diff --git a/third_party/nixpkgs/copy.bara.sky b/third_party/nixpkgs/copy.bara.sky
index b3c475115e..d105fe6e3c 100644
--- a/third_party/nixpkgs/copy.bara.sky
+++ b/third_party/nixpkgs/copy.bara.sky
@@ -2,7 +2,7 @@ core.workflow(
     name = "default",
     origin = git.github_origin(
         url = "https://github.com/NixOS/nixpkgs.git",
-        ref = "master",
+        ref = "nixos-unstable",
     ),
     destination = hg.destination(
         url = "file:///home/lukegb/depot",
@@ -12,6 +12,9 @@ core.workflow(
     destination_files = glob(["third_party/nixpkgs/**"], exclude = ["third_party/nixpkgs/copy.bara.sky"]),
     authoring = authoring.pass_thru("Default email <noreply+nixpkgs@lukegb.com>"),
     transformations = [
+        patch.apply(patches = [
+            "patches/0001-buildBazelPackage-fetchConfigured.patch",
+        ]),
         core.move("", "third_party/nixpkgs"),
     ],
 )
diff --git a/third_party/nixpkgs/patches/0001-buildBazelPackage-fetchConfigured.patch b/third_party/nixpkgs/patches/0001-buildBazelPackage-fetchConfigured.patch
new file mode 100644
index 0000000000..320c71667f
--- /dev/null
+++ b/third_party/nixpkgs/patches/0001-buildBazelPackage-fetchConfigured.patch
@@ -0,0 +1,43 @@
+# HG changeset patch
+# User Luke Granger-Brown <hg@lukegb.com>
+# Date 1589643462 -3600
+#      Sat May 16 16:37:42 2020 +0100
+# Node ID 97b0de0407d168dd225c6642cdb73fb7bc13546a
+# Parent  18763eabcdc1624fd96ce7245bc141f9ef4fd81c
+third_party/nixpkgs: buildBazelPackage: add "fetchConfigured", and allow removing things that sometimes don't exist
+
+diff --git a/pkgs/build-support/build-bazel-package/default.nix b/pkgs/build-support/build-bazel-package/default.nix
+--- a/pkgs/build-support/build-bazel-package/default.nix
++++ b/pkgs/build-support/build-bazel-package/default.nix
+@@ -30,6 +30,13 @@ args@{
+ , removeRulesCC ? true
+ , removeLocalConfigCc ? true
+ , removeLocal ? true
++
++# Use build --nobuild instead of fetch. This allows fetching the dependencies
++# required for the build as configured, rather than fetching all the dependencies
++# which may not work in some situations (e.g. Java code which ends up relying on
++# Debian-specific /usr/share/java paths, but doesn't in the configured build).
++, fetchConfigured ? true
++
+ , ...
+ }:
+ 
+@@ -77,7 +84,7 @@ in stdenv.mkDerivation (fBuildAttrs // {
+       bazel \
+         --output_base="$bazelOut" \
+         --output_user_root="$bazelUserRoot" \
+-        fetch \
++        ${if fetchConfigured then "build --nobuild" else "fetch"} \
+         --loading_phase_threads=1 \
+         $bazelFlags \
+         $bazelFetchFlags \
+@@ -110,7 +117,7 @@ in stdenv.mkDerivation (fBuildAttrs // {
+       # platforms -> NIX_BUILD_TOP/tmp/install/35282f5123611afa742331368e9ae529/_embedded_binaries/platforms
+       find $bazelOut/external -maxdepth 1 -type l | while read symlink; do
+         name="$(basename "$symlink")"
+-        rm "$symlink" "$bazelOut/external/@$name.marker"
++        rm -f "$symlink" "$bazelOut/external/@$name.marker"
+       done
+ 
+       # Patching symlinks to remove build directory reference