diff --git a/internal/devbox/devbox.go b/internal/devbox/devbox.go
index 8f8d666ab93..acb1512b64a 100644
--- a/internal/devbox/devbox.go
+++ b/internal/devbox/devbox.go
@@ -46,6 +46,7 @@ import (
 	"go.jetpack.io/devbox/internal/shellgen"
 	"go.jetpack.io/devbox/internal/telemetry"
 	"go.jetpack.io/devbox/internal/ux"
+	"go.jetpack.io/devbox/nix/flake"
 )
 
 const (
@@ -202,8 +203,14 @@ func (d *Devbox) ConfigHash() (string, error) {
 	return cachehash.Bytes(buf.Bytes()), nil
 }
 
-func (d *Devbox) NixPkgsCommitHash() string {
-	return d.cfg.NixPkgsCommitHash()
+func (d *Devbox) Stdenv() flake.Ref {
+	return flake.Ref{
+		Type:  flake.TypeGitHub,
+		Owner: "NixOS",
+		Repo:  "nixpkgs",
+		Ref:   "nixpkgs-unstable",
+		Rev:   d.cfg.NixPkgsCommitHash(),
+	}
 }
 
 func (d *Devbox) Generate(ctx context.Context) error {
diff --git a/internal/devbox/packages.go b/internal/devbox/packages.go
index 8ed878e34fc..83d1fba7450 100644
--- a/internal/devbox/packages.go
+++ b/internal/devbox/packages.go
@@ -28,6 +28,7 @@ import (
 	"go.jetpack.io/devbox/internal/setup"
 	"go.jetpack.io/devbox/internal/shellgen"
 	"go.jetpack.io/devbox/internal/telemetry"
+	"go.jetpack.io/devbox/nix/flake"
 	"go.jetpack.io/pkg/auth"
 
 	"go.jetpack.io/devbox/internal/boxcli/usererr"
@@ -101,10 +102,17 @@ func (d *Devbox) Add(ctx context.Context, pkgsNames []string, opts devopt.AddOpt
 			// This means it didn't validate and we don't want to fallback to legacy
 			// Just propagate the error.
 			return err
-		} else if _, err := nix.Search(d.lockfile.LegacyNixpkgsPath(pkg.Raw)); err != nil {
-			// This means it looked like a devbox package or attribute path, but we
-			// could not find it in search or in the legacy nixpkgs path.
-			return usererr.New("Package %s not found", pkg.Raw)
+		} else {
+			installable := flake.Installable{
+				Ref:      d.lockfile.Stdenv(),
+				AttrPath: pkg.Raw,
+			}
+			_, err := nix.Search(installable.String())
+			if err != nil {
+				// This means it looked like a devbox package or attribute path, but we
+				// could not find it in search or in the legacy nixpkgs path.
+				return usererr.New("Package %s not found", pkg.Raw)
+			}
 		}
 
 		ux.Finfof(d.stderr, "Adding package %q to devbox.json\n", packageNameForConfig)
diff --git a/internal/devbox/update.go b/internal/devbox/update.go
index cb0c0f07789..79b4693c3ab 100644
--- a/internal/devbox/update.go
+++ b/internal/devbox/update.go
@@ -65,6 +65,9 @@ func (d *Devbox) Update(ctx context.Context, opts devopt.UpdateOpts) error {
 		}
 	}
 
+	if err := d.updateStdenv(); err != nil {
+		return err
+	}
 	if err := d.ensureStateIsUpToDate(ctx, update); err != nil {
 		return err
 	}
@@ -103,6 +106,15 @@ func (d *Devbox) inputsToUpdate(
 	return pkgsToUpdate, nil
 }
 
+func (d *Devbox) updateStdenv() error {
+	err := d.lockfile.Remove(d.Stdenv().String())
+	if err != nil {
+		return err
+	}
+	d.lockfile.Stdenv() // will re-resolve the stdenv flake
+	return nil
+}
+
 func (d *Devbox) updateDevboxPackage(pkg *devpkg.Package) error {
 	resolved, err := d.lockfile.FetchResolvedPackage(pkg.Raw)
 	if err != nil {
diff --git a/internal/devconfig/configfile/file.go b/internal/devconfig/configfile/file.go
index 0ecb976e0ea..09939ff3b88 100644
--- a/internal/devconfig/configfile/file.go
+++ b/internal/devconfig/configfile/file.go
@@ -94,11 +94,8 @@ func (c *ConfigFile) Equals(other *ConfigFile) bool {
 }
 
 func (c *ConfigFile) NixPkgsCommitHash() string {
-	// The commit hash for nixpkgs-unstable on 2023-10-25 from status.nixos.org
-	const DefaultNixpkgsCommit = "75a52265bda7fd25e06e3a67dee3f0354e73243c"
-
-	if c == nil || c.Nixpkgs == nil || c.Nixpkgs.Commit == "" {
-		return DefaultNixpkgsCommit
+	if c == nil || c.Nixpkgs == nil {
+		return ""
 	}
 	return c.Nixpkgs.Commit
 }
diff --git a/internal/devpkg/package.go b/internal/devpkg/package.go
index a6f3b6db528..6a33836b428 100644
--- a/internal/devpkg/package.go
+++ b/internal/devpkg/package.go
@@ -151,9 +151,13 @@ func newPackage(raw string, isInstallable func() bool, locker lock.Locker) *Pack
 		return pkg
 	}
 
-	// We currently don't lock flake references in devbox.lock, so there's
-	// nothing to resolve.
-	pkg.resolve = sync.OnceValue(func() error { return nil })
+	pkg.resolve = sync.OnceValue(func() error {
+		// Don't lock flakes that are local paths.
+		if parsed.Ref.Type == flake.TypePath {
+			return nil
+		}
+		return resolve(pkg)
+	})
 	pkg.setInstallable(parsed, locker.ProjectDir())
 	pkg.outputs = outputs{selectedNames: strings.Split(parsed.Outputs, ",")}
 	pkg.Patch = pkgNeedsPatch(pkg.CanonicalName(), configfile.PatchAuto)
diff --git a/internal/devpkg/package_test.go b/internal/devpkg/package_test.go
index 7c6876edc7c..047c16d9649 100644
--- a/internal/devpkg/package_test.go
+++ b/internal/devpkg/package_test.go
@@ -12,6 +12,7 @@ import (
 	"github.com/samber/lo"
 	"go.jetpack.io/devbox/internal/lock"
 	"go.jetpack.io/devbox/internal/nix"
+	"go.jetpack.io/devbox/nix/flake"
 )
 
 const nixCommitHash = "hsdafkhsdafhas"
@@ -108,12 +109,13 @@ func (l *lockfile) ProjectDir() string {
 	return l.projectDir
 }
 
-func (l *lockfile) LegacyNixpkgsPath(pkg string) string {
-	return fmt.Sprintf(
-		"github:NixOS/nixpkgs/%s#%s",
-		nixCommitHash,
-		pkg,
-	)
+func (l *lockfile) Stdenv() flake.Ref {
+	return flake.Ref{
+		Type:  flake.TypeGitHub,
+		Owner: "NixOS",
+		Repo:  "nixpkgs",
+		Rev:   nixCommitHash,
+	}
 }
 
 func (l *lockfile) Get(pkg string) *lock.Package {
@@ -128,7 +130,10 @@ func (l *lockfile) Resolve(pkg string) (*lock.Package, error) {
 		return &lock.Package{Resolved: pkg}, nil
 	default:
 		return &lock.Package{
-			Resolved: l.LegacyNixpkgsPath(pkg),
+			Resolved: flake.Installable{
+				Ref:      l.Stdenv(),
+				AttrPath: pkg,
+			}.String(),
 		}, nil
 	}
 }
diff --git a/internal/lock/interfaces.go b/internal/lock/interfaces.go
index 2210d99c091..d2c57d245bd 100644
--- a/internal/lock/interfaces.go
+++ b/internal/lock/interfaces.go
@@ -3,16 +3,18 @@
 
 package lock
 
+import "go.jetpack.io/devbox/nix/flake"
+
 type devboxProject interface {
 	ConfigHash() (string, error)
-	NixPkgsCommitHash() string
+	Stdenv() flake.Ref
 	AllPackageNamesIncludingRemovedTriggerPackages() []string
 	ProjectDir() string
 }
 
 type Locker interface {
 	Get(string) *Package
-	LegacyNixpkgsPath(string) string
+	Stdenv() flake.Ref
 	ProjectDir() string
 	Resolve(string) (*Package, error)
 }
diff --git a/internal/lock/lockfile.go b/internal/lock/lockfile.go
index e4a47effa31..d5ab8f792bc 100644
--- a/internal/lock/lockfile.go
+++ b/internal/lock/lockfile.go
@@ -5,17 +5,18 @@ package lock
 
 import (
 	"context"
-	"fmt"
 	"io/fs"
+	"maps"
 	"path/filepath"
+	"slices"
 	"strings"
 
 	"github.com/pkg/errors"
-	"github.com/samber/lo"
 	"go.jetpack.io/devbox/internal/cachehash"
 	"go.jetpack.io/devbox/internal/devpkg/pkgtype"
 	"go.jetpack.io/devbox/internal/nix"
 	"go.jetpack.io/devbox/internal/searcher"
+	"go.jetpack.io/devbox/nix/flake"
 	"go.jetpack.io/pkg/runx/impl/types"
 
 	"go.jetpack.io/devbox/internal/cuecfg"
@@ -74,25 +75,32 @@ func (f *File) Remove(pkgs ...string) error {
 // This avoids writing values that may need to be removed in case of error.
 func (f *File) Resolve(pkg string) (*Package, error) {
 	entry, hasEntry := f.Packages[pkg]
+	if hasEntry && entry.Resolved != "" {
+		return f.Packages[pkg], nil
+	}
 
-	if !hasEntry || entry.Resolved == "" {
-		locked := &Package{}
-		var err error
-		if _, _, versioned := searcher.ParseVersionedPackage(pkg); pkgtype.IsRunX(pkg) || versioned {
-			locked, err = f.FetchResolvedPackage(pkg)
-			if err != nil {
-				return nil, err
-			}
-		} else if IsLegacyPackage(pkg) {
-			// These are legacy packages without a version. Resolve to nixpkgs with
-			// whatever hash is in the devbox.json
-			locked = &Package{
-				Resolved: f.LegacyNixpkgsPath(pkg),
-				Source:   nixpkgSource,
-			}
+	locked := &Package{}
+	_, _, versioned := searcher.ParseVersionedPackage(pkg)
+	if pkgtype.IsRunX(pkg) || versioned || pkgtype.IsFlake(pkg) {
+		resolved, err := f.FetchResolvedPackage(pkg)
+		if err != nil {
+			return nil, err
+		}
+		if resolved != nil {
+			locked = resolved
+		}
+	} else if IsLegacyPackage(pkg) {
+		// These are legacy packages without a version. Resolve to nixpkgs with
+		// whatever hash is in the devbox.json
+		locked = &Package{
+			Resolved: flake.Installable{
+				Ref:      f.Stdenv(),
+				AttrPath: pkg,
+			}.String(),
+			Source: nixpkgSource,
 		}
-		f.Packages[pkg] = locked
 	}
+	f.Packages[pkg] = locked
 
 	return f.Packages[pkg], nil
 }
@@ -133,12 +141,17 @@ func (f *File) Save() error {
 	return cuecfg.WriteFile(lockFilePath(f.devboxProject.ProjectDir()), f)
 }
 
-func (f *File) LegacyNixpkgsPath(pkg string) string {
-	return fmt.Sprintf(
-		"github:NixOS/nixpkgs/%s#%s",
-		f.NixPkgsCommitHash(),
-		pkg,
-	)
+func (f *File) Stdenv() flake.Ref {
+	unlocked := f.devboxProject.Stdenv()
+	pkg, err := f.Resolve(unlocked.String())
+	if err != nil {
+		return unlocked
+	}
+	ref, err := flake.ParseRef(pkg.Resolved)
+	if err != nil {
+		return unlocked
+	}
+	return ref
 }
 
 func (f *File) Get(pkg string) *Package {
@@ -174,10 +187,11 @@ func IsLegacyPackage(pkg string) bool {
 // Tidy ensures that the lockfile has the set of packages corresponding to the devbox.json config.
 // It gets rid of older packages that are no longer needed.
 func (f *File) Tidy() {
-	f.Packages = lo.PickByKeys(
-		f.Packages,
-		f.devboxProject.AllPackageNamesIncludingRemovedTriggerPackages(),
-	)
+	keep := f.devboxProject.AllPackageNamesIncludingRemovedTriggerPackages()
+	keep = append(keep, f.devboxProject.Stdenv().String())
+	maps.DeleteFunc(f.Packages, func(key string, pkg *Package) bool {
+		return !slices.Contains(keep, key)
+	})
 }
 
 // IsUpToDateAndInstalled returns true if the lockfile is up to date and the
diff --git a/internal/lock/resolve.go b/internal/lock/resolve.go
index a8d44b82612..2dd0111669a 100644
--- a/internal/lock/resolve.go
+++ b/internal/lock/resolve.go
@@ -18,6 +18,7 @@ import (
 	"go.jetpack.io/devbox/internal/nix"
 	"go.jetpack.io/devbox/internal/redact"
 	"go.jetpack.io/devbox/internal/searcher"
+	"go.jetpack.io/devbox/nix/flake"
 	"golang.org/x/sync/errgroup"
 )
 
@@ -29,7 +30,17 @@ import (
 // to update because it would be slow and wasteful.
 func (f *File) FetchResolvedPackage(pkg string) (*Package, error) {
 	if pkgtype.IsFlake(pkg) {
-		return nil, nil
+		installable, err := flake.ParseInstallable(pkg)
+		if err != nil {
+			return nil, fmt.Errorf("package %q: %v", pkg, err)
+		}
+		installable.Ref, err = lockFlake(context.TODO(), installable.Ref)
+		if err != nil {
+			return nil, err
+		}
+		return &Package{
+			Resolved: installable.String(),
+		}, nil
 	}
 
 	name, version, _ := searcher.ParseVersionedPackage(pkg)
@@ -194,3 +205,24 @@ func buildLockSystemInfos(pkg *searcher.PackageVersion) (map[string]*SystemInfo,
 	}
 	return sysInfos, nil
 }
+
+func lockFlake(ctx context.Context, ref flake.Ref) (flake.Ref, error) {
+	if ref.Locked() {
+		return ref, nil
+	}
+
+	// Nix requires a NAR hash for GitHub flakes to be locked. A Devbox lock
+	// file is a bit more lenient and only requires a revision so that we
+	// don't need to download the nixpkgs source for cached packages. If the
+	// search index is ever able to return the NAR hash then we can remove
+	// this check.
+	if ref.Type == flake.TypeGitHub && (ref.Rev != "") {
+		return ref, nil
+	}
+
+	meta, err := nix.ResolveFlake(ctx, ref)
+	if err != nil {
+		return ref, err
+	}
+	return meta.Locked, nil
+}
diff --git a/internal/nix/build.go b/internal/nix/build.go
index 6a3704bbe31..922e78aad2e 100644
--- a/internal/nix/build.go
+++ b/internal/nix/build.go
@@ -20,6 +20,9 @@ type BuildArgs struct {
 
 func Build(ctx context.Context, args *BuildArgs, installables ...string) error {
 	defer debug.FunctionTimer().End()
+
+	FixInstallableArgs(installables)
+
 	// --impure is required for allowUnfreeEnv/allowInsecureEnv to work.
 	cmd := command("build", "--impure")
 	cmd.Args = appendArgs(cmd.Args, args.Flags)
diff --git a/internal/nix/flake.go b/internal/nix/flake.go
new file mode 100644
index 00000000000..252a5ec2002
--- /dev/null
+++ b/internal/nix/flake.go
@@ -0,0 +1,30 @@
+package nix
+
+import (
+	"context"
+	"encoding/json"
+
+	"go.jetpack.io/devbox/nix/flake"
+)
+
+type FlakeMetadata struct {
+	Description string    `json:"description"`
+	Original    flake.Ref `json:"original"`
+	Resolved    flake.Ref `json:"resolved"`
+	Locked      flake.Ref `json:"locked"`
+	Path        string    `json:"path"`
+}
+
+func ResolveFlake(ctx context.Context, ref flake.Ref) (FlakeMetadata, error) {
+	cmd := command("flake", "metadata", "--json", ref)
+	out, err := cmd.Output(ctx)
+	if err != nil {
+		return FlakeMetadata{}, err
+	}
+	meta := FlakeMetadata{}
+	err = json.Unmarshal(out, &meta)
+	if err != nil {
+		return FlakeMetadata{}, err
+	}
+	return meta, nil
+}
diff --git a/internal/nix/nix.go b/internal/nix/nix.go
index b32c66d9b58..59987c1aadc 100644
--- a/internal/nix/nix.go
+++ b/internal/nix/nix.go
@@ -259,3 +259,36 @@ func restartDaemon(ctx context.Context) error {
 	time.Sleep(2 * time.Second)
 	return nil
 }
+
+// FixInstallableArgs removes the narHash and lastModifiedDate query parameters
+// from any args that are valid installables and the Nix version is <2.25.
+// Otherwise it returns them unchanged.
+//
+// This fixes an issues with some older versions of Nix where specifying a
+// narHash without a lastModifiedDate results in an error.
+func FixInstallableArgs(args []string) {
+	if AtLeast(Version2_25) {
+		return
+	}
+
+	for i := range args {
+		parsed, _ := flake.ParseInstallable(args[i])
+		if parsed.Ref.NARHash == "" && parsed.Ref.LastModified == 0 {
+			continue
+		}
+		if parsed.Ref.NARHash != "" && parsed.Ref.LastModified != 0 {
+			continue
+		}
+
+		parsed.Ref.NARHash = ""
+		parsed.Ref.LastModified = 0
+		args[i] = parsed.String()
+	}
+}
+
+// fixInstallableArg calls fixInstallableArgs with a single argument.
+func FixInstallableArg(arg string) string {
+	args := []string{arg}
+	FixInstallableArgs(args)
+	return args[0]
+}
diff --git a/internal/nix/profiles.go b/internal/nix/profiles.go
index 9fdfc17690f..54e9adadf94 100644
--- a/internal/nix/profiles.go
+++ b/internal/nix/profiles.go
@@ -52,6 +52,7 @@ func ProfileInstall(ctx context.Context, args *ProfileInstallArgs) error {
 		"--priority", nextPriority(args.ProfilePath),
 	)
 
+	FixInstallableArgs(args.Installables)
 	cmd.Args = appendArgs(cmd.Args, args.Installables)
 	cmd.Env = allowUnfreeEnv(os.Environ())
 
@@ -75,6 +76,8 @@ func ProfileRemove(profilePath string, packageNames ...string) error {
 		"--profile", profilePath,
 		"--impure", // for NIXPKGS_ALLOW_UNFREE
 	)
+
+	FixInstallableArgs(packageNames)
 	cmd.Args = appendArgs(cmd.Args, packageNames)
 	cmd.Env = allowUnfreeEnv(allowInsecureEnv(os.Environ()))
 	return cmd.Run(context.TODO())
diff --git a/internal/nix/store.go b/internal/nix/store.go
index 8b3dbd47e21..0ccd726f61f 100644
--- a/internal/nix/store.go
+++ b/internal/nix/store.go
@@ -27,8 +27,9 @@ func StorePathFromHashPart(ctx context.Context, hash, storeAddr string) (string,
 
 func StorePathsFromInstallable(ctx context.Context, installable string, allowInsecure bool) ([]string, error) {
 	defer debug.FunctionTimer().End()
+
 	// --impure for NIXPKGS_ALLOW_UNFREE
-	cmd := command("path-info", installable, "--json", "--impure")
+	cmd := command("path-info", FixInstallableArg(installable), "--json", "--impure")
 	cmd.Env = allowUnfreeEnv(os.Environ())
 
 	if allowInsecure {
diff --git a/internal/shellgen/flake_input.go b/internal/shellgen/flake_input.go
index 2f96b2bb81c..32e4316c4c4 100644
--- a/internal/shellgen/flake_input.go
+++ b/internal/shellgen/flake_input.go
@@ -11,39 +11,42 @@ import (
 	"github.com/samber/lo"
 	"go.jetpack.io/devbox/internal/devpkg"
 	"go.jetpack.io/devbox/internal/nix"
+	"go.jetpack.io/devbox/nix/flake"
 )
 
-const glibcPatchFlakeRef = "path:./glibc-patch"
+var glibcPatchFlakeRef = flake.Ref{Type: flake.TypePath, Path: "./glibc-patch"}
 
 type flakeInput struct {
 	Name     string
 	Packages []*devpkg.Package
-	URL      string
+	Ref      flake.Ref
 }
 
-// IsNixpkgs returns true if the input is a nixpkgs flake of the form:
-// github:NixOS/nixpkgs/...
+// IsNixpkgs reports whether the input looks like a nixpkgs flake.
 //
 // While there are many ways to specify this input, devbox always uses
 // github:NixOS/nixpkgs/<hash> as the URL. If the user wishes to reference nixpkgs
 // themselves, this function may not return true.
 func (f *flakeInput) IsNixpkgs() bool {
-	return nix.IsGithubNixpkgsURL(f.URL)
+	switch f.Ref.Type {
+	case flake.TypeGitHub:
+		return f.Ref.Owner == "NixOS" && f.Ref.Repo == "nixpkgs"
+	case flake.TypeIndirect:
+		return f.Ref.ID == "nixpkgs"
+	default:
+		return false
+	}
 }
 
 func (f *flakeInput) HashFromNixPkgsURL() string {
-	if !f.IsNixpkgs() {
-		return ""
-	}
-	return nix.HashFromNixPkgsURL(f.URL)
+	return f.Ref.Rev
 }
 
 func (f *flakeInput) URLWithCaching() string {
 	if !f.IsNixpkgs() {
-		return f.URL
+		return nix.FixInstallableArg(f.Ref.String())
 	}
-	hash := nix.HashFromNixPkgsURL(f.URL)
-	return getNixpkgsInfo(hash).URL
+	return getNixpkgsInfo(f.Ref.Rev).URL
 }
 
 func (f *flakeInput) PkgImportName() string {
@@ -180,17 +183,24 @@ func flakeInputs(ctx context.Context, packages []*devpkg.Package) []flakeInput {
 		// glibc-patched flake input. This input refers to the
 		// glibc-patch.nix flake.
 		if pkg.Patch {
-			nixpkgsGlibc := flakeInputs.getOrAppend(glibcPatchFlakeRef)
+			nixpkgsGlibc := flakeInputs.getOrAppend(glibcPatchFlakeRef.String())
 			nixpkgsGlibc.Name = "glibc-patch"
-			nixpkgsGlibc.URL = glibcPatchFlakeRef
+			nixpkgsGlibc.Ref = glibcPatchFlakeRef
 			nixpkgsGlibc.Packages = append(nixpkgsGlibc.Packages, pkg)
 			continue
 		}
 
-		pkgURL := pkg.URLForFlakeInput()
-		flake := flakeInputs.getOrAppend(pkgURL)
+		installable, err := pkg.FlakeInstallable()
+		if err != nil {
+			// I don't think this should happen at this point. The
+			// packages should already be resolved to valid nixpkgs
+			// packages.
+			slog.Debug("error resolving package to flake installable", "err", err)
+			continue
+		}
+		flake := flakeInputs.getOrAppend(installable.Ref.String())
 		flake.Name = pkg.FlakeInputName()
-		flake.URL = pkgURL
+		flake.Ref = installable.Ref
 
 		// TODO(gcurtis): is the uniqueness check necessary? We're
 		// comparing pointers.
diff --git a/internal/shellgen/flake_plan.go b/internal/shellgen/flake_plan.go
index d38249d905e..5fa918647d5 100644
--- a/internal/shellgen/flake_plan.go
+++ b/internal/shellgen/flake_plan.go
@@ -20,7 +20,7 @@ import (
 // flakePlan contains the data to populate the top level flake.nix file
 // that builds the devbox environment
 type flakePlan struct {
-	NixpkgsInfo *NixpkgsInfo
+	Stdenv      flake.Ref
 	Packages    []*devpkg.Package
 	FlakeInputs []flakeInput
 	System      string
@@ -44,21 +44,9 @@ func newFlakePlan(ctx context.Context, devbox devboxer) (*flakePlan, error) {
 		return nil, err
 	}
 
-	flakeInputs := flakeInputs(ctx, packages)
-	nixpkgsInfo := getNixpkgsInfo(devbox.Config().NixPkgsCommitHash())
-
-	// This is an optimization. Try to reuse the nixpkgs info from the flake
-	// inputs to avoid introducing a new one.
-	for _, input := range flakeInputs {
-		if input.IsNixpkgs() {
-			nixpkgsInfo = getNixpkgsInfo(input.HashFromNixPkgsURL())
-			break
-		}
-	}
-
 	return &flakePlan{
-		FlakeInputs: flakeInputs,
-		NixpkgsInfo: nixpkgsInfo,
+		FlakeInputs: flakeInputs(ctx, packages),
+		Stdenv:      devbox.Lockfile().Stdenv(),
 		Packages:    packages,
 		System:      nix.System(),
 	}, nil
@@ -66,7 +54,7 @@ func newFlakePlan(ctx context.Context, devbox devboxer) (*flakePlan, error) {
 
 func (f *flakePlan) needsGlibcPatch() bool {
 	for _, in := range f.FlakeInputs {
-		if in.URL == glibcPatchFlakeRef {
+		if in.Ref == glibcPatchFlakeRef {
 			return true
 		}
 	}
diff --git a/internal/shellgen/generate_test.go b/internal/shellgen/generate_test.go
index 1801fd73cf6..5df57b00213 100644
--- a/internal/shellgen/generate_test.go
+++ b/internal/shellgen/generate_test.go
@@ -14,6 +14,7 @@ import (
 	"go.jetpack.io/devbox/internal/devpkg"
 	"go.jetpack.io/devbox/internal/lock"
 	"go.jetpack.io/devbox/internal/searcher"
+	"go.jetpack.io/devbox/nix/flake"
 )
 
 // update overwrites golden files with the new test results.
@@ -41,10 +42,6 @@ func TestWriteFromTemplate(t *testing.T) {
 	})
 	t.Run("WriteModifiedSmaller", func(t *testing.T) {
 		emptyPlan := &flakePlan{
-			NixpkgsInfo: &NixpkgsInfo{
-				URL:    "",
-				TarURL: "",
-			},
 			Packages:    []*devpkg.Package{},
 			FlakeInputs: []flakeInput{},
 			System:      "x86_64-linux",
@@ -89,15 +86,11 @@ If the new file is correct, you can update the golden file with:
 var (
 	locker            = &lockmock{}
 	testFlakeTmplPlan = &flakePlan{
-		NixpkgsInfo: &NixpkgsInfo{
-			URL:    "https://github.com/nixos/nixpkgs/archive/b9c00c1d41ccd6385da243415299b39aa73357be.tar.gz",
-			TarURL: "", // TODO savil
-		},
 		Packages: []*devpkg.Package{}, // TODO savil
 		FlakeInputs: []flakeInput{
 			{
 				Name: "nixpkgs",
-				URL:  "github:NixOS/nixpkgs/b9c00c1d41ccd6385da243415299b39aa73357be",
+				Ref:  flake.Ref{Type: flake.TypeGitHub, Owner: "NixOS", Repo: "nixpkgs", Rev: "b9c00c1d41ccd6385da243415299b39aa73357be"},
 				Packages: []*devpkg.Package{
 					devpkg.PackageFromStringWithDefaults("php@latest", locker),
 					devpkg.PackageFromStringWithDefaults("php81Packages.composer@latest", locker),
@@ -137,14 +130,6 @@ func (*lockmock) Resolve(pkg string) (*lock.Package, error) {
 	}, nil
 }
 
-func (*lockmock) Get(pkg string) *lock.Package {
-	return nil
-}
-
-func (*lockmock) LegacyNixpkgsPath(pkg string) string {
-	return ""
-}
-
-func (*lockmock) ProjectDir() string {
-	return ""
-}
+func (*lockmock) Get(pkg string) *lock.Package { return nil }
+func (*lockmock) Stdenv() flake.Ref            { return flake.Ref{} }
+func (*lockmock) ProjectDir() string           { return "" }
diff --git a/internal/shellgen/testdata/flake.nix.golden b/internal/shellgen/testdata/flake.nix.golden
index 722e700c1e5..6a93181789b 100644
--- a/internal/shellgen/testdata/flake.nix.golden
+++ b/internal/shellgen/testdata/flake.nix.golden
@@ -2,7 +2,7 @@
    description = "A devbox shell";
 
    inputs = {
-     nixpkgs.url = "https://github.com/nixos/nixpkgs/archive/b9c00c1d41ccd6385da243415299b39aa73357be.tar.gz";
+     nixpkgs.url = "";
      nixpkgs.url = "github:NixOS/nixpkgs/b9c00c1d41ccd6385da243415299b39aa73357be";
    };
 
diff --git a/internal/shellgen/tmpl/flake.nix.tmpl b/internal/shellgen/tmpl/flake.nix.tmpl
index f8d4d23e679..d0ede605761 100644
--- a/internal/shellgen/tmpl/flake.nix.tmpl
+++ b/internal/shellgen/tmpl/flake.nix.tmpl
@@ -2,7 +2,7 @@
    description = "A devbox shell";
 
    inputs = {
-     nixpkgs.url = "{{ .NixpkgsInfo.URL }}";
+     nixpkgs.url = "{{ .Stdenv }}";
 
      {{- range .FlakeInputs }}
      {{.Name}}.url = "{{.URLWithCaching}}";
@@ -41,7 +41,7 @@
             {{- range $_, $output := $pkg.GetOutputsWithCache }}
             {{ if $output.CacheURI -}}
             (builtins.trace "downloading {{ $pkg.Versioned }}" (builtins.fetchClosure {
-              {{/*  
+              {{/*
                 HACK HACK HACK! fetchClosure only supports http(s) caches and not
                 s3 caches. Until we implement that, we put a fake store here.
                 Since we pre-build everything, fetchClosure will not actually
diff --git a/internal/shellgen/tmpl/shell.nix.tmpl b/internal/shellgen/tmpl/shell.nix.tmpl
index f504903eb32..dbd5768797b 100644
--- a/internal/shellgen/tmpl/shell.nix.tmpl
+++ b/internal/shellgen/tmpl/shell.nix.tmpl
@@ -1,7 +1,7 @@
 let
   pkgs = import
     (fetchTarball {
-      url = "{{ .NixpkgsInfo.TarURL }}";
+      url = "https://github.com/nixos/nixpkgs/archive/b9c00c1d41ccd6385da243415299b39aa73357be.tar.gz";
     })
     { };
 in