diff --git a/flake.lock b/flake.lock
index 522531da1..d8d3ee611 100644
--- a/flake.lock
+++ b/flake.lock
@@ -66,11 +66,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1705309234,
-        "narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=",
+        "lastModified": 1701680307,
+        "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26",
+        "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
         "type": "github"
       },
       "original": {
@@ -84,12 +84,8 @@
         "advisory-db": "advisory-db",
         "crane": "crane",
         "fenix": "fenix",
-        "flake-utils": [
-          "flake-utils"
-        ],
-        "nixpkgs": [
-          "nixpkgs"
-        ]
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs"
       },
       "locked": {
         "lastModified": 1706704813,
@@ -109,11 +105,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1706847119,
-        "narHash": "sha256-63LtYmH7s9QrBPWClgn0l70PsIQ8Rm46tC8DCp6D6fA=",
+        "lastModified": 1701961404,
+        "narHash": "sha256-ieWHyh6kJtabQYUam/dXXi22MgcgLQvl+f2x/95n+us=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "c3e9c0b5f8242f8d2a52136f58ec663c4d5d4b26",
+        "rev": "8fef9eee026f0d95c06b5880ef9c1af0f643aadf",
         "type": "github"
       },
       "original": {
@@ -125,9 +121,15 @@
     },
     "root": {
       "inputs": {
-        "flake-utils": "flake-utils",
+        "flake-utils": [
+          "heartwood",
+          "flake-utils"
+        ],
         "heartwood": "heartwood",
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": [
+          "heartwood",
+          "nixpkgs"
+        ]
       }
     },
     "systems": {
diff --git a/flake.nix b/flake.nix
index b49843051..20e8078c5 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1,11 +1,9 @@
 {
   description = "Radicle web frontend";
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/release-23.11";
-    flake-utils.url = "github:numtide/flake-utils";
+    nixpkgs.follows = "heartwood/nixpkgs";
+    flake-utils.follows = "heartwood/flake-utils";
     heartwood = {
-      inputs.flake-utils.follows = "flake-utils";
-      inputs.nixpkgs.follows = "nixpkgs";
       url = "git+https://seed.radicle.xyz/z3gqcJUoA1n9HaHKufZs5FCSGazv5.git?ref=master&rev=15d17098315469bb180157d1c20344faa10f4f73";
     };
   };
@@ -75,7 +73,7 @@
           pname = "radicle-interface";
           version = "1.0.0";
           src = ./.;
-          npmDepsHash = "sha256-WBX+S67Y7SnXLfc202eNxM355Q0nTH4G7fMY5eEDIio=";
+          npmDepsHash = "sha256-QHDQO37EnXpIdHlkHvkojvYJxy9jG4HGQ6KHbVdch0s=";
           postPatch = ''
             patchShebangs --build ./scripts
             mkdir -p "public/twemoji"
diff --git a/scripts/update-flake b/scripts/update-flake
new file mode 100755
index 000000000..65acbb172
--- /dev/null
+++ b/scripts/update-flake
@@ -0,0 +1,75 @@
+#!/bin/sh
+
+set -e
+
+usage() {
+    printf \
+        'Update flake and heartwood-version to the requested heartwood version.
+When called without arguments, reads HASH from tests/support/hearwood-version.
+
+USAGE:
+  update-flake [-h] [PATH|HASH]
+
+OPTIONS:
+  PATH\t\tPath to heartwood git repo; uses current HEAD.
+  HASH\t\tUpdate heartwood version to HASH.
+  -h --help\tPrint this help.\n'
+}
+
+while [ $# -ne 0 ]; do
+    case $1 in
+        --help | -h)
+            usage >&2
+            exit
+            ;;
+        */*)
+            hash=$(git -C "$1" rev-parse --verify HEAD)
+            shift
+            ;;
+        *)
+            hash=$1
+            shift
+            ;;
+    esac
+done
+
+# Heartwood repo id
+rid=z3gqcJUoA1n9HaHKufZs5FCSGazv5
+
+# Some root detection guess work...
+root=$(git rev-parse --show-toplevel 2>/dev/null || echo "$PWD")
+if [ ! -e "$root/tests/support/heartwood-version" ]; then
+    root=$(cd .. ; pwd)
+fi
+
+if [ -z "$hash" ]; then
+    # No hash given, take from heartwood-version
+    if [ -e "$root/tests/support/heartwood-version" ]; then
+        hash=$(cat "$root/tests/support/heartwood-version")
+        [ -n "$hash" ] || {
+            printf "Error reading heartwood-version\n" >&2
+            exit 1
+        }
+    fi
+else
+    printf '%s\n' "$hash" >$root/tests/support/heartwood-version
+fi
+
+if [ -e "$root/flake.nix" ]; then
+    sed -E -e '/url.*git\+https.*'"$rid"'/s/(rev=)[0-9a-f]{40,40}/\1'"$hash"'/' "$root/flake.nix" >$root/flake.nix.tmp
+    mv "$root/flake.nix.tmp" "$root/flake.nix"
+
+    # If running on a nix-enabled system, also update npmDepsHash.
+    if type nix >/dev/null 2>&1; then
+        npmDepsHash=$(nix --experimental-features 'nix-command flakes' \
+            run --inputs-from "$root" nixpkgs#prefetch-npm-deps \
+            -- "$root/package-lock.json")
+        sed -E -e '/npmDepsHash/s/".*"/"'"$npmDepsHash"'"/' "$root/flake.nix" >$root/flake.nix.tmp
+        mv "$root/flake.nix.tmp" "$root/flake.nix"
+
+        nix --experimental-features 'nix-command flakes' flake update "$root"
+    else
+        printf >&2 'Node dependencies may be out of date!
+Re-run on a nix-enabled system to update npmDepsHash.\n'
+    fi
+fi