diff --git a/nix/npm-deps.hash b/nix/npm-deps.hash
index fa226671e4..6169c4b9dc 100644
--- a/nix/npm-deps.hash
+++ b/nix/npm-deps.hash
@@ -1 +1 @@
-sha256-o+VzG7lK0qpyUXF4F5Hk08ooW5CPoZSsOG7DyIReUKQ=
+sha256-RBD8SQx4szE41qGDIYcaKWVhzfC1kVUBC7M5OOQBQQY=
diff --git a/packages/app/src/hooks/use-paseo-agent-providers.ts b/packages/app/src/hooks/use-paseo-agent-providers.ts
index 730585bc8a..85ffbb9247 100644
--- a/packages/app/src/hooks/use-paseo-agent-providers.ts
+++ b/packages/app/src/hooks/use-paseo-agent-providers.ts
@@ -1,5 +1,6 @@
 import { useCallback, useMemo } from "react";
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
+import { useTranslation } from "react-i18next";
 import type {
   PaseoAgentSetProviderRequest,
   RedactedPaseoAgentProviderConfig,
@@ -33,9 +34,12 @@ interface UsePaseoAgentProvidersResult {
 }
 
 export function usePaseoAgentProviders(serverId: string | null): UsePaseoAgentProvidersResult {
+  const { t } = useTranslation();
   const queryClient = useQueryClient();
   const client = useHostRuntimeClient(serverId ?? "");
   const isConnected = useHostRuntimeIsConnected(serverId ?? "");
+  const hostDisconnectedMessage = t("workspace.terminal.hostDisconnected");
+  const saveProviderFailedMessage = t("settings.host.providers.addErrorTitle");
   // COMPAT(paseoAgentConfig): added in v0.1.85, remove gate after 2026-11-30.
   const supported = useSessionStore(
     (state) => state.sessions[serverId ?? ""]?.serverInfo?.features?.paseoAgentConfig === true,
@@ -48,7 +52,7 @@ export function usePaseoAgentProviders(serverId: string | null): UsePaseoAgentPr
     staleTime: 30_000,
     queryFn: async () => {
       if (!client) {
-        throw new Error("Host is not connected");
+        throw new Error(hostDisconnectedMessage);
       }
       return client.getPaseoAgentProviders();
     },
@@ -63,11 +67,11 @@ export function usePaseoAgentProviders(serverId: string | null): UsePaseoAgentPr
   const setProviderMutation = useMutation({
     mutationFn: async (input: PaseoAgentSetProviderInput) => {
       if (!client) {
-        throw new Error("Host is not connected");
+        throw new Error(hostDisconnectedMessage);
       }
       const result = await client.setPaseoAgentProvider(input);
       if (!result.success) {
-        throw new Error(result.error ?? "Failed to save provider");
+        throw new Error(result.error ?? saveProviderFailedMessage);
       }
       return result.provider;
     },
diff --git a/scripts/update-nix.sh b/scripts/update-nix.sh
index b33cd4f99a..70f0257baf 100755
--- a/scripts/update-nix.sh
+++ b/scripts/update-nix.sh
@@ -25,18 +25,26 @@ node "$SCRIPT_DIR/fix-lockfile.mjs" "$LOCK_FILE"
 # 2. Prefetch deps and compute hash
 echo "Prefetching npm dependencies..."
 
-# Resolve prefetch-npm-deps from the same nixpkgs pinned in flake.lock
-NIXPKGS_URL="$(node -p "
-  const l = JSON.parse(require('fs').readFileSync('$ROOT_DIR/flake.lock', 'utf8'));
-  const n = l.nodes.nixpkgs.locked;
-  'github:' + n.owner + '/' + n.repo + '/' + n.rev;
-")"
-
 STDERR_LOG="$(mktemp)"
 trap "rm -f '$STDERR_LOG'" EXIT
 
-if ! NEW_HASH="$(NIX_NPM_FETCHER_VERSION=2 nix shell "${NIXPKGS_URL}#prefetch-npm-deps" -c prefetch-npm-deps "$LOCK_FILE" 2>"$STDERR_LOG")"; then
-  echo "ERROR: prefetch-npm-deps failed:" >&2
+HASH_EXPR="
+let
+  flake = builtins.getFlake \"path:$ROOT_DIR\";
+  system = builtins.currentSystem;
+  fakeHash = \"sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=\";
+in
+  (flake.packages.\${system}.default.override { npmDepsHash = fakeHash; }).npmDeps
+"
+
+if nix build --no-link --impure --expr "$HASH_EXPR" >/dev/null 2>"$STDERR_LOG"; then
+  echo "ERROR: fake npmDepsHash unexpectedly succeeded." >&2
+  exit 1
+fi
+
+NEW_HASH="$(sed -n 's/.*got:[[:space:]]*\(sha256-[^[:space:]]*\).*/\1/p' "$STDERR_LOG" | tail -1)"
+if [[ -z "$NEW_HASH" ]]; then
+  echo "ERROR: failed to compute npmDepsHash:" >&2
   tail -20 "$STDERR_LOG" >&2
   exit 1
 fi