diff --git a/flake.nix b/flake.nix
index 7586cea..85a0bcd 100644
--- a/flake.nix
+++ b/flake.nix
@@ -58,7 +58,7 @@
 
       overlay =
         # Overlay of fixes applied to Nixpkgs
-        import ./overlay genode;
+        import ./overlay { flake = self; };
 
       lib =
         # Local utilities merged with the Nixpkgs lib
diff --git a/overlay/default.nix b/overlay/default.nix
index efd91d5..be02726 100644
--- a/overlay/default.nix
+++ b/overlay/default.nix
@@ -1,5 +1,7 @@
-upstreamSources: final: prev:
+{ flake }:
+final: prev:
 with prev;
+
 let
   overrideHost = drv: attrs:
     if hostPlatform.isGenode then drv.override attrs else drv;
@@ -62,12 +64,14 @@ in {
 
   genodeLibcCross = callPackage ./libc { };
 
-  genodePackages = import ../packages { nixpkgs = final; };
-
-  genodeSources = buildPackages.callPackage ../packages/genodelabs {
-    inherit upstreamSources;
+  genodePackages = import ../packages {
+    inherit flake;
+    nixpkgs = final;
   };
 
+  genodeSources =
+    buildPackages.callPackage ../packages/genodelabs { inherit flake; };
+
   libcCrossChooser = name:
     if stdenv.targetPlatform.isGenode then
       targetPackages.genodeLibcCross
diff --git a/packages/default.nix b/packages/default.nix
index 83146fe..e5bcf34 100644
--- a/packages/default.nix
+++ b/packages/default.nix
@@ -1,11 +1,12 @@
-{ nixpkgs }:
+{ flake, nixpkgs }:
 
 let
   inherit (nixpkgs)
     buildPackages callPackage fetchFromGitHub fetchgit genodeSources stdenv;
   inherit (genodeSources) buildUpstream;
 
-  dhallPackages = buildPackages.callPackage ./dhall { };
+  dhallPackages =
+    flake.inputs.nixpkgs.legacyPackages.x86_64-linux.callPackage ./dhall { };
 
   buildDepotWorld = let
     genodeWorld = fetchFromGitHub {
diff --git a/packages/genodelabs/default.nix b/packages/genodelabs/default.nix
index 2fa1768..4652173 100644
--- a/packages/genodelabs/default.nix
+++ b/packages/genodelabs/default.nix
@@ -1,4 +1,4 @@
-{ upstreamSources, buildPackages, targetPackages }:
+{ flake, buildPackages, targetPackages }:
 
 let
   platform = targetPackages.targetPlatform;
@@ -13,6 +13,8 @@ let
 
   inherit (buildPackages) callPackage fetchurl lib;
 
+  upstreamSources = flake.inputs.genode;
+
   genodeSources =
     # The Genode source repository
     let
@@ -113,8 +115,11 @@ let
       dontFixup = true;
     });
 
-  ports =
-    lib.mapAttrs preparePort (import ./ports.nix { inherit buildPackages; });
+  ports = lib.mapAttrs preparePort (import ./ports.nix {
+    pkgs = flake.inputs.nixpkgs.legacyPackages.x86_64-linux;
+  });
+  # The "ports" mechanism is hardly deterministic, so prepare with
+  # a pinned nixpkgs revision for a pinned platform.
 
   toolchain = callPackage ./toolchain.nix { };
 
diff --git a/packages/genodelabs/ports.nix b/packages/genodelabs/ports.nix
index 3c08b5e..9b8a1a3 100644
--- a/packages/genodelabs/ports.nix
+++ b/packages/genodelabs/ports.nix
@@ -1,15 +1,17 @@
 # This file specifies the output hashes of "Ports".
 # Ports not listed here can still be prepared, but will result in a hash mismatch.
 
-{ buildPackages }:
-with buildPackages; {
+{ pkgs }:
+with pkgs;
+
+{
   binutils = {
-    hash = "sha256-5JpEsIAe3GOZVb8kTMlfhmzku+aGs4/BttMu4xLsnsI=";
+    hash = "sha256-ERzYT3TjbK3fzRVN1UE7RM6XiPPeMKzkeulKx5IQa2o=";
     nativeBuildInputs = [ autoconf ];
   };
   dde_bsd.hash = "sha256-Z2piyoOrNmXyEEp+kX5w/q4JTylYdSOocUrFeqjz13A=";
   dde_ipxe.hash = "sha256-NJ129+DkxFg1fFHJBABBFRRjqEVNSz6v2hEB80AuEM4=";
-  dde_linux.hash = "sha256-aUp90z8dtn48QNUqGe1b08RzbESFmCJl7ECZf+lr0rg=";
+  dde_linux.hash = "sha256-xHAgeKfArgMGKCGHi0762qkUcY97vbiAQYjM/ZRXCes=";
   dde_rump = {
     hash = "sha256-Wr5otGkWEa+5xImsFHQzwap5LckNEbyWA/7xbNcOreI=";
     nativeBuildInputs = [ subversion ];
@@ -17,7 +19,7 @@ with buildPackages; {
   };
   expat.hash = "sha256-KpeM2ySmf+Ojx1mAj9n8lfX7iHaa7w5MPPKZcn4GpTc=";
   gcc = {
-    hash = "sha256-ZF9P6xOHvSDN6oq4SN5jOEBBMGgGh6fXyDOgYdXHG1g=";
+    hash = "sha256-1AKjUbh8X5ips8pg0twpBTtc2qCVXGrbifJ/cf3yRcE=";
     nativeBuildInputs = [ autoconf264 autogen ];
     patches = [ ./gcc-port.patch ];
   };
@@ -27,7 +29,7 @@ with buildPackages; {
   jpeg.hash = "sha256-RLVnlrnYGrhqr3Feikoi/BNditCaKN0u3t9/UDpl2wQ=";
   libc = {
     hash = "sha256-BSZcO25jbH8+OkJWGyJxxVYuQ4Y3yDt0DNsYcITwqxA=";
-    nativeBuildInputs = [ buildPackages.gcc ];
+    nativeBuildInputs = [ gcc ];
   };
   libiconv.hash = "sha256-25YcW5zo1fE33ZolGQroR+KZO8wHEdN1QXa7+MhwS78=";
   libpng.hash = "sha256-hNmSWN4gEk4UIjzkGD4j5qFooMCVXLwcBeOeFumvh+4=";