diff --git a/flake.nix b/flake.nix
index b937be4..588438c 100644
--- a/flake.nix
+++ b/flake.nix
@@ -10,24 +10,32 @@
     let
       apps = [ "main" "events" "wallet" "chat" "market" "forum" "tasks" "restaurant" "libra" ];
 
+      # Use this flake's pinned nixpkgs for the build, regardless of which
+      # nixpkgs the consumer's `pkgs` is from. Without this, the pnpmDeps
+      # hash drifts as soon as a consumer's nixpkgs has a different
+      # pnpm_10 minor version (snapshots are byte-for-byte different per
+      # pnpm version). Only `pkgs`'s system attribute is honored.
+      flakePkgsFor = pkgs: import nixpkgs {
+        inherit (pkgs.stdenv.hostPlatform) system;
+      };
+
       mkWebapp = { pkgs, brandDir ? ./branding/default, app ? "main" }:
         let
           buildScript = if app == "main" then "build" else "build:${app}";
           outDir = if app == "main" then "dist" else "dist-${app}";
+          flakePkgs = flakePkgsFor pkgs;
         in
-        pkgs.stdenv.mkDerivation (finalAttrs: {
+        flakePkgs.stdenv.mkDerivation (finalAttrs: {
           pname = "aio-webapp-${app}";
           version = "0.0.0";
 
           src = ./.;
 
-          # Pin pnpm major version (10.x) regardless of consumer's nixpkgs
-          # so the pnpmDeps hash stays stable for downstream callers that
-          # bring their own pkgs. package.json's packageManager field
-          # declares pnpm@10.33.0; pnpm_10 satisfies that.
-          pnpm = pkgs.pnpm_10;
+          # pnpm comes from THIS flake's pinned nixpkgs (via flakePkgs),
+          # never the consumer's, so the pnpmDeps snapshot is stable.
+          pnpm = flakePkgs.pnpm_10;
 
-          pnpmDeps = pkgs.fetchPnpmDeps {
+          pnpmDeps = flakePkgs.fetchPnpmDeps {
             inherit (finalAttrs) pname version src;
             inherit (finalAttrs) pnpm;
             fetcherVersion = 3;
@@ -35,16 +43,16 @@
           };
 
           nativeBuildInputs = [
-            pkgs.nodejs
+            flakePkgs.nodejs
             finalAttrs.pnpm
-            pkgs.pnpmConfigHook
-            pkgs.autoPatchelfHook
+            flakePkgs.pnpmConfigHook
+            flakePkgs.autoPatchelfHook
           ];
 
           # sharp's prebuilt libvips binaries (under @img/sharp-libvips-*)
           # are dynamically linked; autoPatchelfHook needs the runtime libs.
           buildInputs = [
-            pkgs.stdenv.cc.cc.lib
+            flakePkgs.stdenv.cc.cc.lib
           ];
 
           # Brand kit env knobs read by vite-branding.ts and
@@ -72,7 +80,7 @@
             runHook postInstall
           '';
 
-          meta = with pkgs.lib; {
+          meta = with flakePkgs.lib; {
             description = "AIO webapp${if app == "main" then "" else " (${app} standalone)"}";
             homepage = "https://git.atitlan.io/aiolabs/webapp";
             license = licenses.mit;