diff --git a/flake.nix b/flake.nix
index 67c1666..7c92cac 100644
--- a/flake.nix
+++ b/flake.nix
@@ -26,8 +26,16 @@
                 src = ./.;
                 doCheck = false;
                 name = "rain";
-                cargoLock.lockFile = ./Cargo.lock;
-                cargoLock.allowBuiltinFetchGit = true;
+                # Vendored through fetchCargoVendor rather than cargoLock:
+                # cargoLock fetches each crate from the crates.io API, which now
+                # answers 403 to the curl User-Agent nix sends, so any store miss
+                # fails the build. fetchCargoVendor pulls from the
+                # static.crates.io CDN, which does not.
+                cargoDeps = pkgs.rustPlatform.fetchCargoVendor {
+                  src = ./.;
+                  name = "rain";
+                  hash = "sha256-TrZzMmDnC07lhfjKdKfwNtrzbeRcxKewqTqmiZD2fic=";
+                };
                 buildInputs = rainix.rust-build-inputs.${system};
                 nativeBuildInputs = rainix.rust-build-inputs.${system};
               };