diff --git a/nix/pkgs/cabinet.nix b/nix/pkgs/cabinet.nix
index f5ca3a8..24c9086 100644
--- a/nix/pkgs/cabinet.nix
+++ b/nix/pkgs/cabinet.nix
@@ -14,8 +14,9 @@
 , autoPatchelfHook
 , electron
 , pnpm_9
+, fetchPnpmDeps
+, pnpmConfigHook
 , nodejs_22
-, cacert
 , alsa-lib
 , at-spi2-atk
 , at-spi2-core
@@ -51,9 +52,6 @@
 }:
 
 let
-  pname = "rcade-cabinet";
-  version = "0.2.1";
-
   runtimeLibs = [
     alsa-lib
     at-spi2-atk
@@ -88,6 +86,11 @@ let
     libxshmfence
   ];
 
+in
+stdenv.mkDerivation rec {
+  pname = "rcade-cabinet";
+  version = "0.2.1";
+
   src = lib.cleanSourceWith {
     src = ../..;
     filter = path: type:
@@ -109,79 +112,12 @@ let
       );
   };
 
-  # Only package.json + pnpm-lock.yaml so code changes don't invalidate the FOD hash.
-  depsSrc = lib.cleanSourceWith {
-    src = ../..;
-    filter = path: type:
-      let
-        baseName = baseNameOf path;
-      in
-        if type == "directory" then
-          !(
-            baseName == "node_modules" ||
-            baseName == ".git" ||
-            baseName == "dist" ||
-            baseName == "release" ||
-            baseName == ".turbo" ||
-            baseName == ".svelte-kit" ||
-            baseName == ".vite" ||
-            baseName == ".claude" ||
-            lib.hasPrefix "result" baseName
-          )
-        else
-          baseName == "package.json" ||
-          baseName == "pnpm-lock.yaml" ||
-          baseName == "pnpm-workspace.yaml" ||
-          baseName == ".npmrc";
-  };
-
-  pnpmModulesHash = "sha256-wweW+AAp8i9oJ2EjgTi10K9LQRrAPNvBiMObQWSooa8=";
-
-  # FOD that fetches node_modules with network access and outputs a tarball.
-  pnpmModules = stdenv.mkDerivation {
-    name = "rcade-pnpm-modules.tar.gz";
-    src = depsSrc;
-
-    nativeBuildInputs = [ nodejs_22 pnpm_9 cacert ];
-
-    outputHashAlgo = "sha256";
-    outputHashMode = "flat";
-    outputHash = pnpmModulesHash;
-
-    # Prevent patchShebangs from adding store-path references to the FOD output.
-    dontFixup = true;
-
-    buildPhase = ''
-      export HOME=$(mktemp -d)
-      export SSL_CERT_FILE="${cacert}/etc/ssl/certs/ca-bundle.crt"
-      pnpm install --frozen-lockfile --ignore-scripts
-    '';
-
-    installPhase = ''
-      # Remove workspace symlinks (point to source dirs, invalid after extraction).
-      find . -name 'node_modules' -type d -prune | while read -r nm_dir; do
-        find "$nm_dir" -type l | while read -r link; do
-          target=$(readlink "$link")
-          case "$target" in
-            ../../*node_modules*) ;;
-            ../../*) rm "$link" ;;
-          esac
-        done
-      done
-
-      tar czf $out $(find . -name 'node_modules' -type d -prune | sort)
-    '';
-  };
-
-in
-stdenv.mkDerivation {
-  inherit pname version src;
-
   nativeBuildInputs = [
     makeWrapper
     autoPatchelfHook
     pnpm_9
     nodejs_22
+    pnpmConfigHook
   ];
 
   buildInputs = [
@@ -191,32 +127,20 @@ stdenv.mkDerivation {
     stdenv.cc.cc  # libstdc++
   ];
 
+  pnpmDeps = fetchPnpmDeps {
+    inherit
+      pname
+      version
+      src
+      ;
+    pnpm = pnpm_9;
+    fetcherVersion = 1;
+    hash = "sha256-U7UhUkuMQQSNeFlJkuL15aQmwvjQRj1PJmTgXgO8AGA=";
+  };
+
   buildPhase = ''
     runHook preBuild
 
-    export HOME=$(mktemp -d)
-
-    tar xzf ${pnpmModules}
-
-    # FOD skips patchShebangs (dontFixup), so we patch here instead.
-    patchShebangs node_modules
-    find . -mindepth 2 -maxdepth 4 -name 'node_modules' -type d | while read -r nm; do
-      patchShebangs "$nm"
-    done
-
-    # Recreate workspace symlinks removed from the FOD.
-    # Parse workspace dirs from pnpm-workspace.yaml (simple "  - dir" format)
-    workspaces=$(grep '^ *- ' pnpm-workspace.yaml | sed 's/^ *- //')
-    for ws_dir in $workspaces; do
-      if [ -f "$ws_dir/package.json" ]; then
-        pkg_name=$(${nodejs_22}/bin/node -p "require('./$ws_dir/package.json').name" 2>/dev/null || true)
-        if [ -n "$pkg_name" ]; then
-          mkdir -p "node_modules/$(dirname "$pkg_name")"
-          ln -sfn "$PWD/$ws_dir" "node_modules/$pkg_name"
-        fi
-      fi
-    done
-
     node_modules/.bin/turbo build --filter="@rcade/api" --filter="@rcade/input-classic" --filter="@rcade/input-spinners" --filter="@rcade/sleep" --filter="@rcade/plugin-sleep" --filter="@rcade/plugin-menu-backend" --filter="@rcade/sdk" --filter="@rcade/sdk-plugin"
 
     cd cabinet