diff --git a/frontend/npm-deps-hash b/frontend/npm-deps-hash
new file mode 100644
index 00000000..fcb93e72
--- /dev/null
+++ b/frontend/npm-deps-hash
@@ -0,0 +1 @@
+sha256-8mYI9b1nuQ8YNFkW/ezJwO5Qw6NJTDG+kspYozs/5cI=
\ No newline at end of file
diff --git a/nix/checks.nix b/nix/checks.nix
index ee4ca537..c5d461f8 100644
--- a/nix/checks.nix
+++ b/nix/checks.nix
@@ -149,10 +149,12 @@ in
     version = "0.0.0";
     src = ../frontend;
 
-    # Same lockfile as `frontend`/`swarm-ui` above — recompute in
-    # lockstep with those two whenever `frontend/package-lock.json`
-    # changes (`prefetch-npm-deps frontend/package-lock.json`).
-    npmDepsHash = "sha256-8mYI9b1nuQ8YNFkW/ezJwO5Qw6NJTDG+kspYozs/5cI=";
+    # Same lockfile as `frontend`/`swarm-ui` above — reads the same
+    # `frontend/npm-deps-hash` file both of those do, so this stays in
+    # lockstep automatically. Regenerate that file with
+    # `prefetch-npm-deps frontend/package-lock.json` when the lockfile
+    # changes.
+    npmDepsHash = builtins.readFile ../frontend/npm-deps-hash;
 
     buildPhase = ''
       runHook preBuild
diff --git a/nix/packages/frontend.nix b/nix/packages/frontend.nix
index e97c24f0..406065bd 100644
--- a/nix/packages/frontend.nix
+++ b/nix/packages/frontend.nix
@@ -35,12 +35,15 @@ buildNpmPackage {
   version = "0.0.0";
   src = ../../frontend;
 
-  # Computed from `frontend/package-lock.json` via
-  #   prefetch-npm-deps frontend/package-lock.json
-  # Update whenever the lockfile changes. Recompute locally with the
-  # same command (`pkgs.prefetch-npm-deps`), or let the build fail
-  # and copy the actual hash from the error message.
-  npmDepsHash = "sha256-8mYI9b1nuQ8YNFkW/ezJwO5Qw6NJTDG+kspYozs/5cI=";
+  # Read from `../../frontend/npm-deps-hash`, the single source of
+  # truth `./swarm-ui.nix` and `../checks.nix`'s `swarm-ui-typecheck`
+  # also read — all three build from the one `frontend/package-lock.json`,
+  # so one file keeps them from drifting independently (this used to be
+  # a hardcoded copy per derivation, and only some of the three got
+  # updated the one time the lockfile changed). Regenerate with
+  # `prefetch-npm-deps frontend/package-lock.json` and overwrite the
+  # file whenever the lockfile changes.
+  npmDepsHash = builtins.readFile ../../frontend/npm-deps-hash;
 
   # `npm run build` recurses into all workspaces (`--workspaces
   # --if-present`). The workspaces' build scripts each run their own
diff --git a/nix/packages/swarm-ui.nix b/nix/packages/swarm-ui.nix
index 3d2c0d23..bf9ade44 100644
--- a/nix/packages/swarm-ui.nix
+++ b/nix/packages/swarm-ui.nix
@@ -19,10 +19,12 @@
 # against authelia is figured out) has something to point at.
 #
 # Shares `frontend/package-lock.json` with `./frontend.nix` (same repo,
-# same npm workspace root) — `npmDepsHash` must be updated in lockstep
-# with that file's whenever the lockfile changes, since both hash the
-# same file. Scoped to build only the `swarm-ui` workspace (not the
-# whole `npm run build --workspaces` frontend.nix runs) via an explicit
+# same npm workspace root) — `npmDepsHash` is read from
+# `../../frontend/npm-deps-hash`, the same file `./frontend.nix` and
+# `../checks.nix`'s `swarm-ui-typecheck` read, so all three stay in
+# lockstep automatically instead of needing 3 separate hand-edits.
+# Scoped to build only the `swarm-ui` workspace (not the whole
+# `npm run build --workspaces` frontend.nix runs) via an explicit
 # `npm run build --workspace=…` buildPhase, so a dashboard/agent-only
 # change doesn't need to rebuild (or re-review the output of) this
 # derivation.
@@ -32,10 +34,9 @@ buildNpmPackage {
   version = "0.0.0";
   src = ../../frontend;
 
-  # Recompute with `prefetch-npm-deps frontend/package-lock.json`
-  # whenever the lockfile changes — same value as `./frontend.nix`'s
-  # `npmDepsHash`, both hash the one shared lockfile.
-  npmDepsHash = "sha256-8mYI9b1nuQ8YNFkW/ezJwO5Qw6NJTDG+kspYozs/5cI=";
+  # See `./frontend.nix`'s comment on the same line — one shared file,
+  # regenerate with `prefetch-npm-deps frontend/package-lock.json`.
+  npmDepsHash = builtins.readFile ../../frontend/npm-deps-hash;
 
   buildPhase = ''
     runHook preBuild