{
  fetchFromGitHub,
  lib,
  nodejs,
  stdenv,
}:

stdenv.mkDerivation (finalAttrs: {
  pname = "cockpit-podman";
  version = "123";

  src = fetchFromGitHub {
    owner = "cockpit-project";
    repo = "cockpit-podman";
    tag = finalAttrs.version;
    hash = "sha256-N5nhJU9XUsxLWq3mk3bSyorHEM4zSLHt9I+zkdgU2Vk=";
  };

  # Pre-vendored node_modules from cockpit-project/node-cache, pinned via the
  # node_modules submodule reference in the source tree.
  nodeModules = fetchFromGitHub {
    owner = "cockpit-project";
    repo = "node-cache";
    rev = "e39ef3621b5aefa5bf1c2de7e66a5918fcef620c";
    hash = "sha256-+yhHsGEN1IqIxPY7vQysp1ZczcHzXRoNIVN3DyVgwB8=";
  };

  # pkg/lib is checked out from the main cockpit repo at the pinned commit
  # referenced in the Makefile (COCKPIT_REPO_COMMIT).
  cockpitLib = fetchFromGitHub {
    owner = "cockpit-project";
    repo = "cockpit";
    rev = "5fb84eaefbc5ff4433a21bc452270af8d09e1ab7";
    hash = "sha256-FR6TIKQ+3GuDMOMEivDxEx6E/SVIAXh9Cg36JJ694Wc=";
  };

  nativeBuildInputs = [ nodejs ];

  # cockpit-podman uses passthru.cockpitPath for the NixOS cockpit module to
  # add runtime dependencies to the cockpit service's PATH.
  passthru.cockpitPath = [ ];

  configurePhase = ''
    runHook preConfigure

    # Wire up the vendored node_modules
    cp -r ${finalAttrs.nodeModules} node_modules
    chmod -R u+w node_modules

    # Wire up pkg/lib from the pinned cockpit repo
    mkdir -p pkg
    cp -r ${finalAttrs.cockpitLib}/pkg/lib pkg/lib
    chmod -R u+w pkg

    runHook postConfigure
  '';

  buildPhase = ''
    runHook preBuild

    NODE_ENV=production node build.js

    runHook postBuild
  '';

  installPhase = ''
    runHook preInstall

    mkdir -p $out/share/cockpit/podman
    cp -r dist/* $out/share/cockpit/podman/

    runHook postInstall
  '';

  meta = {
    description = "Cockpit UI for Podman containers";
    homepage = "https://github.com/cockpit-project/cockpit-podman";
    changelog = "https://github.com/cockpit-project/cockpit-podman/releases/tag/${finalAttrs.version}";
    license = lib.licenses.lgpl21Plus;
    platforms = lib.platforms.linux;
    maintainers = [ ];
  };
})