NixOS · mdaniels5757 · Jul 2, 2025
diff --git a/maintainers/scripts/copy-tarballs.pl b/maintainers/scripts/copy-tarballs.pl
@@ -176,15 +176,15 @@ sub uploadFile {
 
         if ($hash =~ /^([a-z0-9]+)-([A-Za-z0-9+\/=]+)$/) {
             $algo = $1;
-            $hash = `nix hash to-base16 $hash` or die;
+            $hash = `nix --extra-experimental-features nix-command hash to-base16 $hash` or die;
             chomp $hash;
         }
 
         next unless $algo =~ /^[a-z0-9]+$/;
 
         # Convert non-SRI base-64 to base-16.
         if ($hash =~ /^[A-Za-z0-9+\/=]+$/) {
-            $hash = `nix hash to-base16 --type '$algo' $hash` or die;
+            $hash = `nix --extra-experimental-features nix-command hash to-base16 --type '$algo' $hash` or die;
             chomp $hash;
         }
 

diff --git a/pkgs/applications/audio/reaper/updater.sh b/pkgs/applications/audio/reaper/updater.sh
@@ -8,14 +8,14 @@ reaper_ver=$(curl -Ls https://www.reaper.fm/download.php | grep -o 'Version [0-9
 function set_hash_for_linux() {
   local arch=$1
   pkg_hash=$(nix-prefetch-url https://www.reaper.fm/files/${reaper_ver%.*}.x/reaper${reaper_ver/./}_linux_$arch.tar.xz)
-  pkg_hash=$(nix hash convert "sha256:$pkg_hash")
+  pkg_hash=$(nix --extra-experimental-features nix-command hash convert "sha256:$pkg_hash")
   update-source-version reaper "${reaper_ver}" "$pkg_hash" --system=$arch-linux --ignore-same-version
 }
 
 function set_hash_for_darwin() {
   local arch=$1
   pkg_hash=$(nix-prefetch-url https://www.reaper.fm/files/${reaper_ver%.*}.x/reaper${reaper_ver/./}_universal.dmg)
-  pkg_hash=$(nix hash convert "sha256:$pkg_hash")
+  pkg_hash=$(nix --extra-experimental-features nix-command hash convert "sha256:$pkg_hash")
   update-source-version reaper "${reaper_ver}" "$pkg_hash" --system=$arch-darwin --ignore-same-version
 }
 

diff --git a/pkgs/applications/blockchains/teos/update.sh b/pkgs/applications/blockchains/teos/update.sh
@@ -23,7 +23,7 @@ git clone --depth 1 --branch "v${version}" -c advice.detachedHead=false 'https:/
 git -C "$repo" checkout "tags/v${version}"
 
 rm -rf "${repo}/.git"
-hashcheck=$(nix hash path "$repo")
+hashcheck=$(nix --extra-experimental-features nix-command hash path "$repo")
 
 (cd "$nixpkgs" && update-source-version teos "$version" "$hashcheck" && update-source-version teos --ignore-same-version --source-key=cargoDeps)
 echo

diff --git a/pkgs/applications/editors/cudatext/update.sh b/pkgs/applications/editors/cudatext/update.sh
@@ -17,7 +17,7 @@ echo "New version: $version"
 
 url="https://github.com/Alexey-T/CudaText/archive/refs/tags/${version}.tar.gz"
 hash=$(nix-prefetch-url --quiet --unpack --type sha256 $url)
-sriHash=$(nix hash to-sri --type sha256 $hash)
+sriHash=$(nix --extra-experimental-features nix-command hash to-sri --type sha256 $hash)
 
 sed -i "s#version = \".*\"#version = \"$version\"#" default.nix
 sed -i "s#hash = \".*\"#hash = \"$sriHash\"#" default.nix
@@ -27,7 +27,7 @@ while IFS=$'\t' read repo owner rev; do
   if [ "$latest" != "$rev" ]; then
     url="https://github.com/${owner}/${repo}/archive/refs/tags/${latest}.tar.gz"
     hash=$(nix-prefetch-url --quiet --unpack --type sha256 $url)
-    sriHash=$(nix hash to-sri --type sha256 $hash)
+    sriHash=$(nix --extra-experimental-features nix-command hash to-sri --type sha256 $hash)
     jq ".\"${repo}\".rev = \"${latest}\" | .\"${repo}\".hash = \"${sriHash}\"" deps.json | sponge deps.json
   fi
 done <<< $(jq -r 'to_entries[]|[.key,.value.owner,.value.rev]|@tsv' deps.json)
diff --git a/pkgs/applications/editors/vscode/extensions/_maintainers/update-bin-srcs-lib.sh b/pkgs/applications/editors/vscode/extensions/_maintainers/update-bin-srcs-lib.sh
@@ -60,7 +60,7 @@ prefetchExtensionUnpacked() {
   declare unpackedStorePath
   unpackedStorePath="$(nix add-to-store -n "$unpackedStoreName" "$tmpDir")"
   declare unpackedSha256
-  unpackedSha256="$(nix hash-path --base32 --type sha256 "$unpackedStorePath")"
+  unpackedSha256="$(nix --extra-experimental-features nix-command hash path --base32 --type sha256 "$unpackedStorePath")"
   1>&2 echo "unpackedStorePath='$unpackedStorePath'"
   1>&2 echo "unpackedSha256='$unpackedSha256'"
 

diff --git a/pkgs/applications/editors/vscode/extensions/ms-vscode.cpptools/update_helper.sh b/pkgs/applications/editors/vscode/extensions/ms-vscode.cpptools/update_helper.sh
@@ -58,7 +58,7 @@ make_trapped_tmpdir
 unzip -q -d "$tmpDir" "$cpptoolsZipStorePath"
 
 cpptoolsStorePath="$(nix add-to-store -n "$extStoreName" "$tmpDir")"
-cpptoolsSha256="$(nix hash-path --base32 --type sha512 "$cpptoolsStorePath")"
+cpptoolsSha256="$(nix --extra-experimental-features nix-command hash path --base32 --type sha512 "$cpptoolsStorePath")"
 echo "cpptoolsStorePath='$cpptoolsStorePath'"
 echo "cpptoolsSha256='$cpptoolsSha256'"
 

diff --git a/pkgs/applications/editors/vscode/update-vscode.sh b/pkgs/applications/editors/vscode/update-vscode.sh
@@ -18,7 +18,7 @@ update-source-version vscode $latestVersion
 
 systems=$(nix eval --json -f . vscode.meta.platforms | jq --raw-output '.[]')
 for system in $systems; do
-  hash=$(nix hash convert --to sri --hash-algo sha256 $(nix-prefetch-url $(nix eval --raw -f . vscode.src.url --system "$system")))
+  hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 $(nix-prefetch-url $(nix eval --raw -f . vscode.src.url --system "$system")))
   update-source-version vscode $latestVersion $hash --system=$system --ignore-same-version --ignore-same-hash
 done
 

diff --git a/pkgs/applications/editors/vscode/update-vscodium.sh b/pkgs/applications/editors/vscode/update-vscodium.sh
@@ -21,6 +21,6 @@ for i in \
     "aarch64-darwin darwin-arm64 zip" \
     "x86_64-darwin darwin-x64 zip"; do
     set -- $i
-    hash=$(nix hash convert --hash-algo sha256 --to sri $(nix-prefetch-url "https://github.com/VSCodium/vscodium/releases/download/$latestVersion/VSCodium-$2-$latestVersion.$3"))
+    hash=$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri $(nix-prefetch-url "https://github.com/VSCodium/vscodium/releases/download/$latestVersion/VSCodium-$2-$latestVersion.$3"))
     update-source-version vscodium $latestVersion $hash --system=$1 --ignore-same-version
 done
diff --git a/pkgs/applications/graphics/tesseract/fetch-language-hashes b/pkgs/applications/graphics/tesseract/fetch-language-hashes
@@ -30,6 +30,6 @@ fi
 
 for lang in $langCodes; do
     url=https://github.com/tesseract-ocr/tessdata/raw/$tessdataRev/$lang.traineddata
-    hash=$(nix hash to-sri --type sha256 $(nix-prefetch-url $url 2>/dev/null))
+    hash=$(nix --extra-experimental-features nix-command hash to-sri --type sha256 $(nix-prefetch-url $url 2>/dev/null))
     echo "$lang = \"$hash\";"
 done
diff --git a/pkgs/applications/networking/browsers/librewolf/update.nix b/pkgs/applications/networking/browsers/librewolf/update.nix
@@ -48,7 +48,7 @@ writeScript "update-librewolf" ''
   repoUrl=https://codeberg.org/librewolf/source.git
   nix-prefetch-git $repoUrl --quiet --rev $latestTag --fetch-submodules > $prefetchOut
   srcDir=$(jq -r .path < $prefetchOut)
-  srcHash=$(nix hash convert --to sri --hash-algo sha256 $(jq -r .sha256 < $prefetchOut))
+  srcHash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 $(jq -r .sha256 < $prefetchOut))
 
   ffVersion=$(<$srcDir/version)
   lwRelease=$(<$srcDir/release)
@@ -70,7 +70,7 @@ writeScript "update-librewolf" ''
   curl --silent --show-error -o "$HOME"/shasums.asc "$mozillaUrl$ffVersion/SHA512SUMS.asc"
   gpgv --keyring="$GNUPGHOME"/pubring.kbx "$HOME"/shasums.asc "$HOME"/shasums
 
-  ffHash=$(nix hash convert --to sri --hash-algo sha512 $(grep '\.source\.tar\.xz$' "$HOME"/shasums | grep '^[^ ]*' -o))
+  ffHash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha512 $(grep '\.source\.tar\.xz$' "$HOME"/shasums | grep '^[^ ]*' -o))
   echo "ffHash=$ffHash"
 
   jq ".source.rev = \"$latestTag\"" $srcJson | sponge $srcJson

diff --git a/pkgs/applications/networking/cluster/timoni/update.sh b/pkgs/applications/networking/cluster/timoni/update.sh
@@ -16,7 +16,7 @@ sed -i "s|$PREV_VERSION|$NEXT_VERSION|" "$FILE"
 
 # update hash
 PREV_HASH=$(nix eval --raw -f $NIXPKGS_ROOT/default.nix $ATTR.src.outputHash)
-NEXT_HASH=$(nix hash to-sri --type sha256 $(nix-prefetch-url --unpack --type sha256 $(nix eval --raw -f $NIXPKGS_ROOT/default.nix $ATTR.src.url)))
+NEXT_HASH=$(nix --extra-experimental-features nix-command hash to-sri --type sha256 $(nix-prefetch-url --unpack --type sha256 $(nix eval --raw -f $NIXPKGS_ROOT/default.nix $ATTR.src.url)))
 sed -i "s|$PREV_HASH|$NEXT_HASH|" "$FILE"
 
 # update vendor hash

diff --git a/pkgs/by-name/at/atlassian-plugin-sdk/package.nix b/pkgs/by-name/at/atlassian-plugin-sdk/package.nix
@@ -71,7 +71,7 @@ stdenv.mkDerivation rec {
       fi
 
       DOWNLOAD_URL="${mavenGroupIdUrl}/atlassian-plugin-sdk/${version}/atlassian-plugin-sdk-$NEW_VERSION.tar.gz"
-      NIX_HASH=$(nix hash to-sri sha256:$(nix-prefetch-url $DOWNLOAD_URL))
+      NIX_HASH=$(nix --extra-experimental-features nix-command hash to-sri sha256:$(nix-prefetch-url $DOWNLOAD_URL))
 
       update-source-version "atlassian-plugin-sdk" "$NEW_VERSION" "$NIX_HASH" "$DOWNLOAD_URL"
     '';

diff --git a/pkgs/by-name/ba/balatro/package.nix b/pkgs/by-name/ba/balatro/package.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = requireFile {
     name = "Balatro-${finalAttrs.version}.exe";
     url = "https://store.steampowered.com/app/2379780/Balatro/";
-    # Use `nix hash file --sri --type sha256` to get the correct hash
+    # Use `nix --extra-experimental-features nix-command hash file --sri --type sha256` to get the correct hash
     hash = "sha256-DXX+FkrM8zEnNNSzesmHiN0V8Ljk+buLf5DE5Z3pP0c=";
   };
 

diff --git a/pkgs/by-name/bi/bilibili/update.sh b/pkgs/by-name/bi/bilibili/update.sh
@@ -14,8 +14,8 @@ amd64_hash=$(nix-prefetch-url $amd64_url)
 arm64_hash=$(nix-prefetch-url $arm64_url)
 
 # use friendlier hashes
-amd64_hash=$(nix hash convert --to sri --hash-algo sha256 "$amd64_hash")
-arm64_hash=$(nix hash convert --to sri --hash-algo sha256 "$arm64_hash")
+amd64_hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 "$amd64_hash")
+arm64_hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 "$arm64_hash")
 
 cat >sources.nix <<EOF
 # Generated by ./update.sh - do not update manually!

diff --git a/pkgs/by-name/bl/bloomeetunes/update.sh b/pkgs/by-name/bl/bloomeetunes/update.sh
@@ -18,7 +18,7 @@ fi
 
 sed -i "s/\(tag = \"v\${version}+\)[0-9]\+/\1${RunNumber}/" "$ROOT/package.nix"
 
-hash=$(nix hash convert --hash-algo sha256 --to sri $(nix-prefetch-url --unpack "https://github.com/HemantKArya/BloomeeTunes/archive/refs/tags/${latestTag}.tar.gz"))
+hash=$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri $(nix-prefetch-url --unpack "https://github.com/HemantKArya/BloomeeTunes/archive/refs/tags/${latestTag}.tar.gz"))
 update-source-version bloomeetunes $latestVersion $hash
 
 curl https://raw.githubusercontent.com/HemantKArya/BloomeeTunes/${latestTag}/pubspec.lock | yq . >$ROOT/pubspec.lock.json
diff --git a/pkgs/by-name/bo/boundary/update.sh b/pkgs/by-name/bo/boundary/update.sh
@@ -15,7 +15,7 @@ function calc_hash () {
     local arch=$2
     url="https://releases.hashicorp.com/boundary/${version}/boundary_${version}_${arch}.zip"
     zip_hash=$(nix-prefetch-url --unpack $url)
-    nix hash to-sri --type sha256 "$zip_hash"
+    nix --extra-experimental-features nix-command hash to-sri --type sha256 "$zip_hash"
 }
 
 replace_sha() {

diff --git a/pkgs/by-name/bu/buck2/update.sh b/pkgs/by-name/bu/buck2/update.sh
@@ -27,20 +27,20 @@ HFILE=pkgs/by-name/bu/buck2/hashes.json
 rm -f "$HFILE" && touch "$HFILE"
 
 PRELUDE_SHA256HASH="$(nix-prefetch-url --type sha256 "$PRELUDE_DL_URL")"
-PRELUDE_SRIHASH="$(nix hash to-sri --type sha256 "$PRELUDE_SHA256HASH")"
+PRELUDE_SRIHASH="$(nix --extra-experimental-features nix-command hash to-sri --type sha256 "$PRELUDE_SHA256HASH")"
 
 printf "{ \"_comment\": \"@generated by pkgs/by-name/bu/buck2/update.sh\"\n" >> "$HFILE"
 printf ", \"_prelude\": \"$PRELUDE_SRIHASH\"\n" >> "$HFILE"
 
 for arch in "${ARCHS[@]}"; do
     IFS=: read -r arch_name arch_target <<< "$arch"
     sha256hash="$(nix-prefetch-url --type sha256 "https://github.com/facebook/buck2/releases/download/${VERSION}/buck2-${arch_target}.zst")"
-    srihash="$(nix hash to-sri --type sha256 "$sha256hash")"
+    srihash="$(nix --extra-experimental-features nix-command hash to-sri --type sha256 "$sha256hash")"
     echo ", \"buck2-$arch_name\": \"$srihash\"" >> "$HFILE"
 
     IFS=: read -r arch_name arch_target <<< "$arch"
     sha256hash="$(nix-prefetch-url --type sha256 "https://github.com/facebook/buck2/releases/download/${VERSION}/rust-project-${arch_target}.zst")"
-    srihash="$(nix hash to-sri --type sha256 "$sha256hash")"
+    srihash="$(nix --extra-experimental-features nix-command hash to-sri --type sha256 "$sha256hash")"
     echo ", \"rust-project-$arch_name\": \"$srihash\"" >> "$HFILE"
 done
 echo "}" >> "$HFILE"

diff --git a/pkgs/by-name/ch/chatgpt/update.sh b/pkgs/by-name/ch/chatgpt/update.sh
@@ -8,7 +8,7 @@ XML_DATA=$(curl -s $XML_URL)
 LATEST_VERSION=$(echo "$XML_DATA" | xmllint --xpath '/rss/channel/item[1]/*[local-name()="shortVersionString"]/text()' -)
 DOWNLOAD_URL=$(echo "$XML_DATA" | xmllint --xpath 'string(//item[1]/enclosure/@url)' -)
 
-HASH=$(nix-prefetch-url $DOWNLOAD_URL | xargs nix hash convert --hash-algo sha256)
+HASH=$(nix-prefetch-url $DOWNLOAD_URL | xargs nix --extra-experimental-features nix-command hash convert --hash-algo sha256)
 
 SOURCE_NIX="$(dirname ${BASH_SOURCE[0]})/source.nix"
 

diff --git a/pkgs/by-name/cl/clojure-lsp/package.nix b/pkgs/by-name/cl/clojure-lsp/package.nix
@@ -61,8 +61,8 @@ buildGraalvmNativeImage rec {
 
     old_jar_hash=$(nix-instantiate --eval --strict -A "clojure-lsp.jar.drvAttrs.outputHash" | tr -d '"' | sed -re 's|[+]|\\&|g')
 
-    curl -o clojure-lsp-standalone.jar -sL https://github.com/clojure-lsp/clojure-lsp/releases/download/$latest_version/clojure-lsp-standalone.jar
-    new_jar_hash=$(nix-hash --flat --type sha256 clojure-lsp-standalone.jar | sed -re 's|[+]|\\&|g')
+    curl -o clojure-lsp-standalone.jar -sL "https://github.com/clojure-lsp/clojure-lsp/releases/download/$latest_version/clojure-lsp-standalone.jar"
+    new_jar_hash="$(nix-hash --flat --type sha256 clojure-lsp-standalone.jar | xargs -n1 nix --extra-experimental-features nix-command hash convert --hash-algo sha256)"
 
     rm -f clojure-lsp-standalone.jar
 

diff --git a/pkgs/by-name/co/coder/update.sh b/pkgs/by-name/co/coder/update.sh
@@ -32,7 +32,7 @@ update_version_and_hashes() {
 
         # Fetch the new hash using nix-prefetch-url
         local NEW_HASH=$(nix-prefetch-url --type sha256 $URL)
-        local SRI_HASH=$(nix hash to-sri --type sha256 $NEW_HASH)
+        local SRI_HASH=$(nix --extra-experimental-features nix-command hash to-sri --type sha256 $NEW_HASH)
 
         # Update the Nix file with the new hash, using '#' as delimiter and preserving indentation
         sed -i "/${channel} = {/,/};/{

diff --git a/pkgs/by-name/co/confluent-cli/update.sh b/pkgs/by-name/co/confluent-cli/update.sh
@@ -26,6 +26,6 @@ for i in \
     "x86_64-darwin darwin_amd64" \
     "aarch64-darwin darwin_arm64"; do
     set -- $i
-    hash=$(nix hash convert --to sri --hash-algo sha256 $(nix-prefetch-url "https://s3-us-west-2.amazonaws.com/confluent.cloud/confluent-cli/archives/$latestVersion/confluent_${latestVersion}_$2.tar.gz"))
+    hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 $(nix-prefetch-url "https://s3-us-west-2.amazonaws.com/confluent.cloud/confluent-cli/archives/$latestVersion/confluent_${latestVersion}_$2.tar.gz"))
     update-source-version confluent-cli $latestVersion $hash --system=$1 --ignore-same-version
 done
diff --git a/pkgs/by-name/cr/crc/update.sh b/pkgs/by-name/cr/crc/update.sh
@@ -26,7 +26,7 @@ CRC_COMMIT=$(curl --silent ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} \
     jq -r "map(select(.name == \"${LATEST_TAG_NAME}\")) | .[0] | .commit.sha")
 
 CRC_GIT_PREFETCH=$(nix-prefetch-url --unpack https://github.com/crc-org/crc/archive/${CRC_COMMIT}.tar.gz)
-CRC_GIT_HASH=$(nix hash convert --to sri --hash-algo sha256 ${CRC_GIT_PREFETCH})
+CRC_GIT_HASH=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 ${CRC_GIT_PREFETCH})
 
 FILE_MAKEFILE=${WORKDIR}/Makefile
 curl --silent https://raw.githubusercontent.com/crc-org/crc/${CRC_COMMIT}/Makefile >$FILE_MAKEFILE

diff --git a/pkgs/by-name/db/dbgate/update.sh b/pkgs/by-name/db/dbgate/update.sh
@@ -17,6 +17,6 @@ for system in \
     aarch64-linux \
     x86_64-darwin \
     aarch64-darwin; do
-    hash=$(nix hash convert --to sri --hash-algo sha256 $(nix-prefetch-url $(nix-instantiate --eval -E "with import ./. {}; dbgate.src.url" --system "$system" | tr -d '"')))
+    hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 $(nix-prefetch-url $(nix-instantiate --eval -E "with import ./. {}; dbgate.src.url" --system "$system" | tr -d '"')))
     update-source-version dbgate $latestVersion $hash --system=$system --ignore-same-version
 done
diff --git a/pkgs/by-name/de/dependabot-cli/update.sh b/pkgs/by-name/de/dependabot-cli/update.sh
@@ -21,7 +21,7 @@ if [ "$OLD_VERSION" = "$VERSION" ]; then
 fi
 
 SHA256="$(nix-prefetch-url --quiet --unpack https://github.com/dependabot/cli/archive/refs/tags/v${VERSION}.tar.gz)"
-HASH="$(nix hash convert --hash-algo sha256 --to sri "$SHA256")"
+HASH="$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri "$SHA256")"
 
 nix-prefetch-docker --json --quiet --final-image-name dependabot-update-job-proxy --final-image-tag "nixpkgs-dependabot-cli-$VERSION" ghcr.io/github/dependabot-update-job-proxy/dependabot-update-job-proxy latest > "$temp_dir/dependabot-update-job-proxy.json"
 

diff --git a/pkgs/by-name/dr/draupnir/update.sh b/pkgs/by-name/dr/draupnir/update.sh
@@ -29,7 +29,7 @@ cd $TMPDIR
 
 curl https://raw.githubusercontent.com/the-draupnir-project/Draupnir/v$latestVersion/yarn.lock -o yarn.lock
 TMP_PREFETCH_HASH=`prefetch-yarn-deps yarn.lock`
-NEW_YARN_OFFLINE_HASH=`nix hash to-sri --type sha256 $TMP_PREFETCH_HASH`
+NEW_YARN_OFFLINE_HASH=`nix --extra-experimental-features nix-command hash to-sri --type sha256 $TMP_PREFETCH_HASH`
 
 cd -
 echo "New yarn offline hash: $NEW_YARN_OFFLINE_HASH"

diff --git a/pkgs/by-name/dy/dynamodb-local/package.nix b/pkgs/by-name/dy/dynamodb-local/package.nix
@@ -74,7 +74,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       fi
 
       DOWNLOAD_URL="https://d1ni2b6xgvw0s0.cloudfront.net/v2.x/dynamodb_local_$NEW_VERSION_DATE.tar.gz"
-      NIX_HASH=$(nix hash to-sri sha256:$(nix-prefetch-url $DOWNLOAD_URL))
+      NIX_HASH=$(nix --extra-experimental-features nix-command hash to-sri sha256:$(nix-prefetch-url $DOWNLOAD_URL))
 
       update-source-version "dynamodb-local" "$NEW_VERSION" "$NIX_HASH" "$DOWNLOAD_URL"
     '';

diff --git a/pkgs/by-name/el/electrs/update.sh b/pkgs/by-name/el/electrs/update.sh
@@ -32,7 +32,7 @@ echo "Verifying commit"
 git -C $repo verify-tag v${version}
 
 rm -rf $repo/.git
-hash=$(nix hash path $repo)
+hash=$(nix --extra-experimental-features nix-command hash path $repo)
 
 (cd "$nixpkgs" && update-source-version electrs "$version" "$hash" && update-source-version electrs --ignore-same-version --source-key=cargoDeps)
 echo

diff --git a/pkgs/by-name/en/envoy-bin/update.sh b/pkgs/by-name/en/envoy-bin/update.sh
@@ -14,7 +14,7 @@ fetch_arch() {
     VER="$1"
     ARCH="$2"
     URL="https://github.com/envoyproxy/envoy/releases/download/v${VER}/envoy-${VER}-linux-${ARCH}"
-    nix hash convert --to sri --hash-algo sha256 "$(nix-prefetch-url --type sha256 "$URL")"
+    nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 "$(nix-prefetch-url --type sha256 "$URL")"
 }
 
 replace_hash() {

diff --git a/pkgs/by-name/fe/feishu/package.nix b/pkgs/by-name/fe/feishu/package.nix
@@ -217,7 +217,7 @@ stdenv.mkDerivation {
         update_link=$(echo $package_info | jq -r '.data.download_link' | sed 's/lf[0-9]*-ug-sign.feishucdn.com/sf3-cn.feishucdn.com\/obj/;s/?.*$//')
         new_version=$(echo $package_info | jq -r '.data.version_number' | sed -n 's/.*@V//p')
         sha256_hash=$(nix-prefetch-url $update_link)
-        sri_hash=$(nix hash to-sri --type sha256 $sha256_hash)
+        sri_hash=$(nix --extra-experimental-features nix-command hash to-sri --type sha256 $sha256_hash)
         update-source-version feishu $new_version $sri_hash $update_link --system=$platform --ignore-same-version --source-key="sources.$platform"
       done
     '';

diff --git a/pkgs/by-name/fi/fishnet/update.bash b/pkgs/by-name/fi/fishnet/update.bash
@@ -14,7 +14,7 @@ new_nnue_big_file="$(
         grep --perl-regexp --only-matching 'EvalFileDefaultNameBig "\Knn-(\w+).nnue'
 )"
 new_nnue_big_hash="$(
-    nix hash to-sri --type sha256 "$(
+    nix --extra-experimental-features nix-command hash to-sri --type sha256 "$(
         nix-prefetch-url --type sha256 "https://tests.stockfishchess.org/api/nn/${new_nnue_big_file}"
     )"
 )"
@@ -23,7 +23,7 @@ new_nnue_small_file="$(
         grep --perl-regexp --only-matching 'EvalFileDefaultNameSmall "\Knn-(\w+).nnue'
 )"
 new_nnue_small_hash="$(
-    nix hash to-sri --type sha256 "$(
+    nix --extra-experimental-features nix-command hash to-sri --type sha256 "$(
         nix-prefetch-url --type sha256 "https://tests.stockfishchess.org/api/nn/${new_nnue_small_file}"
     )"
 )"

diff --git a/pkgs/by-name/fl/fluxcd/update.sh b/pkgs/by-name/fl/fluxcd/update.sh
@@ -12,9 +12,9 @@ LATEST_VERSION=$(echo "${LATEST_TAG}" | sed 's/^v//')
 
 if [ ! "$OLD_VERSION" = "$LATEST_VERSION" ]; then
     SRC_SHA256=$(nix-prefetch-url --quiet --unpack "https://github.com/fluxcd/flux2/archive/refs/tags/${LATEST_TAG}.tar.gz")
-    SRC_HASH=$(nix hash convert --hash-algo sha256 --to sri "$SRC_SHA256")
+    SRC_HASH=$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri "$SRC_SHA256")
     MANIFESTS_SHA256=$(nix-prefetch-url --quiet --unpack "https://github.com/fluxcd/flux2/releases/download/${LATEST_TAG}/manifests.tar.gz")
-    MANIFESTS_HASH=$(nix hash convert --hash-algo sha256 --to sri "$MANIFESTS_SHA256")
+    MANIFESTS_HASH=$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri "$MANIFESTS_SHA256")
 
     setKV () {
         sed -i "s|$1 = \".*\"|$1 = \"${2:-}\"|" "${FLUXCD_PATH}/package.nix"
@@ -27,7 +27,7 @@ if [ ! "$OLD_VERSION" = "$LATEST_VERSION" ]; then
 
     set +e
     VENDOR_SHA256=$(nix-build --no-out-link -A fluxcd "$NIXPKGS_PATH" 2>&1 >/dev/null | grep "got:" | cut -d':' -f2 | sed 's| ||g')
-    VENDOR_HASH=$(nix hash convert --hash-algo sha256 --to sri "$VENDOR_SHA256")
+    VENDOR_HASH=$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri "$VENDOR_SHA256")
     set -e
 
     if [ -n "${VENDOR_HASH:-}" ]; then