diff --git a/flake.nix b/flake.nix
index 90e7162..12dec4d 100644
--- a/flake.nix
+++ b/flake.nix
@@ -28,30 +28,35 @@
             targets = [ "wasm32-unknown-unknown" ];
           }
         );
+        rustPlatform = pkgs.makeRustPlatform {
+          cargo = rustToolchain;
+          rustc = rustToolchain;
+        };
 
-        # Stage 1: Build the WASM crate (FOD — network allowed, output content-addressed)
-        cgol-wasm = pkgs.stdenv.mkDerivation {
+        cgol-wasm = rustPlatform.buildRustPackage {
           pname = "cgol-wasm";
           version = "0.1.0";
           src = ./cgol;
+          cargoLock.lockFile = ./cgol/Cargo.lock;
+          doCheck = false;
 
           nativeBuildInputs = [
-            rustToolchain
-            pkgs.wasm-pack
+            pkgs.wasm-bindgen-cli
             pkgs.binaryen
-            pkgs.cacert
           ];
 
           buildPhase = ''
-            export HOME=$TMPDIR
-            export SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
-            wasm-pack build --release --target web
+            runHook preBuild
+            cargo build --release --frozen --target wasm32-unknown-unknown
+            wasm-bindgen --target web --out-dir pkg target/wasm32-unknown-unknown/release/cgol.wasm
             wasm-opt pkg/cgol_bg.wasm -o pkg/cgol_bg.wasm -O4 \
               --enable-bulk-memory --enable-nontrapping-float-to-int \
               --enable-sign-ext --low-memory-unused --converge
+            runHook postBuild
           '';
 
           installPhase = ''
+            runHook preInstall
             mkdir -p $out
             cp pkg/cgol_bg.wasm $out/
             cp pkg/cgol.js $out/
@@ -68,11 +73,8 @@
               "sideEffects": ["./snippets/*"]
             }
             EOF
+            runHook postInstall
           '';
-
-          outputHashAlgo = "sha256";
-          outputHashMode = "recursive";
-          outputHash = "sha256-5Wiyqr9+3lAwelQAGe4VwTkFhEqhXytO0G6hdAIbil0=";
         };
 
         # Stage 2: Build the website with npm
@@ -80,7 +82,7 @@
           pname = "jet-website";
           version = "0.1.0";
           src = pkgs.lib.cleanSource ./.;
-          npmDepsHash = "sha256-hAPfXGje+8pjMRZ5KZKcbu+TgZ9uy+dbYIFVrNQsItg=";
+          npmDepsHash = "sha256-O4ZUSYyVWOxP15saIadsaZuRO47Y0AvsL4pwvo5b76U=";
 
           # Inject the Nix-built WASM before npm install resolves file: dep
           postPatch = ''