.;
 
-  node_modules = stdenv.mkDerivation {
-    pname = "${finalAttrs.pname}-node_modules";
+  versiajsModules = stdenv.mkDerivation (modulesAttrs: {
+    pname = "${finalAttrs.pname}-modules";
 
-    inherit (finalAttrs) version src; 
+    inherit (finalAttrs) version; 
+
+    src = modulesSrc.src;
 
     nativeBuildInputs = with nodePackages_latest; [ bun nodejs typescript ];
 
@@ -35,9 +40,9 @@ stdenv.mkDerivation (finalAttrs: {
 
     dontFixup = true;
 
-    outputHash = nodeHashes.${stdenv.system};
+    outputHash = modulesSrc.outputHash.${stdenv.system};
     outputHashMode = "recursive";
-  };
+  });
 
   nativeBuildInputs = [ bun ];
 
@@ -48,7 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
   configurePhase = ''
     runHook preConfigure
 
-    cp -r ${finalAttrs.node_modules}/node_modules .
+    cp -r ${finalAttrs.versiajsModules}/node_modules .
 
     runHook postConfigure
   '';
@@ -80,11 +85,13 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  passthru.updateScript = ./update.sh;
+
   meta = {
     description = "A new federated server written with TypeScript and Bun ";
     homepage = "https://lysand.org";
     license = with lib.licenses; [ agpl3Plus ];
     maintainers = with lib.maintainers; [ snaki ];
-    platforms = [ "x86_64-linux" "x86_64-darwin" "aarch64-linux" "aarch64-darwin" ];
+    platforms = [ "x86_64-linux" "aarch64-linux" ];
   };
 })
diff --git a/nix/source.nix b/nix/source.nix
new file mode 100644
index 00000000..d917326e
--- /dev/null
+++ b/nix/source.nix
@@ -0,0 +1,13 @@
+{
+  lib,
+  fetchFromGitHub,
+}: {
+  outputHash.x86_64-linux = "sha256-SbOgLEdrKA7MwkiUvmenXyfbwgrKsq3AYo4Rjlqn0YA=";
+  outputHash.aarch64-linux = "sha256-KJBsOhtDOmW/EVFgZF1TNB5G7mSeRZs18zwZlh1MsUM=";
+  src = fetchFromGitHub {
+    owner = "lysand-org";
+    repo = "server";
+    rev = "832f72160f574f86c8a8897e5dcb3d6382d8192c";
+    hash = "sha256-BaojznCj0WWA0KkDMLjjlYikwpn975arGLyd0lFBXm0=";
+  };
+}
diff --git a/nix/update.sh b/nix/update.sh
new file mode 100755
index 00000000..00156b24
--- /dev/null
+++ b/nix/update.sh
@@ -0,0 +1,21 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i bash -p nix-prefetch-github
+
+set -euo pipefail
+
+SOURCE=$(nix-prefetch-github --nix lysand-org server | tail -n 6)
+
+cat > ./nix/source.nix << EOF
+{
+  lib,
+  fetchFromGitHub,
+}: {
+  outputHash.x86_64-linux = lib.fakeHash;
+  outputHash.aarch64-linux = lib.fakeHash;
+  src = fetchFromGitHub {
+${SOURCE};
+}
+EOF
+
+echo "Done."
+echo "Please update the attributes of 'outputHash' in nix/source.nix."