diff --git a/nix/buildGo/proto.nix b/nix/buildGo/proto.nix
index 57e9a5ec9..4bd3a5727 100644
--- a/nix/buildGo/proto.nix
+++ b/nix/buildGo/proto.nix
@@ -52,6 +52,8 @@ in rec {
     path = "google.golang.org/genproto";
     src = fetchGit {
       url = "https://github.com/google/go-genproto";
+      # necessary because https://github.com/NixOS/nix/issues/1923
+      ref = "main";
       rev = "83cc0476cb11ea0da33dacd4c6354ab192de6fe6";
     };
 
diff --git a/third_party/gopkgs/cloud.google.com/go/default.nix b/third_party/gopkgs/cloud.google.com/go/default.nix
index 876585f2d..015d3e630 100644
--- a/third_party/gopkgs/cloud.google.com/go/default.nix
+++ b/third_party/gopkgs/cloud.google.com/go/default.nix
@@ -2,8 +2,10 @@
 
 depot.nix.buildGo.external {
   path = "cloud.google.com/go";
-  src = builtins.fetchGit {
+
+  src = pkgs.fetchgit {
     url = "https://code.googlesource.com/gocloud";
     rev = "4f03f8e4ba168c636e1c218da7ab41a1c8c0d8cf";
+    hash = "sha256:1cgr8f9349r4ymp2k0x49lby47jgi40bblvl1dk6i99ij6faj93d";
   };
 }
diff --git a/third_party/gopkgs/github.com/golang/groupcache/default.nix b/third_party/gopkgs/github.com/golang/groupcache/default.nix
index 4c12173ed..c2fc341fe 100644
--- a/third_party/gopkgs/github.com/golang/groupcache/default.nix
+++ b/third_party/gopkgs/github.com/golang/groupcache/default.nix
@@ -1,9 +1,15 @@
-{ depot, ... }:
+{ depot, pkgs, ... }:
 
 depot.nix.buildGo.external {
   path = "github.com/golang/groupcache";
-  src = builtins.fetchGit {
+
+  src = pkgs.fetchgit {
     url = "https://github.com/golang/groupcache";
     rev = "611e8accdfc92c4187d399e95ce826046d4c8d73";
+    hash = "sha256:0ydaq1xn03h2arfdri0vcv0df19pk8dvq4ly5hm1kv18yjfv1v13";
   };
+
+  deps = with depot.third_party; [
+    gopkgs."github.com".golang.protobuf.proto
+  ];
 }
diff --git a/third_party/gopkgs/github.com/golang/protobuf/default.nix b/third_party/gopkgs/github.com/golang/protobuf/default.nix
index 5a4290dec..119eafb42 100644
--- a/third_party/gopkgs/github.com/golang/protobuf/default.nix
+++ b/third_party/gopkgs/github.com/golang/protobuf/default.nix
@@ -1,9 +1,11 @@
-{ depot, ... }:
+{ depot, pkgs, ... }:
 
 depot.nix.buildGo.external {
   path = "github.com/golang/protobuf";
-  src = builtins.fetchGit {
+
+  src = pkgs.fetchgit {
     url = "https://github.com/golang/protobuf";
     rev = "ed6926b37a637426117ccab59282c3839528a700";
+    hash = "sha256:0fynqrim022x9xi2bivkw19npbz4316v4yr7mb677s9s36z4dc4h";
   };
 }
diff --git a/third_party/gopkgs/github.com/googleapis/gax-go/default.nix b/third_party/gopkgs/github.com/googleapis/gax-go/default.nix
index 4c2d8dbd3..63c6f4b1d 100644
--- a/third_party/gopkgs/github.com/googleapis/gax-go/default.nix
+++ b/third_party/gopkgs/github.com/googleapis/gax-go/default.nix
@@ -1,13 +1,13 @@
-{ depot, ... }:
+{ depot, pkgs, ... }:
 
-let
-  inherit (depot) buildGo;
-  inherit (builtins) fetchGit;
-in depot.nix.buildGo.external {
+depot.nix.buildGo.external {
   path = "github.com/googleapis/gax-go";
-  src = fetchGit {
-    url = "https://github.com/googleapis/gax-go";
+
+  src = pkgs.fetchFromGitHub {
+    owner = "googleapis";
+    repo = "gax-go";
     rev = "b443e5a67ec8eeac76f5f384004931878cab24b3";
+    sha256 = "075s8b76l14c9vlchly38hsf28bnr7vzq9q57g2kg1025h004lzw";
   };
 
   deps = with depot.third_party; [
diff --git a/third_party/gopkgs/github.com/hashicorp/golang-lru/default.nix b/third_party/gopkgs/github.com/hashicorp/golang-lru/default.nix
index 417826ada..8d540877d 100644
--- a/third_party/gopkgs/github.com/hashicorp/golang-lru/default.nix
+++ b/third_party/gopkgs/github.com/hashicorp/golang-lru/default.nix
@@ -1,10 +1,12 @@
-{ depot, ... }:
+{ depot, pkgs, ... }:
 
 depot.nix.buildGo.external {
   path = "github.com/hashicorp/golang-lru";
-  src = builtins.fetchGit {
+
+  src = pkgs.fetchgit {
     url = "https://github.com/hashicorp/golang-lru";
     rev = "7f827b33c0f158ec5dfbba01bb0b14a4541fd81d";
+    hash = "sha256:1p2igd58xkm8yaj2c2wxiplkf2hj6kxwrg6ss7mx61s5rd71v5xb";
   };
 
   deps = with depot.third_party; [
diff --git a/third_party/gopkgs/go.opencensus.io/default.nix b/third_party/gopkgs/go.opencensus.io/default.nix
index bc1444164..b1ee6da1f 100644
--- a/third_party/gopkgs/go.opencensus.io/default.nix
+++ b/third_party/gopkgs/go.opencensus.io/default.nix
@@ -1,10 +1,13 @@
-{ depot, ... }:
+{ depot, pkgs, ... }:
 
 depot.nix.buildGo.external {
   path = "go.opencensus.io";
-  src = builtins.fetchGit {
-    url = "https://github.com/census-instrumentation/opencensus-go";
+
+  src = pkgs.fetchFromGitHub {
+    owner = "census-instrumentation";
+    repo = "opencensus-go";
     rev = "643eada29081047b355cfaa1ceb9bc307a10423c";
+    sha256 = "1acmv2f5wz06abphk0yvb9igp2j5sn1v21dg1p8n109rwanwd5v4";
   };
 
   deps = with depot.third_party; [
diff --git a/third_party/gopkgs/golang.org/x/crypto/default.nix b/third_party/gopkgs/golang.org/x/crypto/default.nix
index dfaf4ac85..41c3b4e72 100644
--- a/third_party/gopkgs/golang.org/x/crypto/default.nix
+++ b/third_party/gopkgs/golang.org/x/crypto/default.nix
@@ -1,10 +1,12 @@
-{ depot, ... }:
+{ depot, pkgs, ... }:
 
 depot.nix.buildGo.external {
   path = "golang.org/x/crypto";
-  src = builtins.fetchGit {
+
+  src = pkgs.fetchgit {
     url = "https://go.googlesource.com/crypto";
     rev = "e9b2fee46413994441b28dfca259d911d963dfed";
+    hash = "sha256:18sz5426h320l9gdll9n43lzzxg2dmqv0s5fjy6sbvbkkpjs1m28";
   };
 
   deps = with depot.third_party; [
diff --git a/third_party/gopkgs/golang.org/x/net/default.nix b/third_party/gopkgs/golang.org/x/net/default.nix
index 899600dab..9a8fef694 100644
--- a/third_party/gopkgs/golang.org/x/net/default.nix
+++ b/third_party/gopkgs/golang.org/x/net/default.nix
@@ -1,10 +1,12 @@
-{ depot, ... }:
+{ depot, pkgs, ... }:
 
 depot.nix.buildGo.external {
   path = "golang.org/x/net";
-  src = builtins.fetchGit {
+
+  src = pkgs.fetchgit {
     url = "https://go.googlesource.com/net";
     rev = "c0dbc17a35534bf2e581d7a942408dc936316da4";
+    hash = "sha256:1f1xqh2cvr629fkg9n9k347vf6g91jkrsmgmy8hlqdrq163blb54";
   };
 
   deps = with depot.third_party; [
diff --git a/third_party/gopkgs/golang.org/x/oauth2/default.nix b/third_party/gopkgs/golang.org/x/oauth2/default.nix
index 7ad94930a..60864ffe4 100644
--- a/third_party/gopkgs/golang.org/x/oauth2/default.nix
+++ b/third_party/gopkgs/golang.org/x/oauth2/default.nix
@@ -1,10 +1,12 @@
-{ depot, ... }:
+{ depot, pkgs, ... }:
 
 depot.nix.buildGo.external {
   path = "golang.org/x/oauth2";
-  src = builtins.fetchGit {
+
+  src = pkgs.fetchgit {
     url = "https://go.googlesource.com/oauth2";
     rev = "858c2ad4c8b6c5d10852cb89079f6ca1c7309787";
+    hash = "sha256:1dc7n8ddph8w6q0i3cwlgvjwpf2wlkx407va1ydnazasi1j5ixrw";
   };
 
   deps = with depot.third_party; [
diff --git a/third_party/gopkgs/golang.org/x/sys/default.nix b/third_party/gopkgs/golang.org/x/sys/default.nix
index 8636a9913..8da07693c 100644
--- a/third_party/gopkgs/golang.org/x/sys/default.nix
+++ b/third_party/gopkgs/golang.org/x/sys/default.nix
@@ -1,9 +1,11 @@
-{ depot, ... }:
+{ depot, pkgs, ... }:
 
 depot.nix.buildGo.external {
   path = "golang.org/x/sys";
-  src = builtins.fetchGit {
+
+  src = pkgs.fetchgit {
     url = "https://go.googlesource.com/sys";
     rev = "ac6580df4449443a05718fd7858c1f91ad5f8d20";
+    hash = "sha256:14gvx65w5lddi20s4wypbbvbg9ni3m8777jhp9nqxhixc61k3dyi";
   };
 }
diff --git a/third_party/gopkgs/golang.org/x/text/default.nix b/third_party/gopkgs/golang.org/x/text/default.nix
index 33b744461..f5a900b95 100644
--- a/third_party/gopkgs/golang.org/x/text/default.nix
+++ b/third_party/gopkgs/golang.org/x/text/default.nix
@@ -1,9 +1,11 @@
-{ depot, ... }:
+{ depot, pkgs, ... }:
 
 depot.nix.buildGo.external {
   path = "golang.org/x/text";
-  src = builtins.fetchGit {
+
+  src = pkgs.fetchgit {
     url = "https://go.googlesource.com/text";
     rev = "cbf43d21aaebfdfeb81d91a5f444d13a3046e686";
+    hash = "sha256:1h6z2x4ijzd1126zk3lf8f3bp98j1irs7xg6p8nwpymkqkw5laq8";
   };
 }
diff --git a/third_party/gopkgs/golang.org/x/time/default.nix b/third_party/gopkgs/golang.org/x/time/default.nix
index 2a9a4da56..1c03a8f0a 100644
--- a/third_party/gopkgs/golang.org/x/time/default.nix
+++ b/third_party/gopkgs/golang.org/x/time/default.nix
@@ -1,10 +1,11 @@
-{ depot, ... }:
+{ depot, pkgs, ... }:
 
 depot.nix.buildGo.external {
   path = "golang.org/x/time";
 
-  src = builtins.fetchGit {
+  src = pkgs.fetchgit {
     url = "https://go.googlesource.com/time";
     rev = "555d28b269f0569763d25dbe1a237ae74c6bcc82";
+    hash = "sha256:1rhl4lyz030kwfsg63yk83yd3ivryv1afmzdz9sxbhcj84ym6h4r";
   };
 }
diff --git a/third_party/gopkgs/google.golang.org/api/default.nix b/third_party/gopkgs/google.golang.org/api/default.nix
index 0d2f173e3..490d3a9d2 100644
--- a/third_party/gopkgs/google.golang.org/api/default.nix
+++ b/third_party/gopkgs/google.golang.org/api/default.nix
@@ -1,10 +1,12 @@
-{ depot, ... }:
+{ depot, pkgs, ... }:
 
 depot.nix.buildGo.external {
   path = "google.golang.org/api";
-  src = builtins.fetchGit {
+
+  src = pkgs.fetchgit {
     url = "https://code.googlesource.com/google-api-go-client";
     rev = "8b4e46d953bd748a9ff098644a42389b3d8dab41";
+    hash = "sha256:1vffav53qkksrhdqnp8013v90ks6d7jra0vh3sbybg0v0bka7n3p";
   };
 
   deps = with depot.third_party; [
diff --git a/third_party/gopkgs/google.golang.org/genproto/default.nix b/third_party/gopkgs/google.golang.org/genproto/default.nix
index fa25d1360..cba54e589 100644
--- a/third_party/gopkgs/google.golang.org/genproto/default.nix
+++ b/third_party/gopkgs/google.golang.org/genproto/default.nix
@@ -1,10 +1,12 @@
-{ depot, ... }:
+{ depot, pkgs, ... }:
 
 depot.nix.buildGo.external {
   path = "google.golang.org/genproto";
-  src = builtins.fetchGit {
+
+  src = pkgs.fetchgit {
     url = "https://github.com/google/go-genproto";
     rev = "0243a4be9c8f1264d238fdc2895620b4d9baf9e1";
+    hash = "sha256:071672lk0pzns98ncbqk6np7l9flwh84hjjibhhm2s1fi941m6q3";
   };
 
   deps = with depot.third_party; [
diff --git a/third_party/gopkgs/google.golang.org/grpc/default.nix b/third_party/gopkgs/google.golang.org/grpc/default.nix
index f3ed89d09..522a27d60 100644
--- a/third_party/gopkgs/google.golang.org/grpc/default.nix
+++ b/third_party/gopkgs/google.golang.org/grpc/default.nix
@@ -1,10 +1,12 @@
-{ depot, ... }:
+{ depot, pkgs, ... }:
 
 depot.nix.buildGo.external {
   path = "google.golang.org/grpc";
-  src = builtins.fetchGit {
+
+  src = pkgs.fetchgit {
     url = "https://github.com/grpc/grpc-go";
     rev = "085c980048876e2735d4aba8f0d5bca4d7acaaa5";
+    hash = "sha256:1vl089pv8qgxkbdg10kyd7203psn35wwjzxxbvi22628faqcpg61";
   };
 
   deps = with depot.third_party; [
diff --git a/third_party/lisp/cl-plus-ssl.nix b/third_party/lisp/cl-plus-ssl.nix
index e6a616b95..bec5d5b3a 100644
--- a/third_party/lisp/cl-plus-ssl.nix
+++ b/third_party/lisp/cl-plus-ssl.nix
@@ -3,9 +3,10 @@
 
 with depot.nix;
 
-let src = builtins.fetchGit {
+let src = pkgs.fetchgit {
   url = "https://github.com/cl-plus-ssl/cl-plus-ssl.git";
   rev = "29081992f6d7b4e3aa2c5eeece4cd92b745071f4";
+  hash = "sha256:16lyrixl98b7vy29dbbzkbq0xaz789350dajrr1gdny5i55rkjq0";
 };
 in buildLisp.library {
   name = "cl-plus-ssl";