diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 71d270e..4361ba4 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -18,8 +18,3 @@ repos:
     - ts
     - json
     pass_filenames: false
-  - id: rehash
-    name: rehash
-    language: system
-    entry: just rehash-npm-nix
-    pass_filenames: false
diff --git a/Justfile b/Justfile
index 59e81e9..8fe9872 100644
--- a/Justfile
+++ b/Justfile
@@ -19,7 +19,6 @@ update:
     nix flake update
     nix develop --command pre-commit autoupdate
     nix develop --command npm update
-    nix develop --command just rehash-npm-nix
     nix develop --command just update-scanner-version
     nix develop --command pinact run -u --diff
 
@@ -31,6 +30,3 @@ update-scanner-version:
     echo "Latest: $latest"
     sd "(export const SCANNER_VERSION : string = ')[^']+(';)" "\${1}$latest\${2}" src/config/configScanner.ts
     echo "Version updated"
-
-rehash-npm-nix:
-    sd 'npmDepsHash = ".*";' "npmDepsHash = \"$(nix hash convert --to sri $(prefetch-npm-deps ./package-lock.json))\";" vsix.nix
diff --git a/flake.nix b/flake.nix
index cc5512a..bd50c3c 100644
--- a/flake.nix
+++ b/flake.nix
@@ -76,7 +76,6 @@
                 nodejs
                 pinact
                 pre-commit
-                prefetch-npm-deps
                 sd
                 typescript
                 typescript-language-server
diff --git a/vsix.nix b/vsix.nix
index 792577d..9d42eac 100644
--- a/vsix.nix
+++ b/vsix.nix
@@ -1,6 +1,7 @@
 {
   buildNpmPackage,
   clang_20,
+  importNpmLock,
   lib,
   libsecret,
   pkg-config,
@@ -14,7 +15,12 @@ buildNpmPackage {
   pname = "${packageJson.name}-vsix";
   version = packageJson.version;
   src = ./.;
-  npmDepsHash = "sha256-07D441mHQIGb9kR6B/JVv/z+Y4bj5W7zI7+xgDP6qqI=";
+
+  # Derive npm dependencies directly from package-lock.json instead of pinning
+  # a fixed-output npmDepsHash. This way dependency bumps (e.g. Dependabot PRs)
+  # don't require manually updating a hash to keep the Nix build green.
+  npmDeps = importNpmLock { npmRoot = ./.; };
+  npmConfigHook = importNpmLock.npmConfigHook;
 
   nativeBuildInputs = [
     pkg-config