diff --git a/pkgs/applications/version-management/sourcehut/default.nix b/pkgs/applications/version-management/sourcehut/default.nix
index 3fa5399c2b5..f6de0036afe 100644
--- a/pkgs/applications/version-management/sourcehut/default.nix
+++ b/pkgs/applications/version-management/sourcehut/default.nix
@@ -6,7 +6,7 @@
 # https://github.com/NixOS/nixpkgs/pull/54425#discussion_r250688781
 
 let
-  fetchNodeModules = callPackage ../../networking/instant-messengers/rambox/fetchNodeModules.nix { };
+  fetchNodeModules = callPackage ./fetchNodeModules.nix { };
 
   python = python37.override {
     packageOverrides = self: super: {
diff --git a/pkgs/applications/version-management/sourcehut/fetchNodeModules.nix b/pkgs/applications/version-management/sourcehut/fetchNodeModules.nix
new file mode 100644
index 00000000000..047890a932c
--- /dev/null
+++ b/pkgs/applications/version-management/sourcehut/fetchNodeModules.nix
@@ -0,0 +1,26 @@
+{ stdenv, jq }: { src, nodejs, sha256 }:
+
+# Only npm >= 5.4.2 is deterministic, see:
+# https://github.com/npm/npm/issues/17979#issuecomment-332701215
+assert stdenv.lib.versionAtLeast nodejs.version "8.9.0";
+
+stdenv.mkDerivation {
+  name = "node_modules";
+
+  outputHashAlgo = "sha256";
+  outputHash = sha256;
+  outputHashMode = "recursive";
+
+  nativeBuildInputs = [ jq nodejs ];
+
+  buildCommand = ''
+    cp -r ${src}/* .
+    HOME=. npm install --force --ignore-scripts --only=production
+    for f in $(find node_modules -name package.json); do
+      # https://github.com/npm/npm/issues/10393
+      jq -S 'delpaths(keys | map(select(startswith("_")) | [.]))' $f > $f.tmp
+      mv $f.tmp $f
+    done
+    mv node_modules $out
+  '';
+}