diff --git a/ops/maint/update_nixpkgs/default.nix b/ops/maint/update_nixpkgs/default.nix
index e09c3cdf98..359b1d9af2 100644
--- a/ops/maint/update_nixpkgs/default.nix
+++ b/ops/maint/update_nixpkgs/default.nix
@@ -1,9 +1,7 @@
 { depot, lib, ... }:
 let
   inherit (depot) pkgs;
-  mercurial = (pkgs.mercurial.overridePythonAttrs (origAttrs: {
-    propagatedBuildInputs = [pkgs.python3Packages.hg-evolve];
-  }));
+  inherit (depot.nix.pkgs) mercurial;
   updateNixpkgs = pkgs.runCommand "update_nixpkgs" {
     buildInputs = with pkgs; [ makeWrapper ];
   } ''
@@ -25,9 +23,11 @@ pkgs.dockerTools.buildImage {
     ];
   };
 
-  contents = [
-    pkgs.cacert updateNixpkgs
-    (pkgs.runCommand "update_nixpkgs_content" {} ''
+  copyToRoot = pkgs.buildEnv {
+    name = "update_nixpkgs-root";
+    paths = [
+      pkgs.cacert updateNixpkgs
+      (pkgs.runCommand "update_nixpkgs_content" {} ''
   mkdir $out $out/root $out/root/.ssh $out/etc $out/tmp
   chmod 700 $out/root $out/root/.ssh
   chmod 1777 $out/tmp
@@ -56,6 +56,7 @@ topic =
 purge =
 share =
 EOF
-    '')
-  ];
+      '')
+    ];
+  };
 }
diff --git a/ops/nixos/bvm-heptapod/default.nix b/ops/nixos/bvm-heptapod/default.nix
index d9818c0a5b..f1b4401f65 100644
--- a/ops/nixos/bvm-heptapod/default.nix
+++ b/ops/nixos/bvm-heptapod/default.nix
@@ -5,6 +5,7 @@
 { config, depot, lib, pkgs, ... }:
 let
   inherit (depot.ops) secrets;
+  systemConfig = config;
 in {
   imports = [
     ../lib/bvm.nix
@@ -182,6 +183,7 @@ in {
         vim rxvt-unicode-unwrapped.terminfo kitty.terminfo rsync jq
         depot.nix.pkgs.heptapod-runner-mercurial
       ];
+      system.stateVersion = systemConfig.system.stateVersion;
     };
   };
 
diff --git a/py/icalfilter/default.nix b/py/icalfilter/default.nix
index e5f09b09d9..b65f41c097 100644
--- a/py/icalfilter/default.nix
+++ b/py/icalfilter/default.nix
@@ -12,6 +12,7 @@ let
     propagatedBuildInputs = with ps; [
       zope_interface
       pytz
+      setuptools
     ];
 
     src = pkgs.fetchFromGitHub {
diff --git a/third_party/default.nix b/third_party/default.nix
index 0d46d1c8cf..b672b8b3a8 100644
--- a/third_party/default.nix
+++ b/third_party/default.nix
@@ -62,7 +62,10 @@ rec {
         in origOut // {
           dockerImage = nixpkgs.dockerTools.buildImage {
             name = args.name;
-            contents = dockerData;
+            copyToRoot = nixpkgs.buildEnv {
+              name = "${args.name}-env";
+              paths = dockerData;
+            };
             config = {
               Entrypoint = [ "${origOut}/bin/${args.name}" ];
               Env = [