- Use HTTPS and tighter version regexp to guard against MitM - Use nix-instantiate instead of experimental nix eval - Handle dictionary-specific meta overrides