{prev}: {
  # n8n advances quickly. Keep using nixpkgs' package expression and only override
  # the release-specific fetch hashes when we need a newer stable than upstream.
  n8n = prev.n8n.overrideAttrs (finalAttrs: previousAttrs: {
    version = "2.29.4";

    src = prev.fetchFromGitHub {
      owner = "n8n-io";
      repo = "n8n";
      tag = "n8n@${finalAttrs.version}";
      hash = "sha256-Vc10fXKn21PSlv6Sk+5zyi2efkKup1Vi+9+vyJd2I1k=";
    };

    pnpmDeps = prev.fetchPnpmDeps {
      inherit (finalAttrs) pname version src;
      pnpm = prev.pnpm_10;
      fetcherVersion = 3;
      hash = "sha256-2UFKP5bo06afaMPD+dIYQ7O0NiyZai4i8vkidi7HfxE=";
    };

    preBuild = ''
      # Force sass-embedded to use our dart-sass instead of bundled binaries.
      # The bundled Dart binary can't run in the Nix sandbox (no /lib64/ld-linux-x86-64.so.2).
      for dep in node_modules/.pnpm/sass-embedded@*; do
        substituteInPlace "$dep/node_modules/sass-embedded/dist/lib/src/compiler-path.js" \
          --replace-fail \
            'compilerCommand = (() => {' \
            'compilerCommand = (() => { return ["${prev.lib.getExe prev.dart-sass}"];'
      done
    '';

    buildPhase = ''
      runHook preBuild

      pushd node_modules/sqlite3
      node-gyp rebuild
      popd

      # isolated-vm is a native addon required by n8n-nodes-base (Merge node SQL sandbox)
      # since n8n 2.11.x; must be compiled before pnpm build runs generate-metadata
      pushd node_modules/isolated-vm
      node-gyp rebuild
      popd

      # TODO: use deploy after resolved https://github.com/pnpm/pnpm/issues/5315
      pnpm build --filter=n8n

      runHook postBuild
    '';

    meta =
      previousAttrs.meta
      // {
        changelog = "https://github.com/n8n-io/n8n/releases/tag/n8n@${finalAttrs.version}";
      };
  });
}