diff --git a/flake.nix b/flake.nix
index d5c3c414..1a347cce 100644
--- a/flake.nix
+++ b/flake.nix
@@ -25,6 +25,10 @@
       inherit system;
     };
   in {
+    apps.update-modules = {
+      type = "app";
+      program = self.packages.${system}.versiajs.passthru.updateScript;
+    };
     devShells = {
       default = pkgs.mkShell {
         buildInputs = with pkgs; [
diff --git a/nix/nodeHashes.nix b/nix/nodeHashes.nix
deleted file mode 100644
index df2b68d4..00000000
--- a/nix/nodeHashes.nix
+++ /dev/null
@@ -1,6 +0,0 @@
-{ lib }: {
-  x86_64-linux = "sha256-T/U9altP5HFzmULtsuvHQIXQXDCmQEAau8KFN8J5i/8=";
-  x86_64-darwin = lib.fakeHash;
-  aarch64-linux = "sha256-6ZzrYI2G+7q9Efgu5iKhZB3bT2C7T5fk4I/t5glpQYA=";
-  aarch64-darwin = lib.fakeHash;
-}
diff --git a/nix/package.nix b/nix/package.nix
index 947f9732..7f37f675 100644
--- a/nix/package.nix
+++ b/nix/package.nix
@@ -1,24 +1,29 @@
 {
   lib,
   stdenv,
-  fetchFromGitHub,
   bun,
   callPackage,
-  nodeHashes ? callPackage ./nodeHashes.nix { inherit lib; },
+  modulesSrc ? callPackage ./source.nix {},
   nodePackages_latest,
   makeBinaryWrapper,
 }:
 
+assert lib.assertMsg (
+  with builtins; hashFile "sha256" ../bun.lockb == hashFile "sha256" "${modulesSrc.src}/bun.lockb"
+  ) "bun.lockb has changed. Please run 'nix run .#apps.x86_64-linux.update-modules'";
+
 stdenv.mkDerivation (finalAttrs: {
   pname = "versiajs";
   version = "0.7.0";
 
   src = ../.;
 
-  node_modules = stdenv.mkDerivation {
-    pname = "${finalAttrs.pname}-node_modules";
+  versiajsModules = stdenv.mkDerivation (modulesAttrs: {
+    pname = "${finalAttrs.pname}-modules";
 
-    inherit (finalAttrs) version src; 
+    inherit (finalAttrs) version; 
+
+    src = modulesSrc.src;
 
     nativeBuildInputs = with nodePackages_latest; [ bun nodejs typescript ];
 
@@ -35,9 +40,9 @@ stdenv.mkDerivation (finalAttrs: {
 
     dontFixup = true;
 
-    outputHash = nodeHashes.${stdenv.system};
+    outputHash = modulesSrc.outputHash.${stdenv.system};
     outputHashMode = "recursive";
-  };
+  });
 
   nativeBuildInputs = [ bun ];
 
@@ -48,7 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
   configurePhase = ''
     runHook preConfigure
 
-    cp -r ${finalAttrs.node_modules}/node_modules .
+    cp -r ${finalAttrs.versiajsModules}/node_modules .
 
     runHook postConfigure
   '';
@@ -80,11 +85,13 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  passthru.updateScript = ./update.sh;
+
   meta = {
     description = "A new federated server written with TypeScript and Bun ";
     homepage = "https://lysand.org";
     license = with lib.licenses; [ agpl3Plus ];
     maintainers = with lib.maintainers; [ snaki ];
-    platforms = [ "x86_64-linux" "x86_64-darwin" "aarch64-linux" "aarch64-darwin" ];
+    platforms = [ "x86_64-linux" "aarch64-linux" ];
   };
 })
diff --git a/nix/source.nix b/nix/source.nix
new file mode 100644
index 00000000..d917326e
--- /dev/null
+++ b/nix/source.nix
@@ -0,0 +1,13 @@
+{
+  lib,
+  fetchFromGitHub,
+}: {
+  outputHash.x86_64-linux = "sha256-SbOgLEdrKA7MwkiUvmenXyfbwgrKsq3AYo4Rjlqn0YA=";
+  outputHash.aarch64-linux = "sha256-KJBsOhtDOmW/EVFgZF1TNB5G7mSeRZs18zwZlh1MsUM=";
+  src = fetchFromGitHub {
+    owner = "lysand-org";
+    repo = "server";
+    rev = "832f72160f574f86c8a8897e5dcb3d6382d8192c";
+    hash = "sha256-BaojznCj0WWA0KkDMLjjlYikwpn975arGLyd0lFBXm0=";
+  };
+}
diff --git a/nix/update.sh b/nix/update.sh
new file mode 100755
index 00000000..00156b24
--- /dev/null
+++ b/nix/update.sh
@@ -0,0 +1,21 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i bash -p nix-prefetch-github
+
+set -euo pipefail
+
+SOURCE=$(nix-prefetch-github --nix lysand-org server | tail -n 6)
+
+cat > ./nix/source.nix << EOF
+{
+  lib,
+  fetchFromGitHub,
+}: {
+  outputHash.x86_64-linux = lib.fakeHash;
+  outputHash.aarch64-linux = lib.fakeHash;
+  src = fetchFromGitHub {
+${SOURCE};
+}
+EOF
+
+echo "Done."
+echo "Please update the attributes of 'outputHash' in nix/source.nix."