diff --git a/containers/shower/default.nix b/containers/shower/default.nix
index fa1f07f..dff5269 100644
--- a/containers/shower/default.nix
+++ b/containers/shower/default.nix
@@ -105,8 +105,9 @@ let
 
     outputHashMode = "recursive";
     outputHashAlgo = "sha256";
-    # Computed by setting to pkgs.lib.fakeHash and reading the failure.
-    outputHash = pkgs.lib.fakeHash;
+    # Pinned dep closure — reproducible until version bumps. To recompute,
+    # set to pkgs.lib.fakeHash and read the failure.
+    outputHash = "sha256-DQIzHm7b4f1SHDU/KiclS6yZmF/GlizaeH8CM1Hg59s=";
 
     dontFixup = true;
   };