diff --git a/nix/rust.nix b/nix/rust.nix
index 0156534e..5d15fae8 100644
--- a/nix/rust.nix
+++ b/nix/rust.nix
@@ -3,6 +3,9 @@
 # inputs every rust derivation (packages + checks) consumes.
 # Imported per system from flake.nix.
 { pkgs, craneLib }:
+let
+  inherit (pkgs) lib;
+in
 rec {
   # Shared between buildDepsOnly + buildPackage + cargoClippy/cargoTest
   # so every derivation in the chain sees the same toolchain shape.
@@ -21,21 +24,21 @@ rec {
     pkgs.cmake
   ];
 
-  # Narrowed source tree the rust derivations consume.
-  # `cleanCargoSource` is crane's standard "everything cargo cares
-  # about" filter (Cargo.toml/Cargo.lock + *.rs). All non-rust runtime
-  # assets — branding + the claude system prompt template +
-  # claude-settings.json — live in the separate `hyperhive-assets`
-  # derivation and are loaded by the binaries at runtime from
-  # `$HIVE_ASSETS_DIR`. The unit tests in `hive-ag3nt::prompt` read
-  # `prompts/system.md` directly from the workspace tree at *test*
-  # runtime (via `env!("CARGO_MANIFEST_DIR")` — a compile-time string,
-  # no file open at compile), so the prompt template doesn't have to
-  # be in this fileset to keep `cargo test` honest. Net effect: tweaks
-  # to any non-`*.rs` / non-`Cargo.*` file (README, branding, nix
-  # modules, frontend tree, OR `hive-ag3nt/prompts/*`) do NOT bust
-  # this src hash, so the rust derivations stay fully cached.
-  cleanSrc = craneLib.cleanCargoSource ../.;
+  # Narrowed source tree the rust derivations consume: everything
+  # cargo cares about (Cargo.toml/Cargo.lock + *.rs/*.toml), selected
+  # via `lib.fileset` rather than crane's `cleanCargoSource` filter —
+  # filesets drop directories that contain no selected files, so
+  # adding or renaming a non-rust directory (nix modules, docs, …)
+  # does NOT bust this src hash (an empty dir under a plain source
+  # filter would). All non-rust runtime assets — branding + the claude
+  # prompt template + claude-settings.json — live in the separate
+  # `hyperhive-assets` derivation and are loaded by the binaries at
+  # runtime from `$HIVE_ASSETS_DIR`. Net effect: only `*.rs` /
+  # `*.toml` / `Cargo.lock` edits rebuild the rust derivations.
+  cleanSrc = lib.fileset.toSource {
+    root = ../.;
+    fileset = craneLib.fileset.commonCargoSources ../.;
+  };
 
   # Build the workspace's dependency tree once, cached as its own
   # derivation. Package builds and checks reuse this via