diff --git a/crate2nix/Cargo.lock b/crate2nix/Cargo.lock
index 43640483..237563ba 100644
--- a/crate2nix/Cargo.lock
+++ b/crate2nix/Cargo.lock
@@ -1,6 +1,6 @@
 # This file is automatically @generated by Cargo.
 # It is not intended for manual editing.
-version = 3
+version = 4
 
 [[package]]
 name = "aho-corasick"
@@ -100,6 +100,16 @@ dependencies = [
  "thiserror",
 ]
 
+[[package]]
+name = "cargo_toml"
+version = "0.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5fbd1fe9db3ebf71b89060adaf7b0504c2d6a425cf061313099547e382c2e472"
+dependencies = [
+ "serde",
+ "toml",
+]
+
 [[package]]
 name = "cfg-if"
 version = "1.0.0"
@@ -148,6 +158,7 @@ dependencies = [
  "anyhow",
  "cargo-platform",
  "cargo_metadata",
+ "cargo_toml",
  "colored-diff",
  "fs_extra",
  "hex",
@@ -285,9 +296,9 @@ dependencies = [
 
 [[package]]
 name = "hashbrown"
-version = "0.14.5"
+version = "0.15.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
+checksum = "bf151400ff0baff5465007dd2f3e717f3fe502074ca563069ce3a6629d07b289"
 
 [[package]]
 name = "heck"
@@ -341,9 +352,9 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.2.6"
+version = "2.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "168fb715dda47215e360912c096649d23d58bf392ac62f73919e831745e40f26"
+checksum = "8c9c992b02b5b4c94ea26e32fe5bccb7aa7d9f390ab5c1221ff895bc7ea8b652"
 dependencies = [
  "equivalent",
  "hashbrown",
@@ -381,9 +392,9 @@ checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
 
 [[package]]
 name = "libc"
-version = "0.2.155"
+version = "0.2.169"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97b3888a4aecf77e811145cadf6eef5901f4782c53886191b2f693f24761847c"
+checksum = "b5aba8db14291edd000dfcc4d620c7ebfb122c613afb886ca8803fa4e128a20a"
 
 [[package]]
 name = "log"
@@ -405,9 +416,9 @@ checksum = "8548db8274cf1b2b4c093557783f99e9ad64ffdaaa29a6c1af0abc9895c15612"
 
 [[package]]
 name = "once_cell"
-version = "1.19.0"
+version = "1.20.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
+checksum = "1261fe7e33c73b354eab43b1273a57c8f967d0391e80353e51f764ac02cf6775"
 
 [[package]]
 name = "pathdiff"
@@ -452,7 +463,7 @@ dependencies = [
  "pest_meta",
  "proc-macro2",
  "quote",
- "syn 2.0.68",
+ "syn 2.0.96",
 ]
 
 [[package]]
@@ -492,9 +503,9 @@ dependencies = [
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.86"
+version = "1.0.93"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e719e8df665df0d1c8fbfd238015744736151d4445ec0836b8e628aae103b77"
+checksum = "60946a68e5f9d28b0dc1c21bb8a97ee7d018a8b322fa57838ba31cc878e22d99"
 dependencies = [
  "unicode-ident",
 ]
@@ -609,40 +620,41 @@ dependencies = [
 
 [[package]]
 name = "serde"
-version = "1.0.203"
+version = "1.0.217"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7253ab4de971e72fb7be983802300c30b5a7f0c2e56fab8abfc6a214307c0094"
+checksum = "02fc4265df13d6fa1d00ecff087228cc0a2b5f3c0e87e258d8b94a156e984c70"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.203"
+version = "1.0.217"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "500cbc0ebeb6f46627f50f3f5811ccf6bf00643be300b4c3eabc0ef55dc5b5ba"
+checksum = "5a9bf7cf98d04a2b28aead066b7496853d4779c9cc183c440dbac457641e19a0"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.68",
+ "syn 2.0.96",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.118"
+version = "1.0.137"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d947f6b3163d8857ea16c4fa0dd4840d52f3041039a85decd46867eb1abef2e4"
+checksum = "930cfb6e6abf99298aaad7d29abbef7a9999a9a8806a40088f55f0dcec03146b"
 dependencies = [
  "itoa",
+ "memchr",
  "ryu",
  "serde",
 ]
 
 [[package]]
 name = "serde_spanned"
-version = "0.6.6"
+version = "0.6.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "79e674e01f999af37c49f70a6ede167a8a60b2503e56c5599532a65baa5969a0"
+checksum = "87607cb1398ed59d48732e575a4c28a7a8ebf2454b964fe3f224f2afc07909e1"
 dependencies = [
  "serde",
 ]
@@ -701,9 +713,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.68"
+version = "2.0.96"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "901fa70d88b9d6c98022e23b4136f9f3e54e4662c3bc1bd1d84a42a9a0f0c1e9"
+checksum = "d5d0adab1ae378d7f53bdebc67a39f1f151407ef230f0ce2883572f5d8985c80"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -747,22 +759,22 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "1.0.61"
+version = "1.0.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c546c80d6be4bc6a00c0f01730c08df82eaa7a7a61f11d656526506112cc1709"
+checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.61"
+version = "1.0.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46c3384250002a6d5af4d114f2845d37b57521033f30d5c3f46c4d70e1197533"
+checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.68",
+ "syn 2.0.96",
 ]
 
 [[package]]
@@ -782,9 +794,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "toml"
-version = "0.8.14"
+version = "0.8.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f49eb2ab21d2f26bd6db7bf383edc527a7ebaee412d17af4d40fdccd442f335"
+checksum = "a1ed1f98e3fdc28d6d910e6737ae6ab1a93bf1985935a1193e68f93eeb68d24e"
 dependencies = [
  "serde",
  "serde_spanned",
@@ -794,18 +806,18 @@ dependencies = [
 
 [[package]]
 name = "toml_datetime"
-version = "0.6.6"
+version = "0.6.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4badfd56924ae69bcc9039335b2e017639ce3f9b001c393c1b2d1ef846ce2cbf"
+checksum = "0dd7358ecb8fc2f8d014bf86f6f638ce72ba252a2c3a2572f2a795f1d23efb41"
 dependencies = [
  "serde",
 ]
 
 [[package]]
 name = "toml_edit"
-version = "0.22.14"
+version = "0.22.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f21c7aaf97f1bd9ca9d4f9e73b0a6c74bd5afef56f2bc931943a6e1c37e04e38"
+checksum = "4ae48d6208a266e853d946088ed816055e556cc6028c5e8e2b84d9fa5dd7c7f5"
 dependencies = [
  "indexmap",
  "serde",
@@ -985,9 +997,9 @@ dependencies = [
 
 [[package]]
 name = "windows-targets"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f0713a46559409d202e70e28227288446bf7841d3211583a4b53e3f6d96e7eb"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
 dependencies = [
  "windows_aarch64_gnullvm",
  "windows_aarch64_msvc",
@@ -1001,57 +1013,57 @@ dependencies = [
 
 [[package]]
 name = "windows_aarch64_gnullvm"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7088eed71e8b8dda258ecc8bac5fb1153c5cffaf2578fc8ff5d61e23578d3263"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
 
 [[package]]
 name = "windows_aarch64_msvc"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9985fd1504e250c615ca5f281c3f7a6da76213ebd5ccc9561496568a2752afb6"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 
 [[package]]
 name = "windows_i686_gnu"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88ba073cf16d5372720ec942a8ccbf61626074c6d4dd2e745299726ce8b89670"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
 
 [[package]]
 name = "windows_i686_gnullvm"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87f4261229030a858f36b459e748ae97545d6f1ec60e5e0d6a3d32e0dc232ee9"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 
 [[package]]
 name = "windows_i686_msvc"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db3c2bf3d13d5b658be73463284eaf12830ac9a26a90c717b7f771dfe97487bf"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 
 [[package]]
 name = "windows_x86_64_gnu"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e4246f76bdeff09eb48875a0fd3e2af6aada79d409d33011886d3e1581517d9"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "852298e482cd67c356ddd9570386e2862b5673c85bd5f88df9ab6802b334c596"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 
 [[package]]
 name = "windows_x86_64_msvc"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bec47e5bfd1bff0eeaf6d8b485cc1074891a197ab4225d504cb7a1ab88b02bf0"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
 [[package]]
 name = "winnow"
-version = "0.6.13"
+version = "0.6.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59b5e5f6c299a3c7890b876a2a587f3115162487e704907d9b6cd29473052ba1"
+checksum = "c8d71a593cc5c42ad7876e2c1fda56f314f3754c084128833e64f1345ff8a03a"
 dependencies = [
  "memchr",
 ]
diff --git a/crate2nix/Cargo.nix b/crate2nix/Cargo.nix
index cfdb08c8..674ac893 100644
--- a/crate2nix/Cargo.nix
+++ b/crate2nix/Cargo.nix
@@ -216,6 +216,7 @@ rec {
         version = "0.10.4";
         edition = "2018";
         sha256 = "0w9sa2ypmrsqqvc20nhwr75wbb5cjr4kkyhpjm1z1lv2kdicfy1h";
+        libName = "block_buffer";
         authors = [
           "RustCrypto Developers"
         ];
@@ -289,6 +290,7 @@ rec {
         version = "0.1.8";
         edition = "2021";
         sha256 = "1z5b7ivbj508wkqdg2vb0hw4vi1k1pyhcn6h1h1b8svcb8vg1c94";
+        libName = "cargo_platform";
         dependencies = [
           {
             name = "serde";
@@ -341,11 +343,35 @@ rec {
         };
         resolvedDefaultFeatures = [ "default" ];
       };
+      "cargo_toml" = rec {
+        crateName = "cargo_toml";
+        version = "0.21.0";
+        edition = "2021";
+        sha256 = "0wp4qa1f6iwm149i61ng4njddhh40mxszbb0j2w73gryvglizgaz";
+        libPath = "src/cargo_toml.rs";
+        authors = [
+          "Kornel <kornel@geekhood.net>"
+        ];
+        dependencies = [
+          {
+            name = "serde";
+            packageId = "serde";
+            features = [ "derive" ];
+          }
+          {
+            name = "toml";
+            packageId = "toml";
+          }
+        ];
+        features = {
+        };
+      };
       "cfg-if" = rec {
         crateName = "cfg-if";
         version = "1.0.0";
         edition = "2018";
         sha256 = "1za0vb97n4brpzpv8lsbnzmq5r8f2b0cpqqr0sy8h5bn751xxwds";
+        libName = "cfg_if";
         authors = [
           "Alex Crichton <alex@alexcrichton.com>"
         ];
@@ -420,6 +446,7 @@ rec {
         version = "0.2.3";
         edition = "2015";
         sha256 = "1dfwjxd13f8l8bdzm76kkp6cp4sr1pyc8lavp52avwy313mhh0j1";
+        libName = "colored_diff";
         dependencies = [
           {
             name = "ansi_term";
@@ -497,6 +524,10 @@ rec {
             name = "cargo_metadata";
             packageId = "cargo_metadata";
           }
+          {
+            name = "cargo_toml";
+            packageId = "cargo_toml";
+          }
           {
             name = "hex";
             packageId = "hex";
@@ -572,6 +603,7 @@ rec {
         version = "0.8.5";
         edition = "2021";
         sha256 = "03bp38ljx4wj6vvy4fbhx41q8f585zyqix6pncz1mkz93z08qgv1";
+        libName = "crossbeam_deque";
         dependencies = [
           {
             name = "crossbeam-epoch";
@@ -595,6 +627,7 @@ rec {
         version = "0.9.18";
         edition = "2021";
         sha256 = "03j2np8llwf376m3fxqx859mgp9f83hj1w34153c7a9c7i5ar0jv";
+        libName = "crossbeam_epoch";
         dependencies = [
           {
             name = "crossbeam-utils";
@@ -616,6 +649,7 @@ rec {
         version = "0.8.20";
         edition = "2021";
         sha256 = "100fksq5mm1n7zj242cclkw6yf7a4a8ix3lvpfkhxvdhbda9kv12";
+        libName = "crossbeam_utils";
         features = {
           "default" = [ "std" ];
           "loom" = [ "dep:loom" ];
@@ -627,6 +661,7 @@ rec {
         version = "0.1.6";
         edition = "2018";
         sha256 = "1cvby95a6xg7kxdz5ln3rl9xh66nz66w46mm3g56ri1z5x815yqv";
+        libName = "crypto_common";
         authors = [
           "RustCrypto Developers"
         ];
@@ -748,6 +783,7 @@ rec {
         version = "0.1.1";
         edition = "2018";
         sha256 = "1fnkqrbz7ixxzsb04bsz9p0zzazanma8znfdqjvh39n14vapfvx0";
+        libName = "fuchsia_cprng";
         authors = [
           "Erick Tryzelaar <etryzelaar@google.com>"
         ];
@@ -852,27 +888,25 @@ rec {
       };
       "hashbrown" = rec {
         crateName = "hashbrown";
-        version = "0.14.5";
+        version = "0.15.2";
         edition = "2021";
-        sha256 = "1wa1vy1xs3mp11bn3z9dv0jricgr6a2j0zkf1g19yz3vw4il89z5";
+        sha256 = "12dj0yfn59p3kh3679ac0w1fagvzf4z2zp87a13gbbqbzw0185dz";
         authors = [
           "Amanieu d'Antras <amanieu@gmail.com>"
         ];
         features = {
-          "ahash" = [ "dep:ahash" ];
           "alloc" = [ "dep:alloc" ];
           "allocator-api2" = [ "dep:allocator-api2" ];
           "compiler_builtins" = [ "dep:compiler_builtins" ];
           "core" = [ "dep:core" ];
-          "default" = [ "ahash" "inline-more" "allocator-api2" ];
+          "default" = [ "default-hasher" "inline-more" "allocator-api2" "equivalent" "raw-entry" ];
+          "default-hasher" = [ "dep:foldhash" ];
           "equivalent" = [ "dep:equivalent" ];
           "nightly" = [ "allocator-api2?/nightly" "bumpalo/allocator_api" ];
           "rayon" = [ "dep:rayon" ];
-          "rkyv" = [ "dep:rkyv" ];
-          "rustc-dep-of-std" = [ "nightly" "core" "compiler_builtins" "alloc" "rustc-internal-api" ];
+          "rustc-dep-of-std" = [ "nightly" "core" "compiler_builtins" "alloc" "rustc-internal-api" "raw-entry" ];
           "serde" = [ "dep:serde" ];
         };
-        resolvedDefaultFeatures = [ "raw" ];
       };
       "heck" = rec {
         crateName = "heck";
@@ -895,6 +929,7 @@ rec {
         version = "0.1.19";
         edition = "2018";
         sha256 = "0cxcm8093nf5fyn114w8vxbrbcyvv91d4015rdnlgfll7cs6gd32";
+        libName = "hermit_abi";
         authors = [
           "Stefan Lankes"
         ];
@@ -1004,9 +1039,9 @@ rec {
       };
       "indexmap" = rec {
         crateName = "indexmap";
-        version = "2.2.6";
+        version = "2.7.1";
         edition = "2021";
-        sha256 = "09hgwi2ig0wyj5rjziia76zmhgfj95k0jb4ic3iiawm4vlavg3qn";
+        sha256 = "0lmnm1zbr5gq3wic3d8a76gpvampridzwckfl97ckd5m08mrk74c";
         dependencies = [
           {
             name = "equivalent";
@@ -1017,7 +1052,6 @@ rec {
             name = "hashbrown";
             packageId = "hashbrown";
             usesDefaultFeatures = false;
-            features = [ "raw" ];
           }
         ];
         features = {
@@ -1099,9 +1133,9 @@ rec {
       };
       "libc" = rec {
         crateName = "libc";
-        version = "0.2.155";
-        edition = "2015";
-        sha256 = "0z44c53z54znna8n322k5iwg80arxxpdzjj5260pxxzc9a58icwp";
+        version = "0.2.169";
+        edition = "2021";
+        sha256 = "02m253hs8gw0m1n8iyrsc4n15yzbqwhddi7w1l0ds7i92kdsiaxm";
         authors = [
           "The Rust Project Developers"
         ];
@@ -1160,6 +1194,7 @@ rec {
         version = "0.1.1";
         edition = "2018";
         sha256 = "04jnq6arig0amz0scadavbzn9bg9k4zphmrm1562n6ygfj1dnj45";
+        libName = "nix_base32";
         authors = [
           "Peter Kolloch <info@eigenvalue.net>"
         ];
@@ -1167,9 +1202,9 @@ rec {
       };
       "once_cell" = rec {
         crateName = "once_cell";
-        version = "1.19.0";
+        version = "1.20.2";
         edition = "2021";
-        sha256 = "14kvw7px5z96dk4dwdm1r9cqhhy2cyj1l5n5b29mynbb8yr15nrz";
+        sha256 = "0xb7rw1aqr7pa4z3b00y7786gyf8awx2gca3md73afy76dzgwq8j";
         authors = [
           "Aleksey Kladov <aleksey.kladov@gmail.com>"
         ];
@@ -1201,6 +1236,7 @@ rec {
         version = "2.3.1";
         edition = "2018";
         sha256 = "0gi8wgx0dcy8rnv1kywdv98lwcx67hz0a0zwpib5v2i08r88y573";
+        libName = "percent_encoding";
         authors = [
           "The rust-url developers"
         ];
@@ -1300,7 +1336,7 @@ rec {
           }
           {
             name = "syn";
-            packageId = "syn 2.0.68";
+            packageId = "syn 2.0.96";
           }
         ];
         features = {
@@ -1346,6 +1382,7 @@ rec {
         version = "1.0.4";
         edition = "2018";
         sha256 = "1373bhxaf0pagd8zkyd03kkx6bchzf6g0dkwrwzsnal9z47lj9fs";
+        libName = "proc_macro_error";
         authors = [
           "CreepySkeleton <creepy-skeleton@yandex.ru>"
         ];
@@ -1388,6 +1425,7 @@ rec {
         edition = "2018";
         sha256 = "0sgq6m5jfmasmwwy8x4mjygx5l7kp8s4j60bv25ckv2j1qc41gm1";
         procMacro = true;
+        libName = "proc_macro_error_attr";
         authors = [
           "CreepySkeleton <creepy-skeleton@yandex.ru>"
         ];
@@ -1411,9 +1449,9 @@ rec {
       };
       "proc-macro2" = rec {
         crateName = "proc-macro2";
-        version = "1.0.86";
+        version = "1.0.93";
         edition = "2021";
-        sha256 = "0xrv22p8lqlfdf1w0pj4si8n2ws4aw0kilmziwf0vpv5ys6rwway";
+        sha256 = "169dw9wch753if1mgyi2nfl1il77gslvh6y2q46qplprwml6m530";
         libName = "proc_macro2";
         authors = [
           "David Tolnay <dtolnay@gmail.com>"
@@ -1726,6 +1764,7 @@ rec {
         version = "1.0.6";
         edition = "2018";
         sha256 = "00h5j1w87dmhnvbv9l8bic3y7xxsnjmssvifw2ayvgx9mb1ivz4k";
+        libName = "same_file";
         authors = [
           "Andrew Gallant <jamslam@gmail.com>"
         ];
@@ -1762,9 +1801,9 @@ rec {
       };
       "serde" = rec {
         crateName = "serde";
-        version = "1.0.203";
+        version = "1.0.217";
         edition = "2018";
-        sha256 = "1500ghq198n6py5anvz5qbqagd9h1hq04f4qpsvjzrvix56snlvj";
+        sha256 = "0w2ck1p1ajmrv1cf51qf7igjn2nc51r0izzc00fzmmhkvxjl5z02";
         authors = [
           "Erick Tryzelaar <erick.tryzelaar@gmail.com>"
           "David Tolnay <dtolnay@gmail.com>"
@@ -1796,9 +1835,9 @@ rec {
       };
       "serde_derive" = rec {
         crateName = "serde_derive";
-        version = "1.0.203";
+        version = "1.0.217";
         edition = "2015";
-        sha256 = "1fmmqmfza3mwxb1v80737dj01gznrh8mhgqgylkndx5npq7bq32h";
+        sha256 = "180r3rj5gi5s1m23q66cr5wlfgc5jrs6n1mdmql2njnhk37zg6ss";
         procMacro = true;
         authors = [
           "Erick Tryzelaar <erick.tryzelaar@gmail.com>"
@@ -1819,7 +1858,7 @@ rec {
           }
           {
             name = "syn";
-            packageId = "syn 2.0.68";
+            packageId = "syn 2.0.96";
             usesDefaultFeatures = false;
             features = [ "clone-impls" "derive" "parsing" "printing" "proc-macro" ];
           }
@@ -1830,9 +1869,9 @@ rec {
       };
       "serde_json" = rec {
         crateName = "serde_json";
-        version = "1.0.118";
+        version = "1.0.137";
         edition = "2021";
-        sha256 = "1r7jpqdfnrv8skn5va1r202g6lhdhka0vyn42vm5g21x2srzciyr";
+        sha256 = "0sql0gndrw2miw440sl0m2lrk6bsxyxrmlnpma52k6dzd9pgn34k";
         authors = [
           "Erick Tryzelaar <erick.tryzelaar@gmail.com>"
           "David Tolnay <dtolnay@gmail.com>"
@@ -1842,6 +1881,11 @@ rec {
             name = "itoa";
             packageId = "itoa";
           }
+          {
+            name = "memchr";
+            packageId = "memchr";
+            usesDefaultFeatures = false;
+          }
           {
             name = "ryu";
             packageId = "ryu";
@@ -1864,15 +1908,15 @@ rec {
           "default" = [ "std" ];
           "indexmap" = [ "dep:indexmap" ];
           "preserve_order" = [ "indexmap" "std" ];
-          "std" = [ "serde/std" ];
+          "std" = [ "memchr/std" "serde/std" ];
         };
         resolvedDefaultFeatures = [ "default" "std" "unbounded_depth" ];
       };
       "serde_spanned" = rec {
         crateName = "serde_spanned";
-        version = "0.6.6";
+        version = "0.6.8";
         edition = "2021";
-        sha256 = "1839b6m5p9ijjmcwamiya2r612ks2vg6w2pp95yg76lr3zh79rkr";
+        sha256 = "1q89g70azwi4ybilz5jb8prfpa575165lmrffd49vmcf76qpqq47";
         dependencies = [
           {
             name = "serde";
@@ -1985,6 +2029,7 @@ rec {
         edition = "2018";
         sha256 = "1q5gcigmvw0cinjxzpyrkflliq5r1ivljmrvfrl3phcwgwraxdfw";
         procMacro = true;
+        libName = "structopt_derive";
         authors = [
           "Guillaume Pinot <texitoi@texitoi.eu>"
         ];
@@ -2048,11 +2093,11 @@ rec {
         };
         resolvedDefaultFeatures = [ "clone-impls" "default" "derive" "full" "parsing" "printing" "proc-macro" "quote" ];
       };
-      "syn 2.0.68" = rec {
+      "syn 2.0.96" = rec {
         crateName = "syn";
-        version = "2.0.68";
+        version = "2.0.96";
         edition = "2021";
-        sha256 = "1sf1y2hajhjav38ipg63c934xrgkz4v42fz24a0ckmmri06sf7wh";
+        sha256 = "102wk3cgawimi3i0q3r3xw3i858zkyingg6y7gsxfy733amsvl6m";
         authors = [
           "David Tolnay <dtolnay@gmail.com>"
         ];
@@ -2178,9 +2223,9 @@ rec {
       };
       "thiserror" = rec {
         crateName = "thiserror";
-        version = "1.0.61";
+        version = "1.0.69";
         edition = "2021";
-        sha256 = "028prh962l16cmjivwb1g9xalbpqip0305zhq006mg74dc6whin5";
+        sha256 = "0lizjay08agcr5hs9yfzzj6axs53a2rgx070a1dsi3jpkcrzbamn";
         authors = [
           "David Tolnay <dtolnay@gmail.com>"
         ];
@@ -2194,9 +2239,9 @@ rec {
       };
       "thiserror-impl" = rec {
         crateName = "thiserror-impl";
-        version = "1.0.61";
+        version = "1.0.69";
         edition = "2021";
-        sha256 = "0cvm37hp0kbcyk1xac1z0chpbd9pbn2g456iyid6sah0a113ihs6";
+        sha256 = "1h84fmn2nai41cxbhk6pqf46bxqq1b344v8yz089w1chzi76rvjg";
         procMacro = true;
         libName = "thiserror_impl";
         authors = [
@@ -2213,7 +2258,7 @@ rec {
           }
           {
             name = "syn";
-            packageId = "syn 2.0.68";
+            packageId = "syn 2.0.96";
           }
         ];
 
@@ -2256,9 +2301,9 @@ rec {
       };
       "toml" = rec {
         crateName = "toml";
-        version = "0.8.14";
+        version = "0.8.19";
         edition = "2021";
-        sha256 = "0dgk8bacrza09npifba1xsx7wyjjvhz3igxpdnyjcbqxn8mfnjbg";
+        sha256 = "0knjd3mkxyb87qcs2dark3qkpadidap3frqfj5nqvhpxwfc1zvd1";
         authors = [
           "Alex Crichton <alex@alexcrichton.com>"
         ];
@@ -2303,9 +2348,9 @@ rec {
       };
       "toml_datetime" = rec {
         crateName = "toml_datetime";
-        version = "0.6.6";
+        version = "0.6.8";
         edition = "2021";
-        sha256 = "1grcrr3gh7id3cy3j700kczwwfbn04p5ncrrj369prjaj9bgvbab";
+        sha256 = "0hgv7v9g35d7y9r2afic58jvlwnf73vgd1mz2k8gihlgrf73bmqd";
         authors = [
           "Alex Crichton <alex@alexcrichton.com>"
         ];
@@ -2323,9 +2368,9 @@ rec {
       };
       "toml_edit" = rec {
         crateName = "toml_edit";
-        version = "0.22.14";
+        version = "0.22.22";
         edition = "2021";
-        sha256 = "0f2fw0viqvisjhqwjavgypz5mgbldh53przrsjlrrggijyppl77j";
+        sha256 = "1xf7sxfzmnc45f75x302qrn5aph52vc8w226v59yhrm211i8vr2a";
         authors = [
           "Andronik Ordian <write@reusable.software>"
           "Ed Page <eopage@gmail.com>"
@@ -2385,6 +2430,7 @@ rec {
         version = "0.1.6";
         edition = "2021";
         sha256 = "1ff4yfksirqs37ybin9aw71aa5gva00hw7jdxbw8w668zy964r7d";
+        libName = "ucd_trie";
         authors = [
           "Andrew Gallant <jamslam@gmail.com>"
         ];
@@ -2398,6 +2444,7 @@ rec {
         version = "0.9.0";
         edition = "2018";
         sha256 = "08g21dn3wwix3ycfl0vrbahn0835nv2q3swm8wms0vwvgm07mid8";
+        libName = "unic_char_property";
         authors = [
           "The UNIC Project Developers"
         ];
@@ -2414,6 +2461,7 @@ rec {
         version = "0.9.0";
         edition = "2018";
         sha256 = "1g0z7iwvjhqspi6194zsff8vy6i3921hpqcrp3v1813hbwnh5603";
+        libName = "unic_char_range";
         authors = [
           "The UNIC Project Developers"
         ];
@@ -2428,6 +2476,7 @@ rec {
         version = "0.9.0";
         edition = "2018";
         sha256 = "1g1mm954m0zr497dl4kx3vr09yaly290zs33bbl4wrbaba1gzmw0";
+        libName = "unic_common";
         authors = [
           "The UNIC Project Developers"
         ];
@@ -2440,6 +2489,7 @@ rec {
         version = "0.9.0";
         edition = "2018";
         sha256 = "08wgz2q6vrdvmbd23kf9pbg8cyzm5q8hq9spc4blzy2ppqk5vvg4";
+        libName = "unic_segment";
         authors = [
           "The UNIC Project Developers"
         ];
@@ -2456,6 +2506,7 @@ rec {
         version = "0.9.0";
         edition = "2018";
         sha256 = "0027lczcg0r401g6fnzm2bq9fxhgxvri1nlryhhv8192lqic2y90";
+        libName = "unic_ucd_segment";
         authors = [
           "The UNIC Project Developers"
         ];
@@ -2480,6 +2531,7 @@ rec {
         version = "0.9.0";
         edition = "2018";
         sha256 = "1i5hnzpfnxkp4ijfk8kvhpvj84bij575ybqx1b6hyigy6wi2zgcn";
+        libName = "unic_ucd_version";
         authors = [
           "The UNIC Project Developers"
         ];
@@ -2515,6 +2567,7 @@ rec {
         version = "1.0.12";
         edition = "2018";
         sha256 = "0jzf1znfpb2gx8nr8mvmyqs1crnv79l57nxnbiszc7xf7ynbjm1k";
+        libName = "unicode_ident";
         authors = [
           "David Tolnay <dtolnay@gmail.com>"
         ];
@@ -2525,6 +2578,7 @@ rec {
         version = "0.1.23";
         edition = "2018";
         sha256 = "1x81a50h2zxigj74b9bqjsirxxbyhmis54kg600xj213vf31cvd5";
+        libName = "unicode_normalization";
         authors = [
           "kwantam <kwantam@gmail.com>"
           "Manish Goregaokar <manishsmail@gmail.com>"
@@ -2546,6 +2600,7 @@ rec {
         version = "1.11.0";
         edition = "2018";
         sha256 = "00kjpwp1g8fqm45drmwivlacn3y9jx73bvs09n6s3x73nqi7vj6l";
+        libName = "unicode_segmentation";
         authors = [
           "kwantam <kwantam@gmail.com>"
           "Manish Goregaokar <manishsmail@gmail.com>"
@@ -2558,6 +2613,7 @@ rec {
         version = "0.1.13";
         edition = "2021";
         sha256 = "0p92vl8n7qc8mxz45xn6qbgi0259z96n32a158l6vj5bywwdadh3";
+        libName = "unicode_width";
         authors = [
           "kwantam <kwantam@gmail.com>"
           "Manish Goregaokar <manishsmail@gmail.com>"
@@ -2709,6 +2765,7 @@ rec {
         version = "0.4.0";
         edition = "2015";
         sha256 = "1dmpa6mvcvzz16zg6d5vrfy4bxgg541wxrcip7cnshi06v38ffxc";
+        libName = "winapi_i686_pc_windows_gnu";
         authors = [
           "Peter Atashian <retep998@gmail.com>"
         ];
@@ -2719,6 +2776,7 @@ rec {
         version = "0.1.8";
         edition = "2021";
         sha256 = "0svcgddd2rw06mj4r76gj655qsa1ikgz3d3gzax96fz7w62c6k2d";
+        libName = "winapi_util";
         authors = [
           "Andrew Gallant <jamslam@gmail.com>"
         ];
@@ -2737,6 +2795,7 @@ rec {
         version = "0.4.0";
         edition = "2015";
         sha256 = "0gqq64czqb64kskjryj8isp62m2sgvx25yyj3kpc2myh85w24bki";
+        libName = "winapi_x86_64_pc_windows_gnu";
         authors = [
           "Peter Atashian <retep998@gmail.com>"
         ];
@@ -2747,6 +2806,7 @@ rec {
         version = "0.52.0";
         edition = "2021";
         sha256 = "0gd3v4ji88490zgb6b5mq5zgbvwv7zx1ibn8v3x83rwcdbryaar8";
+        libName = "windows_sys";
         authors = [
           "Microsoft"
         ];
@@ -2991,9 +3051,10 @@ rec {
       };
       "windows-targets" = rec {
         crateName = "windows-targets";
-        version = "0.52.5";
+        version = "0.52.6";
         edition = "2021";
-        sha256 = "1sz7jrnkygmmlj1ia8fk85wbyil450kq5qkh5qh9sh2rcnj161vg";
+        sha256 = "0wwrx625nwlfp7k93r2rra568gad1mwd888h1jwnl0vfg5r4ywlv";
+        libName = "windows_targets";
         authors = [
           "Microsoft"
         ];
@@ -3043,9 +3104,9 @@ rec {
       };
       "windows_aarch64_gnullvm" = rec {
         crateName = "windows_aarch64_gnullvm";
-        version = "0.52.5";
+        version = "0.52.6";
         edition = "2021";
-        sha256 = "0qrjimbj67nnyn7zqy15mzzmqg0mn5gsr2yciqjxm3cb3vbyx23h";
+        sha256 = "1lrcq38cr2arvmz19v32qaggvj8bh1640mdm9c2fr877h0hn591j";
         authors = [
           "Microsoft"
         ];
@@ -3053,9 +3114,9 @@ rec {
       };
       "windows_aarch64_msvc" = rec {
         crateName = "windows_aarch64_msvc";
-        version = "0.52.5";
+        version = "0.52.6";
         edition = "2021";
-        sha256 = "1dmga8kqlmln2ibckk6mxc9n59vdg8ziqa2zr8awcl720hazv1cr";
+        sha256 = "0sfl0nysnz32yyfh773hpi49b1q700ah6y7sacmjbqjjn5xjmv09";
         authors = [
           "Microsoft"
         ];
@@ -3063,9 +3124,9 @@ rec {
       };
       "windows_i686_gnu" = rec {
         crateName = "windows_i686_gnu";
-        version = "0.52.5";
+        version = "0.52.6";
         edition = "2021";
-        sha256 = "0w4np3l6qwlra9s2xpflqrs60qk1pz6ahhn91rr74lvdy4y0gfl8";
+        sha256 = "02zspglbykh1jh9pi7gn8g1f97jh1rrccni9ivmrfbl0mgamm6wf";
         authors = [
           "Microsoft"
         ];
@@ -3073,9 +3134,9 @@ rec {
       };
       "windows_i686_gnullvm" = rec {
         crateName = "windows_i686_gnullvm";
-        version = "0.52.5";
+        version = "0.52.6";
         edition = "2021";
-        sha256 = "1s9f4gff0cixd86mw3n63rpmsm4pmr4ffndl6s7qa2h35492dx47";
+        sha256 = "0rpdx1537mw6slcpqa0rm3qixmsb79nbhqy5fsm3q2q9ik9m5vhf";
         authors = [
           "Microsoft"
         ];
@@ -3083,9 +3144,9 @@ rec {
       };
       "windows_i686_msvc" = rec {
         crateName = "windows_i686_msvc";
-        version = "0.52.5";
+        version = "0.52.6";
         edition = "2021";
-        sha256 = "1gw7fklxywgpnwbwg43alb4hm0qjmx72hqrlwy5nanrxs7rjng6v";
+        sha256 = "0rkcqmp4zzmfvrrrx01260q3xkpzi6fzi2x2pgdcdry50ny4h294";
         authors = [
           "Microsoft"
         ];
@@ -3093,9 +3154,9 @@ rec {
       };
       "windows_x86_64_gnu" = rec {
         crateName = "windows_x86_64_gnu";
-        version = "0.52.5";
+        version = "0.52.6";
         edition = "2021";
-        sha256 = "1n8p2mcf3lw6300k77a0knksssmgwb9hynl793mhkzyydgvlchjf";
+        sha256 = "0y0sifqcb56a56mvn7xjgs8g43p33mfqkd8wj1yhrgxzma05qyhl";
         authors = [
           "Microsoft"
         ];
@@ -3103,9 +3164,9 @@ rec {
       };
       "windows_x86_64_gnullvm" = rec {
         crateName = "windows_x86_64_gnullvm";
-        version = "0.52.5";
+        version = "0.52.6";
         edition = "2021";
-        sha256 = "15n56jrh4s5bz66zimavr1rmcaw6wa306myrvmbc6rydhbj9h8l5";
+        sha256 = "03gda7zjx1qh8k9nnlgb7m3w3s1xkysg55hkd1wjch8pqhyv5m94";
         authors = [
           "Microsoft"
         ];
@@ -3113,9 +3174,9 @@ rec {
       };
       "windows_x86_64_msvc" = rec {
         crateName = "windows_x86_64_msvc";
-        version = "0.52.5";
+        version = "0.52.6";
         edition = "2021";
-        sha256 = "1w1bn24ap8dp9i85s8mlg8cim2bl2368bd6qyvm0xzqvzmdpxi5y";
+        sha256 = "1v7rb5cibyzx8vak29pdrk8nx9hycsjs4w0jgms08qk49jl6v7sq";
         authors = [
           "Microsoft"
         ];
@@ -3123,9 +3184,9 @@ rec {
       };
       "winnow" = rec {
         crateName = "winnow";
-        version = "0.6.13";
+        version = "0.6.24";
         edition = "2021";
-        sha256 = "189b0mrr9lkckdyr0177hwj1c59igxc2lsl71f4wg8wrqbvfbdar";
+        sha256 = "0fm0z1gk9wb47s1jhh889isz657kavd1yb3fhzbjmi657icimmy8";
         dependencies = [
           {
             name = "memchr";
diff --git a/crate2nix/Cargo.toml b/crate2nix/Cargo.toml
index 0fd06d2e..583be6c6 100644
--- a/crate2nix/Cargo.toml
+++ b/crate2nix/Cargo.toml
@@ -16,6 +16,7 @@ resolver = "2"
 anyhow = "1.0.28"
 cargo_metadata = "0.18"
 cargo-platform = "0.1"
+cargo_toml = "0.21.0"
 hex = "0.4"
 itertools = "0.12"
 lazy_static = "1"
diff --git a/crate2nix/default.nix b/crate2nix/default.nix
index 5a850653..bce7747a 100644
--- a/crate2nix/default.nix
+++ b/crate2nix/default.nix
@@ -1,9 +1,6 @@
 # Provided by callPackage or also directly usable via nix-build with defaults.
 { pkgs ? (
-    let
-      flakeLock = builtins.fromJSON (builtins.readFile ../flake.lock);
-    in
-    import "${builtins.fetchTree flakeLock.nodes.nixpkgs.locked}" { }
+    import (builtins.fetchTree ((import ../nix/lib.nix).flakeInput "nixpkgs")) { }
   )
 , stdenv ? pkgs.stdenv
 , lib ? pkgs.lib
diff --git a/crate2nix/src/config.rs b/crate2nix/src/config.rs
index 4346d857..114572bb 100644
--- a/crate2nix/src/config.rs
+++ b/crate2nix/src/config.rs
@@ -10,6 +10,8 @@ use std::{
     path::Path,
 };
 
+use crate::CommitHash;
+
 impl Config {
     /// Read config from path.
     pub fn read_from_or_default(path: &Path) -> Result<Config, Error> {
@@ -112,7 +114,7 @@ pub enum Source {
         /// E.g. https://github.com/kolloch/crate2nix.git
         url: url::Url,
         /// The revision hash.
-        rev: String,
+        rev: CommitHash,
         /// The sha256 of the fetched result.
         sha256: String,
     },
@@ -196,14 +198,7 @@ impl Display for Source {
                 sha256,
                 registry,
                 ..
-            } => write!(
-                f,
-                "{} {} from {}: {}",
-                name,
-                version,
-                registry.to_string(),
-                sha256
-            ),
+            } => write!(f, "{} {} from {}: {}", name, version, registry, sha256),
             Source::Git { url, rev, sha256 } => write!(f, "{}#{} via git: {}", url, rev, sha256),
             Source::Nix { file, attr: None } => write!(f, "{}", file),
             Source::Nix {
diff --git a/crate2nix/src/lib.rs b/crate2nix/src/lib.rs
index 1d3a83ef..357bbebe 100644
--- a/crate2nix/src/lib.rs
+++ b/crate2nix/src/lib.rs
@@ -34,6 +34,7 @@ pub mod config;
 mod lock;
 mod metadata;
 pub mod nix_build;
+pub mod normalize_manifest;
 mod prefetch;
 pub mod render;
 mod resolve;
@@ -42,6 +43,8 @@ pub mod sources;
 pub mod test;
 pub mod util;
 
+pub use util::CommitHash;
+
 /// The resolved build info and the input for rendering the build.nix.tera template.
 #[derive(Debug, Deserialize, Serialize)]
 pub struct BuildInfo {
@@ -225,7 +228,7 @@ fn prefetch_and_fill_registries(
     config: &GenerateConfig,
     default_nix: &mut BuildInfo,
 ) -> Result<(), Error> {
-    default_nix.registries = prefetch::prefetch_registries(config, &mut default_nix.crates)
+    default_nix.registries = prefetch::prefetch_registries(config, &default_nix.crates)
         .map_err(|e| format_err!("while prefetching crates for calculating sha256: {}", e))?;
 
     Ok(())
diff --git a/crate2nix/src/lock.rs b/crate2nix/src/lock.rs
index b0aab37d..719e7ee9 100644
--- a/crate2nix/src/lock.rs
+++ b/crate2nix/src/lock.rs
@@ -50,32 +50,31 @@ impl EncodableResolve {
             ..
         } in self.package.iter()
         {
-            let Some((source, checksum)) = Option::zip(source.as_ref(), checksum.as_ref()) else {
+            let Some(source) = source.as_ref() else {
                 continue;
             };
-            if checksum == "<none>" {
-                continue;
-            }
 
-            if let Some(package_id) =
+            let Some(package_id) =
                 package_id_by_source.get(&(name.as_str(), source.as_str(), version.clone()))
-            {
-                hashes.insert((*package_id).clone(), checksum.clone());
-            }
-        }
+            else {
+                continue;
+            };
 
-        // Retrieve legacy checksums.
-        const CHECKSUM_PREFIX: &str = "checksum ";
-        if let Some(metadata) = &self.metadata {
-            for (key, value) in metadata {
-                if key.starts_with(CHECKSUM_PREFIX) {
-                    let package_id = PackageId {
-                        repr: key.trim_start_matches(CHECKSUM_PREFIX).to_string(),
-                    };
-                    if value != "<none>" {
-                        hashes.insert(package_id, value.clone());
-                    }
+            let checksum = match checksum.as_ref() {
+                Some(checksum) if checksum == "<none>" => None,
+                Some(checksum) => Some(checksum),
+                None => {
+                    // Retrieve legacy checksums.
+                    self.metadata.as_ref().and_then(|metadata| {
+                        const CHECKSUM_PREFIX: &str = "checksum";
+                        let checksum_key = format!("{CHECKSUM_PREFIX} {name} {version} ({source})");
+                        metadata.get(&checksum_key)
+                    })
                 }
+            };
+
+            if let Some(checksum) = checksum {
+                hashes.insert((*package_id).clone(), checksum.to_owned());
             }
         }
 
diff --git a/crate2nix/src/main.rs b/crate2nix/src/main.rs
index d1dbc7a5..6bcf1b13 100644
--- a/crate2nix/src/main.rs
+++ b/crate2nix/src/main.rs
@@ -6,7 +6,8 @@ use anyhow::format_err;
 use anyhow::{bail, Error};
 use crate2nix::{
     config::{Config, NixFile},
-    render,
+    normalize_manifest::normalize_manifest,
+    render, CommitHash,
 };
 use semver::Version;
 use serde::Deserialize;
@@ -159,6 +160,20 @@ pub enum Opt {
         )]
         output: PathBuf,
     },
+
+    #[structopt(
+        name = "normalize-manifest",
+        about = "Resolve fields inherited from a workspace, so that the manifest can be processed stand-alone."
+    )]
+    NormalizeManifest {
+        #[structopt(
+            short = "f",
+            long = "cargo-toml",
+            parse(from_os_str),
+            help = "The path to the Cargo.toml of the project."
+        )]
+        cargo_toml: PathBuf,
+    },
 }
 
 #[derive(Debug, StructOpt, Deserialize, Serialize)]
@@ -273,8 +288,8 @@ pub enum SourceAddingCommands {
         /// E.g. https://github.com/kolloch/crate2nix.git
         url: url::Url,
 
-        #[structopt(long = "rev", parse(from_str), help = "The git revision hash.")]
-        rev: String,
+        #[structopt(long = "rev", parse(try_from_str = CommitHash::try_from), help = "The git revision hash.")]
+        rev: CommitHash,
     },
 
     #[structopt(
@@ -481,6 +496,10 @@ fn main() -> anyhow::Result<()> {
         } => {
             command.execute(&crate2nix_json)?;
         }
+        Opt::NormalizeManifest { cargo_toml } => {
+            let manifest = normalize_manifest(&cargo_toml)?;
+            print!("{manifest}");
+        }
     }
 
     Ok(())
diff --git a/crate2nix/src/normalize_manifest.rs b/crate2nix/src/normalize_manifest.rs
new file mode 100644
index 00000000..e35ddbd5
--- /dev/null
+++ b/crate2nix/src/normalize_manifest.rs
@@ -0,0 +1,165 @@
+//! Expand a Cargo.toml manifest to include any data inherited from its workspace.
+
+use std::path::Path;
+
+use anyhow::Context as _;
+use cargo_toml::Manifest;
+
+/// Loads a Cargo.toml manifest (which may be a workspace member manifest) from the given path.
+/// Automatically locates the corresponding manifest if there is one to fill in inherited values.
+///
+/// For example `version.workspace = true` becomes `version = "1.2.3"`
+pub fn normalize_manifest(cargo_toml: impl AsRef<Path>) -> Result<String, anyhow::Error> {
+    // Expands most, but not all, inherited workspace values. See note below.
+    let manifest = Manifest::from_path(&cargo_toml)?;
+
+    // As of this comment cargo_toml does not expand inherited lints. For example manifest content
+    // like this:
+    //
+    //     [lints]
+    //     workspace = true
+    //
+    // is left as-is. The presence of a `workspace = true` setting leads to a read error from
+    // `cargo metadata` later on. To avoid this and similar issues this fixup step walks through
+    // the normalized manifest's TOML nodes to remove any table entries of `workspace = true`.
+
+    let toml = toml::Value::try_from(manifest).with_context(|| {
+        format!(
+            "error converting manifest at {} back to TOML after normalization",
+            cargo_toml.as_ref().to_string_lossy()
+        )
+    })?;
+
+    let toml =
+        prune_workspace_references(toml).unwrap_or(toml::Value::Table(toml::map::Map::new()));
+
+    Ok(toml::to_string_pretty(&toml)?)
+}
+
+fn prune_workspace_references(toml: toml::Value) -> Option<toml::Value> {
+    match toml {
+        toml::Value::Table(map) => {
+            let orig_is_empty = map.is_empty();
+            let pruned = map
+                .into_iter()
+                .filter(|entry| !is_workspace_reference(entry))
+                .filter_map(|(key, value)| Some((key, prune_workspace_references(value)?)))
+                .collect::<toml::map::Map<_, _>>();
+            if pruned.is_empty() && !orig_is_empty {
+                None
+            } else {
+                Some(toml::Value::Table(pruned))
+            }
+        }
+        toml::Value::Array(vec) => Some(toml::Value::Array(
+            vec.into_iter()
+                .filter_map(prune_workspace_references)
+                .collect(),
+        )),
+        value => Some(value),
+    }
+}
+
+fn is_workspace_reference((key, value): &(String, toml::Value)) -> bool {
+    key == "workspace" && value == &toml::Value::Boolean(true)
+}
+
+#[cfg(test)]
+mod tests {
+    use std::{
+        env::temp_dir,
+        fs::{create_dir_all, File},
+        io::Write as _,
+        path::PathBuf,
+    };
+
+    use super::normalize_manifest;
+
+    #[test]
+    fn normalizes_a_package_manifest_in_a_workspace() -> anyhow::Result<()> {
+        let TestWorkspace {
+            package_manifest, ..
+        } = test_workspace()?;
+        let normalized = normalize_manifest(&package_manifest)?;
+        assert_eq!(
+            normalized.trim(),
+            r#"
+[dependencies]
+itertools = "^0.13.0"
+
+[package]
+edition = "2021"
+name = "package"
+version = "1.0.0"
+"#
+            .trim()
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn produces_consistent_output_for_normalized_manifest() -> anyhow::Result<()> {
+        let TestWorkspace {
+            package_manifest, ..
+        } = test_workspace()?;
+        let normalized = normalize_manifest(&package_manifest)?;
+        for _ in 1..10 {
+            let normalized_again = normalize_manifest(&package_manifest)?;
+            assert_eq!(normalized_again, normalized);
+        }
+
+        Ok(())
+    }
+
+    #[derive(Debug)]
+    struct TestWorkspace {
+        package_manifest: PathBuf,
+    }
+
+    fn test_workspace() -> anyhow::Result<TestWorkspace> {
+        let workspace_dir = temp_dir();
+
+        let workspace_manifest = workspace_dir.join("Cargo.toml");
+        File::create(workspace_manifest)?.write_all(
+            br#"
+[workspace.package]
+version = "1.0.0"
+edition = "2021"
+
+[workspace]
+members = [
+  "crates/package"
+]
+resolver = "2"
+
+[workspace.dependencies]
+itertools = "^0.13.0"
+
+[workspace.lints.clippy]
+all = { level = "warn", priority = -1 }
+"#,
+        )?;
+
+        create_dir_all(workspace_dir.join("crates").join("package"))?;
+        let package_manifest = workspace_dir
+            .join("crates")
+            .join("package")
+            .join("Cargo.toml");
+        File::create(&package_manifest)?.write_all(
+            br#"
+[package]
+name = "package"
+version.workspace = true
+edition.workspace = true
+
+[dependencies]
+itertools = { workspace = true }
+
+[lints]
+workspace = true
+"#,
+        )?;
+
+        Ok(TestWorkspace { package_manifest })
+    }
+}
diff --git a/crate2nix/src/prefetch.rs b/crate2nix/src/prefetch.rs
index 14ea9e32..85b322ec 100644
--- a/crate2nix/src/prefetch.rs
+++ b/crate2nix/src/prefetch.rs
@@ -131,12 +131,7 @@ pub fn prefetch(
         let (sha256, hash_source) = if let Some(HashWithSource { sha256, source }) = hash {
             (sha256.trim().to_string(), source)
         } else {
-            eprintln!(
-                "Prefetching {:>4}/{}: {}",
-                idx,
-                without_hash_num,
-                source.to_string()
-            );
+            eprintln!("Prefetching {:>4}/{}: {}", idx, without_hash_num, source);
             idx += 1;
             (source.prefetch()?, HashSource::Prefetched)
         };
@@ -314,7 +309,8 @@ impl PrefetchableSource for RegistrySource {
 
 impl PrefetchableSource for GitSource {
     fn needs_prefetch(&self) -> bool {
-        self.sha256.is_none()
+        // self.rev is sufficient for reproducible fetching, and that field is mandatory
+        false
     }
 
     fn prefetch(&self) -> Result<String, Error> {
@@ -333,7 +329,7 @@ impl PrefetchableSource for GitSource {
             self.url.as_str(),
             "--fetch-submodules",
             "--rev",
-            &self.rev,
+            self.rev.as_ref(),
         ];
 
         // TODO: --branch-name isn't documented in nix-prefetch-git --help
diff --git a/crate2nix/src/resolve.rs b/crate2nix/src/resolve.rs
index 4153c83e..9a880c47 100644
--- a/crate2nix/src/resolve.rs
+++ b/crate2nix/src/resolve.rs
@@ -20,6 +20,7 @@ use std::path::{Path, PathBuf};
 use crate::metadata::IndexedMetadata;
 #[cfg(test)]
 use crate::test;
+use crate::CommitHash;
 use crate::GenerateConfig;
 use itertools::Itertools;
 use std::{collections::btree_map::BTreeMap, fmt::Display};
@@ -421,7 +422,7 @@ pub struct RegistrySource {
 #[derive(Debug, Clone, Deserialize, Serialize, PartialEq, Eq, Hash)]
 pub struct GitSource {
     pub url: Url,
-    pub rev: String,
+    pub rev: CommitHash,
     pub r#ref: Option<String>,
     pub sha256: Option<String>,
 }
@@ -493,14 +494,43 @@ impl ResolvedSource {
             );
         }
         let mut url = url::Url::parse(&source_string[GIT_SOURCE_PREFIX.len()..])?;
-        let mut query_pairs = url.query_pairs();
-        let branch = query_pairs
-            .find(|(k, _)| k == "branch")
-            .map(|(_, v)| v.to_string());
-        let rev = if let Some((_, rev)) = query_pairs.find(|(k, _)| k == "rev") {
-            rev.to_string()
-        } else if let Some(rev) = url.fragment() {
-            rev.to_string()
+        let query_pairs = url.query_pairs().collect::<HashMap<_, _>>();
+
+        // Locked git sources have optional ?branch, ?tag, ?rev, or ?ref query arguments. It is
+        // important to capture these in case the given commit hash is not reachable from the
+        // repo's default HEAD. OTOH if no form of ref is given that is an implication by cargo
+        // that the default HEAD should be fetched.
+        const REF_PARAMS: [(&str, &str); 4] = [
+            ("branch", "refs/heads/"),
+            ("tag", "refs/tags/"),
+            ("rev", ""),
+            ("ref", ""),
+        ];
+        let r#ref = REF_PARAMS.iter().find_map(|(key, ref_prefix)| {
+            let v = query_pairs.get(*key)?;
+            if CommitHash::parse(v).is_some() {
+                // Rev is usually a commit hash, but in some cases it can be a ref. Use as a ref
+                // only if it is **not** a valid commit hash.
+                return None;
+            }
+            Some(format!("{ref_prefix}{v}"))
+        });
+
+        // In locked sources the git commit hash is given as a URL fragment. It sometimes also
+        // given in a ?rev query argument. But in other cases a ?rev argument might not be a commit
+        // hash: the [cargo reference docs][] give an example of a rev argument of `"refs/pull/493/head"`.
+        //
+        // [cargo reference docs]: https://doc.rust-lang.org/cargo/reference/specifying-dependencies.html
+        //
+        // That example applies to a Cargo.toml manifest - but such rev arguments do seem to be
+        // preserved in the lock file.
+        let rev = if let Some(rev) = url.fragment().and_then(CommitHash::parse) {
+            rev
+        } else if let Some(rev) = query_pairs
+            .get("rev")
+            .and_then(|rev| CommitHash::parse(rev))
+        {
+            rev
         } else {
             return ResolvedSource::fallback_to_local_directory(
                 config,
@@ -509,12 +539,13 @@ impl ResolvedSource {
                 "No git revision found.",
             );
         };
+
         url.set_query(None);
         url.set_fragment(None);
         Ok(ResolvedSource::Git(GitSource {
             url,
             rev,
-            r#ref: branch,
+            r#ref,
             sha256: None,
         }))
     }
@@ -633,14 +664,14 @@ impl ResolvedSource {
     }
 }
 
-impl ToString for ResolvedSource {
-    fn to_string(&self) -> String {
+impl Display for ResolvedSource {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         match self {
-            Self::CratesIo(source) => source.to_string(),
-            Self::Registry(source) => source.to_string(),
-            Self::Git(source) => source.to_string(),
-            Self::LocalDirectory(source) => source.to_string(),
-            Self::Nix(source) => source.to_string(),
+            Self::CratesIo(source) => write!(f, "{}", source),
+            Self::Registry(source) => write!(f, "{}", source),
+            Self::Git(source) => write!(f, "{}", source),
+            Self::LocalDirectory(source) => write!(f, "{}", source),
+            Self::Nix(source) => write!(f, "{}", source),
         }
     }
 }
diff --git a/crate2nix/src/sources.rs b/crate2nix/src/sources.rs
index 4ce96358..a9eae712 100644
--- a/crate2nix/src/sources.rs
+++ b/crate2nix/src/sources.rs
@@ -4,6 +4,7 @@ use crate::{
     config,
     prefetch::PrefetchableSource,
     resolve::{CratesIoSource, GitSource, RegistrySource},
+    CommitHash,
 };
 use anyhow::{bail, format_err, Context, Error};
 use semver::Version;
@@ -59,7 +60,7 @@ pub fn registry_source(
 }
 
 /// Returns the completed Source::Git definition by prefetching the hash.
-pub fn git_io_source(url: Url, rev: String) -> Result<config::Source, Error> {
+pub fn git_io_source(url: Url, rev: CommitHash) -> Result<config::Source, Error> {
     let prefetchable = GitSource {
         url: url.clone(),
         rev: rev.clone(),
diff --git a/crate2nix/src/test.rs b/crate2nix/src/test.rs
index 8d1774b1..b95460fd 100644
--- a/crate2nix/src/test.rs
+++ b/crate2nix/src/test.rs
@@ -1,4 +1,7 @@
-///! Constructor functions for test data.
+//! Constructor functions for test data.
+
+#![allow(missing_docs)]
+
 use cargo_metadata::{Dependency, Metadata, Node, NodeDep, Package, PackageId, Resolve};
 use std::path::PathBuf;
 use tempdir::TempDir;
@@ -8,6 +11,7 @@ pub fn generate_config() -> crate::GenerateConfig {
     crate::GenerateConfig {
         cargo_toml: vec!["Cargo.toml".into()],
         crate_hashes_json: "crate-hashes.json".into(),
+        registry_hashes_json: "registry-hashes.json".into(),
         nixpkgs_path: "bogus-nixpkgs-path".into(),
         other_metadata_options: vec![],
         output: "Cargo.nix".into(),
diff --git a/crate2nix/src/util.rs b/crate2nix/src/util.rs
index 9eed2a70..593247d4 100644
--- a/crate2nix/src/util.rs
+++ b/crate2nix/src/util.rs
@@ -1,7 +1,11 @@
 //! Homeless code. Usually abstract and algorithmic.
 
+use core::{convert::AsRef, fmt::Display};
 use std::collections::BTreeSet;
 
+use anyhow::anyhow;
+use serde::{Deserialize, Serialize};
+
 /// Return all occurrences of each item after the first.
 /// ```
 /// use crate2nix::util::find_duplicates;
@@ -14,3 +18,49 @@ pub fn find_duplicates<'a, T: Ord>(source: impl Iterator<Item = &'a T>) -> Vec<&
     let mut seen = BTreeSet::new();
     source.filter(|v| !seen.insert(*v)).collect()
 }
+
+/// Newtype for a string that has been verified to be a git commit hash, and has been normalized.
+#[derive(Clone, Debug, Hash, PartialEq, Eq, Deserialize, Serialize)]
+#[serde(try_from = "String")]
+pub struct CommitHash(String);
+
+impl CommitHash {
+    /// If the string contains 40 hexadecimal characters returns a normalized string by trimming
+    /// leading and trailing whitespace, and converting alphabetical characters to lower case.
+    pub fn parse(input: &str) -> Option<Self> {
+        let normalized = input.trim().to_lowercase();
+        if normalized.len() == 40 && normalized.chars().all(|c| c.is_ascii_hexdigit()) {
+            Some(CommitHash(normalized))
+        } else {
+            None
+        }
+    }
+}
+
+impl AsRef<str> for CommitHash {
+    fn as_ref(&self) -> &str {
+        &self.0
+    }
+}
+
+impl TryFrom<String> for CommitHash {
+    type Error = anyhow::Error;
+
+    fn try_from(value: String) -> Result<Self, Self::Error> {
+        <Self as TryFrom<&str>>::try_from(&value)
+    }
+}
+
+impl TryFrom<&str> for CommitHash {
+    type Error = anyhow::Error;
+
+    fn try_from(value: &str) -> Result<Self, Self::Error> {
+        CommitHash::parse(value).ok_or_else(|| anyhow!("value {value} is not a git commit hash"))
+    }
+}
+
+impl Display for CommitHash {
+    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        write!(f, "{}", self.0)
+    }
+}
diff --git a/crate2nix/templates/Cargo.nix.tera b/crate2nix/templates/Cargo.nix.tera
index 980d5032..7d74ad03 100644
--- a/crate2nix/templates/Cargo.nix.tera
+++ b/crate2nix/templates/Cargo.nix.tera
@@ -156,12 +156,13 @@ rec {
         src = lib.cleanSourceWith { filter = sourceFilter;  src = {{crate.source.LocalDirectory.path | safe}}; };
         {%- elif crate.source.Git %}
         workspace_member = null;
-        src = pkgs.fetchgit {
+        src = builtins.fetchGit {
           url = {{crate.source.Git.url}};
           rev = {{crate.source.Git.rev}};
-          {%- if crate.source.Git.sha256 %}
-          sha256 = {{ crate.source.Git.sha256 }};
+          {%- if crate.source.Git.ref %}
+          ref = {{ crate.source.Git.ref }};
           {%- endif %}
+          submodules = true;
         };
         {%- else %}
         src = builtins.throw ''ERROR: Could not resolve source: {{crate.source | json_encode() | safe}}'';
diff --git a/crate2nix/tests/self_build_up_to_date.rs b/crate2nix/tests/self_build_up_to_date.rs
index 7e5d0130..5d4a2f4f 100644
--- a/crate2nix/tests/self_build_up_to_date.rs
+++ b/crate2nix/tests/self_build_up_to_date.rs
@@ -31,6 +31,7 @@ fn self_up_to_date() {
             output: PathBuf::from("./Cargo.nix"),
             nixpkgs_path: "../nix/nixpkgs.nix".to_string(),
             crate_hashes_json: PathBuf::from("./crate-hashes.json"),
+            registry_hashes_json: PathBuf::from("./registry-hashes.json"),
             other_metadata_options: vec![],
             use_cargo_lock_checksums: true,
             read_crate_hashes: true,
@@ -76,6 +77,9 @@ fn assert_up_to_date(project_dir: &Path) {
         crate_hashes_json: PathBuf::from("../")
             .join(project_dir)
             .join("./crate-hashes.json"),
+        registry_hashes_json: PathBuf::from("../")
+            .join(project_dir)
+            .join("./registry-hashes.json"),
         other_metadata_options: vec![],
         use_cargo_lock_checksums: true,
         read_crate_hashes: true,
diff --git a/docs/flake-module.nix b/docs/flake-module.nix
index 9d36a25e..12c1796e 100644
--- a/docs/flake-module.nix
+++ b/docs/flake-module.nix
@@ -1,6 +1,6 @@
 {
   perSystem = { config, self', inputs', pkgs, lib, system, ... }:
-    let nodejs = pkgs.nodejs_21; in {
+    let nodejs = pkgs.nodejs_22; in {
       devshells.default = {
         commands = [
           { package = nodejs; category = "docs"; }
diff --git a/docs/src/content/docs/00_guides/70_building_fetched_sources.md b/docs/src/content/docs/00_guides/70_building_fetched_sources.md
index 74a8d87d..bddf09d0 100644
--- a/docs/src/content/docs/00_guides/70_building_fetched_sources.md
+++ b/docs/src/content/docs/00_guides/70_building_fetched_sources.md
@@ -17,14 +17,21 @@ using the [tools.nix](./31_auto_generating) support:
 # nix/nix-test-runner.nix
 let
   # Reuses the locked flake inputs.
-  flakeLock = builtins.fromJSON (builtins.readFile ../flake.lock);
+  flakeInput = (import ./lib.nix).flakeInput;
   # Gets the locked sources.
-  src = builtins.fetchTree flakeLock.nodes.nix-test-runner.locked;
+  src = builtins.fetchTree (flakeInput "nix-test-runner");
+
+  # Use last pinned crate2nix packages and corresponding nixpkgs to build the
+  # test runner so that it works even if we have broken stuff!
+  crate2nix_stable = builtins.fetchTree (flakeInput "crate2nix_stable");
+  nixpkgs_stable = builtins.fetchTree (flakeInput "crate2nix_stable.nixpkgs");
 in
-{ pkgs ? import ./nixpkgs.nix { }
-  # Use last pinned crate2nix packages to build the test runner
-  # so that it works even if we have broken stuff!
-, tools ? pkgs.callPackage "${builtins.fetchTree flakeLock.nodes.crate2nix_stable.locked}/tools.nix" { }
+{
+  # A system must be specified if using default value for pkgs and calling this
+  # package from a pure evaluation context, such as from the flake devShell.
+  system ? builtins.currentSystem
+, pkgs ? import nixpkgs_stable { inherit system; }
+, tools ? pkgs.callPackage "${crate2nix_stable}/tools.nix" { }
 }:
 let
   nixTestRunner = tools.appliedCargoNix {
@@ -38,9 +45,9 @@ nixTestRunner.rootCrate.build
 ```nix
 # nix/nixpkgs.nix
 let
-  flakeLock = builtins.fromJSON (builtins.readFile ../flake.lock);
+  flakeInput = (import ./lib.nix).flakeInput;
 in
-import "${builtins.fetchTree flakeLock.nodes.nixpkgs.locked}"
+import (builtins.fetchTree (flakeInput "nixpkgs"))
 ```
 
 ```nix
diff --git a/flake.lock b/flake.lock
index 71425620..12d3f56d 100644
--- a/flake.lock
+++ b/flake.lock
@@ -603,16 +603,18 @@
     },
     "nixpkgs_6": {
       "locked": {
-        "lastModified": 1712026416,
-        "narHash": "sha256-N/3VR/9e1NlN49p7kCiATiEY6Tzdo+CbrAG8kqCQKcI=",
+        "lastModified": 1737469691,
+        "narHash": "sha256-nmKOgAU48S41dTPIXAq0AHZSehWUn6ZPrUKijHAMmIk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "080a4a27f206d07724b88da096e27ef63401a504",
+        "rev": "9e4d5190a9482a1fb9d18adf0bdb83c6e506eaab",
         "type": "github"
       },
       "original": {
-        "id": "nixpkgs",
-        "type": "indirect"
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
       }
     },
     "pre-commit-hooks": {
diff --git a/flake.nix b/flake.nix
index 181f3785..50f92abf 100644
--- a/flake.nix
+++ b/flake.nix
@@ -11,7 +11,7 @@
   };
 
   inputs = {
-    nixpkgs.url = "nixpkgs";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
 
     flake-compat.url = "https://flakehub.com/f/edolstra/flake-compat/1.tar.gz";
 
diff --git a/nix/devshell/flake-module.nix b/nix/devshell/flake-module.nix
index e39497f6..7b8e4655 100644
--- a/nix/devshell/flake-module.nix
+++ b/nix/devshell/flake-module.nix
@@ -32,7 +32,7 @@
           { package = nix-prefetch-git; category = "nix"; }
           {
             name = "nix-test";
-            package = (import ../nix-test-runner.nix { inherit pkgs; });
+            package = import ../nix-test-runner.nix { inherit (pkgs) system; };
             category = "nix";
             help = "nix test runner for unit tests.";
           }
diff --git a/nix/lib.nix b/nix/lib.nix
new file mode 100644
index 00000000..ffb661a1
--- /dev/null
+++ b/nix/lib.nix
@@ -0,0 +1,30 @@
+let
+  flakeLock = builtins.fromJSON (builtins.readFile ../flake.lock);
+  flakeInputNodeOf = parentNode: inputName:
+    let
+      inputNodeName = builtins.getAttr inputName parentNode.inputs;
+    in
+    builtins.getAttr inputNodeName flakeLock.nodes;
+  rootNode = let rootName = flakeLock.root; in builtins.getAttr rootName flakeLock.nodes;
+in
+{
+  # Get a locked flake input value that can be given to `builtins.fetchTree` or
+  # to `builtins.getFlake`. For example,
+  #
+  #     pkgs = import (builtins.fetchTree (flakeInput "nixpkgs")) { }
+  #
+  # This function can also be used to get inputs of inputs using dot-separated
+  # paths. For example,
+  #
+  #     pkgs = import (builtins.fetchTree (flakeInput "crate2nix_stable.nixpkgs")) { }
+  #
+  # Gets the nixpkgs input of the crate2nix_stable input.
+  #
+  flakeInput = name:
+    let
+      parts = builtins.split "[.]" name;
+      inputNames = builtins.filter builtins.isString parts;
+      flakeNode = builtins.foldl' flakeInputNodeOf rootNode inputNames;
+    in
+    flakeNode.locked;
+}
diff --git a/nix/nix-test-runner.nix b/nix/nix-test-runner.nix
index a366b620..62f6b9f9 100644
--- a/nix/nix-test-runner.nix
+++ b/nix/nix-test-runner.nix
@@ -1,11 +1,42 @@
 let
-  flakeLock = builtins.fromJSON (builtins.readFile ../flake.lock);
-  src = builtins.fetchTree flakeLock.nodes.nix-test-runner.locked;
+  flakeInput = (import ./lib.nix).flakeInput;
+  src = builtins.fetchTree (flakeInput "nix-test-runner");
+
+  # Use last pinned crate2nix packages and corresponding nixpkgs to build the
+  # test runner so that it works even if we have broken stuff!
+  crate2nix_stable = builtins.fetchTree (flakeInput "crate2nix_stable");
+
+  # The latest stable crate2nix doesn't work with the version of nixpkgs that is
+  # currently locked because of a change to the way `cargo metadata` formats
+  # package IDs. So to build the test runner with the last release of crate2nix
+  # we also need an older version of nixpkgs. For consistency with using the
+  # pinned version of crate2nix we should also use the pinned version of nixpkgs
+  # from the same release which would look like this:
+  #
+  #     builtins.fetchTree (flakeInput "crate2nix_stable.nixpkgs")
+  #
+  # Unfortunately that doesn't work either. That's likely because ./nixpkgs.nix
+  # has been erroneously using the pinned version of nixpkgs from this repo's
+  # cachix dependency instead of the version of nixpkgs pinned in this repo's
+  # flake. Because that has been fixed in ./nixpkgs.nix it's neccessary to
+  # override the pinned stable nixpkgs revision here until the next stable
+  # release when it can be matched with the pinned stable crate2nix version
+  # again.
+  known_good_nixpkgs = builtins.fetchTree {
+    "lastModified" = 1700612854;
+    "narHash" = "sha256-yrQ8osMD+vDLGFX7pcwsY/Qr5PUd6OmDMYJZzZi0+zc=";
+    "owner" = "NixOS";
+    "repo" = "nixpkgs";
+    "rev" = "19cbff58383a4ae384dea4d1d0c823d72b49d614";
+    "type" = "github";
+  };
 in
-{ pkgs ? import ./nixpkgs.nix { }
-  # Use last pinned crate2nix packages to build the test runner
-  # so that it works even if we have broken stuff!
-, tools ? pkgs.callPackage "${builtins.fetchTree flakeLock.nodes.crate2nix_stable.locked}/tools.nix" { }
+{
+  # A system must be specified if using default value for pkgs and calling this
+  # package from a pure evaluation context, such as from the flake devShell.
+  system ? builtins.currentSystem
+, pkgs ? import known_good_nixpkgs { inherit system; }
+, tools ? pkgs.callPackage "${crate2nix_stable}/tools.nix" { }
 }:
 let
   nixTestRunner = tools.appliedCargoNix {
diff --git a/nix/nixpkgs.nix b/nix/nixpkgs.nix
index 7dde9d94..24125f84 100644
--- a/nix/nixpkgs.nix
+++ b/nix/nixpkgs.nix
@@ -1,4 +1,4 @@
 let
-  flakeLock = builtins.fromJSON (builtins.readFile ../flake.lock);
+  flakeInput = (import ./lib.nix).flakeInput;
 in
-import "${builtins.fetchTree flakeLock.nodes.nixpkgs.locked}"
+import (builtins.fetchTree (flakeInput "nixpkgs"))
diff --git a/sample_projects/bin_with_git_branch_dep/crate-hashes.json b/sample_projects/bin_with_git_branch_dep/crate-hashes.json
deleted file mode 100644
index 68abb2b6..00000000
--- a/sample_projects/bin_with_git_branch_dep/crate-hashes.json
+++ /dev/null
@@ -1,3 +0,0 @@
-{
-  "nix-base32 0.1.2-alpha.0 (git+https://github.com/kolloch/nix-base32?branch=branch-for-test#42f5544e51187f0c7535d453fcffb4b524c99eb2)": "011f945b48xkilkqbvbsxazspz5z23ka0s90ms4jiqjbhiwll1nw"
-}
\ No newline at end of file
diff --git a/sample_projects/bin_with_git_dep_in_workspace/Cargo.lock b/sample_projects/bin_with_git_dep_in_workspace/Cargo.lock
new file mode 100644
index 00000000..74a6b1d9
--- /dev/null
+++ b/sample_projects/bin_with_git_dep_in_workspace/Cargo.lock
@@ -0,0 +1,635 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "android-tzdata"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e999941b234f3131b00bc13c22d06e8c5ff726d1b6318ac7eb276997bbb4fef0"
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "bin_with_dep_in_workspace"
+version = "0.1.0"
+dependencies = [
+ "ndc-models",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "79296716171880943b8470b5f8d03aa55eb2e645a4874bdbb28adb49162e012c"
+
+[[package]]
+name = "cc"
+version = "1.2.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13208fcbb66eaeffe09b99fffbe1af420f00a7b35aa99ad683dfc1aa76145229"
+dependencies = [
+ "shlex",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "chrono"
+version = "0.4.39"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e36cc9d416881d2e24f9a963be5fb1cd90966419ac844274161d10488b3e825"
+dependencies = [
+ "android-tzdata",
+ "iana-time-zone",
+ "num-traits",
+ "serde",
+ "windows-targets",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
+[[package]]
+name = "darling"
+version = "0.20.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f63b86c8a8826a49b8c21f08a2d07338eec8d900540f8630dc76284be802989"
+dependencies = [
+ "darling_core",
+ "darling_macro",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.20.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95133861a8032aaea082871032f5815eb9e98cef03fa916ab4500513994df9e5"
+dependencies = [
+ "fnv",
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.20.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d336a2a514f6ccccaa3e09b02d41d35330c07ddf03a62165fcec10bb561c7806"
+dependencies = [
+ "darling_core",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "deranged"
+version = "0.3.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b42b6fa04a440b495c8b04d0e71b707c585f83cb9cb28cf8cd0d976c315e31b4"
+dependencies = [
+ "powerfmt",
+ "serde",
+]
+
+[[package]]
+name = "dyn-clone"
+version = "1.0.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d6ef0072f8a535281e4876be788938b528e9a1d43900b82c2569af7da799125"
+
+[[package]]
+name = "equivalent"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "hashbrown"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+
+[[package]]
+name = "hashbrown"
+version = "0.15.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf151400ff0baff5465007dd2f3e717f3fe502074ca563069ce3a6629d07b289"
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "iana-time-zone"
+version = "0.1.61"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "235e081f3925a06703c2d0117ea8b91f042756fd6e7a6e5d901e8ca1a996b220"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "wasm-bindgen",
+ "windows-core",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "ident_case"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
+
+[[package]]
+name = "indexmap"
+version = "1.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
+dependencies = [
+ "autocfg",
+ "hashbrown 0.12.3",
+ "serde",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8c9c992b02b5b4c94ea26e32fe5bccb7aa7d9f390ab5c1221ff895bc7ea8b652"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.15.2",
+ "serde",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d75a2a4b1b190afb6f5425f10f6a8f959d2ea0b9c2b1d79553551850539e4674"
+
+[[package]]
+name = "js-sys"
+version = "0.3.77"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1cfaf33c695fc6e08064efbc1f72ec937429614f25eef83af942d0e227c3a28f"
+dependencies = [
+ "once_cell",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.169"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5aba8db14291edd000dfcc4d620c7ebfb122c613afb886ca8803fa4e128a20a"
+
+[[package]]
+name = "log"
+version = "0.4.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04cbf5b083de1c7e0222a7a51dbfdba1cbe1c6ab0b15e29fff3f6c077fd9cd9f"
+
+[[package]]
+name = "memchr"
+version = "2.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
+
+[[package]]
+name = "ndc-models"
+version = "0.1.6"
+source = "git+http://github.com/hasura/ndc-spec.git?tag=v0.1.6#d1be19e9cdd86ac7b6ad003ff82b7e5b4e96b84f"
+dependencies = [
+ "indexmap 2.7.1",
+ "ref-cast",
+ "schemars",
+ "serde",
+ "serde_json",
+ "serde_with",
+ "smol_str",
+]
+
+[[package]]
+name = "num-conv"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1261fe7e33c73b354eab43b1273a57c8f967d0391e80353e51f764ac02cf6775"
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.93"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "60946a68e5f9d28b0dc1c21bb8a97ee7d018a8b322fa57838ba31cc878e22d99"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.38"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e4dccaaaf89514f546c693ddc140f729f958c247918a13380cccc6078391acc"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "ref-cast"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf0a6f84d5f1d581da8b41b47ec8600871962f2a528115b542b362d4b744931"
+dependencies = [
+ "ref-cast-impl",
+]
+
+[[package]]
+name = "ref-cast-impl"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bcc303e793d3734489387d205e9b186fac9c6cfacedd98cbb2e8a5943595f3e6"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f7c45b9784283f1b2e7fb61b42047c2fd678ef0960d4f6f1eba131594cc369d4"
+
+[[package]]
+name = "ryu"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3cb5ba0dc43242ce17de99c180e96db90b235b8a9fdc9543c96d2209116bd9f"
+
+[[package]]
+name = "schemars"
+version = "0.8.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09c024468a378b7e36765cd36702b7a90cc3cba11654f6685c8f233408e89e92"
+dependencies = [
+ "dyn-clone",
+ "indexmap 1.9.3",
+ "indexmap 2.7.1",
+ "schemars_derive",
+ "serde",
+ "serde_json",
+ "smol_str",
+]
+
+[[package]]
+name = "schemars_derive"
+version = "0.8.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1eee588578aff73f856ab961cd2f79e36bc45d7ded33a7562adba4667aecc0e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "serde_derive_internals",
+ "syn",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.217"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02fc4265df13d6fa1d00ecff087228cc0a2b5f3c0e87e258d8b94a156e984c70"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.217"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a9bf7cf98d04a2b28aead066b7496853d4779c9cc183c440dbac457641e19a0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_derive_internals"
+version = "0.29.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "18d26a20a969b9e3fdf2fc2d9f21eda6c40e2de84c9408bb5d3b05d499aae711"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.137"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "930cfb6e6abf99298aaad7d29abbef7a9999a9a8806a40088f55f0dcec03146b"
+dependencies = [
+ "indexmap 2.7.1",
+ "itoa",
+ "memchr",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "serde_with"
+version = "3.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6b6f7f2fcb69f747921f79f3926bd1e203fce4fef62c268dd3abfb6d86029aa"
+dependencies = [
+ "base64",
+ "chrono",
+ "hex",
+ "indexmap 1.9.3",
+ "indexmap 2.7.1",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "serde_with_macros",
+ "time",
+]
+
+[[package]]
+name = "serde_with_macros"
+version = "3.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d00caa5193a3c8362ac2b73be6b9e768aa5a4b2f721d8f4b339600c3cb51f8e"
+dependencies = [
+ "darling",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
+[[package]]
+name = "smol_str"
+version = "0.1.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fad6c857cbab2627dcf01ec85a623ca4e7dcb5691cbaa3d7fb7653671f0d09c9"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
+[[package]]
+name = "syn"
+version = "2.0.96"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d5d0adab1ae378d7f53bdebc67a39f1f151407ef230f0ce2883572f5d8985c80"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "time"
+version = "0.3.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35e7868883861bd0e56d9ac6efcaaca0d6d5d82a2a7ec8209ff492c07cf37b21"
+dependencies = [
+ "deranged",
+ "itoa",
+ "num-conv",
+ "powerfmt",
+ "serde",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
+
+[[package]]
+name = "time-macros"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2834e6017e3e5e4b9834939793b282bc03b37a3336245fa820e35e233e2a85de"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11cd88e12b17c6494200a9c1b683a04fcac9573ed74cd1b62aeb2727c5592243"
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.100"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1edc8929d7499fc4e8f0be2262a241556cfc54a0bea223790e71446f2aab1ef5"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+]
+
+[[package]]
+name = "wasm-bindgen-backend"
+version = "0.2.100"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f0a0651a5c2bc21487bde11ee802ccaf4c51935d0d3d42a6101f98161700bc6"
+dependencies = [
+ "bumpalo",
+ "log",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.100"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7fe63fc6d09ed3792bd0897b314f53de8e16568c2b3f7982f468c0bf9bd0b407"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.100"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ae87ea40c9f689fc23f209965b6fb8a99ad69aeeb0231408be24920604395de"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-backend",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.100"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a05d73b933a847d6cccdda8f838a22ff101ad9bf93e33684f39c1f5f0eece3d"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "windows-core"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33ab640c8d7e35bf8ba19b884ba838ceb4fba93a4e8c65a9059d08afcfc683d9"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
diff --git a/sample_projects/bin_with_git_dep_in_workspace/Cargo.toml b/sample_projects/bin_with_git_dep_in_workspace/Cargo.toml
new file mode 100644
index 00000000..a7767408
--- /dev/null
+++ b/sample_projects/bin_with_git_dep_in_workspace/Cargo.toml
@@ -0,0 +1,7 @@
+[package]
+name = "bin_with_dep_in_workspace"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+ndc-models = { git = "http://github.com/hasura/ndc-spec.git", tag = "v0.1.6" }
diff --git a/sample_projects/bin_with_git_dep_in_workspace/src/main.rs b/sample_projects/bin_with_git_dep_in_workspace/src/main.rs
new file mode 100644
index 00000000..91b0f8bf
--- /dev/null
+++ b/sample_projects/bin_with_git_dep_in_workspace/src/main.rs
@@ -0,0 +1,3 @@
+pub fn main() {
+    println!("{}", ndc_models::VERSION);
+}
diff --git a/sample_projects/bin_with_git_submodule_dep/Cargo.nix b/sample_projects/bin_with_git_submodule_dep/Cargo.nix
index 34060349..562da0df 100644
--- a/sample_projects/bin_with_git_submodule_dep/Cargo.nix
+++ b/sample_projects/bin_with_git_submodule_dep/Cargo.nix
@@ -315,6 +315,7 @@ rec {
         version = "1.0.0";
         edition = "2018";
         sha256 = "1za0vb97n4brpzpv8lsbnzmq5r8f2b0cpqqr0sy8h5bn751xxwds";
+        libName = "cfg_if";
         authors = [
           "Alex Crichton <alex@alexcrichton.com>"
         ];
@@ -330,6 +331,7 @@ rec {
         edition = "2015";
         links = "clang";
         sha256 = "1lb9ffil7bidvpsfg38wkkfj55946v82ia07ss4ikkp39cxkllk7";
+        libName = "clang_sys";
         authors = [
           "Kyle Mayes <kyle@mayeses.com>"
         ];
@@ -485,11 +487,12 @@ rec {
         edition = "2018";
         links = "rocksdb";
         workspace_member = null;
-        src = pkgs.fetchgit {
+        src = builtins.fetchGit {
           url = "https://github.com/rust-rocksdb/rust-rocksdb";
           rev = "66f04df013b6e6bd42b5a8c353406e09a7c7da2a";
-          sha256 = "1rchvjrjamdaznx26gy4bmjj10rrf00mgc1wvkc489r9z1nh4h1h";
+          submodules = true;
         };
+        libName = "librocksdb_sys";
         authors = [
           "Karl Hobley <karlhobley10@gmail.com>"
           "Arkadiy Paronyan <arkadiy@ethcore.io>"
@@ -553,6 +556,7 @@ rec {
         edition = "2018";
         links = "z";
         sha256 = "0yqahz2m5g44mpgfdy0k53hpfkfs5rfiv3a1y7p766ijbsr3fwfr";
+        libName = "libz_sys";
         authors = [
           "Alex Crichton <alex@alexcrichton.com>"
           "Josh Triplett <josh@joshtriplett.org>"
@@ -605,6 +609,7 @@ rec {
         version = "0.2.1";
         edition = "2018";
         sha256 = "16ppc5g84aijpri4jzv14rvcnslvlpphbszc7zzp6vfkddf4qdb8";
+        libName = "minimal_lexical";
         authors = [
           "Alex Huszagh <ahuszagh@gmail.com>"
         ];
@@ -654,6 +659,7 @@ rec {
         version = "0.3.28";
         edition = "2015";
         sha256 = "16kgffwncx5hsppsdf54z6jnjkhwywqy601cxk3rqncyi9zmilv9";
+        libName = "pkg_config";
         authors = [
           "Alex Crichton <alex@alexcrichton.com>"
         ];
@@ -664,6 +670,7 @@ rec {
         version = "1.0.76";
         edition = "2021";
         sha256 = "136cp0fgl6rg5ljm3b1xpc0bn0lyvagzzmxvbxgk5hxml36mdz4m";
+        libName = "proc_macro2";
         authors = [
           "David Tolnay <dtolnay@gmail.com>"
           "Alex Crichton <alex@alexcrichton.com>"
@@ -761,6 +768,7 @@ rec {
         version = "0.4.3";
         edition = "2021";
         sha256 = "0gs8q9yhd3kcg4pr00ag4viqxnh5l7jpyb9fsfr8hzh451w4r02z";
+        libName = "regex_automata";
         authors = [
           "The Rust Project Developers"
           "Andrew Gallant <jamslam@gmail.com>"
@@ -821,6 +829,7 @@ rec {
         version = "0.8.2";
         edition = "2021";
         sha256 = "17rd2s8xbiyf6lb4aj2nfi44zqlj98g2ays8zzj2vfs743k79360";
+        libName = "regex_syntax";
         authors = [
           "The Rust Project Developers"
           "Andrew Gallant <jamslam@gmail.com>"
@@ -837,10 +846,10 @@ rec {
         version = "0.21.0";
         edition = "2018";
         workspace_member = null;
-        src = pkgs.fetchgit {
+        src = builtins.fetchGit {
           url = "https://github.com/rust-rocksdb/rust-rocksdb";
           rev = "66f04df013b6e6bd42b5a8c353406e09a7c7da2a";
-          sha256 = "1rchvjrjamdaznx26gy4bmjj10rrf00mgc1wvkc489r9z1nh4h1h";
+          submodules = true;
         };
         authors = [
           "Tyler Neely <t@jujit.su>"
@@ -875,6 +884,7 @@ rec {
         version = "1.1.0";
         edition = "2015";
         sha256 = "1qkc5khrmv5pqi5l5ca9p5nl5hs742cagrndhbrlk3dhlrx3zm08";
+        libName = "rustc_hash";
         authors = [
           "The Rust Project Developers"
         ];
@@ -936,6 +946,7 @@ rec {
         version = "1.0.12";
         edition = "2018";
         sha256 = "0jzf1znfpb2gx8nr8mvmyqs1crnv79l57nxnbiszc7xf7ynbjm1k";
+        libName = "unicode_ident";
         authors = [
           "David Tolnay <dtolnay@gmail.com>"
         ];
@@ -956,6 +967,7 @@ rec {
         version = "0.48.0";
         edition = "2018";
         sha256 = "1aan23v5gs7gya1lc46hqn9mdh8yph3fhxmhxlw36pn6pqc28zb7";
+        libName = "windows_sys";
         authors = [
           "Microsoft"
         ];
@@ -1249,6 +1261,7 @@ rec {
         version = "0.48.5";
         edition = "2018";
         sha256 = "034ljxqshifs1lan89xwpcy1hp0lhdh4b5n0d2z4fwjx2piacbws";
+        libName = "windows_targets";
         authors = [
           "Microsoft"
         ];
diff --git a/sample_projects/bin_with_git_submodule_dep/crate-hashes.json b/sample_projects/bin_with_git_submodule_dep/crate-hashes.json
deleted file mode 100644
index b080ff73..00000000
--- a/sample_projects/bin_with_git_submodule_dep/crate-hashes.json
+++ /dev/null
@@ -1,4 +0,0 @@
-{
-  "librocksdb-sys 0.15.0+8.9.1 (git+https://github.com/rust-rocksdb/rust-rocksdb#66f04df013b6e6bd42b5a8c353406e09a7c7da2a)": "1rchvjrjamdaznx26gy4bmjj10rrf00mgc1wvkc489r9z1nh4h1h",
-  "rocksdb 0.21.0 (git+https://github.com/rust-rocksdb/rust-rocksdb#66f04df013b6e6bd42b5a8c353406e09a7c7da2a)": "1rchvjrjamdaznx26gy4bmjj10rrf00mgc1wvkc489r9z1nh4h1h"
-}
\ No newline at end of file
diff --git a/sample_projects/bin_with_lib_git_dep/crate-hashes.json b/sample_projects/bin_with_lib_git_dep/crate-hashes.json
deleted file mode 100644
index 8691c7e5..00000000
--- a/sample_projects/bin_with_lib_git_dep/crate-hashes.json
+++ /dev/null
@@ -1,3 +0,0 @@
-{
-  "nix-base32 0.1.2-alpha.0 (git+https://github.com/kolloch/nix-base32?rev=42f5544e51187f0c7535d453fcffb4b524c99eb2#42f5544e51187f0c7535d453fcffb4b524c99eb2)": "011f945b48xkilkqbvbsxazspz5z23ka0s90ms4jiqjbhiwll1nw"
-}
\ No newline at end of file
diff --git a/sample_projects/codegen/Cargo.nix b/sample_projects/codegen/Cargo.nix
index 91bdd375..38ae08b4 100644
--- a/sample_projects/codegen/Cargo.nix
+++ b/sample_projects/codegen/Cargo.nix
@@ -249,10 +249,10 @@ rec {
         version = "0.9.7";
         edition = "2018";
         workspace_member = null;
-        src = pkgs.fetchgit {
+        src = builtins.fetchGit {
           url = "https://github.com/diwic/dbus-rs.git";
           rev = "618262f5e3217cdd173d46d705bbac26c5141e21";
-          sha256 = "0gvhz2knd1k799l7ssh4rdm5qw0vhazzr3bxpmlgq7fhy6hjazrs";
+          submodules = true;
         };
         authors = [
           "David Henningsson <diwic@ubuntu.com>"
@@ -287,11 +287,12 @@ rec {
         edition = "2018";
         crateBin = [];
         workspace_member = null;
-        src = pkgs.fetchgit {
+        src = builtins.fetchGit {
           url = "https://github.com/diwic/dbus-rs.git";
           rev = "618262f5e3217cdd173d46d705bbac26c5141e21";
-          sha256 = "0gvhz2knd1k799l7ssh4rdm5qw0vhazzr3bxpmlgq7fhy6hjazrs";
+          submodules = true;
         };
+        libName = "dbus_codegen";
         authors = [
           "David Henningsson <diwic@ubuntu.com>"
         ];
@@ -323,6 +324,7 @@ rec {
         version = "0.1.19";
         edition = "2018";
         sha256 = "0cxcm8093nf5fyn114w8vxbrbcyvv91d4015rdnlgfll7cs6gd32";
+        libName = "hermit_abi";
         authors = [
           "Stefan Lankes"
         ];
@@ -362,11 +364,12 @@ rec {
         edition = "2015";
         links = "dbus";
         workspace_member = null;
-        src = pkgs.fetchgit {
+        src = builtins.fetchGit {
           url = "https://github.com/diwic/dbus-rs.git";
           rev = "618262f5e3217cdd173d46d705bbac26c5141e21";
-          sha256 = "0gvhz2knd1k799l7ssh4rdm5qw0vhazzr3bxpmlgq7fhy6hjazrs";
+          submodules = true;
         };
+        libName = "libdbus_sys";
         authors = [
           "David Henningsson <diwic@ubuntu.com>"
         ];
@@ -390,6 +393,7 @@ rec {
         version = "0.3.28";
         edition = "2015";
         sha256 = "16kgffwncx5hsppsdf54z6jnjkhwywqy601cxk3rqncyi9zmilv9";
+        libName = "pkg_config";
         authors = [
           "Alex Crichton <alex@alexcrichton.com>"
         ];
@@ -429,6 +433,7 @@ rec {
         version = "0.1.11";
         edition = "2015";
         sha256 = "11ds4ydhg8g7l06rlmh712q41qsrd0j0h00n1jm74kww3kqk65z5";
+        libName = "unicode_width";
         authors = [
           "kwantam <kwantam@gmail.com>"
           "Manish Goregaokar <manishsmail@gmail.com>"
@@ -509,6 +514,7 @@ rec {
         version = "0.4.0";
         edition = "2015";
         sha256 = "1dmpa6mvcvzz16zg6d5vrfy4bxgg541wxrcip7cnshi06v38ffxc";
+        libName = "winapi_i686_pc_windows_gnu";
         authors = [
           "Peter Atashian <retep998@gmail.com>"
         ];
@@ -519,6 +525,7 @@ rec {
         version = "0.4.0";
         edition = "2015";
         sha256 = "0gqq64czqb64kskjryj8isp62m2sgvx25yyj3kpc2myh85w24bki";
+        libName = "winapi_x86_64_pc_windows_gnu";
         authors = [
           "Peter Atashian <retep998@gmail.com>"
         ];
diff --git a/sample_projects/codegen/crate-hashes.json b/sample_projects/codegen/crate-hashes.json
deleted file mode 100644
index b395d569..00000000
--- a/sample_projects/codegen/crate-hashes.json
+++ /dev/null
@@ -1,5 +0,0 @@
-{
-  "dbus 0.9.7 (git+https://github.com/diwic/dbus-rs.git#618262f5e3217cdd173d46d705bbac26c5141e21)": "0gvhz2knd1k799l7ssh4rdm5qw0vhazzr3bxpmlgq7fhy6hjazrs",
-  "dbus-codegen 0.10.0 (git+https://github.com/diwic/dbus-rs.git#618262f5e3217cdd173d46d705bbac26c5141e21)": "0gvhz2knd1k799l7ssh4rdm5qw0vhazzr3bxpmlgq7fhy6hjazrs",
-  "libdbus-sys 0.2.5 (git+https://github.com/diwic/dbus-rs.git#618262f5e3217cdd173d46d705bbac26c5141e21)": "0gvhz2knd1k799l7ssh4rdm5qw0vhazzr3bxpmlgq7fhy6hjazrs"
-}
\ No newline at end of file
diff --git a/sample_projects/sub_dir_crates/Cargo.nix b/sample_projects/sub_dir_crates/Cargo.nix
index 5b16ffb6..b9ac2f8f 100644
--- a/sample_projects/sub_dir_crates/Cargo.nix
+++ b/sample_projects/sub_dir_crates/Cargo.nix
@@ -93,10 +93,10 @@ rec {
         version = "0.1.0";
         edition = "2018";
         workspace_member = null;
-        src = pkgs.fetchgit {
+        src = builtins.fetchGit {
           url = "https://github.com/kolloch/with_sub_crates.git";
           rev = "f8ad2b98ff0eb5fea4962f55e3ced5b0b5afe973";
-          sha256 = "0nlw7rg28p6bya040cbipq4jdcdp4h3q9shdjygfk2xkva9bjl8w";
+          submodules = true;
         };
         authors = [
           "Peter Kolloch <info@eigenvalue.net>"
@@ -108,10 +108,10 @@ rec {
         version = "0.1.0";
         edition = "2018";
         workspace_member = null;
-        src = pkgs.fetchgit {
+        src = builtins.fetchGit {
           url = "https://github.com/kolloch/with_sub_crates.git";
           rev = "f8ad2b98ff0eb5fea4962f55e3ced5b0b5afe973";
-          sha256 = "0nlw7rg28p6bya040cbipq4jdcdp4h3q9shdjygfk2xkva9bjl8w";
+          submodules = true;
         };
         authors = [
           "Peter Kolloch <info@eigenvalue.net>"
diff --git a/sample_projects/sub_dir_crates/crate-hashes.json b/sample_projects/sub_dir_crates/crate-hashes.json
deleted file mode 100644
index e81908ae..00000000
--- a/sample_projects/sub_dir_crates/crate-hashes.json
+++ /dev/null
@@ -1,4 +0,0 @@
-{
-  "lib1 0.1.0 (git+https://github.com/kolloch/with_sub_crates.git?rev=f8ad2b98ff0eb5fea4962f55e3ced5b0b5afe973#f8ad2b98ff0eb5fea4962f55e3ced5b0b5afe973)": "0nlw7rg28p6bya040cbipq4jdcdp4h3q9shdjygfk2xkva9bjl8w",
-  "lib2 0.1.0 (git+https://github.com/kolloch/with_sub_crates.git?rev=f8ad2b98ff0eb5fea4962f55e3ced5b0b5afe973#f8ad2b98ff0eb5fea4962f55e3ced5b0b5afe973)": "0nlw7rg28p6bya040cbipq4jdcdp4h3q9shdjygfk2xkva9bjl8w"
-}
\ No newline at end of file
diff --git a/tests.nix b/tests.nix
index 3564d9da..1d9d091b 100644
--- a/tests.nix
+++ b/tests.nix
@@ -299,6 +299,12 @@ let
       derivationAttrPath = [ "workspaceMembers" "bin_with_cond_lib_dep" ];
     }
 
+    {
+      name = "bin_with_git_dep_in_workspace";
+      src = ./sample_projects/bin_with_git_dep_in_workspace;
+      expectedOutput = "v0.1.6";
+    }
+
     {
       name = "bin_with_git_submodule_dep";
       src = ./sample_projects/bin_with_git_submodule_dep;
diff --git a/tools.nix b/tools.nix
index 3a867d4d..3eaeee9a 100644
--- a/tools.nix
+++ b/tools.nix
@@ -11,7 +11,14 @@
 , strictDeprecation ? true
 }:
 let
-  cargoNix = pkgs.callPackage ./crate2nix/Cargo.nix { inherit strictDeprecation; };
+  defaultCrateOverrides = pkgs.defaultCrateOverrides // {
+    libgit2-sys = old: {
+      nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ pkgs.libgit2.nativeBuildInputs;
+      buildInputs = (old.buildInputs or [ ]) ++ pkgs.libgit2.buildInputs;
+    };
+  };
+
+  cargoNix = pkgs.callPackage ./crate2nix/Cargo.nix { inherit strictDeprecation defaultCrateOverrides; };
   crate2nix = cargoNix.rootCrate.build;
 in
 rec {
@@ -187,24 +194,53 @@ rec {
             l = lib.splitString "=" s;
             key = builtins.elemAt l 0;
           in
-          {
-            # Cargo supports using the now-obsoleted "ref" key in place of
-            # "branch"; see cargo-vendor source
-            name =
-              if key == "ref"
-              then "branch"
-              else key;
-            value = builtins.elemAt l 1;
-          };
+          { name = key; value = builtins.elemAt l 1; };
         queryParams = builtins.listToAttrs (map kv queryParamsList);
+        firstNonNull = lib.lists.findFirst (v: v != null) null;
+        ref =
+          let
+            refParams = [
+              { key = "branch"; refPrefix = "refs/heads/"; }
+              { key = "tag"; refPrefix = "refs/tags/"; }
+              { key = "rev"; refPrefix = ""; }
+              { key = "ref"; refPrefix = ""; }
+            ];
+            parseRef = { key, refPrefix }:
+              let
+                v = if queryParams ? key then queryParams.key else null;
+                isActuallyAHash = parseCommitHash v == null;
+              in
+              # Rev is usually a commit hash, but in some cases it can be a ref.
+                # Use as a ref only if it is **not** a valid commit hash.
+              if v == null || isActuallyAHash then null else "${refPrefix}${v}";
+          in
+          firstNonNull
+            (builtins.map parseRef refParams);
+        rev =
+          let
+            fromFragment = parseCommitHash fragment;
+            fromRev = if queryParams ? rev then parseCommitHash queryParams.rev else null;
+          in
+          firstNonNull [ fromFragment fromRev ];
       in
       assert builtins.length splitHash <= 2;
       assert builtins.length splitQuestion <= 2;
+      assert rev != null;
       queryParams // {
+        inherit ref rev;
         url = preQueryParams;
-        urlFragment = fragment;
       };
 
+    # If the input is a valid git commit hash returns a normalized version by
+    # converting alphabetical characters to lower case. If the input is not a
+    # valid hash returns null.
+    parseCommitHash = str:
+      let
+        normalized = lib.toLower str;
+        isValidHash = !(isNull (builtins.match "^[0123456789abcdef]{40}$" normalized));
+      in
+      if builtins.isString str && isValidHash then normalized else null;
+
     gatherLockFiles = crateDir:
       let
         fromCrateDir =
@@ -263,16 +299,11 @@ rec {
           let
             parsed = parseGitSource source;
             src = builtins.fetchGit ({
+              inherit (parsed) url rev;
               submodules = true;
-              inherit (parsed) url;
-              rev =
-                if isNull parsed.urlFragment
-                then parsed.rev
-                else parsed.urlFragment;
-            } // (if (parsed ? branch || parsed ? tag)
-            then { ref = parsed.branch or "refs/tags/${parsed.tag}"; }
-            else { allRefs = true; })
-            );
+            } // lib.optionalAttrs (!(isNull parsed.ref)) {
+              inherit (parsed) ref;
+            });
             hash = pkgs.runCommand "hash-of-${attrs.name}" { nativeBuildInputs = [ pkgs.nix ]; } ''
               echo -n "$(nix-hash --type sha256 --base32 ${src})" > $out
             '';
@@ -390,18 +421,16 @@ rec {
           "git" = { name, version, source, ... } @ package:
             assert (sourceType package) == "git";
             let
-              packageId = toPackageId package;
-              sha256 = extendedHashes.${packageId};
               parsed = parseGitSource source;
-              src = pkgs.fetchgit {
-                name = "${name}-${version}";
-                inherit sha256;
-                inherit (parsed) url;
-                rev =
-                  if isNull parsed.urlFragment
-                  then parsed.rev
-                  else parsed.urlFragment;
+              srcname = "${name}-${version}";
+              src-spec = {
+                inherit (parsed) url rev;
+                name = srcname;
+                submodules = true;
+              } // lib.optionalAttrs (!(isNull parsed.ref)) {
+                inherit (parsed) ref;
               };
+              src = builtins.fetchGit src-spec;
 
               rootCargo = builtins.fromTOML (builtins.readFile "${src}/Cargo.toml");
               isWorkspace = rootCargo ? "workspace";
@@ -425,13 +454,17 @@ rec {
                 else
                   ".";
             in
-            pkgs.runCommand (lib.removeSuffix ".tar.gz" src.name) { }
+            pkgs.runCommand (lib.removeSuffix ".tar.gz" srcname) { }
               ''
                 mkdir -p $out
                 cp -apR ${src}/${pathToExtract}/* $out
+                cd $out
+
+                mv ./Cargo.toml ./Cargo.toml.orig
+                ${crate2nix}/bin/crate2nix normalize-manifest --cargo-toml ${src}/${pathToExtract}/Cargo.toml > ./Cargo.toml
+
                 echo '{"package":null,"files":{}}' > $out/.cargo-checksum.json
               '';
-
         };
       };
   };