diff --git a/.github/workflows/nix-package-check.yml b/.github/workflows/nix-package-check.yml
index a34270bd..581414c8 100644
--- a/.github/workflows/nix-package-check.yml
+++ b/.github/workflows/nix-package-check.yml
@@ -36,11 +36,12 @@ jobs:
           --no-build
 
       - name: Verify fixed dependency closures
-        run: >-
-          nix
-          --accept-flake-config
-          build
-          .#packages.x86_64-linux.canary.cargoDeps
-          .#packages.x86_64-linux.canary.pnpmDeps
-          --no-link
-          --print-build-logs
+        # Rebuild so a cached output cannot hide a stale lockfile hash.
+        run: |
+          nix --accept-flake-config build \
+            .#packages.x86_64-linux.canary.cargoDeps \
+            .#packages.x86_64-linux.canary.pnpmDeps \
+            --no-link --print-build-logs
+          nix --accept-flake-config build \
+            .#packages.x86_64-linux.canary.pnpmDeps \
+            --rebuild --no-link --print-build-logs
diff --git a/nix/package.nix b/nix/package.nix
index 16ad9f35..6cd6fa0b 100644
--- a/nix/package.nix
+++ b/nix/package.nix
@@ -42,7 +42,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       ;
     pnpm = pnpm_11;
     fetcherVersion = 3;
-    hash = "sha256-EUFwuJmJt9T+qEITMg/XDiT57CDVLDBR2Z2XJvTyCsc=";
+    hash = "sha256-EJnJHWso625GL+bDQJ/bN0XFhbU19h27vUEvAOr86kY=";
   };
 
   nativeBuildInputs = [