{
  lib,
  namespace,
  nodejs,
  stdenv,
  pkgs,
}:
let
  inherit (lib.trivial) importJSON;
  inherit (lib.${namespace}) mkAllSources selectVariant;
  inherit lib;

  versionSpec = importJSON ./version.json;
  selected = selectVariant versionSpec null null;
  sources = mkAllSources pkgs selected;
  inherit (selected.variables) version;
in
stdenv.mkDerivation {
  pname = "cockpit-podman";
  inherit version;

  inherit (sources) src nodeModules;

  # pkg/lib checked out from the main cockpit repo at the commit pinned in
  # the Makefile (COCKPIT_REPO_COMMIT).
  inherit (sources) cockpitLib;

  nativeBuildInputs = [ nodejs ];

  # passthru.cockpitPath is used by the NixOS cockpit module to add runtime
  # dependencies to the cockpit service's PATH.
  passthru.cockpitPath = [ ];

  configurePhase = ''
    runHook preConfigure

    # Replace the empty git submodule placeholder with the real vendored modules.
    # Use dotglob so hidden entries (.bin, .package-lock.json, etc.) are included.
    rm -rf node_modules
    mkdir node_modules
    (shopt -s dotglob; cp -r $nodeModules/* node_modules/)
    chmod -R u+w node_modules

    # Node needs package-lock.json at the project root to resolve modules.
    cp node_modules/.package-lock.json package-lock.json

    # Wire up pkg/lib from the pinned cockpit repo.
    mkdir -p pkg
    cp -r $cockpitLib/pkg/lib pkg/lib
    chmod -R u+w pkg

    runHook postConfigure
  '';

  buildPhase = ''
    runHook preBuild

    NODE_ENV=production node build.js

    runHook postBuild
  '';

  installPhase = ''
    runHook preInstall

    mkdir -p $out/share/cockpit/podman
    cp -r dist/* $out/share/cockpit/podman/

    runHook postInstall
  '';

  meta = {
    description = "Cockpit UI for Podman containers";
    homepage = "https://github.com/cockpit-project/cockpit-podman";
    changelog = "https://github.com/cockpit-project/cockpit-podman/releases/tag/${version}";
    license = lib.licenses.lgpl21Plus;
    platforms = lib.platforms.linux;
    maintainers = [ ];
  };
}