diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8fe440fc39..3755b62f9c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -276,6 +276,19 @@ jobs:
       - name: JDBC plugin package check
         run: ./plugins/jdbc/package.sh
 
+  nix-packaging:
+    needs: changes
+    if: needs.changes.outputs.nix == 'true'
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+
+      - name: Build Nix package
+        run: nix build .#dbx-desktop --no-link --print-build-logs
+
   changes:
     runs-on: ubuntu-22.04
     outputs:
@@ -285,6 +298,7 @@ jobs:
       rust_full: ${{ steps.rust-mode.outputs.full }}
       jdbc: ${{ steps.filter.outputs.jdbc }}
       agents: ${{ steps.filter.outputs.agents }}
+      nix: ${{ steps.filter.outputs.nix }}
     steps:
       - uses: actions/checkout@v5
         with:
@@ -325,6 +339,20 @@ jobs:
               - 'plugins/jdbc/**'
             agents:
               - 'agents/**'
+            nix:
+              # The fixed-output pnpm hash must change whenever the workspace dependency graph changes.
+              - 'package.json'
+              - 'packages/**/package.json'
+              - 'pnpm-lock.yaml'
+              - 'pnpm-workspace.yaml'
+              - 'flake.nix'
+              - 'flake.lock'
+              - 'Cargo.toml'
+              - 'Cargo.lock'
+              - 'crates/**/Cargo.toml'
+              - 'src-tauri/Cargo.toml'
+              - '.github/workflows/ci.yml'
+              - '.github/workflows/update-nix-pnpm-hash.yml'
 
       - name: Select Rust feature coverage
         id: rust-mode
diff --git a/.github/workflows/update-nix-pnpm-hash.yml b/.github/workflows/update-nix-pnpm-hash.yml
new file mode 100644
index 0000000000..b42468d48b
--- /dev/null
+++ b/.github/workflows/update-nix-pnpm-hash.yml
@@ -0,0 +1,60 @@
+name: Update Nix pnpm hash
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'pnpm-lock.yaml'
+      - 'pnpm-workspace.yaml'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+concurrency:
+  group: update-nix-pnpm-hash-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  update:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+
+      - name: Update hash when needed
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          build_log=$(mktemp)
+          if nix build .#dbx-desktop --no-link --print-build-logs >"$build_log" 2>&1; then
+            echo "Nix package already has the correct pnpm hash."
+            exit 0
+          fi
+
+          cat "$build_log"
+          expected_hash=$(sed -n 's/.*got: \(sha256-[A-Za-z0-9+/=]*\).*/\1/p' "$build_log" | tail -1)
+          if [ -z "$expected_hash" ]; then
+            echo "Nix build failed without reporting a replacement fixed-output hash."
+            exit 1
+          fi
+
+          EXPECTED_HASH="$expected_hash" perl -0pi -e \
+            's/(hash = ")sha256-[^"]+(")/$1 . $ENV{EXPECTED_HASH} . $2/e' flake.nix
+
+          nix build .#dbx-desktop --no-link --print-build-logs
+
+          if git diff --quiet -- flake.nix; then
+            echo "The Nix build passed without changing flake.nix."
+            exit 0
+          fi
+
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add flake.nix
+          git commit -m "fix(nix): update pnpm dependency hash"
+          # Push only the checked commit to the triggering branch; a concurrent update must fail safely.
+          git push origin "HEAD:${GITHUB_REF_NAME}"
diff --git a/flake.nix b/flake.nix
index a2baa80c99..70184c8e20 100644
--- a/flake.nix
+++ b/flake.nix
@@ -160,9 +160,9 @@
         #   3. pnpm build      → compile Vue/TypeScript frontend               #
         #   4. cargo build -p dbx → compile Tauri Rust backend                 #
         #                                                                      #
-        # ⚠️  The pnpmDeps.hash below is a placeholder.                       #
-        #    Run `nix build .#dbx-desktop` once; Nix will report the          #
-        #    correct sha256 — paste it in place of the placeholder.           #
+        # The pnpmDeps hash is verified by the nix-packaging CI job.           #
+        # When dependency inputs change, use the hash reported by the failed  #
+        # Nix build and rerun the job before merging.                          #
         # ------------------------------------------------------------------ #
         packages.dbx-desktop = pkgs.stdenv.mkDerivation (finalAttrs: {
           pname = "dbx-desktop";
@@ -177,7 +177,7 @@
             inherit (finalAttrs) pname version src;
             # `fetcherVersion = 4` is supported for `pnpm_11`
             fetcherVersion = 4;
-            # Replace with the correct hash after the first failed build:
+            # Update with the hash reported by a failed fixed-output build:
             #   nix build .#dbx-desktop 2>&1 | grep 'got:'
             hash = "sha256-xRnzwsiLazZVedPCOnRha2f1fos3uEO+UuNRaWJhQ6I=";
           };