diff --git a/.github/workflows/update-vendor-hash.yml b/.github/workflows/update-vendor-hash.yml
index d42b7fec9..6c7f137a8 100644
--- a/.github/workflows/update-vendor-hash.yml
+++ b/.github/workflows/update-vendor-hash.yml
@@ -33,21 +33,7 @@ jobs:
         uses: cachix/install-nix-action@v31
 
       - name: Update vendorHash in flake.nix
-        run: |
-          set -euo pipefail
-          echo "Attempting nix build to get new vendorHash..."
-          if output=$(nix build .#dms-shell 2>&1); then
-            echo "Build succeeded, no hash update needed"
-            exit 0
-          fi
-          new_hash=$(echo "$output" | grep -oP "got:\s+\K\S+" | head -n1 || true)
-          [ -n "$new_hash" ] || { echo "Could not extract new vendorHash"; echo "$output"; exit 1; }
-          current_hash=$(grep -oP 'vendorHash = "\K[^"]+' flake.nix)
-          [ "$current_hash" = "$new_hash" ] && { echo "vendorHash already up to date"; exit 0; }
-          sed -i "s|vendorHash = \"$current_hash\"|vendorHash = \"$new_hash\"|" flake.nix
-          echo "Verifying build with new vendorHash..."
-          nix build .#dms-shell
-          echo "vendorHash updated successfully!"
+        run: scripts/update-vendor-hash.sh
 
       - name: Commit and push vendorHash update
         env:
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index af315d178..04886e5d2 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -30,6 +30,12 @@ repos:
         language: system
         files: ^core/.*\.(go|mod|sum)$
         pass_filenames: false
+      - id: nix-vendor-hash
+        name: update Nix vendor hash
+        entry: bash -c 'command -v nix >/dev/null 2>&1 || exit 0; scripts/update-vendor-hash.sh --stage'
+        language: system
+        files: ^core/go\.(mod|sum)$
+        pass_filenames: false
   - repo: local
     hooks:
       - id: settings-search-index
diff --git a/flake.nix b/flake.nix
index 32e722cc8..72233cb2e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -275,7 +275,7 @@
                 nil
               ]
               ++ devQmlPkgs
-              ++ pkgs.lib.optionals pkgs.stdenv.isLinux [ niriForTests pkgs.xvfb pkgs.dbus ];
+              ++ pkgs.lib.optionals pkgs.stdenv.hostPlatform.isLinux [ niriForTests pkgs.xvfb pkgs.dbus ];
 
             shellHook = ''
               touch quickshell/.qmlls.ini 2>/dev/null
diff --git a/scripts/update-vendor-hash.sh b/scripts/update-vendor-hash.sh
new file mode 100755
index 000000000..a5d6ee015
--- /dev/null
+++ b/scripts/update-vendor-hash.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+command -v nix >/dev/null 2>&1 || { printf '%s\n' "nix is required to update the vendorHash" >&2; exit 1; }
+
+if output=$(nix build --no-link .#dms-shell.goModules 2>&1); then
+    exit 0
+fi
+
+new_hash=$(grep -m1 -oP 'got:\s+\K\S+' <<<"$output" || true)
+[ -n "$new_hash" ] || { printf '%s\n' "Could not extract new vendorHash" >&2; printf '%s\n' "$output" >&2; exit 1; }
+
+current_hash=$(grep -m1 -oP 'vendorHash = "\K[^"]+' flake.nix)
+[ "$current_hash" = "$new_hash" ] && exit 0
+
+sed -i "s|vendorHash = \"$current_hash\"|vendorHash = \"$new_hash\"|" flake.nix
+if [ "${1:-}" = "--stage" ]; then
+    git add flake.nix
+fi
+nix build --no-link .#dms-shell.goModules