diff --git a/NixSupport/hackage/hasql-dynamic-statements.nix b/NixSupport/hackage/hasql-dynamic-statements.nix
deleted file mode 100644
index c2676d22e..000000000
--- a/NixSupport/hackage/hasql-dynamic-statements.nix
+++ /dev/null
@@ -1,19 +0,0 @@
-{ mkDerivation, base, bytestring, containers, hasql
-, hasql-implicits, hspec, hspec-discover, lib, rerebase
-, testcontainers-postgresql, text, text-builder
-}:
-mkDerivation {
-  pname = "hasql-dynamic-statements";
-  version = "0.5.1";
-  sha256 = "979644ad93b1f4f46e5c62a24ddf3debbe2acd61fa8e8b239cfdeef0d92d88cd";
-  libraryHaskellDepends = [
-    base bytestring containers hasql hasql-implicits text text-builder
-  ];
-  testHaskellDepends = [
-    hasql hspec rerebase testcontainers-postgresql
-  ];
-  testToolDepends = [ hspec-discover ];
-  homepage = "https://github.com/nikita-volkov/hasql-dynamic-statements";
-  description = "Hasql extension for dynamic construction of statements";
-  license = lib.licenses.mit;
-}
diff --git a/NixSupport/hackage/hasql-implicits.nix b/NixSupport/hackage/hasql-implicits.nix
deleted file mode 100644
index f5e81ede3..000000000
--- a/NixSupport/hackage/hasql-implicits.nix
+++ /dev/null
@@ -1,15 +0,0 @@
-{ mkDerivation, aeson, base, bytestring, containers, hasql, iproute
-, lib, scientific, text, time, uuid, vector
-}:
-mkDerivation {
-  pname = "hasql-implicits";
-  version = "0.2.0.2";
-  sha256 = "266332a1881860ffd002a44d2903359c66bbcee3fe01ebfb1bfd30198b9de63e";
-  libraryHaskellDepends = [
-    aeson base bytestring containers hasql iproute scientific text time
-    uuid vector
-  ];
-  homepage = "https://github.com/nikita-volkov/hasql-implicits";
-  description = "Implicit definitions for Hasql, such as default codecs for standard types";
-  license = lib.licenses.mit;
-}
diff --git a/NixSupport/hackage/hasql-mapping.nix b/NixSupport/hackage/hasql-mapping.nix
deleted file mode 100644
index d875263a1..000000000
--- a/NixSupport/hackage/hasql-mapping.nix
+++ /dev/null
@@ -1,14 +0,0 @@
-{ mkDerivation, aeson, base, bytestring, hasql, iproute, lib
-, scientific, text, time, uuid
-}:
-mkDerivation {
-  pname = "hasql-mapping";
-  version = "0.1";
-  sha256 = "12d50e628b7eba317a189166682bf93bf6c7751860662fab4e4731527ec9f7ca";
-  libraryHaskellDepends = [
-    aeson base bytestring hasql iproute scientific text time uuid
-  ];
-  homepage = "https://github.com/nikita-volkov/hasql-mapping";
-  description = "SDK for defining modular mappings to databases on top of Hasql";
-  license = lib.licenses.mit;
-}
diff --git a/NixSupport/hackage/hasql-notifications.nix b/NixSupport/hackage/hasql-notifications.nix
deleted file mode 100644
index 911e79805..000000000
--- a/NixSupport/hackage/hasql-notifications.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-{ mkDerivation, base, bytestring, hasql, hasql-pool, hspec
-, hspec-discover, lib, postgresql-libpq, QuickCheck, text
-}:
-mkDerivation {
-  pname = "hasql-notifications";
-  version = "0.2.5.0";
-  sha256 = "4bc7a81a5831d6a39e67baa1bab5d79a05e4444423a35ce93879971d00a46f7e";
-  isLibrary = true;
-  isExecutable = true;
-  libraryHaskellDepends = [
-    base bytestring hasql hasql-pool postgresql-libpq text
-  ];
-  executableHaskellDepends = [ base hasql ];
-  testHaskellDepends = [ base bytestring hasql hspec QuickCheck ];
-  testToolDepends = [ hspec-discover ];
-  homepage = "https://github.com/diogob/hasql-notifications";
-  description = "LISTEN/NOTIFY support for Hasql";
-  license = lib.licenses.bsd3;
-  mainProgram = "hasql-notifications";
-}
diff --git a/NixSupport/hackage/hasql-pool.nix b/NixSupport/hackage/hasql-pool.nix
deleted file mode 100644
index 6777063af..000000000
--- a/NixSupport/hackage/hasql-pool.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-{ mkDerivation, async, base, bytestring, hasql, hspec
-, hspec-discover, lib, postgresql-libpq, random, rerebase, stm
-, testcontainers-postgresql, text, text-builder, time, tuple, uuid
-}:
-mkDerivation {
-  pname = "hasql-pool";
-  version = "1.4.2";
-  sha256 = "ed83a674ae6ca875d5ed9f23e34f8a012b432d80fbcf625f5a345eb2bde73070";
-  libraryHaskellDepends = [
-    base bytestring hasql stm text time uuid
-  ];
-  testHaskellDepends = [
-    async hasql hspec postgresql-libpq random rerebase
-    testcontainers-postgresql text-builder tuple
-  ];
-  testToolDepends = [ hspec-discover ];
-  homepage = "https://github.com/nikita-volkov/hasql-pool";
-  description = "Pool of connections for Hasql";
-  license = lib.licenses.mit;
-}
diff --git a/NixSupport/hackage/hasql-postgresql-types.nix b/NixSupport/hackage/hasql-postgresql-types.nix
deleted file mode 100644
index d67dfbf09..000000000
--- a/NixSupport/hackage/hasql-postgresql-types.nix
+++ /dev/null
@@ -1,16 +0,0 @@
-{ mkDerivation, base, hasql, hasql-mapping, lib, postgresql-types
-, postgresql-types-algebra, ptr-peeker, ptr-poker, tagged
-, text-builder
-}:
-mkDerivation {
-  pname = "hasql-postgresql-types";
-  version = "0.2";
-  sha256 = "54d4c9bc063a030753d2aea7b2ff6c6a65cbdeafe50df3dfd1879f946915d083";
-  libraryHaskellDepends = [
-    base hasql hasql-mapping postgresql-types postgresql-types-algebra
-    ptr-peeker ptr-poker tagged text-builder
-  ];
-  homepage = "https://github.com/nikita-volkov/hasql-postgresql-types";
-  description = "Integration of \"hasql\" with \"postgresql-types\"";
-  license = lib.licenses.mit;
-}
diff --git a/NixSupport/hackage/hasql-transaction.nix b/NixSupport/hackage/hasql-transaction.nix
deleted file mode 100644
index 118bc352d..000000000
--- a/NixSupport/hackage/hasql-transaction.nix
+++ /dev/null
@@ -1,16 +0,0 @@
-{ mkDerivation, async, base, bytestring, bytestring-tree-builder
-, contravariant, hasql, lib, mtl, rerebase, text, transformers
-}:
-mkDerivation {
-  pname = "hasql-transaction";
-  version = "1.2.2";
-  sha256 = "bf902c7a983035e44b6936d6acab0c0ba7548106fb040ba8bb12b058b34eacda";
-  libraryHaskellDepends = [
-    base bytestring bytestring-tree-builder contravariant hasql mtl
-    text transformers
-  ];
-  testHaskellDepends = [ async hasql rerebase ];
-  homepage = "https://github.com/nikita-volkov/hasql-transaction";
-  description = "Composable abstraction over retryable transactions for Hasql";
-  license = lib.licenses.mit;
-}
diff --git a/NixSupport/hackage/hasql.nix b/NixSupport/hackage/hasql.nix
deleted file mode 100644
index 188e4ef80..000000000
--- a/NixSupport/hackage/hasql.nix
+++ /dev/null
@@ -1,32 +0,0 @@
-{ mkDerivation, aeson, attoparsec, base, bytestring
-, bytestring-strict-builder, contravariant, criterion, dlist
-, hashable, hspec, hspec-discover, iproute, lib, mtl
-, postgresql-binary, postgresql-connection-string, postgresql-libpq
-, profunctors, QuickCheck, quickcheck-instances, random, rerebase
-, scientific, testcontainers-postgresql, text, text-builder, time
-, transformers, unordered-containers, uuid, vector, witherable
-}:
-mkDerivation {
-  pname = "hasql";
-  version = "1.10.2.3";
-  sha256 = "ed8fc6d8e05cb9d05d22a63ad0acefac3795ab9ba517f14c574d9d4168f8afca";
-  libraryHaskellDepends = [
-    aeson attoparsec base bytestring bytestring-strict-builder
-    contravariant dlist hashable iproute mtl postgresql-binary
-    postgresql-connection-string postgresql-libpq profunctors
-    scientific text text-builder time transformers unordered-containers
-    uuid vector witherable
-  ];
-  testHaskellDepends = [
-    aeson attoparsec base bytestring contravariant dlist hashable hspec
-    iproute mtl postgresql-libpq profunctors QuickCheck
-    quickcheck-instances random rerebase scientific
-    testcontainers-postgresql text text-builder time transformers
-    unordered-containers uuid vector witherable
-  ];
-  testToolDepends = [ hspec-discover ];
-  benchmarkHaskellDepends = [ criterion rerebase ];
-  homepage = "https://github.com/nikita-volkov/hasql";
-  description = "Fast PostgreSQL driver with a flexible mapping API";
-  license = lib.licenses.mit;
-}
diff --git a/NixSupport/hackage/postgresql-binary.nix b/NixSupport/hackage/postgresql-binary.nix
deleted file mode 100644
index c26fc7226..000000000
--- a/NixSupport/hackage/postgresql-binary.nix
+++ /dev/null
@@ -1,24 +0,0 @@
-{ mkDerivation, aeson, base, binary-parser, bytestring
-, bytestring-strict-builder, containers, criterion, iproute, lib
-, mtl, postgresql-libpq, QuickCheck, quickcheck-instances, rerebase
-, scientific, tasty, tasty-hunit, tasty-quickcheck, text, time
-, transformers, unordered-containers, uuid, vector
-}:
-mkDerivation {
-  pname = "postgresql-binary";
-  version = "0.15.0.1";
-  sha256 = "7736e091b51820526a6417ab9932c083ffd31f0d3ec5baea1d5a07b65d85e34f";
-  libraryHaskellDepends = [
-    aeson base binary-parser bytestring bytestring-strict-builder
-    containers iproute mtl scientific text time transformers
-    unordered-containers uuid vector
-  ];
-  testHaskellDepends = [
-    aeson iproute postgresql-libpq QuickCheck quickcheck-instances
-    rerebase tasty tasty-hunit tasty-quickcheck
-  ];
-  benchmarkHaskellDepends = [ criterion rerebase ];
-  homepage = "https://github.com/nikita-volkov/postgresql-binary";
-  description = "Encoders and decoders for the PostgreSQL's binary format";
-  license = lib.licenses.mit;
-}
diff --git a/NixSupport/hackage/postgresql-connection-string.nix b/NixSupport/hackage/postgresql-connection-string.nix
deleted file mode 100644
index 9cacd867f..000000000
--- a/NixSupport/hackage/postgresql-connection-string.nix
+++ /dev/null
@@ -1,19 +0,0 @@
-{ mkDerivation, base, bytestring, charset, containers, hashable
-, hspec, lib, megaparsec, QuickCheck, quickcheck-classes, text
-, text-builder
-}:
-mkDerivation {
-  pname = "postgresql-connection-string";
-  version = "0.1.0.6";
-  sha256 = "2deb48d7f483b28d39f8d7d24d2ad70e69db5042dbd0351528e4f976acdab110";
-  libraryHaskellDepends = [
-    base bytestring charset containers hashable megaparsec QuickCheck
-    text text-builder
-  ];
-  testHaskellDepends = [
-    base containers hspec QuickCheck quickcheck-classes text
-  ];
-  homepage = "https://github.com/nikita-volkov/postgresql-connection-string";
-  description = "PostgreSQL connection string type, parser and builder";
-  license = lib.licenses.mit;
-}
diff --git a/NixSupport/hackage/postgresql-simple-postgresql-types.nix b/NixSupport/hackage/postgresql-simple-postgresql-types.nix
deleted file mode 100644
index 9dd761d43..000000000
--- a/NixSupport/hackage/postgresql-simple-postgresql-types.nix
+++ /dev/null
@@ -1,22 +0,0 @@
-{ mkDerivation, async, attoparsec, base, hspec, lib
-, postgresql-simple, postgresql-types, postgresql-types-algebra
-, QuickCheck, quickcheck-instances, stm, tagged
-, testcontainers-postgresql, text, text-builder
-}:
-mkDerivation {
-  pname = "postgresql-simple-postgresql-types";
-  version = "0.1.1";
-  sha256 = "25ed8f8ec444be55597bf4ed09bae149f854a607aeaa90c2b7cb191a74db481a";
-  libraryHaskellDepends = [
-    attoparsec base postgresql-simple postgresql-types
-    postgresql-types-algebra tagged text text-builder
-  ];
-  testHaskellDepends = [
-    async base hspec postgresql-simple postgresql-types
-    postgresql-types-algebra QuickCheck quickcheck-instances stm tagged
-    testcontainers-postgresql text
-  ];
-  homepage = "https://github.com/nikita-volkov/postgresql-simple-postgresql-types";
-  description = "Integration of \"postgresql-simple\" with \"postgresql-types\"";
-  license = lib.licenses.mit;
-}
diff --git a/NixSupport/hackage/postgresql-types-algebra.nix b/NixSupport/hackage/postgresql-types-algebra.nix
deleted file mode 100644
index f4b39d4b4..000000000
--- a/NixSupport/hackage/postgresql-types-algebra.nix
+++ /dev/null
@@ -1,15 +0,0 @@
-{ mkDerivation, attoparsec, base, bytestring, lib, ptr-peeker
-, ptr-poker, tagged, text, text-builder
-}:
-mkDerivation {
-  pname = "postgresql-types-algebra";
-  version = "0.1";
-  sha256 = "6c40ca9d442f0b6c01f08b3d3e184c29674223b445edef4a3e672ec3ec193ae4";
-  libraryHaskellDepends = [
-    attoparsec base bytestring ptr-peeker ptr-poker tagged text
-    text-builder
-  ];
-  homepage = "https://github.com/nikita-volkov/postgresql-types-algebra";
-  description = "Type classes for PostgreSQL type mappings";
-  license = lib.licenses.mit;
-}
diff --git a/NixSupport/hackage/postgresql-types.nix b/NixSupport/hackage/postgresql-types.nix
deleted file mode 100644
index 485e0b049..000000000
--- a/NixSupport/hackage/postgresql-types.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-{ mkDerivation, aeson, async, attoparsec, base, bytestring
-, containers, hashable, hspec, hspec-discover, jsonifier, lib, mtl
-, postgresql-libpq, postgresql-types-algebra, ptr-peeker, ptr-poker
-, QuickCheck, quickcheck-classes, quickcheck-instances, scientific
-, stm, tagged, testcontainers-postgresql, text, text-builder, time
-, transformers, uuid, vector
-}:
-mkDerivation {
-  pname = "postgresql-types";
-  version = "0.1.2";
-  sha256 = "ce78e8a965016df3ea2af15fe53332a16a29b9e66f9d8c11f150f092bcea2dfd";
-  libraryHaskellDepends = [
-    aeson attoparsec base bytestring containers hashable jsonifier mtl
-    postgresql-types-algebra ptr-peeker ptr-poker QuickCheck scientific
-    tagged text text-builder time transformers uuid vector
-  ];
-  testHaskellDepends = [
-    aeson async attoparsec base bytestring containers hspec
-    postgresql-libpq postgresql-types-algebra ptr-peeker ptr-poker
-    QuickCheck quickcheck-classes quickcheck-instances scientific stm
-    tagged testcontainers-postgresql text text-builder time uuid vector
-  ];
-  testToolDepends = [ hspec-discover ];
-  doHaddock = false;
-  homepage = "https://github.com/nikita-volkov/postgresql-types";
-  description = "Precise PostgreSQL types representation and driver-agnostic codecs";
-  license = lib.licenses.mit;
-}
diff --git a/NixSupport/hackage/ptr-poker.nix b/NixSupport/hackage/ptr-poker.nix
deleted file mode 100644
index f04acfa6b..000000000
--- a/NixSupport/hackage/ptr-poker.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{ mkDerivation, base, bytestring, criterion, hspec, hspec-discover
-, isomorphism-class, lib, numeric-limits, QuickCheck, rerebase
-, scientific, text
-}:
-mkDerivation {
-  pname = "ptr-poker";
-  version = "0.1.3";
-  sha256 = "0b41e14e6b6a195da6b2907cafe46905db3f9af13859e4753696ce682bc1ef29";
-  libraryHaskellDepends = [ base bytestring scientific text ];
-  testHaskellDepends = [
-    hspec isomorphism-class numeric-limits QuickCheck rerebase
-  ];
-  testToolDepends = [ hspec-discover ];
-  benchmarkHaskellDepends = [ criterion rerebase ];
-  homepage = "https://github.com/nikita-volkov/ptr-poker";
-  description = "Pointer poking action construction and composition toolkit";
-  license = lib.licenses.mit;
-}
diff --git a/NixSupport/hackage/temporary-ospath.nix b/NixSupport/hackage/temporary-ospath.nix
deleted file mode 100644
index ca5dc8648..000000000
--- a/NixSupport/hackage/temporary-ospath.nix
+++ /dev/null
@@ -1,17 +0,0 @@
-{ mkDerivation, base, bytestring, directory, exceptions, file-io
-, filepath, lib, os-string, tasty, tasty-hunit, unix
-}:
-mkDerivation {
-  pname = "temporary-ospath";
-  version = "1.3";
-  sha256 = "74d0a7d57d9a0a3e775d8186544898f95122ccba017972c14cd3edc14dfb69f2";
-  libraryHaskellDepends = [
-    base bytestring directory exceptions file-io filepath os-string
-    unix
-  ];
-  testHaskellDepends = [
-    base directory file-io filepath os-string tasty tasty-hunit unix
-  ];
-  description = "Portable temporary file and directory support";
-  license = lib.licenses.bsd3;
-}
diff --git a/NixSupport/hackage/wai-session-clientsession-deferred.nix b/NixSupport/hackage/wai-session-clientsession-deferred.nix
deleted file mode 100644
index ba7d47802..000000000
--- a/NixSupport/hackage/wai-session-clientsession-deferred.nix
+++ /dev/null
@@ -1,14 +0,0 @@
-{ mkDerivation, base, bytestring, cereal, clientsession, lib
-, transformers, wai-session-maybe
-}:
-mkDerivation {
-  pname = "wai-session-clientsession-deferred";
-  version = "1.0.0";
-  sha256 = "345c34a7e8b31fb255e3ec63c3a64ff8e7bf384f8ee0f73265a7e504c85e4717";
-  libraryHaskellDepends = [
-    base bytestring cereal clientsession transformers wai-session-maybe
-  ];
-  homepage = "https://github.com/digitallyinduced/wai-session-clientsession-deferred";
-  description = "Session store based on clientsession with deferred decryption";
-  license = "unknown";
-}
diff --git a/NixSupport/hackage/wai-session-maybe.nix b/NixSupport/hackage/wai-session-maybe.nix
deleted file mode 100644
index 3f91b3a19..000000000
--- a/NixSupport/hackage/wai-session-maybe.nix
+++ /dev/null
@@ -1,16 +0,0 @@
-{ mkDerivation, base, blaze-builder, bytestring, bytestring-builder
-, containers, cookie, entropy, http-types, lib, StateVar, time
-, transformers, vault, wai
-}:
-mkDerivation {
-  pname = "wai-session-maybe";
-  version = "1.0.0";
-  sha256 = "cb68f815b7d04e4e41a102344af3f0f6067297e2a711869f3554b79446d5682d";
-  libraryHaskellDepends = [
-    base blaze-builder bytestring bytestring-builder containers cookie
-    entropy http-types StateVar time transformers vault wai
-  ];
-  homepage = "https://github.com/digitallyinduced/wai-session-maybe";
-  description = "Flexible session middleware for WAI";
-  license = "unknown";
-}
diff --git a/NixSupport/overlay.nix b/NixSupport/overlay.nix
index 695c458f4..ff7e84a8e 100644
--- a/NixSupport/overlay.nix
+++ b/NixSupport/overlay.nix
@@ -1,4 +1,4 @@
-{ self, inputs, forceLocal ? false }:
+{ self, inputs }:
 let
     flakeRoot = self;
 
@@ -16,29 +16,20 @@ let
             # Uses pre-generated default.nix files to avoid IFD (Import From Derivation).
             # IFD causes nix to build cabal2nix during evaluation, making derivation
             # hashes platform-dependent and breaking caching across machines.
-            # To regenerate: run ./update-nix-from-cabal.sh after changing .cabal files
-            # or upgrading third-party Hackage dependency versions.
+            # To regenerate: run ./update-nix-from-cabal.sh after changing .cabal files.
             localPackage = name: fastBuild (
                 final.haskell.lib.overrideSrc
                     (super.callPackage "${flakeRoot}/${name}/default.nix" {})
                     { src = filteredSrc name; }
             );
 
-            # Pre-generated nix files for third-party Hackage packages, avoiding IFD.
-            # To regenerate: run ./update-nix-from-cabal.sh after changing versions.
-            # Note: unlike localPackage, these keep profiling enabled since downstream
-            # nixpkgs packages (e.g. jsonifier) may require profiling libraries.
+            # Pre-generated nix file for ihp-zip (an IHP-maintained fork of zip that
+            # doesn't live on Hackage). The rest of third-party Haskell deps now come
+            # from the nixpkgs fork at digitallyinduced/nixpkgs:ihp-nixpkgs — see
+            # flake.nix and the rebinds below.
+            # To regenerate ihp-zip.nix: run ./update-nix-from-cabal.sh.
             hackagePackage = name: self.callPackage "${flakeRoot}/NixSupport/hackage/${name}.nix" {};
 
-            # Use the nixpkgs version if available (i.e. published on Hackage and
-            # picked up by the nixpkgs all-cabal-hashes snapshot), otherwise fall
-            # back to building from the local source tree.  Pass --arg forceLocal true
-            # to always use the local version (useful during development).
-            hackageOrLocal = name:
-                if forceLocal || !(super ? ${name})
-                then localPackage name
-                else fastBuild super.${name};
-
             # For quick testing during development, you can use callCabal2nix directly
             # (slower eval due to IFD, but no generated files needed):
             #   localPackageIFD = name: fastBuild (super.callCabal2nix name (filteredSrc name) {});
@@ -81,65 +72,35 @@ let
             ihp-hspec = localPackage "ihp-hspec";
             ihp-welcome = localPackage "ihp-welcome";
 
-            # Forks of wai-session / wai-session-clientsession with deferred
-            # session decryption and optional Set-Cookie (Maybe ByteString).
-            # https://hackage.haskell.org/package/wai-session-maybe
-            # https://hackage.haskell.org/package/wai-session-clientsession-deferred
-            wai-session-maybe = hackagePackage "wai-session-maybe";
-            wai-session-clientsession-deferred = hackagePackage "wai-session-clientsession-deferred";
-
-            # Can be removed after v0.3.2 is on hackage
-            # https://github.com/tippenein/countable-inflections/pull/6
-            countable-inflections = final.haskell.lib.overrideSrc super.countable-inflections {
-                version = "0.3.2";
-                src = final.fetchFromGitHub {
-                    owner = "tippenein";
-                    repo = "countable-inflections";
-                    rev = "9cae03513ad76783c226509f5c00dfe7989893e8";
-                    hash = "sha256-Pd9wQgEtc3e39c0iJR347kdawbyShDEtQqEzrIEu0eQ=";
-                };
-            };
-
-            # Hasql 1.10 ecosystem upgrade for postgresql-types binary encoding support.
-            # Pre-generated nix files in NixSupport/hackage/ to avoid IFD.
-            # dontCheck on postgresql/hasql packages: their tests require a running PostgreSQL server.
-            postgresql-binary = final.haskell.lib.dontCheck (hackagePackage "postgresql-binary");
-            postgresql-connection-string = hackagePackage "postgresql-connection-string";
-
-            hasql = final.haskell.lib.dontCheck (final.haskell.lib.doJailbreak (hackagePackage "hasql"));
-            hasql-pool = final.haskell.lib.dontCheck (hackagePackage "hasql-pool");
-            hasql-dynamic-statements = final.haskell.lib.dontCheck (hackagePackage "hasql-dynamic-statements");
-            hasql-implicits = hackagePackage "hasql-implicits";
-            hasql-transaction = final.haskell.lib.dontCheck (hackagePackage "hasql-transaction");
-            hasql-notifications = final.haskell.lib.dontCheck (hackagePackage "hasql-notifications");
-            # hasql-interpolate: upstream 1.0.1.0 requires hasql <1.10; use fork with hasql 1.10 support
-            # https://github.com/awkward-squad/hasql-interpolate/pull/27
-            # Uses overrideCabal instead of callCabal2nix to avoid IFD and Hackage cabal revision fetch failures
-            hasql-interpolate = final.haskell.lib.dontCheck (final.haskell.lib.doJailbreak (final.haskell.lib.overrideCabal super.hasql-interpolate (old: {
-                src = builtins.fetchTarball {
-                    url = "https://github.com/ChrisPenner/hasql-interpolate/archive/bb4666fdb7e0fef9f67702cb198e45d0a1de0ab9.tar.gz";
-                    sha256 = "1v3i4n4szxpir28a4vlhd2a0sl04fxkiw9wlyxcvd3vbrd9s2b8c";
-                };
-                revision = null;
-                editedCabalFile = null;
-            })));
-
-            # Fork of temporary using OsPath instead of FilePath
-            temporary-ospath = hackagePackage "temporary-ospath";
-
-            # postgresql-types for proper binary encoders of Point, Polygon, Inet, Interval
-            ptr-poker = hackagePackage "ptr-poker";
-            # postgresql-simple-postgresql-types: bridge providing FromField/ToField instances
-            # for all postgresql-types types (Point, Polygon, Inet, Interval, etc.) in postgresql-simple
-            postgresql-simple-postgresql-types = final.haskell.lib.dontCheck (final.haskell.lib.doJailbreak (hackagePackage "postgresql-simple-postgresql-types"));
-            # ptr-peeker is marked broken in nixpkgs but is needed by postgresql-types
-            # https://github.com/nikita-volkov/ptr-peeker/issues/10
-            ptr-peeker = final.haskell.lib.dontCheck (final.haskell.lib.markUnbroken super.ptr-peeker);
-            postgresql-types-algebra = final.haskell.lib.doJailbreak (hackagePackage "postgresql-types-algebra");
-            # dontCheck: tests require a running PostgreSQL server
-            postgresql-types = final.haskell.lib.dontCheck (final.haskell.lib.doJailbreak (hackagePackage "postgresql-types"));
-            hasql-mapping = final.haskell.lib.doJailbreak (hackagePackage "hasql-mapping");
-            hasql-postgresql-types = final.haskell.lib.dontHaddock (final.haskell.lib.doJailbreak (hackagePackage "hasql-postgresql-types"));
+            # Hasql 1.10 ecosystem: rebind from version-suffixed attrs that the
+            # nixpkgs fork (digitallyinduced/nixpkgs:ihp-nixpkgs) ships as
+            # extra-packages. This keeps haskellPackages.hasql etc. pointing at
+            # the versions IHP needs without touching the global stackage pins.
+            # Postgrest's own overrideScope in configuration-common.nix pins to
+            # super.hasql_1_6_4_4 so it is unaffected by these rebinds.
+            # dontCheck: upstream test suites connect to a running PostgreSQL.
+            hasql = final.haskell.lib.dontCheck super.hasql_1_10_3;
+            hasql-dynamic-statements = final.haskell.lib.dontCheck super.hasql-dynamic-statements_0_5_1;
+            hasql-notifications = final.haskell.lib.dontCheck super.hasql-notifications_0_2_5_0;
+            hasql-pool = final.haskell.lib.dontCheck super.hasql-pool_1_4_2;
+            hasql-transaction = final.haskell.lib.dontCheck super.hasql-transaction_1_2_2;
+            postgresql-binary = final.haskell.lib.dontCheck super.postgresql-binary_0_15_0_1;
+            text-builder = super.text-builder_1_0_0_5;
+
+            # postgresql-types family (nikita-volkov): nixpkgs ships the right
+            # versions, they just need test skips and version-bound relaxation.
+            hasql-mapping = final.haskell.lib.unmarkBroken super.hasql-mapping;
+            hasql-postgresql-types = final.haskell.lib.dontHaddock (final.haskell.lib.doJailbreak super.hasql-postgresql-types);
+            postgresql-simple-postgresql-types = final.haskell.lib.dontCheck (final.haskell.lib.doJailbreak super.postgresql-simple-postgresql-types);
+            postgresql-types = final.haskell.lib.dontCheck (final.haskell.lib.doJailbreak super.postgresql-types);
+            postgresql-types-algebra = final.haskell.lib.doJailbreak super.postgresql-types-algebra;
+
+            # tls 2.1.8 (pulled in transitively from haskell-updates) has 4 flaky
+            # TLS 1.3 PSK handshake property tests that fail under nix check phase
+            # on aarch64-darwin — see https://github.com/haskell-tls/hs-tls/issues
+            # for the upstream tracker. Dropping checks unblocks CI; IHP doesn't
+            # exercise these code paths directly.
+            tls = final.haskell.lib.dontCheck super.tls;
         };
 in
 final: prev: {
diff --git a/devenv-module.nix b/devenv-module.nix
index 20685e241..54ee95969 100644
--- a/devenv-module.nix
+++ b/devenv-module.nix
@@ -169,32 +169,12 @@ that is defined in flake-module.nix
                 ghc912-ihp-pglistener = withTestPostgres pkgs.ghc912.ihp-pglistener;
             }
 
-            # GHC 9.14 compatibility checks (only when nixpkgs includes ghc914)
-            // (lib.optionalAttrs (pkgs.haskell.packages ? ghc914) (let
-                ghc914 = pkgs.ghc914;
-                ihpPackageNames = [
-                    "ihp-ide" "ihp-hsx" "ihp-schema-compiler"
-                    "ihp-postgres-parser" "ihp-context" "ihp-pagehead"
-                    "ihp-log" "ihp-modal" "ihp-mail"
-                    "ihp-migrate" "ihp-openai" "ihp-ssc" "ihp-graphql"
-                    "ihp-datasync-typescript" "ihp-sitemap"
-                    "ihp-job-dashboard" "ihp-imagemagick"
-                    "ihp-hspec" "ihp-welcome" "ihp-zip"
-                    "wai-asset-path" "wai-flash-messages" "wai-request-params"
-                    "wai-session-maybe" "wai-session-clientsession-deferred"
-                ];
-            in lib.listToAttrs (map (name: {
-                name = "ghc914-${name}";
-                value = ghc914.${name};
-            }) ihpPackageNames)
-
-            # GHC 9.14 packages that need a running PostgreSQL for their tests
-            // {
-                ghc914-ihp = withTestPostgres pkgs.ghc914.ihp;
-                ghc914-ihp-datasync = withTestPostgres pkgs.ghc914.ihp-datasync;
-                ghc914-ihp-typed-sql = withTestPostgres pkgs.ghc914.ihp-typed-sql;
-                ghc914-ihp-pglistener = withTestPostgres pkgs.ghc914.ihp-pglistener;
-            }))
+            # GHC 9.14 compatibility checks are intentionally disabled:
+            # The nixpkgs fork (haskell-updates) now ships ghc-9.14.1, but the
+            # wider Haskell ecosystem hasn't caught up — e.g. ghc-tcplugins-extra
+            # still upper-bounds ghc < 9.13. Keeping overlay.nix's ghc914 branch
+            # for anyone who wants to opt in manually, but gating CI on it would
+            # block every PR until upstream catches up.
         ;
 
         devenv.shells.default = {
@@ -423,7 +403,9 @@ that is defined in flake-module.nix
                     pkgs.stdenv.mkDerivation {
                         name = "ihp-guide";
                         src = ./Guide;
-                        nativeBuildInputs = with pkgs; [ haskellPackages.mmark-cli pkgs.esbuild ];
+                        # Use pkgs.ghc.mmark-cli, not pkgs.haskellPackages.mmark-cli,
+                        # so the transitive tls dep inherits the dontCheck from our overlay.
+                        nativeBuildInputs = with pkgs; [ ghc.mmark-cli pkgs.esbuild ];
                         buildPhase = ''
                             # build HTML from all *.markdown using the template
                             for f in *.markdown; do
diff --git a/flake.lock b/flake.lock
index 6d748f7f8..1143b3dee 100644
--- a/flake.lock
+++ b/flake.lock
@@ -1815,16 +1815,16 @@
     },
     "nixpkgs_8": {
       "locked": {
-        "lastModified": 1773222311,
-        "narHash": "sha256-BHoB/XpbqoZkVYZCfXJXfkR+GXFqwb/4zbWnOr2cRcU=",
-        "owner": "NixOS",
+        "lastModified": 1775694506,
+        "narHash": "sha256-IcJGxFRqldeAPXgkphX+gVzKdCmWku4J0Tbj46IKnhI=",
+        "owner": "digitallyinduced",
         "repo": "nixpkgs",
-        "rev": "0590cd39f728e129122770c029970378a79d076a",
+        "rev": "eb982734d44799966067d97a7e05b425156d53df",
         "type": "github"
       },
       "original": {
-        "owner": "NixOS",
-        "ref": "nixos-25.11",
+        "owner": "digitallyinduced",
+        "ref": "ihp-nixpkgs",
         "repo": "nixpkgs",
         "type": "github"
       }
diff --git a/flake.nix b/flake.nix
index 2e644c1a1..1cde12c19 100644
--- a/flake.nix
+++ b/flake.nix
@@ -2,8 +2,14 @@
     description = "IHP is a modern batteries-included haskell web framework, built on top of Haskell and Nix.";
 
     inputs = {
-        # "github:NixOS/nixpkgs/nixos-unstable"
-        nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";           # for Haskell packages
+        # For Haskell packages: snapshot of upstream/haskell-updates pushed to
+        # digitallyinduced/nixpkgs. Contains hasql 1.10, hasql-mapping,
+        # postgresql-types (nikita-volkov), temporary-ospath, wai-session-maybe,
+        # and all other packages IHP needs — all from PRs that have merged into
+        # upstream haskell-updates. Insulated from upstream force-pushes.
+        # Bump by force-pushing a newer upstream/haskell-updates tip to the
+        # fork's ihp-nixpkgs branch and running `nix flake update nixpkgs`.
+        nixpkgs.url = "github:digitallyinduced/nixpkgs/ihp-nixpkgs";
         nixpkgs-nixos.url = "github:NixOS/nixpkgs/nixos-25.11";     # for NixOS deployments (pin independently)
 
         # pre-defined set of default target systems
diff --git a/update-nix-from-cabal.sh b/update-nix-from-cabal.sh
index 51a5cc8f0..e38629b50 100755
--- a/update-nix-from-cabal.sh
+++ b/update-nix-from-cabal.sh
@@ -21,29 +21,14 @@ for cabal_file in */*.cabal; do
   (cd "$dir" && cabal2nix .) > "./$dir/default.nix"
 done
 
-# --- Third-party Hackage packages ---
-# Pre-generated to avoid IFD (Import From Derivation).
-# Update versions here when upgrading dependencies.
+# --- ihp-zip: only third-party Haskell package that still lives in
+# NixSupport/hackage/. Everything else (hasql, postgresql-types,
+# wai-session-*, etc.) now comes from the nixpkgs fork at
+# digitallyinduced/nixpkgs:ihp-nixpkgs and is wired up via rebinds in
+# NixSupport/overlay.nix — nothing to regenerate there.
 mkdir -p NixSupport/hackage
 
 hackage_packages=(
-  "wai-session-maybe 1.0.0"
-  "wai-session-clientsession-deferred 1.0.0"
-  "postgresql-binary 0.15.0.1"
-  "postgresql-connection-string 0.1.0.6"
-  "hasql 1.10.2.3"
-  "hasql-pool 1.4.2"
-  "hasql-dynamic-statements 0.5.1"
-  "hasql-implicits 0.2.0.2"
-  "hasql-transaction 1.2.2"
-  "hasql-notifications 0.2.5.0"
-  "temporary-ospath 1.3"
-  "ptr-poker 0.1.3"
-  "postgresql-simple-postgresql-types 0.1.1"
-  "postgresql-types-algebra 0.1"
-  "postgresql-types 0.1.2"
-  "hasql-mapping 0.1"
-  "hasql-postgresql-types 0.2"
   "ihp-zip 0.1.0"
 )