diff --git a/flake.nix b/flake.nix
index 97afeed..b937be4 100644
--- a/flake.nix
+++ b/flake.nix
@@ -21,15 +21,22 @@
 
           src = ./.;
 
+          # Pin pnpm major version (10.x) regardless of consumer's nixpkgs
+          # so the pnpmDeps hash stays stable for downstream callers that
+          # bring their own pkgs. package.json's packageManager field
+          # declares pnpm@10.33.0; pnpm_10 satisfies that.
+          pnpm = pkgs.pnpm_10;
+
           pnpmDeps = pkgs.fetchPnpmDeps {
             inherit (finalAttrs) pname version src;
+            inherit (finalAttrs) pnpm;
             fetcherVersion = 3;
-            hash = "sha256-GZuH5ndka9PEHjC00g+kUJW515Zj/+xW6DZQAaK8G4k=";
+            hash = "sha256-FUN2lMHsaBTkk1tljDysYZAoQD+5MIBIEvGnRUWiF4s=";
           };
 
           nativeBuildInputs = [
             pkgs.nodejs
-            pkgs.pnpm
+            finalAttrs.pnpm
             pkgs.pnpmConfigHook
             pkgs.autoPatchelfHook
           ];
@@ -47,6 +54,9 @@
           env = {
             BRAND_DIR = "${brandDir}";
             BRAND_APP = if app == "main" then "" else app;
+            # Avoid pnpm 10's interactive modules-purge prompt in the
+            # sandbox (ERR_PNPM_ABORTED_REMOVE_MODULES_DIR_NO_TTY).
+            CI = "true";
           };
 
           buildPhase = ''