diff --git a/.github/workflows/update-nix-pnpm-deps-hash.yaml b/.github/workflows/update-nix-pnpm-deps-hash.yaml
new file mode 100644
index 000000000..25b21992a
--- /dev/null
+++ b/.github/workflows/update-nix-pnpm-deps-hash.yaml
@@ -0,0 +1,30 @@
+name: Update Nix pnpmDeps Hash
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+    paths:
+      - 'pnpm-lock.yaml'
+
+permissions:
+  contents: write
+
+jobs:
+  update:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: cachix/install-nix-action@v31
+        with:
+          extra_nix_config: experimental-features = nix-command flakes
+
+      - name: Update Hash
+        run: nix/update-pnpm-deps-hash.sh
+
+      - uses: stefanzweifel/git-auto-commit-action@v6
+        with:
+          commit_message: 'chore(nix): update pnpmDeps hash'
+          commit_author: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
diff --git a/flake.nix b/flake.nix
index 5ff75c2e4..5513ff9e8 100644
--- a/flake.nix
+++ b/flake.nix
@@ -23,14 +23,14 @@
 
       packages = forAllSystems (system: {
         default = self.packages.${system}.airi;
-        airi = (pkgsForSystem system).callPackage ./package.nix { };
-        airi-debug = (pkgsForSystem system).callPackage ./package.nix { debugBuild = true; };
+        airi = (pkgsForSystem system).callPackage ./nix/package.nix { };
+        airi-debug = (pkgsForSystem system).callPackage ./nix/package.nix { debugBuild = true; };
       });
 
       overlays = {
         default = self.overlays.airi;
         airi = final: _: {
-          airi = final.callPackage ./package.nix { };
+          airi = final.callPackage ./nix/package.nix { };
         };
       };
 
diff --git a/package.nix b/nix/package.nix
similarity index 96%
rename from package.nix
rename to nix/package.nix
index 475ff02cd..4b0f4d21a 100644
--- a/package.nix
+++ b/nix/package.nix
@@ -29,17 +29,17 @@ rustPlatform.buildRustPackage (final: {
   pname = "airi";
   version = "0.7.2-beta.2";
 
-  src = ./.;
+  src = ../.;
 
   cargoLock = {
-    lockFile = ./Cargo.lock;
+    lockFile = ../Cargo.lock;
     outputHashes."rdev-0.6.0" = "sha256-mGt44/kVo5EJO1Wf6MPLq0sZgwGTzuQjeVT6HxVzpQY=";
   };
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (final) pname version src;
     fetcherVersion = 1;
-    hash = "sha256-y28rG+9NADUdwdjIAkYCqmYOKLoEWosAOpiGM4JPQoQ="; # To update, set it to ""
+    hash = builtins.readFile ./pnpm-deps-hash.txt;
   };
 
   # Cache of assets downloaded during vite build
diff --git a/nix/pnpm-deps-hash.txt b/nix/pnpm-deps-hash.txt
new file mode 100644
index 000000000..6147168ad
--- /dev/null
+++ b/nix/pnpm-deps-hash.txt
@@ -0,0 +1 @@
+sha256-NOtKBXFu/eIVcCNjsizlF3t/6f+izx3cRdU7HbjW0cM=
\ No newline at end of file
diff --git a/nix/update-pnpm-deps-hash.sh b/nix/update-pnpm-deps-hash.sh
new file mode 100755
index 000000000..73c24986a
--- /dev/null
+++ b/nix/update-pnpm-deps-hash.sh
@@ -0,0 +1,9 @@
+#! /usr/bin/env bash
+
+set -eux
+
+ROOT="$(dirname "$(readlink -f "$0")")"
+
+:> "$ROOT/pnpm-deps-hash.txt" # Clear hash
+HASH=$(nix build "$ROOT/..#airi.pnpmDeps" |& grep -oP 'got: +\K\S+')
+echo -n $HASH > "$ROOT/pnpm-deps-hash.txt"