# Do I really need nixpkgs cooldowns (determinate systems) for desktop use case?

**URL:** https://discourse.nixos.org/t/do-i-really-need-nixpkgs-cooldowns-determinate-systems-for-desktop-use-case/80047
**Category:** Security
**Created:** [September 11, 2026, 10:37am UTC](https://discourse.nixos.org/t/do-i-really-need-nixpkgs-cooldowns-determinate-systems-for-desktop-use-case/80047 "2026-09-11T10:37:54Z")
**Posts on this page:** 9
**Page:** 2

<div class="post-metadata">

### Author: ![waffle8946](https://discourse.nixos.org/user_avatar/discourse.nixos.org/waffle8946/32/27221_2.png) [@waffle8946](https://discourse.nixos.org/u/waffle8946)
#### Post date: [September 13, 2026, 3:25am UTC](https://discourse.nixos.org/t/do-i-really-need-nixpkgs-cooldowns-determinate-systems-for-desktop-use-case/80047/21 "2026-09-13T03:25:05Z")

</div>

Correct, but you can use `--override-input nixpkgs <url>`.  
Still, there’s no reason to rely on github, since there’s lockable tarballs, i.e.

```nix
  inputs.nixpkgs.url = "https://channels.nixos.org/nixos-unstable/nixexprs.tar.zst";

```

Switch out `nixos-unstable` for the desired channel.

---

<div class="post-metadata">

### Author: ![MaxHearnden](https://discourse.nixos.org/user_avatar/discourse.nixos.org/maxhearnden/32/16760_2.png) [@MaxHearnden](https://discourse.nixos.org/u/MaxHearnden)
#### Post date: [September 13, 2026, 10:28am UTC](https://discourse.nixos.org/t/do-i-really-need-nixpkgs-cooldowns-determinate-systems-for-desktop-use-case/80047/23 "2026-09-13T10:28:59Z")

</div>

It depends, nix only fetches inputs as required (either by evaluation or as part of a flake update) and only if the input is not already in the nix store or nix doesn’t know the content’s hash.

So after a rebuild, the flake is still buildable even if GitHub goes offline, at least until a gc.

---

<div class="post-metadata">

### Author: ![nh2](https://discourse.nixos.org/user_avatar/discourse.nixos.org/nh2/32/631_2.png) [@nh2](https://discourse.nixos.org/u/nh2)
#### Post date: [September 13, 2026, 11:36am UTC](https://discourse.nixos.org/t/do-i-really-need-nixpkgs-cooldowns-determinate-systems-for-desktop-use-case/80047/24 "2026-09-13T11:36:36Z")

</div>

Removing unpopular packages is being brought up every now and then but it does not bring security benefits:

Packages only affect people that install it. A vulnerable package nobody uses isn’t a problem.

---

<div class="post-metadata">

### Author: ![Mapybara](https://discourse.nixos.org/letter_avatar_proxy/v4/letter/m/8dc957/32.png) [@Mapybara](https://discourse.nixos.org/u/Mapybara)
#### Post date: [September 14, 2026, 12:23am UTC](https://discourse.nixos.org/t/do-i-really-need-nixpkgs-cooldowns-determinate-systems-for-desktop-use-case/80047/25 "2026-09-14T00:23:03Z")

</div>

I mean it brings some benefits by way of alerting people to which packages the maintainers believe belong in nixpkgs, and this is not just a theoretical point: I was using the Zen browser until I was alerted to its security problems by the nixpkgs discussion about it.

But on the whole I agree with you at least to the extent that it’s not a big deal compared to the other considerations discussed above.

---

<div class="post-metadata">

### Author: ![harlequin2661](https://discourse.nixos.org/user_avatar/discourse.nixos.org/harlequin2661/32/38823_2.png) [@harlequin2661](https://discourse.nixos.org/u/harlequin2661)
#### Post date: [September 18, 2026, 4:33pm UTC](https://discourse.nixos.org/t/do-i-really-need-nixpkgs-cooldowns-determinate-systems-for-desktop-use-case/80047/26 "2026-09-18T16:33:04Z")

</div>

> There is security risk by introducing a 3rd party (Determinate Systems) to provide this. I expect it has strong modern internal controls, but also has less community oversight than nixpkgs.

but are they not just mirroring nixpkgs?

---

<div class="post-metadata">

### Author: ![harlequin2661](https://discourse.nixos.org/user_avatar/discourse.nixos.org/harlequin2661/32/38823_2.png) [@harlequin2661](https://discourse.nixos.org/u/harlequin2661)
#### Post date: [September 18, 2026, 4:34pm UTC](https://discourse.nixos.org/t/do-i-really-need-nixpkgs-cooldowns-determinate-systems-for-desktop-use-case/80047/27 "2026-09-18T16:34:30Z")

</div>

> It’s awfully convenient that they have the solution ready to go for you

but they have nixpkgs-weekly since 2024

 ![image](https://discourse.nixos.org/uploads/default/original/3X/4/f/4fe1e41e3cfe993c6f97a6338bdf836d54d9cef6.png)

---

<div class="post-metadata">

### Author: ![blitz](https://discourse.nixos.org/user_avatar/discourse.nixos.org/blitz/32/2037_2.png) [@blitz](https://discourse.nixos.org/u/blitz)
#### Post date: [September 19, 2026, 9:18am UTC](https://discourse.nixos.org/t/do-i-really-need-nixpkgs-cooldowns-determinate-systems-for-desktop-use-case/80047/28 "2026-09-19T09:18:25Z")

</div>

I think that adding extra delay in consuming a NixOS release is a net negative. Instead of that we (all the commercial players) should invest in build capacity and people power to ship security fixes faster not slower. There are already some weeks passing by before security fixes that have to go through staging hit users.

Creating a “chilled” release is a marketing play that probably works well with already scared customers. But ultimately better security in NixOS comes from working with the community and not by spreading fear.

PS. I work on Cyberus Linux (formerly CTRL-OS), so I might not be an unbiased voice here either.

---

<div class="post-metadata">

### Author: ![harlequin2661](https://discourse.nixos.org/user_avatar/discourse.nixos.org/harlequin2661/32/38823_2.png) [@harlequin2661](https://discourse.nixos.org/u/harlequin2661)
#### Post date: [September 19, 2026, 9:24am UTC](https://discourse.nixos.org/t/do-i-really-need-nixpkgs-cooldowns-determinate-systems-for-desktop-use-case/80047/29 "2026-09-19T09:24:59Z")

</div>

> [@blitz](#):
>
> invest in build capacity and people power to ship security fixes faster not slower

what would enable such solution? money? more nixos users (which eventually leads to more volunteers)?

---

<div class="post-metadata">

### Author: ![NobbZ](https://discourse.nixos.org/user_avatar/discourse.nixos.org/nobbz/32/7022_2.png) [@NobbZ](https://discourse.nixos.org/u/NobbZ)
#### Post date: [September 19, 2026, 9:30am UTC](https://discourse.nixos.org/t/do-i-really-need-nixpkgs-cooldowns-determinate-systems-for-desktop-use-case/80047/30 "2026-09-19T09:30:23Z")

</div>

> [@harlequin2661](#):
>
> what would enable such solution?

I think that build scheduling plays a large role here. Just throwing more compute at the problem will just make more machines shuffling store paths around.

Wen there are 2 machines asking for a job we should consider what inputs they already have available to reduce substitution time.

This is especially cumbersome for wrappers of large packages.

I don’t know how much the improved hydra scheduler is already doing this, I can only talk about the nix built-in work scheduler.

[Previous page](https://discourse.nixos.org/t/do-i-really-need-nixpkgs-cooldowns-determinate-systems-for-desktop-use-case/80047.md?page=1)
