diff --git a/deploy/nixos/download.nix b/deploy/nixos/download.nix
index 2384d3d..e86be16 100644
--- a/deploy/nixos/download.nix
+++ b/deploy/nixos/download.nix
@@ -23,10 +23,10 @@ let
     src = sourcePath;
     cargoRoot = "backend";
 
-    # SHA-256 of all crates.io dependencies (from backend/Cargo.lock).
-    # Set this to `lib.fakeHash` on the first build, then copy the real hash
-    # from the error message (nixpkgs prints it).
-    cargoHash = cfg.cargoHash;
+    # Derive the dependency hash automatically from the checked-in
+    # backend/Cargo.lock (version 4; all deps are crates.io registry entries, so
+    # no extra outputHashes are needed). No manual cargoHash to maintain.
+    cargoLock.lockFile = sourcePath + "/backend/Cargo.lock";
 
     buildInputs = [ ];
     nativeBuildInputs = with pkgs; [ ];
@@ -87,15 +87,6 @@ in
       description = "Path to the download source tree (backend/ + frontend/). Defaults to workingDir.";
     };
 
-    # SHA-256 of the Cargo dependency vendor (crates.io). See `cargoHash` in
-    # `rustPlatform.buildRustPackage`. Required; default to fakeHash to force a
-    # first build that reports the correct value.
-    cargoHash = lib.mkOption {
-      type = lib.types.str;
-      default = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
-      description = "cargo vendor hash (sha256) of the Rust crate dependencies.";
-    };
-
     user = lib.mkOption {
       type = lib.types.str;
       default = "filehost";