diff --git a/.github/workflows/nix-dev-cache.yaml b/.github/workflows/nix-dev-cache.yaml
index 70234e2740..e984357813 100644
--- a/.github/workflows/nix-dev-cache.yaml
+++ b/.github/workflows/nix-dev-cache.yaml
@@ -24,7 +24,7 @@ jobs:
           - ubuntu-24.04
           # - ubuntu-24.04-arm https://github.com/unisonweb/unison/issues/5789
           - macos-13
-          - macos-14
+          - macos-15
     steps:
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
     - name: mount Nix store on larger partition
@@ -33,13 +33,13 @@ jobs:
       run: |
         sudo mkdir /nix /mnt/nix
         sudo mount --bind /mnt/nix /nix
-    - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
+    - uses: cachix/install-nix-action@9280e7aca88deada44c930f1e2c78e21c3ae3edd # v31.7
       if: runner.os == 'Linux'
       with:
         extra_nix_config: |
           extra-trusted-public-keys = hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ=
           extra-substituters = https://cache.iog.io
-    - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
+    - uses: cachix/install-nix-action@9280e7aca88deada44c930f1e2c78e21c3ae3edd # v31.7
       if: runner.os != 'Linux'
     - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15
       with:
diff --git a/codebase2/codebase-sqlite/unison-codebase-sqlite.cabal b/codebase2/codebase-sqlite/unison-codebase-sqlite.cabal
index 0e5780e7f9..79f9c09eda 100644
--- a/codebase2/codebase-sqlite/unison-codebase-sqlite.cabal
+++ b/codebase2/codebase-sqlite/unison-codebase-sqlite.cabal
@@ -1,6 +1,6 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.37.0.
+-- This file has been generated from package.yaml by hpack version 0.36.0.
 --
 -- see: https://github.com/sol/hpack
 
diff --git a/codebase2/codebase-sync/unison-codebase-sync.cabal b/codebase2/codebase-sync/unison-codebase-sync.cabal
index a0a50e89d3..e36f87a395 100644
--- a/codebase2/codebase-sync/unison-codebase-sync.cabal
+++ b/codebase2/codebase-sync/unison-codebase-sync.cabal
@@ -1,6 +1,6 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.35.0.
+-- This file has been generated from package.yaml by hpack version 0.36.0.
 --
 -- see: https://github.com/sol/hpack
 
diff --git a/codebase2/util-serialization/unison-util-serialization.cabal b/codebase2/util-serialization/unison-util-serialization.cabal
index 57ad5b4a47..21a8d6e4a3 100644
--- a/codebase2/util-serialization/unison-util-serialization.cabal
+++ b/codebase2/util-serialization/unison-util-serialization.cabal
@@ -1,6 +1,6 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.35.0.
+-- This file has been generated from package.yaml by hpack version 0.36.0.
 --
 -- see: https://github.com/sol/hpack
 
diff --git a/codebase2/util-term/unison-util-term.cabal b/codebase2/util-term/unison-util-term.cabal
index a42a62fbe9..1546c87262 100644
--- a/codebase2/util-term/unison-util-term.cabal
+++ b/codebase2/util-term/unison-util-term.cabal
@@ -1,6 +1,6 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.35.0.
+-- This file has been generated from package.yaml by hpack version 0.36.0.
 --
 -- see: https://github.com/sol/hpack
 
diff --git a/flake.lock b/flake.lock
index 4c07d21e1a..f6c6797cee 100644
--- a/flake.lock
+++ b/flake.lock
@@ -645,11 +645,15 @@
       "inputs": {
         "flake-utils": "flake-utils",
         "haskellNix": "haskellNix",
-        "nixpkgs-haskellNix": [
+        "nixpkgs": [
           "haskellNix",
           "nixpkgs-unstable"
         ],
-        "nixpkgs-release": "nixpkgs-release"
+        "nixpkgs-release": "nixpkgs-release",
+        "systems": [
+          "flake-utils",
+          "systems"
+        ]
       }
     },
     "stackage": {
diff --git a/flake.nix b/flake.nix
index 4412b45b24..578d1177ff 100644
--- a/flake.nix
+++ b/flake.nix
@@ -5,54 +5,52 @@
     allow-import-from-derivation = true;
     extra-substituters = ["https://unison.cachix.org"];
     extra-trusted-public-keys = ["unison.cachix.org-1:i1DUFkisRPVOyLp/vblDsbsObmyCviq/zs6eRuzth3k="];
+    ## This allows derivations with `__noChroot` set to run outside the sandbox.
+    sandbox = "relaxed";
   };
 
   inputs = {
+    flake-utils.url = "github:numtide/flake-utils";
     haskellNix.url = "github:input-output-hk/haskell.nix";
-    nixpkgs-haskellNix.follows = "haskellNix/nixpkgs-unstable";
+    nixpkgs.follows = "haskellNix/nixpkgs-unstable";
     nixpkgs-release.url = "github:NixOS/nixpkgs/release-24.05";
-    flake-utils.url = "github:numtide/flake-utils";
+    systems.follows = "flake-utils/systems";
   };
 
   outputs = {
-    self,
+    flake-utils,
     haskellNix,
-    nixpkgs-haskellNix,
+    nixpkgs,
     nixpkgs-release,
-    flake-utils,
+    self,
+    systems,
   }:
-    flake-utils.lib.eachSystem [
-      "x86_64-linux"
-      "x86_64-darwin"
-      "aarch64-darwin"
-      "aarch64-linux"
-    ]
+    flake-utils.lib.eachSystem (import systems)
     (system: let
-      versions = import ./nix/versions.nix {inherit (nixpkgs-haskellNix) lib;};
-      pkgs = import nixpkgs-haskellNix {
+      versions = import ./nix/versions.nix {inherit (nixpkgs) lib;};
+      pkgs = import nixpkgs {
         inherit system;
         inherit (haskellNix) config;
         overlays = [
           haskellNix.overlay
-          (import ./nix/dependencies.nix {inherit nixpkgs-release;})
+          (import ./nix/dependencies.nix {nixpkgs = nixpkgs-release;})
         ];
       };
       unison-project = import ./nix/unison-project.nix {
-        inherit (nixpkgs-haskellNix) lib;
+        inherit (nixpkgs) lib;
         inherit (pkgs) haskell-nix;
       };
       haskell-nix-flake = import ./nix/haskell-nix-flake.nix {
         inherit pkgs unison-project versions;
-        inherit (nixpkgs-haskellNix) lib;
+        inherit (nixpkgs) lib;
       };
       renameAttrs = fn:
-        nixpkgs-haskellNix.lib.mapAttrs' (name: value: {
+        nixpkgs.lib.mapAttrs' (name: value: {
           inherit value;
           name = fn name;
         });
     in
-      assert pkgs.stack.version == versions.stack;
-      assert pkgs.hpack.version == versions.hpack; {
+      assert pkgs.stack.version == versions.stack; {
         packages =
           renameAttrs (name: "component-${name}") haskell-nix-flake.packages
           // renameAttrs (name: "docker-${name}") (import ./nix/docker.nix {
diff --git a/lib/orphans/network-uri-orphans-sqlite/network-uri-orphans-sqlite.cabal b/lib/orphans/network-uri-orphans-sqlite/network-uri-orphans-sqlite.cabal
index cf3a4679cf..ab2123b0af 100644
--- a/lib/orphans/network-uri-orphans-sqlite/network-uri-orphans-sqlite.cabal
+++ b/lib/orphans/network-uri-orphans-sqlite/network-uri-orphans-sqlite.cabal
@@ -1,6 +1,6 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.35.2.
+-- This file has been generated from package.yaml by hpack version 0.36.0.
 --
 -- see: https://github.com/sol/hpack
 
diff --git a/lib/orphans/unison-core-orphans-sqlite/unison-core-orphans-sqlite.cabal b/lib/orphans/unison-core-orphans-sqlite/unison-core-orphans-sqlite.cabal
index d8f941669c..406d104c36 100644
--- a/lib/orphans/unison-core-orphans-sqlite/unison-core-orphans-sqlite.cabal
+++ b/lib/orphans/unison-core-orphans-sqlite/unison-core-orphans-sqlite.cabal
@@ -1,6 +1,6 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.35.2.
+-- This file has been generated from package.yaml by hpack version 0.36.0.
 --
 -- see: https://github.com/sol/hpack
 
diff --git a/lib/orphans/unison-hash-orphans-aeson/unison-hash-orphans-aeson.cabal b/lib/orphans/unison-hash-orphans-aeson/unison-hash-orphans-aeson.cabal
index c3019f362c..7ececdbe15 100644
--- a/lib/orphans/unison-hash-orphans-aeson/unison-hash-orphans-aeson.cabal
+++ b/lib/orphans/unison-hash-orphans-aeson/unison-hash-orphans-aeson.cabal
@@ -1,6 +1,6 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.35.2.
+-- This file has been generated from package.yaml by hpack version 0.36.0.
 --
 -- see: https://github.com/sol/hpack
 
diff --git a/lib/orphans/unison-hash-orphans-sqlite/unison-hash-orphans-sqlite.cabal b/lib/orphans/unison-hash-orphans-sqlite/unison-hash-orphans-sqlite.cabal
index 7c4ee59a53..e14df7d554 100644
--- a/lib/orphans/unison-hash-orphans-sqlite/unison-hash-orphans-sqlite.cabal
+++ b/lib/orphans/unison-hash-orphans-sqlite/unison-hash-orphans-sqlite.cabal
@@ -1,6 +1,6 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.35.2.
+-- This file has been generated from package.yaml by hpack version 0.36.0.
 --
 -- see: https://github.com/sol/hpack
 
diff --git a/lib/orphans/uuid-orphans-sqlite/uuid-orphans-sqlite.cabal b/lib/orphans/uuid-orphans-sqlite/uuid-orphans-sqlite.cabal
index 193a8ed521..3c749ededd 100644
--- a/lib/orphans/uuid-orphans-sqlite/uuid-orphans-sqlite.cabal
+++ b/lib/orphans/uuid-orphans-sqlite/uuid-orphans-sqlite.cabal
@@ -1,6 +1,6 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.35.2.
+-- This file has been generated from package.yaml by hpack version 0.36.0.
 --
 -- see: https://github.com/sol/hpack
 
diff --git a/lib/unison-hashing/unison-hashing.cabal b/lib/unison-hashing/unison-hashing.cabal
index 83cd62bcba..5cc3e37136 100644
--- a/lib/unison-hashing/unison-hashing.cabal
+++ b/lib/unison-hashing/unison-hashing.cabal
@@ -1,6 +1,6 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.37.0.
+-- This file has been generated from package.yaml by hpack version 0.36.0.
 --
 -- see: https://github.com/sol/hpack
 
diff --git a/lib/unison-pretty-printer/unison-pretty-printer.cabal b/lib/unison-pretty-printer/unison-pretty-printer.cabal
index 6f6792f0e9..e0f274169d 100644
--- a/lib/unison-pretty-printer/unison-pretty-printer.cabal
+++ b/lib/unison-pretty-printer/unison-pretty-printer.cabal
@@ -1,6 +1,6 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.37.0.
+-- This file has been generated from package.yaml by hpack version 0.36.0.
 --
 -- see: https://github.com/sol/hpack
 
diff --git a/lib/unison-sqlite/unison-sqlite.cabal b/lib/unison-sqlite/unison-sqlite.cabal
index 13a9eb27cd..9bd012a20b 100644
--- a/lib/unison-sqlite/unison-sqlite.cabal
+++ b/lib/unison-sqlite/unison-sqlite.cabal
@@ -1,6 +1,6 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.37.0.
+-- This file has been generated from package.yaml by hpack version 0.36.0.
 --
 -- see: https://github.com/sol/hpack
 
diff --git a/lib/unison-util-file-embed/unison-util-file-embed.cabal b/lib/unison-util-file-embed/unison-util-file-embed.cabal
index d15d6e908b..6f74c10d2f 100644
--- a/lib/unison-util-file-embed/unison-util-file-embed.cabal
+++ b/lib/unison-util-file-embed/unison-util-file-embed.cabal
@@ -1,6 +1,6 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.35.2.
+-- This file has been generated from package.yaml by hpack version 0.36.0.
 --
 -- see: https://github.com/sol/hpack
 
diff --git a/lib/unison-util-rope/unison-util-rope.cabal b/lib/unison-util-rope/unison-util-rope.cabal
index 7d314ce042..6711189418 100644
--- a/lib/unison-util-rope/unison-util-rope.cabal
+++ b/lib/unison-util-rope/unison-util-rope.cabal
@@ -1,6 +1,6 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.35.2.
+-- This file has been generated from package.yaml by hpack version 0.36.0.
 --
 -- see: https://github.com/sol/hpack
 
diff --git a/nix/dependencies.nix b/nix/dependencies.nix
index 7df873660f..539d63842c 100644
--- a/nix/dependencies.nix
+++ b/nix/dependencies.nix
@@ -1,10 +1,10 @@
-{nixpkgs-release}: final: prev: let
-  pinned-pkgs = import nixpkgs-release {inherit (final) system;};
+{nixpkgs}: final: prev: let
+  pinned-pkgs = nixpkgs.legacyPackages.${final.system};
 in {
   stack = pinned-pkgs.stack;
 
-  ## See https://docs.haskellstack.org/en/stable/nix_integration/#supporting-both-nix-and-non-nix-developers for an
-  ## explanation of this package.
+  ## See https://docs.haskellstack.org/en/stable/topics/nix_integration/#supporting-both-nix-and-non-nix-developers for
+  ## an explanation of this package.
   stack-wrapped = final.symlinkJoin {
     name = "stack"; # will be available as the usual `stack` in terminal
     paths = [final.stack];
diff --git a/nix/haskell-nix-flake.nix b/nix/haskell-nix-flake.nix
index 3896076604..91e37a4127 100644
--- a/nix/haskell-nix-flake.nix
+++ b/nix/haskell-nix-flake.nix
@@ -33,20 +33,14 @@
         ++ [
           pkgs.cachix
           pkgs.gettext # for envsubst, used by unison-src/builtin-tests/interpreter-tests.sh
-          pkgs.hpack
           pkgs.jq # helpful when pushing to Cachix
           pkgs.pkg-config
           pkgs.stack-wrapped
         ];
-      # workaround for https://gitlab.haskell.org/ghc/ghc/-/issues/11042
-      shellHook = ''
-        export LD_LIBRARY_PATH=${pkgs.zlib}/lib:$LD_LIBRARY_PATH
-      '';
       tools =
         (args.tools or {})
         // {
-          cabal = {version = versions.cabal;};
-          ormolu = {version = versions.ormolu;};
+          cabal.version = versions.cabal;
           haskell-language-server = {
             version = versions.hls;
             modules = [
@@ -65,7 +59,9 @@
               constraints: ormolu == ${versions.ormolu}
             '';
           };
-          weeder = {version = versions.weeder;};
+          hpack.version = versions.hpack;
+          ormolu.version = versions.ormolu;
+          weeder.version = versions.weeder;
         };
     };
 
@@ -80,6 +76,10 @@ in
       // {
         ## This check has a test that tries to write to $HOME, so we give it a fake one.
         "unison-cli:test:cli-tests" = haskell-nix-flake.checks."unison-cli:test:cli-tests".overrideAttrs (old: {
+          ## On macOS, this derivation requires access to `security`, which is outside the sandbox, so we tell Nix that
+          ## it doesn’t work in the sandbox. There is a lot of discussion, but no fix, with NixOS/nixpkgs#297775 maybe
+          ## being the best starting point.
+          __noChroot = pkgs.stdenv.isDarwin;
           ## The builder here doesn’t `runHook preBuild`, so we just prepend onto `buildPhase`.
           buildPhase =
             ''
diff --git a/nix/versions.nix b/nix/versions.nix
index e924acd830..63ac751101 100644
--- a/nix/versions.nix
+++ b/nix/versions.nix
@@ -6,7 +6,7 @@ in
   vscodeSettings."haskell.toolchain"
   ## There are some things we want to pin that the VS Code Haskell extension doesn’t let us control.
   // {
-    hpack = "0.35.2";
+    hpack = "0.36.0"; # This needs to match the version returned by `nix develop --command stack --version`.
     ormolu = "0.7.2.0";
     weeder = "2.8.0";
   }
diff --git a/parser-typechecker/unison-parser-typechecker.cabal b/parser-typechecker/unison-parser-typechecker.cabal
index a3714bec08..0e90adaae8 100644
--- a/parser-typechecker/unison-parser-typechecker.cabal
+++ b/parser-typechecker/unison-parser-typechecker.cabal
@@ -1,6 +1,6 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.37.0.
+-- This file has been generated from package.yaml by hpack version 0.36.0.
 --
 -- see: https://github.com/sol/hpack
 
diff --git a/unison-cli-integration/unison-cli-integration.cabal b/unison-cli-integration/unison-cli-integration.cabal
index 6cda3a952d..faad64d72a 100644
--- a/unison-cli-integration/unison-cli-integration.cabal
+++ b/unison-cli-integration/unison-cli-integration.cabal
@@ -1,6 +1,6 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.37.0.
+-- This file has been generated from package.yaml by hpack version 0.36.0.
 --
 -- see: https://github.com/sol/hpack
 
diff --git a/unison-cli-main/unison-cli-main.cabal b/unison-cli-main/unison-cli-main.cabal
index e94c51e228..e79362e14a 100644
--- a/unison-cli-main/unison-cli-main.cabal
+++ b/unison-cli-main/unison-cli-main.cabal
@@ -1,6 +1,6 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.37.0.
+-- This file has been generated from package.yaml by hpack version 0.36.0.
 --
 -- see: https://github.com/sol/hpack
 
diff --git a/unison-runtime/unison-runtime.cabal b/unison-runtime/unison-runtime.cabal
index 5269eb0e46..101c2f063c 100644
--- a/unison-runtime/unison-runtime.cabal
+++ b/unison-runtime/unison-runtime.cabal
@@ -1,6 +1,6 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.37.0.
+-- This file has been generated from package.yaml by hpack version 0.36.0.
 --
 -- see: https://github.com/sol/hpack
 
diff --git a/unison-share-api/unison-share-api.cabal b/unison-share-api/unison-share-api.cabal
index dd8a117685..2bb80dbf8a 100644
--- a/unison-share-api/unison-share-api.cabal
+++ b/unison-share-api/unison-share-api.cabal
@@ -1,6 +1,6 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.37.0.
+-- This file has been generated from package.yaml by hpack version 0.36.0.
 --
 -- see: https://github.com/sol/hpack
 
diff --git a/unison-share-projects-api/unison-share-projects-api.cabal b/unison-share-projects-api/unison-share-projects-api.cabal
index 17d5aaeb2b..a0a711d8c3 100644
--- a/unison-share-projects-api/unison-share-projects-api.cabal
+++ b/unison-share-projects-api/unison-share-projects-api.cabal
@@ -1,6 +1,6 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.37.0.
+-- This file has been generated from package.yaml by hpack version 0.36.0.
 --
 -- see: https://github.com/sol/hpack