diff --git a/flake.nix b/flake.nix
index 8aaa2491..f2f0bdca 100644
--- a/flake.nix
+++ b/flake.nix
@@ -46,16 +46,33 @@
             pkgs = nixpkgs.legacyPackages.${system};
             treefmt-eval = treefmt-nix.lib.evalModule pkgs treefmt-config;
             craneLib = crane.mkLib pkgs;
+            # Narrowed source tree the rust derivations consume.
+            # `commonCargoSources` is crane's standard "everything cargo
+            # cares about" filter (Cargo.toml/Cargo.lock + *.rs); we
+            # union it with the one non-rust path the workspace still
+            # references — `hive-ag3nt/prompts/` — which is read at
+            # compile time by `hive-ag3nt::prompt::tests` via
+            # `include_str!`. Branding assets + claude prompts at
+            # runtime live in the `hyperhive-assets` derivation
+            # (#555), so a tweak to e.g. `branding/hyperhive.svg`,
+            # `README.md`, the `nix/` modules, or the frontend tree
+            # does NOT bust this src hash and the rust derivations
+            # stay cached.
+            cleanSrc = lib.fileset.toSource {
+              root = ./.;
+              fileset = lib.fileset.unions [
+                (craneLib.fileset.commonCargoSources ./.)
+                ./hive-ag3nt/prompts
+              ];
+            };
             # Build the workspace's dependency tree once, cached as
             # its own derivation. `buildPackage` and `cargoClippy`
             # both reuse this via `inherit cargoArtifacts;` so a
-            # workspace-only edit doesn't rebuild deps. Same
-            # `nativeBuildInputs` as the workspace build itself —
-            # build.rs runs during dep-build too (any deps with a
-            # build.rs need rsvg too if they transitively pull it
-            # in; harmless if they don't).
+            # workspace-only edit doesn't rebuild deps. All three
+            # derivations consume the same `cleanSrc` so the input
+            # hash stays consistent across the chain.
             cargoArtifacts = craneLib.buildDepsOnly {
-              src = ./.;
+              src = cleanSrc;
               # Workspace Cargo.toml is virtual (no `[package].name`),
               # so crane can't auto-derive a name. Spell it out
               # explicitly here and below — keeps the derivation name
@@ -88,13 +105,14 @@
         {
           pkgs,
           craneLib,
+          cleanSrc,
           cargoArtifacts,
           nativeBuildInputs,
           ...
         }:
         {
           default = craneLib.buildPackage {
-            src = ./.;
+            src = cleanSrc;
             inherit cargoArtifacts nativeBuildInputs;
             pname = "hyperhive-workspace";
             version = "0.1.0";
@@ -250,6 +268,7 @@
         {
           treefmt-eval,
           craneLib,
+          cleanSrc,
           cargoArtifacts,
           nativeBuildInputs,
           ...
@@ -265,7 +284,7 @@
           # separator, which is why the old wiring went through
           # overrideAttrs).
           clippy = craneLib.cargoClippy {
-            src = ./.;
+            src = cleanSrc;
             inherit cargoArtifacts nativeBuildInputs;
             pname = "hyperhive-workspace";
             version = "0.1.0";