diff --git a/nix/frontend.nix b/nix/frontend.nix
index c161ed2..cb2a853 100644
--- a/nix/frontend.nix
+++ b/nix/frontend.nix
@@ -28,12 +28,12 @@ buildNpmPackage {
   version = "0.0.0";
   src = ../frontend;
 
-  # Computed from `frontend/package-lock.json`. The build will fail
-  # with the actual hash printed on the first attempt; update this
-  # whenever package-lock.json changes. Use
-  #   nix run nixpkgs#prefetch-npm-deps -- frontend/package-lock.json
-  # locally to recompute without a build round-trip.
-  npmDepsHash = lib.fakeHash;
+  # Computed from `frontend/package-lock.json` via
+  #   prefetch-npm-deps frontend/package-lock.json
+  # Update whenever the lockfile changes. Recompute locally with the
+  # same command (`pkgs.prefetch-npm-deps`), or let the build fail
+  # and copy the actual hash from the error message.
+  npmDepsHash = "sha256-MHXxkZpe/5LAhpQ76ZK94znG2noTobthjUi6iNY8/K4=";
 
   # `npm run build` recurses into all workspaces (`--workspaces
   # --if-present`). The workspaces' build scripts each run their own