diff --git a/docs/plans/state.json b/docs/plans/state.json
index 87b7870..535d01e 100644
--- a/docs/plans/state.json
+++ b/docs/plans/state.json
@@ -72,7 +72,7 @@
         "flake.lock",
         "nix/package.nix"
       ],
-      "test_status": "nix build now evaluates; still requires real pnpm.fetchDeps hash from first build"
+      "test_status": "nix build dependency hash resolved (fetchPnpmDeps hash pinned from build output); run nix build .#flynn to verify end-to-end in host environment"
     },
 
     "deployment-targets-paas": {
diff --git a/nix/package.nix b/nix/package.nix
index 27d6592..31e5c1a 100644
--- a/nix/package.nix
+++ b/nix/package.nix
@@ -29,7 +29,7 @@ pkgs.stdenv.mkDerivation rec {
 
     # NOTE: Update this hash after the first `nix build` by copying the
   # "got: sha256-..." value from the error message.
-    hash = lib.fakeHash;
+    hash = "sha256-dyxGSSLoMVEKgTs+owdgRZw9uvJhQLEFsib/GPyxtxM=";
   };
 
   nativeBuildInputs = [