diff --git a/nix/modules/hive-matrix.nix b/nix/modules/hive-matrix.nix
index ea99d839..7e670aa6 100644
--- a/nix/modules/hive-matrix.nix
+++ b/nix/modules/hive-matrix.nix
@@ -41,26 +41,25 @@ let
   # emscripten-wrapped C library that fluffychat's main.dart.js
   # references at runtime.
   #
-  # Source: pub.dev `native_imaging` v0.4.0 tarball — same provenance
-  # as fluffychat-web's pubspec.lock-resolved native_imaging dependency
-  # (both pin 0.4.0, both fetch from pub.dev). When fluffychat's
-  # pubspec.lock bumps native_imaging, bump the version + hash here.
+  # Source: the exact native_imaging derivation that `pkgs.fluffychat-web`
+  # already pulls in via its `pubspecLock` (resolved by nixpkgs's flutter
+  # pub-cache machinery), reached via `passthru.pubspecLock.dependencySources`.
+  # This means **no parallel hash pin** — when nixpkgs bumps
+  # `pkgs.fluffychat-web` (and with it the pubspec.lock-resolved
+  # native_imaging version), our build automatically picks up the
+  # matching source. Version is also pulled from passthru for the
+  # derivation's `version` attr so it stays in lockstep.
   #
   # Closure cost: `pkgs.emscripten` is ~3.6 GiB build-time (LLVM +
   # toolchain). Runtime closure is only the two produced files —
   # nothing emscripten-shaped survives into the deployed dist.
-  fluffychat-web-imaging = pkgs.stdenv.mkDerivation rec {
+  fluffychat-web-imaging = pkgs.stdenv.mkDerivation {
     pname = "fluffychat-web-imaging";
-    version = "0.4.0";
+    version = pkgs.fluffychat-web.passthru.pubspecLock.dependencyVersions.native_imaging;
 
-    src = pkgs.fetchurl {
-      url = "https://pub.dev/packages/native_imaging/versions/${version}.tar.gz";
-      hash = "sha256-ztessYuApDFXjJBo65w+51+N85SR6K2vRxY1usKC1lE=";
-    };
-
-    # pub.dev's `.tar.gz` for a dart package unpacks to the working
-    # directory (no top-level subdir), unlike a normal source tarball.
-    sourceRoot = ".";
+    # The pub-cache derivation that fluffychat-web's flutter build uses.
+    # Already in the build closure; no `fetchurl` or own hash pin.
+    src = pkgs.fluffychat-web.passthru.pubspecLock.dependencySources.native_imaging;
 
     nativeBuildInputs = with pkgs; [
       emscripten