diff --git a/maintainers/scripts/copy-tarballs.pl b/maintainers/scripts/copy-tarballs.pl
index 30fbac6f002d..6e4dcd6b22b0 100755
--- a/maintainers/scripts/copy-tarballs.pl
+++ b/maintainers/scripts/copy-tarballs.pl
@@ -176,7 +176,7 @@ elsif (defined $expr) {
 
         if ($hash =~ /^([a-z0-9]+)-([A-Za-z0-9+\/=]+)$/) {
             $algo = $1;
-            $hash = `nix hash to-base16 $hash` or die;
+            $hash = `nix --extra-experimental-features nix-command hash to-base16 $hash` or die;
             chomp $hash;
         }
 
@@ -184,7 +184,7 @@ elsif (defined $expr) {
 
         # Convert non-SRI base-64 to base-16.
         if ($hash =~ /^[A-Za-z0-9+\/=]+$/) {
-            $hash = `nix hash to-base16 --type '$algo' $hash` or die;
+            $hash = `nix --extra-experimental-features nix-command hash to-base16 --type '$algo' $hash` or die;
             chomp $hash;
         }
 
diff --git a/pkgs/applications/audio/reaper/updater.sh b/pkgs/applications/audio/reaper/updater.sh
index a47df805345f..50832c27d2fa 100755
--- a/pkgs/applications/audio/reaper/updater.sh
+++ b/pkgs/applications/audio/reaper/updater.sh
@@ -8,14 +8,14 @@ reaper_ver=$(curl -Ls https://www.reaper.fm/download.php | grep -o 'Version [0-9
 function set_hash_for_linux() {
   local arch=$1
   pkg_hash=$(nix-prefetch-url https://www.reaper.fm/files/${reaper_ver%.*}.x/reaper${reaper_ver/./}_linux_$arch.tar.xz)
-  pkg_hash=$(nix hash convert "sha256:$pkg_hash")
+  pkg_hash=$(nix --extra-experimental-features nix-command hash convert "sha256:$pkg_hash")
   update-source-version reaper "${reaper_ver}" "$pkg_hash" --system=$arch-linux --ignore-same-version
 }
 
 function set_hash_for_darwin() {
   local arch=$1
   pkg_hash=$(nix-prefetch-url https://www.reaper.fm/files/${reaper_ver%.*}.x/reaper${reaper_ver/./}_universal.dmg)
-  pkg_hash=$(nix hash convert "sha256:$pkg_hash")
+  pkg_hash=$(nix --extra-experimental-features nix-command hash convert "sha256:$pkg_hash")
   update-source-version reaper "${reaper_ver}" "$pkg_hash" --system=$arch-darwin --ignore-same-version
 }
 
diff --git a/pkgs/applications/blockchains/teos/update.sh b/pkgs/applications/blockchains/teos/update.sh
index f27be08299b2..5dae537abd0c 100755
--- a/pkgs/applications/blockchains/teos/update.sh
+++ b/pkgs/applications/blockchains/teos/update.sh
@@ -23,7 +23,7 @@ git clone --depth 1 --branch "v${version}" -c advice.detachedHead=false 'https:/
 git -C "$repo" checkout "tags/v${version}"
 
 rm -rf "${repo}/.git"
-hashcheck=$(nix hash path "$repo")
+hashcheck=$(nix --extra-experimental-features nix-command hash path "$repo")
 
 (cd "$nixpkgs" && update-source-version teos "$version" "$hashcheck" && update-source-version teos --ignore-same-version --source-key=cargoDeps)
 echo
diff --git a/pkgs/applications/editors/cudatext/update.sh b/pkgs/applications/editors/cudatext/update.sh
index 36b53ec141be..3ed1f8d56dc3 100755
--- a/pkgs/applications/editors/cudatext/update.sh
+++ b/pkgs/applications/editors/cudatext/update.sh
@@ -17,7 +17,7 @@ echo "New version: $version"
 
 url="https://github.com/Alexey-T/CudaText/archive/refs/tags/${version}.tar.gz"
 hash=$(nix-prefetch-url --quiet --unpack --type sha256 $url)
-sriHash=$(nix hash to-sri --type sha256 $hash)
+sriHash=$(nix --extra-experimental-features nix-command hash to-sri --type sha256 $hash)
 
 sed -i "s#version = \".*\"#version = \"$version\"#" default.nix
 sed -i "s#hash = \".*\"#hash = \"$sriHash\"#" default.nix
@@ -27,7 +27,7 @@ while IFS=$'\t' read repo owner rev; do
   if [ "$latest" != "$rev" ]; then
     url="https://github.com/${owner}/${repo}/archive/refs/tags/${latest}.tar.gz"
     hash=$(nix-prefetch-url --quiet --unpack --type sha256 $url)
-    sriHash=$(nix hash to-sri --type sha256 $hash)
+    sriHash=$(nix --extra-experimental-features nix-command hash to-sri --type sha256 $hash)
     jq ".\"${repo}\".rev = \"${latest}\" | .\"${repo}\".hash = \"${sriHash}\"" deps.json | sponge deps.json
   fi
 done <<< $(jq -r 'to_entries[]|[.key,.value.owner,.value.rev]|@tsv' deps.json)
diff --git a/pkgs/applications/editors/vscode/extensions/_maintainers/update-bin-srcs-lib.sh b/pkgs/applications/editors/vscode/extensions/_maintainers/update-bin-srcs-lib.sh
index 4b0ca54da362..15bfb8682955 100755
--- a/pkgs/applications/editors/vscode/extensions/_maintainers/update-bin-srcs-lib.sh
+++ b/pkgs/applications/editors/vscode/extensions/_maintainers/update-bin-srcs-lib.sh
@@ -60,7 +60,7 @@ prefetchExtensionUnpacked() {
   declare unpackedStorePath
   unpackedStorePath="$(nix add-to-store -n "$unpackedStoreName" "$tmpDir")"
   declare unpackedSha256
-  unpackedSha256="$(nix hash-path --base32 --type sha256 "$unpackedStorePath")"
+  unpackedSha256="$(nix --extra-experimental-features nix-command hash path --base32 --type sha256 "$unpackedStorePath")"
   1>&2 echo "unpackedStorePath='$unpackedStorePath'"
   1>&2 echo "unpackedSha256='$unpackedSha256'"
 
diff --git a/pkgs/applications/editors/vscode/extensions/ms-vscode.cpptools/update_helper.sh b/pkgs/applications/editors/vscode/extensions/ms-vscode.cpptools/update_helper.sh
index 9541700a28b8..76bb4bfde053 100755
--- a/pkgs/applications/editors/vscode/extensions/ms-vscode.cpptools/update_helper.sh
+++ b/pkgs/applications/editors/vscode/extensions/ms-vscode.cpptools/update_helper.sh
@@ -58,7 +58,7 @@ make_trapped_tmpdir
 unzip -q -d "$tmpDir" "$cpptoolsZipStorePath"
 
 cpptoolsStorePath="$(nix add-to-store -n "$extStoreName" "$tmpDir")"
-cpptoolsSha256="$(nix hash-path --base32 --type sha512 "$cpptoolsStorePath")"
+cpptoolsSha256="$(nix --extra-experimental-features nix-command hash path --base32 --type sha512 "$cpptoolsStorePath")"
 echo "cpptoolsStorePath='$cpptoolsStorePath'"
 echo "cpptoolsSha256='$cpptoolsSha256'"
 
diff --git a/pkgs/applications/editors/vscode/update-vscode.sh b/pkgs/applications/editors/vscode/update-vscode.sh
index e839bc194082..d8796470c312 100755
--- a/pkgs/applications/editors/vscode/update-vscode.sh
+++ b/pkgs/applications/editors/vscode/update-vscode.sh
@@ -18,7 +18,7 @@ update-source-version vscode $latestVersion
 
 systems=$(nix eval --json -f . vscode.meta.platforms | jq --raw-output '.[]')
 for system in $systems; do
-  hash=$(nix hash convert --to sri --hash-algo sha256 $(nix-prefetch-url $(nix eval --raw -f . vscode.src.url --system "$system")))
+  hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 $(nix-prefetch-url $(nix eval --raw -f . vscode.src.url --system "$system")))
   update-source-version vscode $latestVersion $hash --system=$system --ignore-same-version --ignore-same-hash
 done
 
diff --git a/pkgs/applications/editors/vscode/update-vscodium.sh b/pkgs/applications/editors/vscode/update-vscodium.sh
index 6f5a04262465..e568013cfd34 100755
--- a/pkgs/applications/editors/vscode/update-vscodium.sh
+++ b/pkgs/applications/editors/vscode/update-vscodium.sh
@@ -21,6 +21,6 @@ for i in \
     "aarch64-darwin darwin-arm64 zip" \
     "x86_64-darwin darwin-x64 zip"; do
     set -- $i
-    hash=$(nix hash convert --hash-algo sha256 --to sri $(nix-prefetch-url "https://github.com/VSCodium/vscodium/releases/download/$latestVersion/VSCodium-$2-$latestVersion.$3"))
+    hash=$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri $(nix-prefetch-url "https://github.com/VSCodium/vscodium/releases/download/$latestVersion/VSCodium-$2-$latestVersion.$3"))
     update-source-version vscodium $latestVersion $hash --system=$1 --ignore-same-version
 done
diff --git a/pkgs/applications/graphics/tesseract/fetch-language-hashes b/pkgs/applications/graphics/tesseract/fetch-language-hashes
index b8aedcfbd9c0..2104cdf1d79b 100755
--- a/pkgs/applications/graphics/tesseract/fetch-language-hashes
+++ b/pkgs/applications/graphics/tesseract/fetch-language-hashes
@@ -30,6 +30,6 @@ fi
 
 for lang in $langCodes; do
     url=https://github.com/tesseract-ocr/tessdata/raw/$tessdataRev/$lang.traineddata
-    hash=$(nix hash to-sri --type sha256 $(nix-prefetch-url $url 2>/dev/null))
+    hash=$(nix --extra-experimental-features nix-command hash to-sri --type sha256 $(nix-prefetch-url $url 2>/dev/null))
     echo "$lang = \"$hash\";"
 done
diff --git a/pkgs/applications/networking/browsers/librewolf/update.nix b/pkgs/applications/networking/browsers/librewolf/update.nix
index f55e57abb065..88c5a7e49fc7 100644
--- a/pkgs/applications/networking/browsers/librewolf/update.nix
+++ b/pkgs/applications/networking/browsers/librewolf/update.nix
@@ -46,7 +46,7 @@ writeScript "update-librewolf" ''
   repoUrl=https://codeberg.org/librewolf/source.git
   nix-prefetch-git $repoUrl --quiet --rev $latestTag --fetch-submodules > $prefetchOut
   srcDir=$(jq -r .path < $prefetchOut)
-  srcHash=$(nix hash convert --to sri --hash-algo sha256 $(jq -r .sha256 < $prefetchOut))
+  srcHash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 $(jq -r .sha256 < $prefetchOut))
 
   ffVersion=$(<$srcDir/version)
   lwRelease=$(<$srcDir/release)
@@ -68,7 +68,7 @@ writeScript "update-librewolf" ''
   curl --silent --show-error -o "$HOME"/shasums.asc "$mozillaUrl$ffVersion/SHA512SUMS.asc"
   gpgv --keyring="$GNUPGHOME"/pubring.kbx "$HOME"/shasums.asc "$HOME"/shasums
 
-  ffHash=$(nix hash convert --to sri --hash-algo sha512 $(grep '\.source\.tar\.xz$' "$HOME"/shasums | grep '^[^ ]*' -o))
+  ffHash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha512 $(grep '\.source\.tar\.xz$' "$HOME"/shasums | grep '^[^ ]*' -o))
   echo "ffHash=$ffHash"
 
   jq ".source.rev = \"$latestTag\"" $srcJson | sponge $srcJson
diff --git a/pkgs/applications/networking/cluster/timoni/update.sh b/pkgs/applications/networking/cluster/timoni/update.sh
index 4e997beeece5..10e4814f46ae 100755
--- a/pkgs/applications/networking/cluster/timoni/update.sh
+++ b/pkgs/applications/networking/cluster/timoni/update.sh
@@ -16,7 +16,7 @@ sed -i "s|$PREV_VERSION|$NEXT_VERSION|" "$FILE"
 
 # update hash
 PREV_HASH=$(nix eval --raw -f $NIXPKGS_ROOT/default.nix $ATTR.src.outputHash)
-NEXT_HASH=$(nix hash to-sri --type sha256 $(nix-prefetch-url --unpack --type sha256 $(nix eval --raw -f $NIXPKGS_ROOT/default.nix $ATTR.src.url)))
+NEXT_HASH=$(nix --extra-experimental-features nix-command hash to-sri --type sha256 $(nix-prefetch-url --unpack --type sha256 $(nix eval --raw -f $NIXPKGS_ROOT/default.nix $ATTR.src.url)))
 sed -i "s|$PREV_HASH|$NEXT_HASH|" "$FILE"
 
 # update vendor hash
diff --git a/pkgs/by-name/at/atlassian-plugin-sdk/package.nix b/pkgs/by-name/at/atlassian-plugin-sdk/package.nix
index 8f4becdd9914..5547053892a8 100644
--- a/pkgs/by-name/at/atlassian-plugin-sdk/package.nix
+++ b/pkgs/by-name/at/atlassian-plugin-sdk/package.nix
@@ -71,7 +71,7 @@ stdenv.mkDerivation rec {
       fi
 
       DOWNLOAD_URL="${mavenGroupIdUrl}/atlassian-plugin-sdk/${version}/atlassian-plugin-sdk-$NEW_VERSION.tar.gz"
-      NIX_HASH=$(nix hash to-sri sha256:$(nix-prefetch-url $DOWNLOAD_URL))
+      NIX_HASH=$(nix --extra-experimental-features nix-command hash to-sri sha256:$(nix-prefetch-url $DOWNLOAD_URL))
 
       update-source-version "atlassian-plugin-sdk" "$NEW_VERSION" "$NIX_HASH" "$DOWNLOAD_URL"
     '';
diff --git a/pkgs/by-name/ba/balatro/package.nix b/pkgs/by-name/ba/balatro/package.nix
index 526ca9ee051f..ec56a60e8bda 100644
--- a/pkgs/by-name/ba/balatro/package.nix
+++ b/pkgs/by-name/ba/balatro/package.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = requireFile {
     name = "Balatro-${finalAttrs.version}.exe";
     url = "https://store.steampowered.com/app/2379780/Balatro/";
-    # Use `nix hash file --sri --type sha256` to get the correct hash
+    # Use `nix --extra-experimental-features nix-command hash file --sri --type sha256` to get the correct hash
     hash = "sha256-DXX+FkrM8zEnNNSzesmHiN0V8Ljk+buLf5DE5Z3pP0c=";
   };
 
diff --git a/pkgs/by-name/be/beekeeper-studio/update.sh b/pkgs/by-name/be/beekeeper-studio/update.sh
index 8bca15d4e3c8..cc6f15fb95c0 100755
--- a/pkgs/by-name/be/beekeeper-studio/update.sh
+++ b/pkgs/by-name/be/beekeeper-studio/update.sh
@@ -16,5 +16,5 @@ fi
 
 nix-update beekeeper-studio --version "$latestVersion" || true
 
-hash=$(nix hash convert --to sri --hash-algo sha256 $(nix-prefetch-url "$(nix eval -f . --raw beekeeper-studio.src.url --system aarch64-linux)"))
+hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 $(nix-prefetch-url "$(nix eval -f . --raw beekeeper-studio.src.url --system aarch64-linux)"))
 update-source-version beekeeper-studio $latestVersion $hash --system=aarch64-linux --ignore-same-version
diff --git a/pkgs/by-name/bi/bilibili/update.sh b/pkgs/by-name/bi/bilibili/update.sh
index 5bd8dea6fdfd..e515f08f6616 100755
--- a/pkgs/by-name/bi/bilibili/update.sh
+++ b/pkgs/by-name/bi/bilibili/update.sh
@@ -14,8 +14,8 @@ amd64_hash=$(nix-prefetch-url $amd64_url)
 arm64_hash=$(nix-prefetch-url $arm64_url)
 
 # use friendlier hashes
-amd64_hash=$(nix hash convert --to sri --hash-algo sha256 "$amd64_hash")
-arm64_hash=$(nix hash convert --to sri --hash-algo sha256 "$arm64_hash")
+amd64_hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 "$amd64_hash")
+arm64_hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 "$arm64_hash")
 
 cat >sources.nix <<EOF
 # Generated by ./update.sh - do not update manually!
diff --git a/pkgs/by-name/bl/bloomeetunes/update.sh b/pkgs/by-name/bl/bloomeetunes/update.sh
index 1d7d1f316cc9..75dd3934aff0 100755
--- a/pkgs/by-name/bl/bloomeetunes/update.sh
+++ b/pkgs/by-name/bl/bloomeetunes/update.sh
@@ -18,7 +18,7 @@ fi
 
 sed -i "s/\(tag = \"v\${version}+\)[0-9]\+/\1${RunNumber}/" "$ROOT/package.nix"
 
-hash=$(nix hash convert --hash-algo sha256 --to sri $(nix-prefetch-url --unpack "https://github.com/HemantKArya/BloomeeTunes/archive/refs/tags/${latestTag}.tar.gz"))
+hash=$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri $(nix-prefetch-url --unpack "https://github.com/HemantKArya/BloomeeTunes/archive/refs/tags/${latestTag}.tar.gz"))
 update-source-version bloomeetunes $latestVersion $hash
 
 curl https://raw.githubusercontent.com/HemantKArya/BloomeeTunes/${latestTag}/pubspec.lock | yq . >$ROOT/pubspec.lock.json
diff --git a/pkgs/by-name/bo/boundary/update.sh b/pkgs/by-name/bo/boundary/update.sh
index 0418b2b3dd0a..660f44964a95 100644
--- a/pkgs/by-name/bo/boundary/update.sh
+++ b/pkgs/by-name/bo/boundary/update.sh
@@ -15,7 +15,7 @@ function calc_hash () {
     local arch=$2
     url="https://releases.hashicorp.com/boundary/${version}/boundary_${version}_${arch}.zip"
     zip_hash=$(nix-prefetch-url --unpack $url)
-    nix hash to-sri --type sha256 "$zip_hash"
+    nix --extra-experimental-features nix-command hash to-sri --type sha256 "$zip_hash"
 }
 
 replace_sha() {
diff --git a/pkgs/by-name/bu/buck2/update.sh b/pkgs/by-name/bu/buck2/update.sh
index b4614c47126c..ef158d8326ff 100755
--- a/pkgs/by-name/bu/buck2/update.sh
+++ b/pkgs/by-name/bu/buck2/update.sh
@@ -27,7 +27,7 @@ HFILE=pkgs/by-name/bu/buck2/hashes.json
 rm -f "$HFILE" && touch "$HFILE"
 
 PRELUDE_SHA256HASH="$(nix-prefetch-url --type sha256 "$PRELUDE_DL_URL")"
-PRELUDE_SRIHASH="$(nix hash to-sri --type sha256 "$PRELUDE_SHA256HASH")"
+PRELUDE_SRIHASH="$(nix --extra-experimental-features nix-command hash to-sri --type sha256 "$PRELUDE_SHA256HASH")"
 
 printf "{ \"_comment\": \"@generated by pkgs/by-name/bu/buck2/update.sh\"\n" >> "$HFILE"
 printf ", \"_prelude\": \"$PRELUDE_SRIHASH\"\n" >> "$HFILE"
@@ -35,12 +35,12 @@ printf ", \"_prelude\": \"$PRELUDE_SRIHASH\"\n" >> "$HFILE"
 for arch in "${ARCHS[@]}"; do
     IFS=: read -r arch_name arch_target <<< "$arch"
     sha256hash="$(nix-prefetch-url --type sha256 "https://github.com/facebook/buck2/releases/download/${VERSION}/buck2-${arch_target}.zst")"
-    srihash="$(nix hash to-sri --type sha256 "$sha256hash")"
+    srihash="$(nix --extra-experimental-features nix-command hash to-sri --type sha256 "$sha256hash")"
     echo ", \"buck2-$arch_name\": \"$srihash\"" >> "$HFILE"
 
     IFS=: read -r arch_name arch_target <<< "$arch"
     sha256hash="$(nix-prefetch-url --type sha256 "https://github.com/facebook/buck2/releases/download/${VERSION}/rust-project-${arch_target}.zst")"
-    srihash="$(nix hash to-sri --type sha256 "$sha256hash")"
+    srihash="$(nix --extra-experimental-features nix-command hash to-sri --type sha256 "$sha256hash")"
     echo ", \"rust-project-$arch_name\": \"$srihash\"" >> "$HFILE"
 done
 echo "}" >> "$HFILE"
diff --git a/pkgs/by-name/bu/buckets/package.nix b/pkgs/by-name/bu/buckets/package.nix
index c0e90904add2..c8e84075de3d 100644
--- a/pkgs/by-name/bu/buckets/package.nix
+++ b/pkgs/by-name/bu/buckets/package.nix
@@ -18,7 +18,7 @@ let
     .${system};
 
   # Get hash in sri format
-  # nix-prefetch-url <url> | xargs nix hash convert --hash-algo sha256
+  # nix-prefetch-url <url> | xargs nix --extra-experimental-features nix-command hash convert --hash-algo sha256
   hash =
     {
       x86_64-linux = "sha256-DK5+VT4+OCcJ4Bbv6GGs6R332GMsD1gNEmcz0iaJb1c=";
diff --git a/pkgs/by-name/ch/chatgpt/update.sh b/pkgs/by-name/ch/chatgpt/update.sh
index 03b9176ed146..871a6b4f6685 100755
--- a/pkgs/by-name/ch/chatgpt/update.sh
+++ b/pkgs/by-name/ch/chatgpt/update.sh
@@ -8,7 +8,7 @@ XML_DATA=$(curl -s $XML_URL)
 LATEST_VERSION=$(echo "$XML_DATA" | xmllint --xpath '/rss/channel/item[1]/*[local-name()="shortVersionString"]/text()' -)
 DOWNLOAD_URL=$(echo "$XML_DATA" | xmllint --xpath 'string(//item[1]/enclosure/@url)' -)
 
-HASH=$(nix-prefetch-url $DOWNLOAD_URL | xargs nix hash convert --hash-algo sha256)
+HASH=$(nix-prefetch-url $DOWNLOAD_URL | xargs nix --extra-experimental-features nix-command hash convert --hash-algo sha256)
 
 SOURCE_NIX="$(dirname ${BASH_SOURCE[0]})/source.nix"
 
diff --git a/pkgs/by-name/cl/clojure-lsp/package.nix b/pkgs/by-name/cl/clojure-lsp/package.nix
index cbde13c0a97d..561a18d097f6 100644
--- a/pkgs/by-name/cl/clojure-lsp/package.nix
+++ b/pkgs/by-name/cl/clojure-lsp/package.nix
@@ -59,7 +59,7 @@ buildGraalvmNativeImage (finalAttrs: {
     old_jar_hash="$(nix-instantiate --strict --json --eval -A clojure-lsp.jar.drvAttrs.outputHash | jq -r .)"
 
     curl -o clojure-lsp-standalone.jar -sL "https://github.com/clojure-lsp/clojure-lsp/releases/download/$latest_version/clojure-lsp-standalone.jar"
-    new_jar_hash="$(nix-hash --flat --type sha256 clojure-lsp-standalone.jar | xargs -n1 nix hash convert --hash-algo sha256)"
+    new_jar_hash="$(nix-hash --flat --type sha256 clojure-lsp-standalone.jar | xargs -n1 nix --extra-experimental-features nix-command hash convert --hash-algo sha256)"
 
     rm -f clojure-lsp-standalone.jar
 
diff --git a/pkgs/by-name/co/coder/update.sh b/pkgs/by-name/co/coder/update.sh
index 6c12ef73b191..7f5e29d10b00 100755
--- a/pkgs/by-name/co/coder/update.sh
+++ b/pkgs/by-name/co/coder/update.sh
@@ -32,7 +32,7 @@ update_version_and_hashes() {
 
         # Fetch the new hash using nix-prefetch-url
         local NEW_HASH=$(nix-prefetch-url --type sha256 $URL)
-        local SRI_HASH=$(nix hash to-sri --type sha256 $NEW_HASH)
+        local SRI_HASH=$(nix --extra-experimental-features nix-command hash to-sri --type sha256 $NEW_HASH)
 
         # Update the Nix file with the new hash, using '#' as delimiter and preserving indentation
         sed -i "/${channel} = {/,/};/{
diff --git a/pkgs/by-name/co/confluent-cli/update.sh b/pkgs/by-name/co/confluent-cli/update.sh
index 2992fffd400a..e237957438f0 100755
--- a/pkgs/by-name/co/confluent-cli/update.sh
+++ b/pkgs/by-name/co/confluent-cli/update.sh
@@ -26,6 +26,6 @@ for i in \
     "x86_64-darwin darwin_amd64" \
     "aarch64-darwin darwin_arm64"; do
     set -- $i
-    hash=$(nix hash convert --to sri --hash-algo sha256 $(nix-prefetch-url "https://s3-us-west-2.amazonaws.com/confluent.cloud/confluent-cli/archives/$latestVersion/confluent_${latestVersion}_$2.tar.gz"))
+    hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 $(nix-prefetch-url "https://s3-us-west-2.amazonaws.com/confluent.cloud/confluent-cli/archives/$latestVersion/confluent_${latestVersion}_$2.tar.gz"))
     update-source-version confluent-cli $latestVersion $hash --system=$1 --ignore-same-version
 done
diff --git a/pkgs/by-name/cr/crc/update.sh b/pkgs/by-name/cr/crc/update.sh
index d022177a9354..8921955d5fb6 100755
--- a/pkgs/by-name/cr/crc/update.sh
+++ b/pkgs/by-name/cr/crc/update.sh
@@ -26,7 +26,7 @@ CRC_COMMIT=$(curl --silent ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} \
     jq -r "map(select(.name == \"${LATEST_TAG_NAME}\")) | .[0] | .commit.sha")
 
 CRC_GIT_PREFETCH=$(nix-prefetch-url --unpack https://github.com/crc-org/crc/archive/${CRC_COMMIT}.tar.gz)
-CRC_GIT_HASH=$(nix hash convert --to sri --hash-algo sha256 ${CRC_GIT_PREFETCH})
+CRC_GIT_HASH=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 ${CRC_GIT_PREFETCH})
 
 FILE_MAKEFILE=${WORKDIR}/Makefile
 curl --silent https://raw.githubusercontent.com/crc-org/crc/${CRC_COMMIT}/Makefile >$FILE_MAKEFILE
diff --git a/pkgs/by-name/db/dbgate/update.sh b/pkgs/by-name/db/dbgate/update.sh
index a7acfa2c0e91..1e893aaa7706 100755
--- a/pkgs/by-name/db/dbgate/update.sh
+++ b/pkgs/by-name/db/dbgate/update.sh
@@ -17,6 +17,6 @@ for system in \
     aarch64-linux \
     x86_64-darwin \
     aarch64-darwin; do
-    hash=$(nix hash convert --to sri --hash-algo sha256 $(nix-prefetch-url $(nix-instantiate --eval -E "with import ./. {}; dbgate.src.url" --system "$system" | tr -d '"')))
+    hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 $(nix-prefetch-url $(nix-instantiate --eval -E "with import ./. {}; dbgate.src.url" --system "$system" | tr -d '"')))
     update-source-version dbgate $latestVersion $hash --system=$system --ignore-same-version
 done
diff --git a/pkgs/by-name/de/dependabot-cli/update.sh b/pkgs/by-name/de/dependabot-cli/update.sh
index a01d0accfa32..6ec4191c948e 100755
--- a/pkgs/by-name/de/dependabot-cli/update.sh
+++ b/pkgs/by-name/de/dependabot-cli/update.sh
@@ -21,7 +21,7 @@ if [ "$OLD_VERSION" = "$VERSION" ]; then
 fi
 
 SHA256="$(nix-prefetch-url --quiet --unpack https://github.com/dependabot/cli/archive/refs/tags/v${VERSION}.tar.gz)"
-HASH="$(nix hash convert --hash-algo sha256 --to sri "$SHA256")"
+HASH="$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri "$SHA256")"
 
 nix-prefetch-docker --json --quiet --final-image-name dependabot-update-job-proxy --final-image-tag "nixpkgs-dependabot-cli-$VERSION" ghcr.io/github/dependabot-update-job-proxy/dependabot-update-job-proxy latest > "$temp_dir/dependabot-update-job-proxy.json"
 
diff --git a/pkgs/by-name/dr/draupnir/update.sh b/pkgs/by-name/dr/draupnir/update.sh
index 78842bfcbfc4..604deb5ec211 100755
--- a/pkgs/by-name/dr/draupnir/update.sh
+++ b/pkgs/by-name/dr/draupnir/update.sh
@@ -29,7 +29,7 @@ cd $TMPDIR
 
 curl https://raw.githubusercontent.com/the-draupnir-project/Draupnir/v$latestVersion/yarn.lock -o yarn.lock
 TMP_PREFETCH_HASH=`prefetch-yarn-deps yarn.lock`
-NEW_YARN_OFFLINE_HASH=`nix hash to-sri --type sha256 $TMP_PREFETCH_HASH`
+NEW_YARN_OFFLINE_HASH=`nix --extra-experimental-features nix-command hash to-sri --type sha256 $TMP_PREFETCH_HASH`
 
 cd -
 echo "New yarn offline hash: $NEW_YARN_OFFLINE_HASH"
diff --git a/pkgs/by-name/du/duplicati/package.nix b/pkgs/by-name/du/duplicati/package.nix
index 803bada022dd..9f61595f0f20 100644
--- a/pkgs/by-name/du/duplicati/package.nix
+++ b/pkgs/by-name/du/duplicati/package.nix
@@ -18,7 +18,7 @@ let
     "aarch64-linux" = "linux-arm64";
   };
   _platform = _supportedPlatforms."${stdenv.hostPlatform.system}";
-  # nix hash convert --to sri "sha256:`nix-prefetch-url --unpack https://updates.duplicati.com/stable/duplicati-2.1.0.5_stable_2025-03-04-linux-arm64-cli.zip`"
+  # nix --extra-experimental-features nix-command hash convert --to sri "sha256:`nix-prefetch-url --unpack https://updates.duplicati.com/stable/duplicati-2.1.0.5_stable_2025-03-04-linux-arm64-cli.zip`"
   _fileHashForSystem = {
     "armv7l-linux" = "sha256-FQQ07M0rwvxNkHPW6iK5WBTKgFrZ4LOP4vgINfmtq4k=";
     "x86_64-linux" = "sha256-1QspF/A3hOtqd8bVbSqClJIHUN9gBrd18J5qvZJLkQE=";
diff --git a/pkgs/by-name/dy/dynamodb-local/package.nix b/pkgs/by-name/dy/dynamodb-local/package.nix
index 177950548dc2..82be1d83820d 100644
--- a/pkgs/by-name/dy/dynamodb-local/package.nix
+++ b/pkgs/by-name/dy/dynamodb-local/package.nix
@@ -74,7 +74,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       fi
 
       DOWNLOAD_URL="https://d1ni2b6xgvw0s0.cloudfront.net/v2.x/dynamodb_local_$NEW_VERSION_DATE.tar.gz"
-      NIX_HASH=$(nix hash to-sri sha256:$(nix-prefetch-url $DOWNLOAD_URL))
+      NIX_HASH=$(nix --extra-experimental-features nix-command hash to-sri sha256:$(nix-prefetch-url $DOWNLOAD_URL))
 
       update-source-version "dynamodb-local" "$NEW_VERSION" "$NIX_HASH" "$DOWNLOAD_URL"
     '';
diff --git a/pkgs/by-name/el/electrs/update.sh b/pkgs/by-name/el/electrs/update.sh
index db6a2fa5639f..0c1db1772886 100755
--- a/pkgs/by-name/el/electrs/update.sh
+++ b/pkgs/by-name/el/electrs/update.sh
@@ -32,7 +32,7 @@ echo "Verifying commit"
 git -C $repo verify-tag v${version}
 
 rm -rf $repo/.git
-hash=$(nix hash path $repo)
+hash=$(nix --extra-experimental-features nix-command hash path $repo)
 
 (cd "$nixpkgs" && update-source-version electrs "$version" "$hash" && update-source-version electrs --ignore-same-version --source-key=cargoDeps)
 echo
diff --git a/pkgs/by-name/en/envoy-bin/update.sh b/pkgs/by-name/en/envoy-bin/update.sh
index df32827256aa..e0ae167b10e7 100755
--- a/pkgs/by-name/en/envoy-bin/update.sh
+++ b/pkgs/by-name/en/envoy-bin/update.sh
@@ -14,7 +14,7 @@ fetch_arch() {
     VER="$1"
     ARCH="$2"
     URL="https://github.com/envoyproxy/envoy/releases/download/v${VER}/envoy-${VER}-linux-${ARCH}"
-    nix hash convert --to sri --hash-algo sha256 "$(nix-prefetch-url --type sha256 "$URL")"
+    nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 "$(nix-prefetch-url --type sha256 "$URL")"
 }
 
 replace_hash() {
diff --git a/pkgs/by-name/fe/feishu/package.nix b/pkgs/by-name/fe/feishu/package.nix
index fbbe4ad8f67f..28193a77a4e2 100644
--- a/pkgs/by-name/fe/feishu/package.nix
+++ b/pkgs/by-name/fe/feishu/package.nix
@@ -217,7 +217,7 @@ stdenv.mkDerivation {
         update_link=$(echo $package_info | jq -r '.data.download_link' | sed 's/lf[0-9]*-ug-sign.feishucdn.com/sf3-cn.feishucdn.com\/obj/;s/?.*$//')
         new_version=$(echo $package_info | jq -r '.data.version_number' | sed -n 's/.*@V//p')
         sha256_hash=$(nix-prefetch-url $update_link)
-        sri_hash=$(nix hash to-sri --type sha256 $sha256_hash)
+        sri_hash=$(nix --extra-experimental-features nix-command hash to-sri --type sha256 $sha256_hash)
         update-source-version feishu $new_version $sri_hash $update_link --system=$platform --ignore-same-version --source-key="sources.$platform"
       done
     '';
diff --git a/pkgs/by-name/fi/fishnet/update.bash b/pkgs/by-name/fi/fishnet/update.bash
index 8bf6997f3936..6e40cba6bfec 100644
--- a/pkgs/by-name/fi/fishnet/update.bash
+++ b/pkgs/by-name/fi/fishnet/update.bash
@@ -14,7 +14,7 @@ new_nnue_big_file="$(
         grep --perl-regexp --only-matching 'EvalFileDefaultNameBig "\Knn-(\w+).nnue'
 )"
 new_nnue_big_hash="$(
-    nix hash to-sri --type sha256 "$(
+    nix --extra-experimental-features nix-command hash to-sri --type sha256 "$(
         nix-prefetch-url --type sha256 "https://tests.stockfishchess.org/api/nn/${new_nnue_big_file}"
     )"
 )"
@@ -23,7 +23,7 @@ new_nnue_small_file="$(
         grep --perl-regexp --only-matching 'EvalFileDefaultNameSmall "\Knn-(\w+).nnue'
 )"
 new_nnue_small_hash="$(
-    nix hash to-sri --type sha256 "$(
+    nix --extra-experimental-features nix-command hash to-sri --type sha256 "$(
         nix-prefetch-url --type sha256 "https://tests.stockfishchess.org/api/nn/${new_nnue_small_file}"
     )"
 )"
diff --git a/pkgs/by-name/fl/fluxcd/update.sh b/pkgs/by-name/fl/fluxcd/update.sh
index bc229dd6c72e..33decbba8a91 100755
--- a/pkgs/by-name/fl/fluxcd/update.sh
+++ b/pkgs/by-name/fl/fluxcd/update.sh
@@ -12,9 +12,9 @@ LATEST_VERSION=$(echo "${LATEST_TAG}" | sed 's/^v//')
 
 if [ ! "$OLD_VERSION" = "$LATEST_VERSION" ]; then
     SRC_SHA256=$(nix-prefetch-url --quiet --unpack "https://github.com/fluxcd/flux2/archive/refs/tags/${LATEST_TAG}.tar.gz")
-    SRC_HASH=$(nix hash convert --hash-algo sha256 --to sri "$SRC_SHA256")
+    SRC_HASH=$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri "$SRC_SHA256")
     MANIFESTS_SHA256=$(nix-prefetch-url --quiet --unpack "https://github.com/fluxcd/flux2/releases/download/${LATEST_TAG}/manifests.tar.gz")
-    MANIFESTS_HASH=$(nix hash convert --hash-algo sha256 --to sri "$MANIFESTS_SHA256")
+    MANIFESTS_HASH=$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri "$MANIFESTS_SHA256")
 
     setKV () {
         sed -i "s|$1 = \".*\"|$1 = \"${2:-}\"|" "${FLUXCD_PATH}/package.nix"
@@ -27,7 +27,7 @@ if [ ! "$OLD_VERSION" = "$LATEST_VERSION" ]; then
 
     set +e
     VENDOR_SHA256=$(nix-build --no-out-link -A fluxcd "$NIXPKGS_PATH" 2>&1 >/dev/null | grep "got:" | cut -d':' -f2 | sed 's| ||g')
-    VENDOR_HASH=$(nix hash convert --hash-algo sha256 --to sri "$VENDOR_SHA256")
+    VENDOR_HASH=$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri "$VENDOR_SHA256")
     set -e
 
     if [ -n "${VENDOR_HASH:-}" ]; then
diff --git a/pkgs/by-name/ga/gauge/plugins/make-gauge-plugin.nix b/pkgs/by-name/ga/gauge/plugins/make-gauge-plugin.nix
index 1bf16e984bea..36025ca24492 100644
--- a/pkgs/by-name/ga/gauge/plugins/make-gauge-plugin.nix
+++ b/pkgs/by-name/ga/gauge/plugins/make-gauge-plugin.nix
@@ -91,7 +91,7 @@ stdenvNoCC.mkDerivation (
 
             echo "Fetching hash for $system"
             hash=$(nix-prefetch-url --type sha256 $url --unpack)
-            sriHash="$(nix hash to-sri --type sha256 $hash)"
+            sriHash="$(nix --extra-experimental-features nix-command hash to-sri --type sha256 $hash)"
 
             yq -iPoj ". + { \"$system\": { \"url\": \"$url\", \"hash\": \"$sriHash\" } }" "$tempfile"
         }
@@ -101,7 +101,7 @@ stdenvNoCC.mkDerivation (
 
             echo "Fetching hash"
             hash=$(nix-prefetch-url --type sha256 $url --unpack)
-            sriHash="$(nix hash to-sri --type sha256 $hash)"
+            sriHash="$(nix --extra-experimental-features nix-command hash to-sri --type sha256 $hash)"
 
             yq -iPoj ". + { \"url\": \"$url\", \"hash\": \"$sriHash\" }" "$tempfile"
         }
diff --git a/pkgs/by-name/go/google-chrome/update.sh b/pkgs/by-name/go/google-chrome/update.sh
index c65b8ae4dfec..d6428933d270 100755
--- a/pkgs/by-name/go/google-chrome/update.sh
+++ b/pkgs/by-name/go/google-chrome/update.sh
@@ -41,7 +41,7 @@ update_linux() {
 
     local download_url="https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${version}-1_amd64.deb"
     new_hash="$(nix-prefetch-url "$download_url" 2>/dev/null)"
-    new_sri_hash="$(nix hash to-sri --type sha256 "$new_hash")"
+    new_sri_hash="$(nix --extra-experimental-features nix-command hash to-sri --type sha256 "$new_hash")"
 
     sed -i "/^  linux = stdenvNoCC.mkDerivation/,/^  });/s/version = \".*\"/version = \"$version\"/" "$DEFAULT_NIX"
     sed -i "/^  linux = stdenvNoCC.mkDerivation/,/^  });/s|hash = \".*\"|hash = \"$new_sri_hash\"|" "$DEFAULT_NIX"
@@ -87,8 +87,8 @@ update_darwin() {
     manifest_version="$(echo "$response" | xmllint --xpath "string(//manifest/@version)" -)"
 
     local download_url="$url$pkg"
-    new_hash="$(nix hash to-sri --type sha256 "$(nix-prefetch-url "$download_url" 2>/dev/null)")"
-    new_sri_hash="$(nix hash to-sri --type sha256 "$new_hash")"
+    new_hash="$(nix --extra-experimental-features nix-command hash to-sri --type sha256 "$(nix-prefetch-url "$download_url" 2>/dev/null)")"
+    new_sri_hash="$(nix --extra-experimental-features nix-command hash to-sri --type sha256 "$new_hash")"
 
     sed -i "/^  darwin = stdenvNoCC.mkDerivation/,/^  });/s/version = \".*\"/version = \"$manifest_version\"/" "$DEFAULT_NIX"
     sed -i "/^  darwin = stdenvNoCC.mkDerivation/,/^  });/s|hash = \".*\"|hash = \"$new_sri_hash\"|" "$DEFAULT_NIX"
diff --git a/pkgs/by-name/ha/hamrs-pro/update.sh b/pkgs/by-name/ha/hamrs-pro/update.sh
index dfd93fa6788a..7913ced30cbb 100755
--- a/pkgs/by-name/ha/hamrs-pro/update.sh
+++ b/pkgs/by-name/ha/hamrs-pro/update.sh
@@ -19,6 +19,6 @@ for system in \
     aarch64-linux \
     x86_64-darwin \
     aarch64-darwin; do
-    hash=$(nix hash convert --to sri --hash-algo sha256 $(nix-prefetch-url $(nix-instantiate --eval -E "with import ./. {}; hamrs-pro.src.url" --system "$system" | tr -d '"')))
+    hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 $(nix-prefetch-url $(nix-instantiate --eval -E "with import ./. {}; hamrs-pro.src.url" --system "$system" | tr -d '"')))
     update-source-version hamrs-pro $latestVersion $hash --system=$system --ignore-same-version
 done
diff --git a/pkgs/by-name/he/hey-mail/package.nix b/pkgs/by-name/he/hey-mail/package.nix
index b4e3f10b2995..472c5fc80dfe 100644
--- a/pkgs/by-name/he/hey-mail/package.nix
+++ b/pkgs/by-name/he/hey-mail/package.nix
@@ -154,7 +154,7 @@ stdenv.mkDerivation (finalAttrs: {
     if [[ "x$UPDATE_NIX_OLD_VERSION" != "x$version" ]]; then
 
         revision=$(jq -r .revision <<<"$data")
-        hash=$(nix hash to-sri "sha512:$(jq -r .download_sha512 <<<"$data")")
+        hash=$(nix --extra-experimental-features nix-command hash to-sri "sha512:$(jq -r .download_sha512 <<<"$data")")
 
         update-source-version "$UPDATE_NIX_ATTR_PATH" "$version" "$hash"
         update-source-version --ignore-same-hash --version-key=rev "$UPDATE_NIX_ATTR_PATH" "$revision" "$hash"
diff --git a/pkgs/by-name/ho/hoppscotch/update.sh b/pkgs/by-name/ho/hoppscotch/update.sh
index dbdb039c00bc..dd18d1942cad 100755
--- a/pkgs/by-name/ho/hoppscotch/update.sh
+++ b/pkgs/by-name/ho/hoppscotch/update.sh
@@ -19,6 +19,6 @@ for system in \
     x86_64-linux \
     x86_64-darwin \
     aarch64-darwin; do
-    hash=$(nix hash convert --to sri --hash-algo sha256 $(nix-prefetch-url $(nix-instantiate --eval -E "with import $BASEDIR {}; hoppscotch.src.url" --system "$system" | tr -d '"')))
+    hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 $(nix-prefetch-url $(nix-instantiate --eval -E "with import $BASEDIR {}; hoppscotch.src.url" --system "$system" | tr -d '"')))
     (cd $BASEDIR && update-source-version hoppscotch $latestVersion $hash --system=$system --ignore-same-version)
 done
diff --git a/pkgs/by-name/i-/i-dot-ming/package.nix b/pkgs/by-name/i-/i-dot-ming/package.nix
index 3254482681ba..0fd556b1bc65 100644
--- a/pkgs/by-name/i-/i-dot-ming/package.nix
+++ b/pkgs/by-name/i-/i-dot-ming/package.nix
@@ -35,7 +35,7 @@ stdenvNoCC.mkDerivation rec {
         curl -Lo $tmp/I.Ming.ttf https://raw.githubusercontent.com/ichitenfont/I.Ming/$version/$version/I.Ming-$version.ttf
         install -DT -m444 $tmp/I.Ming.ttf $tmp/share/fonts/truetype/I.Ming/I.Ming.ttf
         rm $tmp/I.Ming.ttf
-        hash=$(nix hash path --type sha256 --base32 --sri $tmp)
+        hash=$(nix --extra-experimental-features nix-command hash path --type sha256 --base32 --sri $tmp)
         sed -i -E \
           -e "s/version = \"[0-9.]+\"/version = \"$version\"/" \
           -e "s|hash = \".*\"|hash = \"$hash\"|" \
diff --git a/pkgs/by-name/ib/ibm-plex/update.sh b/pkgs/by-name/ib/ibm-plex/update.sh
index dd91a5521e9d..c44aac891530 100755
--- a/pkgs/by-name/ib/ibm-plex/update.sh
+++ b/pkgs/by-name/ib/ibm-plex/update.sh
@@ -37,7 +37,7 @@ printf '{\n' > "$dirname/hashes.nix"
 
 for family in "${families[@]}"; do
     url="https://github.com/IBM/plex/releases/download/%40ibm%2Fplex-${family}%40${version}/ibm-plex-${family}.zip"
-    printf '  "%s" = "%s";\n' "$family" "$(nix-prefetch-url --unpack "$url" | xargs nix hash convert --hash-algo sha256)" >>"$dirname/hashes.nix"
+    printf '  "%s" = "%s";\n' "$family" "$(nix-prefetch-url --unpack "$url" | xargs nix --extra-experimental-features nix-command hash convert --hash-algo sha256)" >>"$dirname/hashes.nix"
 done
 
 printf '}\n' >> "$dirname/hashes.nix"
diff --git a/pkgs/by-name/je/jenkins/package.nix b/pkgs/by-name/je/jenkins/package.nix
index 6bd6791ffd11..796792cf725d 100644
--- a/pkgs/by-name/je/jenkins/package.nix
+++ b/pkgs/by-name/je/jenkins/package.nix
@@ -64,7 +64,7 @@ stdenv.mkDerivation (finalAttrs: {
 
       version="$(jq -r .version <<<$core_json)"
       sha256="$(jq -r .sha256 <<<$core_json)"
-      hash="$(nix hash to-sri --type sha256 "$sha256")"
+      hash="$(nix --extra-experimental-features nix-command hash to-sri --type sha256 "$sha256")"
 
       if [ ! "$oldVersion" = "$version" ]; then
         update-source-version jenkins "$version" "$hash"
diff --git a/pkgs/by-name/je/jetbrains-toolbox/update.sh b/pkgs/by-name/je/jetbrains-toolbox/update.sh
index 6e0619033962..03f58c1829de 100755
--- a/pkgs/by-name/je/jetbrains-toolbox/update.sh
+++ b/pkgs/by-name/je/jetbrains-toolbox/update.sh
@@ -28,6 +28,6 @@ for system in $systems; do
       unpack=""
     fi
     prefetch=$(nix-prefetch-url $unpack "$url")
-    hash=$(nix hash convert --hash-algo sha256 --to sri $prefetch)
+    hash=$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri $prefetch)
     update-source-version jetbrains-toolbox $latestVersion $hash --system=$system --ignore-same-version
 done
diff --git a/pkgs/by-name/ke/keyguard/update.sh b/pkgs/by-name/ke/keyguard/update.sh
index 803f359bf537..872efbf61632 100755
--- a/pkgs/by-name/ke/keyguard/update.sh
+++ b/pkgs/by-name/ke/keyguard/update.sh
@@ -20,7 +20,7 @@ if [[ "$latestVersion" == "$currentVersion" ]]; then
     exit 0
 fi
 
-hash=$(nix hash convert --hash-algo sha256 --to sri $(nix-prefetch-url --unpack "https://github.com/AChep/keyguard-app/archive/refs/tags/${latestTag}.tar.gz"))
+hash=$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri $(nix-prefetch-url --unpack "https://github.com/AChep/keyguard-app/archive/refs/tags/${latestTag}.tar.gz"))
 update-source-version keyguard $latestVersion $hash
 
 sed -i 's/tag = "r[0-9]\+\(\.[0-9]\+\)\?";/tag = "'"$latestTag"'";/g' "$ROOT/package.nix"
diff --git a/pkgs/by-name/li/librewolf-bin-unwrapped/update.sh b/pkgs/by-name/li/librewolf-bin-unwrapped/update.sh
index beeee3124a37..9116a5b95dc1 100755
--- a/pkgs/by-name/li/librewolf-bin-unwrapped/update.sh
+++ b/pkgs/by-name/li/librewolf-bin-unwrapped/update.sh
@@ -19,6 +19,6 @@ for i in \
     "x86_64-linux linux-x86_64" \
     "aarch64-linux linux-arm64"; do
     set -- $i
-    hash=$(nix hash convert --to sri --hash-algo sha256 $(curl ${GITLAB_TOKEN:+-H "Private-Token: $GITLAB_TOKEN"} -sL https://gitlab.com/api/v4/projects/44042130/packages/generic/librewolf/$latestVersion/librewolf-$latestVersion-$2-package.tar.xz.sha256sum))
+    hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 $(curl ${GITLAB_TOKEN:+-H "Private-Token: $GITLAB_TOKEN"} -sL https://gitlab.com/api/v4/projects/44042130/packages/generic/librewolf/$latestVersion/librewolf-$latestVersion-$2-package.tar.xz.sha256sum))
     update-source-version librewolf-bin-unwrapped $latestVersion $hash --system=$1 --ignore-same-version
 done
diff --git a/pkgs/by-name/lm/lmstudio/update.sh b/pkgs/by-name/lm/lmstudio/update.sh
index 4b9f5ef47560..415c2006e172 100755
--- a/pkgs/by-name/lm/lmstudio/update.sh
+++ b/pkgs/by-name/lm/lmstudio/update.sh
@@ -11,7 +11,7 @@ for system in "aarch64-darwin darwin/arm64" "x86_64-linux linux/x64"; do
   arch="${1}"
   url=$(echo "${packages}" | grep "${2}")
   version="$(echo "${url}" | cut -d/ -f6)"
-  hash=$(nix hash convert --hash-algo sha256 "$(nix-prefetch-url "${url}")")
+  hash=$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 "$(nix-prefetch-url "${url}")")
 
   update-source-version lmstudio "${version}" "${hash}" --system="${arch}" --version-key="version_${arch}" \
     2> >(tee /dev/stderr) | grep -q "nothing to do" && exit
diff --git a/pkgs/by-name/lo/localsend/update.sh b/pkgs/by-name/lo/localsend/update.sh
index 1b8b3085b933..de38328446b2 100755
--- a/pkgs/by-name/lo/localsend/update.sh
+++ b/pkgs/by-name/lo/localsend/update.sh
@@ -17,10 +17,10 @@ fi
 sed -i "s/version = \".*\"/version = \"${latestVersion}\"/" "$ROOT/package.nix"
 
 DARWIN_x64_URL="https://github.com/localsend/localsend/releases/download/v${latestVersion}/LocalSend-${latestVersion}.dmg"
-DARWIN_X64_SHA=$(nix hash to-sri --type sha256 $(nix-prefetch-url ${DARWIN_x64_URL}))
+DARWIN_X64_SHA=$(nix --extra-experimental-features nix-command hash to-sri --type sha256 $(nix-prefetch-url ${DARWIN_x64_URL}))
 sed -i "/darwin/,/hash/{s|hash = \".*\"|hash = \"${DARWIN_X64_SHA}\"|}" "$ROOT/package.nix"
 
 GIT_SRC_URL="https://github.com/localsend/localsend/archive/refs/tags/v${latestVersion}.tar.gz"
-GIT_SRC_SHA=$(nix hash to-sri --type sha256 $(nix-prefetch-url --unpack ${GIT_SRC_URL}))
+GIT_SRC_SHA=$(nix --extra-experimental-features nix-command hash to-sri --type sha256 $(nix-prefetch-url --unpack ${GIT_SRC_URL}))
 sed -i "/linux/,/hash/{s|hash = \".*\"|hash = \"${GIT_SRC_SHA}\"|}" "$ROOT/package.nix"
 curl https://raw.githubusercontent.com/localsend/localsend/v${latestVersion}/app/pubspec.lock | yq . > $ROOT/pubspec.lock.json
diff --git a/pkgs/by-name/mi/mihomo-party/update.sh b/pkgs/by-name/mi/mihomo-party/update.sh
index 406680fd0208..9e12398c0068 100755
--- a/pkgs/by-name/mi/mihomo-party/update.sh
+++ b/pkgs/by-name/mi/mihomo-party/update.sh
@@ -18,6 +18,6 @@ for i in \
     "aarch64-linux arm64"; do
     set -- $i
     prefetch=$(nix-prefetch-url "https://github.com/mihomo-party-org/mihomo-party/releases/download/v$latestVersion/mihomo-party-linux-$latestVersion-$2.deb")
-    hash=$(nix hash convert --hash-algo sha256 --to sri $prefetch)
+    hash=$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri $prefetch)
     update-source-version mihomo-party $latestVersion $hash --system=$1 --ignore-same-version
 done
diff --git a/pkgs/by-name/mu/mullvad-browser/update.nix b/pkgs/by-name/mu/mullvad-browser/update.nix
index 148a8ecc9bcd..16cfdb2cc197 100644
--- a/pkgs/by-name/mu/mullvad-browser/update.nix
+++ b/pkgs/by-name/mu/mullvad-browser/update.nix
@@ -67,7 +67,7 @@ writeShellScript "update-${pname}" ''
   for platform in ${lib.escapeShellArgs meta.platforms}; do
     arch="''${platforms[$platform]}"
     sha256=$(grep "${name}-$arch-$version.tar.xz" "$HOME/shasums" | head -1 | cut -d" " -f1)
-    hash=$(nix hash to-sri --type sha256 "$sha256")
+    hash=$(nix --extra-experimental-features nix-command hash to-sri --type sha256 "$sha256")
 
     update-source-version "${pname}" "$version" "$hash" --ignore-same-version --source-key="sources.$platform"
   done
diff --git a/pkgs/by-name/nb/nbxplorer/util/update-common.sh b/pkgs/by-name/nb/nbxplorer/util/update-common.sh
index e9b05253c403..2ac0118c26df 100755
--- a/pkgs/by-name/nb/nbxplorer/util/update-common.sh
+++ b/pkgs/by-name/nb/nbxplorer/util/update-common.sh
@@ -58,7 +58,7 @@ echo
 echo "Verifying commit"
 git -C $repo verify-commit HEAD
 rm -rf $repo/.git
-newHash=$(nix hash-path $repo)
+newHash=$(nix --extra-experimental-features nix-command hash path $repo)
 rm -rf $tmpdir
 echo
 
diff --git a/pkgs/by-name/om/ombi/update.sh b/pkgs/by-name/om/ombi/update.sh
index 9b49180b6f11..0a32e9b423cc 100755
--- a/pkgs/by-name/om/ombi/update.sh
+++ b/pkgs/by-name/om/ombi/update.sh
@@ -15,7 +15,7 @@ updateHash()
 
     url="https://github.com/Ombi-app/Ombi/releases/download/v$version/$os-$arch.tar.gz"
     hash=$(nix-prefetch-url --type sha256 $url)
-    sriHash="$(nix hash to-sri --type sha256 $hash)"
+    sriHash="$(nix --extra-experimental-features nix-command hash to-sri --type sha256 $hash)"
 
     sed -i "s|$hashKey = \"[a-zA-Z0-9\/+-=]*\";|$hashKey = \"$sriHash\";|g" "$dirname/default.nix"
 }
diff --git a/pkgs/by-name/pd/pdfium-binaries/update.sh b/pkgs/by-name/pd/pdfium-binaries/update.sh
index 8cc3aecd7933..7546a8926329 100755
--- a/pkgs/by-name/pd/pdfium-binaries/update.sh
+++ b/pkgs/by-name/pd/pdfium-binaries/update.sh
@@ -21,7 +21,7 @@ for system in \
     aarch64-linux \
     x86_64-darwin \
     aarch64-darwin; do
-    hash=$(nix hash convert --to sri --hash-algo sha256 $(nix-prefetch-url --unpack $(nix-instantiate --eval -E "with import ./. {}; pdfium-binaries.src.url" --system "$system" | tr -d '"')))
+    hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 $(nix-prefetch-url --unpack $(nix-instantiate --eval -E "with import ./. {}; pdfium-binaries.src.url" --system "$system" | tr -d '"')))
     update-source-version pdfium-binaries $latestVersion $hash --system=$system --ignore-same-version
 done
 
@@ -30,6 +30,6 @@ for system in \
     aarch64-linux \
     x86_64-darwin \
     aarch64-darwin; do
-    hash=$(nix hash convert --to sri --hash-algo sha256 $(nix-prefetch-url --unpack $(nix-instantiate --eval -E "with import ./. {}; pdfium-binaries-v8.src.url" --system "$system" | tr -d '"')))
+    hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 $(nix-prefetch-url --unpack $(nix-instantiate --eval -E "with import ./. {}; pdfium-binaries-v8.src.url" --system "$system" | tr -d '"')))
     update-source-version pdfium-binaries-v8 $latestVersion $hash --system=$system --ignore-same-version
 done
diff --git a/pkgs/by-name/pe/perses/update.sh b/pkgs/by-name/pe/perses/update.sh
index 8c0948f24e75..092727655033 100755
--- a/pkgs/by-name/pe/perses/update.sh
+++ b/pkgs/by-name/pe/perses/update.sh
@@ -23,7 +23,7 @@ src="$(nix-build -A "${UPDATE_NIX_ATTR_PATH}".src --no-out-link)"
     echo "    url = \"${url}\";"
 
     hash="$(nix-prefetch-url "${url}" --name "${UPDATE_NIX_PNAME}-${name,,}-${version}.tar.gz")"
-    hash="$(nix hash convert --hash-algo sha256 "${hash}")"
+    hash="$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 "${hash}")"
 
     echo "    hash = \"${hash}\";"
 
diff --git a/pkgs/by-name/ph/phoenixd/update.sh b/pkgs/by-name/ph/phoenixd/update.sh
index 3b43d0443740..a983312c6a71 100755
--- a/pkgs/by-name/ph/phoenixd/update.sh
+++ b/pkgs/by-name/ph/phoenixd/update.sh
@@ -19,6 +19,6 @@ for system in \
     aarch64-linux \
     x86_64-darwin \
     aarch64-darwin; do
-    hash=$(nix hash convert --to sri --hash-algo sha256 $(nix-prefetch-url $(nix-instantiate --eval -E "with import ./. {}; phoenixd.src.url" --system "$system" | tr -d '"')))
+    hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 $(nix-prefetch-url $(nix-instantiate --eval -E "with import ./. {}; phoenixd.src.url" --system "$system" | tr -d '"')))
     update-source-version phoenixd $latestVersion $hash --system=$system --ignore-same-version
 done
diff --git a/pkgs/by-name/pi/pilipalax/update.sh b/pkgs/by-name/pi/pilipalax/update.sh
index dd22b6a805c3..6f8e37101fd3 100755
--- a/pkgs/by-name/pi/pilipalax/update.sh
+++ b/pkgs/by-name/pi/pilipalax/update.sh
@@ -18,7 +18,7 @@ fi
 
 sed -i "s/\(tag = \"\${version}+\)[0-9]\+/\1${RunNumber}/" "$ROOT/package.nix"
 
-hash=$(nix hash convert --hash-algo sha256 --to sri $(nix-prefetch-url --unpack "https://github.com/orz12/PiliPalaX/archive/refs/tags/${latestTag}.tar.gz"))
+hash=$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri $(nix-prefetch-url --unpack "https://github.com/orz12/PiliPalaX/archive/refs/tags/${latestTag}.tar.gz"))
 update-source-version pilipalax $latestVersion $hash
 
 curl https://raw.githubusercontent.com/orz12/PiliPalaX/${latestTag}/pubspec.lock | yq . >$ROOT/pubspec.lock.json
diff --git a/pkgs/by-name/pl/platformsh/update.sh b/pkgs/by-name/pl/platformsh/update.sh
index a5df69f2970b..6da4fddd5ffe 100755
--- a/pkgs/by-name/pl/platformsh/update.sh
+++ b/pkgs/by-name/pl/platformsh/update.sh
@@ -10,9 +10,9 @@ version=$(curl -s ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} \
 linux_arm64_url=https://github.com/platformsh/cli/releases/download/$version/platform_${version}_linux_arm64.tar.gz
 linux_amd64_url=https://github.com/platformsh/cli/releases/download/$version/platform_${version}_linux_amd64.tar.gz
 darwin_all_url=https://github.com/platformsh/cli/releases/download/$version/platform_${version}_darwin_all.tar.gz
-linux_arm64_hash=$(nix hash to-sri --type sha256 $(nix-prefetch-url --type sha256 "$linux_arm64_url"))
-linux_amd64_hash=$(nix hash to-sri --type sha256 $(nix-prefetch-url --type sha256 "$linux_amd64_url"))
-darwin_all_hash=$(nix hash to-sri --type sha256 $(nix-prefetch-url --type sha256 "$darwin_all_url"))
+linux_arm64_hash=$(nix --extra-experimental-features nix-command hash to-sri --type sha256 $(nix-prefetch-url --type sha256 "$linux_arm64_url"))
+linux_amd64_hash=$(nix --extra-experimental-features nix-command hash to-sri --type sha256 $(nix-prefetch-url --type sha256 "$linux_amd64_url"))
+darwin_all_hash=$(nix --extra-experimental-features nix-command hash to-sri --type sha256 $(nix-prefetch-url --type sha256 "$darwin_all_url"))
 jq -n \
     --arg version "$version" \
     --arg darwin_all_hash "$darwin_all_hash" \
diff --git a/pkgs/by-name/pr/protoc-gen-grpc-java/update.sh b/pkgs/by-name/pr/protoc-gen-grpc-java/update.sh
index a7e62e72cea1..b0c8e2f98df4 100755
--- a/pkgs/by-name/pr/protoc-gen-grpc-java/update.sh
+++ b/pkgs/by-name/pr/protoc-gen-grpc-java/update.sh
@@ -27,7 +27,7 @@ version="$(
 echo '{' >"${HASHES_FILE}"
 for arch in "${ARCHS[@]}"; do
   url="https://repo1.maven.org/maven2/io/grpc/protoc-gen-grpc-java/${version}/protoc-gen-grpc-java-${version}-${arch}.exe"
-  hash=$(nix hash convert --hash-algo sha256 --to sri "$(nix-prefetch-url "${url}")")
+  hash=$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri "$(nix-prefetch-url "${url}")")
   echo "  ${arch} = \"${hash}\";" >>"${HASHES_FILE}"
 done
 echo '}' >>"${HASHES_FILE}"
diff --git a/pkgs/by-name/qq/qq/update.sh b/pkgs/by-name/qq/qq/update.sh
index e281dbf08b72..334f6e9443b8 100755
--- a/pkgs/by-name/qq/qq/update.sh
+++ b/pkgs/by-name/qq/qq/update.sh
@@ -16,7 +16,7 @@ darwin_url=$(jq -r .downloadUrl <<< "$darwin_payload")
 darwin_hash=$(nix-prefetch-url $darwin_url)
 
 # use friendlier hashes
-darwin_hash=$(nix hash convert --to sri --hash-algo sha256 "$darwin_hash")
+darwin_hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 "$darwin_hash")
 
 # linux
 
@@ -31,8 +31,8 @@ linux_aarch64_hash=$(nix-prefetch-url $linux_aarch64_url)
 linux_x86_64_hash=$(nix-prefetch-url $linux_x86_64_url)
 
 # use friendlier hashes
-linux_aarch64_hash=$(nix hash convert --to sri --hash-algo sha256 "$linux_aarch64_hash")
-linux_x86_64_hash=$(nix hash convert --to sri --hash-algo sha256 "$linux_x86_64_hash")
+linux_aarch64_hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 "$linux_aarch64_hash")
+linux_x86_64_hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 "$linux_x86_64_hash")
 
 cat >sources.nix <<EOF
 # Generated by ./update.sh - do not update manually!
diff --git a/pkgs/by-name/re/readarr/update.sh b/pkgs/by-name/re/readarr/update.sh
index 4334c3aa8527..74d696d90f3f 100755
--- a/pkgs/by-name/re/readarr/update.sh
+++ b/pkgs/by-name/re/readarr/update.sh
@@ -15,7 +15,7 @@ updateHash()
 
     url="https://github.com/Readarr/Readarr/releases/download/v$version/Readarr.develop.$version.$os-core-$arch.tar.gz"
     hash=$(nix-prefetch-url --type sha256 $url)
-    sriHash="$(nix hash to-sri --type sha256 $hash)"
+    sriHash="$(nix --extra-experimental-features nix-command hash to-sri --type sha256 $hash)"
 
     sed -i "s|$hashKey = \"[a-zA-Z0-9\/+-=]*\";|$hashKey = \"$sriHash\";|g" "$dirname/package.nix"
 }
diff --git a/pkgs/by-name/rn/rnnoise/package.nix b/pkgs/by-name/rn/rnnoise/package.nix
index 96127916b5cc..432be6ff64ae 100644
--- a/pkgs/by-name/rn/rnnoise/package.nix
+++ b/pkgs/by-name/rn/rnnoise/package.nix
@@ -65,7 +65,7 @@ stdenv.mkDerivation (finalAttrs: {
     #!nix-shell -i bash -p curl jq common-updater-scripts nix nix-prefetch findutils moreutils
 
     prefetch-sri() {
-        nix-prefetch-url "$1" | xargs nix hash to-sri --type sha256
+        nix-prefetch-url "$1" | xargs nix --extra-experimental-features nix-command hash to-sri --type sha256
     }
 
     res="$(curl ''${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} \
diff --git a/pkgs/by-name/ru/rundeck/package.nix b/pkgs/by-name/ru/rundeck/package.nix
index 12da62d4f0f2..c56b3c2082cd 100644
--- a/pkgs/by-name/ru/rundeck/package.nix
+++ b/pkgs/by-name/ru/rundeck/package.nix
@@ -55,7 +55,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     if [[ "x$UPDATE_NIX_OLD_VERSION" != "x$full_version" ]]; then
       download_url="https://packagecloud.io/pagerduty/rundeck/packages/java/org.rundeck/rundeck-$full_version.war/artifacts/rundeck-$full_version.war/download?distro_version_id=167"
-      hash=$(curl -L "$download_url" | nix-hash --flat --type sha256 --base32 - | nix hash to-sri --type sha256)
+      hash=$(curl -L "$download_url" | nix-hash --flat --type sha256 --base32 - | nix --extra-experimental-features nix-command hash to-sri --type sha256)
       update-source-version "$UPDATE_NIX_ATTR_PATH" "$full_version" "$hash"
     fi
   '';
diff --git a/pkgs/by-name/si/signal-desktop-bin/update.sh b/pkgs/by-name/si/signal-desktop-bin/update.sh
index 10b73d331c91..408624617ada 100755
--- a/pkgs/by-name/si/signal-desktop-bin/update.sh
+++ b/pkgs/by-name/si/signal-desktop-bin/update.sh
@@ -17,7 +17,7 @@ latestBuildAarch64=$(jq '.id' <<< $latestBuildInfoAarch64)
 latestVersionAarch64=$(jq -r '.source_package.version' <<< $latestBuildInfoAarch64)
 latestPrettyVersionAarch64="${latestVersionAarch64%-*}"
 
-darwinHash="$(nix hash convert --hash-algo sha256 --to sri "$(nix-prefetch-url "https://updates.signal.org/desktop/signal-desktop-mac-universal-${latestVersion}.dmg")")"
+darwinHash="$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri "$(nix-prefetch-url "https://updates.signal.org/desktop/signal-desktop-mac-universal-${latestVersion}.dmg")")"
 
 echo "Updating signal-desktop for x86_64-linux"
 update-source-version signal-desktop-bin "$latestVersion" \
diff --git a/pkgs/by-name/sp/sparkle/update.sh b/pkgs/by-name/sp/sparkle/update.sh
index 2aa1a555d142..c7e559d34660 100755
--- a/pkgs/by-name/sp/sparkle/update.sh
+++ b/pkgs/by-name/sp/sparkle/update.sh
@@ -13,5 +13,5 @@ if [[ "$latestVersion" == "$currentVersion" ]]; then
 fi
 
 nix-update sparkle --version $latestVersion --system x86_64-linux
-hash=$(nix hash convert --to sri --hash-algo sha256 $(nix-prefetch-url $(nix-instantiate --eval -E "with import ./. {}; sparkle.src.url" --system aarch64-linux | tr -d '"')))
+hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 $(nix-prefetch-url $(nix-instantiate --eval -E "with import ./. {}; sparkle.src.url" --system aarch64-linux | tr -d '"')))
 update-source-version sparkle $latestVersion $hash --system=aarch64-linux --ignore-same-version
diff --git a/pkgs/by-name/st/standardnotes/update.nix b/pkgs/by-name/st/standardnotes/update.nix
index a6110e0684de..abd69308c55f 100644
--- a/pkgs/by-name/st/standardnotes/update.nix
+++ b/pkgs/by-name/st/standardnotes/update.nix
@@ -61,7 +61,7 @@ writeScript "update-standardnotes" ''
     upstreamPlatform="$2"
     url=$(getDownloadUrl "$upstreamPlatform")
     hash=$(nix-prefetch-url "$url" --type sha512)
-    sriHash=$(nix hash to-sri --type sha512 $hash)
+    sriHash=$(nix --extra-experimental-features nix-command hash to-sri --type sha512 $hash)
     setJsonKey .deb[\""$nixPlatform"\"].url "$url"
     setJsonKey .deb[\""$nixPlatform"\"].hash "$sriHash"
   }
diff --git a/pkgs/by-name/st/stockfish/update.bash b/pkgs/by-name/st/stockfish/update.bash
index aaf294fd027d..6e1ecfc525e2 100644
--- a/pkgs/by-name/st/stockfish/update.bash
+++ b/pkgs/by-name/st/stockfish/update.bash
@@ -2,12 +2,12 @@ new_src="$(nix-build --attr "pkgs.$PNAME.src" --no-out-link)"
 new_nnue_big_file="$(grep --perl-regexp --only-matching 'EvalFileDefaultNameBig "\Knn-(\w+).nnue' "$new_src/src/evaluate.h")"
 new_nnue_small_file="$(grep --perl-regexp --only-matching 'EvalFileDefaultNameSmall "\Knn-(\w+).nnue' "$new_src/src/evaluate.h")"
 new_nnue_big_hash="$(
-    nix hash convert --hash-algo sha256 "$(
+    nix --extra-experimental-features nix-command hash convert --hash-algo sha256 "$(
         nix-prefetch-url --type sha256 "https://tests.stockfishchess.org/api/nn/$new_nnue_big_file"
     )"
 )"
 new_nnue_small_hash="$(
-    nix hash convert --hash-algo sha256 "$(
+    nix --extra-experimental-features nix-command hash convert --hash-algo sha256 "$(
         nix-prefetch-url --type sha256 "https://tests.stockfishchess.org/api/nn/$new_nnue_small_file"
     )"
 )"
diff --git a/pkgs/by-name/su/sudachidict/update.sh b/pkgs/by-name/su/sudachidict/update.sh
index 4d89a50c00c1..df4d47ed7422 100755
--- a/pkgs/by-name/su/sudachidict/update.sh
+++ b/pkgs/by-name/su/sudachidict/update.sh
@@ -17,7 +17,7 @@ for TYPE in "${DICT_TYPES[@]}"; do
   URL="https://github.com/$ORG/$REPO/releases/download/v$VERSION/sudachi-dictionary-$VERSION-$TYPE.zip"
 
   PLAIN_HASH=$(nix-prefetch-url --type sha256 "$URL" --unpack)
-  HASH=$(nix hash convert --hash-algo sha256 --to sri "$PLAIN_HASH")
+  HASH=$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri "$PLAIN_HASH")
 
   sed -i -E "/(${TYPE} = fetchzip \{|^ *url = .*${TYPE}\.zip\";\$)/,/^ *hash = / s|hash = \"[^\"]*\"|hash = \"$HASH\"|" package.nix
 done
diff --git a/pkgs/by-name/ta/tailwindcss_3/update.sh b/pkgs/by-name/ta/tailwindcss_3/update.sh
index 1a5f68d74f07..0bc2cd7d0117 100755
--- a/pkgs/by-name/ta/tailwindcss_3/update.sh
+++ b/pkgs/by-name/ta/tailwindcss_3/update.sh
@@ -19,7 +19,7 @@ function updatePlatform() {
     echo "Updating tailwindcss_3 for $NIXPLAT"
 
     URL="https://github.com/tailwindlabs/tailwindcss/releases/download/v${LATEST_VERSION}/tailwindcss-${TAILWINDPLAT}"
-    HASH=$(nix hash to-sri --type sha256 "$(nix-prefetch-url --type sha256 "$URL")")
+    HASH=$(nix --extra-experimental-features nix-command hash to-sri --type sha256 "$(nix-prefetch-url --type sha256 "$URL")")
 
     sed -i "s,$NIXPLAT = \"sha256.*\",$NIXPLAT = \"${HASH}\"," "$ROOT/package.nix"
 }
diff --git a/pkgs/by-name/ta/tandoor-recipes/update.sh b/pkgs/by-name/ta/tandoor-recipes/update.sh
index f197ead847e4..ee0d655b89db 100755
--- a/pkgs/by-name/ta/tandoor-recipes/update.sh
+++ b/pkgs/by-name/ta/tandoor-recipes/update.sh
@@ -34,7 +34,7 @@ yarn_hash=$(prefetch-yarn-deps yarn.lock)
 popd
 
 # Use friendlier hashes
-yarn_hash=$(nix hash to-sri --type sha256 "$yarn_hash")
+yarn_hash=$(nix --extra-experimental-features nix-command hash to-sri --type sha256 "$yarn_hash")
 
 common="./pkgs/applications/misc/tandoor-recipes/common.nix"
 sed -i -E -e "s#version = \".*\"#version = \"$version\"#" $common
diff --git a/pkgs/by-name/te/termius/package.nix b/pkgs/by-name/te/termius/package.nix
index 893cacdbcc08..30b80e4010fc 100644
--- a/pkgs/by-name/te/termius/package.nix
+++ b/pkgs/by-name/te/termius/package.nix
@@ -99,7 +99,7 @@ stdenv.mkDerivation rec {
     if [[ "x$UPDATE_NIX_OLD_VERSION" != "x$version" ]]; then
 
         revision=$(jq -r .revision <<<"$data")
-        hash=$(nix hash to-sri "sha512:$(jq -r .download_sha512 <<<"$data")")
+        hash=$(nix --extra-experimental-features nix-command hash to-sri "sha512:$(jq -r .download_sha512 <<<"$data")")
 
         update-source-version "$UPDATE_NIX_ATTR_PATH" "$version" "$hash"
         update-source-version --ignore-same-hash --version-key=revision "$UPDATE_NIX_ATTR_PATH" "$revision" "$hash"
diff --git a/pkgs/by-name/th/the-unarchiver/update/update.mjs b/pkgs/by-name/th/the-unarchiver/update/update.mjs
index 5ec4d67749eb..7fe8295d3a9a 100755
--- a/pkgs/by-name/th/the-unarchiver/update/update.mjs
+++ b/pkgs/by-name/th/the-unarchiver/update/update.mjs
@@ -84,7 +84,7 @@ async function main() {
     process.exit(1);
   }
   const hash = child_process
-    .execSync(`nix hash convert --hash-algo sha256 --to sri ${prefetchHash}`)
+    .execSync(`nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri ${prefetchHash}`)
     .toString()
     .trim();
   /** @type {Info} */
diff --git a/pkgs/by-name/to/tor-browser/update.nix b/pkgs/by-name/to/tor-browser/update.nix
index 148a8ecc9bcd..16cfdb2cc197 100644
--- a/pkgs/by-name/to/tor-browser/update.nix
+++ b/pkgs/by-name/to/tor-browser/update.nix
@@ -67,7 +67,7 @@ writeShellScript "update-${pname}" ''
   for platform in ${lib.escapeShellArgs meta.platforms}; do
     arch="''${platforms[$platform]}"
     sha256=$(grep "${name}-$arch-$version.tar.xz" "$HOME/shasums" | head -1 | cut -d" " -f1)
-    hash=$(nix hash to-sri --type sha256 "$sha256")
+    hash=$(nix --extra-experimental-features nix-command hash to-sri --type sha256 "$sha256")
 
     update-source-version "${pname}" "$version" "$hash" --ignore-same-version --source-key="sources.$platform"
   done
diff --git a/pkgs/by-name/tr/tradingview/update.sh b/pkgs/by-name/tr/tradingview/update.sh
index c3f38cbb4206..9fdbd4f7ffe1 100755
--- a/pkgs/by-name/tr/tradingview/update.sh
+++ b/pkgs/by-name/tr/tradingview/update.sh
@@ -15,7 +15,7 @@ snap_info=($(
 # "revision" is the actual version identifier; "version" is for human consumption.
 revision="${snap_info[0]}"
 sha512="${snap_info[1]}"
-sri=$(nix hash to-sri --type "sha512" $sha512)
+sri=$(nix --extra-experimental-features nix-command hash to-sri --type "sha512" $sha512)
 upstream_version="${snap_info[2]}"
 last_updated="${snap_info[3]}"
 
diff --git a/pkgs/by-name/ty/typesense/update.sh b/pkgs/by-name/ty/typesense/update.sh
index 3dec74232f46..7d502bc63a74 100755
--- a/pkgs/by-name/ty/typesense/update.sh
+++ b/pkgs/by-name/ty/typesense/update.sh
@@ -32,7 +32,7 @@ for platform in "${!platforms[@]}"; do
     arch="${platforms[$platform]}"
     url="https://dl.typesense.org/releases/${version}/typesense-server-${version}-${arch}.tar.gz"
     sha256hash="$(nix-prefetch-url --type sha256 "$url")"
-    hash="$(nix hash to-sri --type sha256 "$sha256hash")"
+    hash="$(nix --extra-experimental-features nix-command hash to-sri --type sha256 "$sha256hash")"
     echo "$(jq --arg arch "$arch" \
       --arg platform "$platform" \
       --arg hash "$hash" \
diff --git a/pkgs/by-name/up/upsun/update.sh b/pkgs/by-name/up/upsun/update.sh
index d01cef8a59e9..28fe856c91de 100755
--- a/pkgs/by-name/up/upsun/update.sh
+++ b/pkgs/by-name/up/upsun/update.sh
@@ -10,9 +10,9 @@ version=$(curl -s ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} \
 linux_arm64_url=https://github.com/platformsh/cli/releases/download/$version/upsun_${version}_linux_arm64.tar.gz
 linux_amd64_url=https://github.com/platformsh/cli/releases/download/$version/upsun_${version}_linux_amd64.tar.gz
 darwin_all_url=https://github.com/platformsh/cli/releases/download/$version/upsun_${version}_darwin_all.tar.gz
-linux_arm64_hash=$(nix hash to-sri --type sha256 $(nix-prefetch-url --type sha256 "$linux_arm64_url"))
-linux_amd64_hash=$(nix hash to-sri --type sha256 $(nix-prefetch-url --type sha256 "$linux_amd64_url"))
-darwin_all_hash=$(nix hash to-sri --type sha256 $(nix-prefetch-url --type sha256 "$darwin_all_url"))
+linux_arm64_hash=$(nix --extra-experimental-features nix-command hash to-sri --type sha256 $(nix-prefetch-url --type sha256 "$linux_arm64_url"))
+linux_amd64_hash=$(nix --extra-experimental-features nix-command hash to-sri --type sha256 $(nix-prefetch-url --type sha256 "$linux_amd64_url"))
+darwin_all_hash=$(nix --extra-experimental-features nix-command hash to-sri --type sha256 $(nix-prefetch-url --type sha256 "$darwin_all_url"))
 jq -n \
     --arg version "$version" \
     --arg darwin_all_hash "$darwin_all_hash" \
diff --git a/pkgs/by-name/va/vault-bin/update-bin.sh b/pkgs/by-name/va/vault-bin/update-bin.sh
index f397f48c6852..8a3ff2504196 100755
--- a/pkgs/by-name/va/vault-bin/update-bin.sh
+++ b/pkgs/by-name/va/vault-bin/update-bin.sh
@@ -15,7 +15,7 @@ function calc_hash () {
     local arch=$2
     url="https://releases.hashicorp.com/vault/${version}/vault_${version}_${arch}.zip"
     zip_hash=$(nix-prefetch-url --unpack $url)
-    nix hash to-sri --type sha256 "$zip_hash"
+    nix --extra-experimental-features nix-command hash to-sri --type sha256 "$zip_hash"
 }
 
 replace_sha() {
diff --git a/pkgs/by-name/vi/vivaldi/update-vivaldi.sh b/pkgs/by-name/vi/vivaldi/update-vivaldi.sh
index 994257889ee6..043569a1445b 100755
--- a/pkgs/by-name/vi/vivaldi/update-vivaldi.sh
+++ b/pkgs/by-name/vi/vivaldi/update-vivaldi.sh
@@ -7,7 +7,7 @@ version=$(curl -sS https://vivaldi.com/download/ | sed -rne 's/.*vivaldi-stable_
 
 update_hash() {
     url="https://downloads.vivaldi.com/stable/vivaldi-stable_$version-1_$2.deb"
-    hash=$(nix hash to-sri --type sha256 $(nix-prefetch-url --type sha256 "$url"))
+    hash=$(nix --extra-experimental-features nix-command hash to-sri --type sha256 $(nix-prefetch-url --type sha256 "$url"))
     update-source-version vivaldi "$version" "$hash" --system=$1 --ignore-same-version
 }
 
diff --git a/pkgs/by-name/wa/waveterm/update.sh b/pkgs/by-name/wa/waveterm/update.sh
index e04f4c805dbd..a6464739a68a 100755
--- a/pkgs/by-name/wa/waveterm/update.sh
+++ b/pkgs/by-name/wa/waveterm/update.sh
@@ -20,7 +20,7 @@ for i in \
     "aarch64-linux arm64"; do
     set -- $i
     prefetch=$(nix-prefetch-url "https://github.com/wavetermdev/waveterm/releases/download/v$latestVersion/waveterm-linux-$2-$latestVersion.deb")
-    hash=$(nix hash convert --hash-algo sha256 --to sri $prefetch)
+    hash=$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri $prefetch)
     update-source-version waveterm $latestVersion $hash --system=$1 --ignore-same-version
 done
 
@@ -29,6 +29,6 @@ for i in \
     "aarch64-darwin arm64"; do
     set -- $i
     prefetch=$(nix-prefetch-url "https://github.com/wavetermdev/waveterm/releases/download/v$latestVersion/Wave-darwin-$2-$latestVersion.zip")
-    hash=$(nix hash convert --hash-algo sha256 --to sri $prefetch)
+    hash=$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri $prefetch)
     update-source-version waveterm $latestVersion $hash --system=$1 --ignore-same-version
 done
diff --git a/pkgs/by-name/we/wechat-uos/update.sh b/pkgs/by-name/we/wechat-uos/update.sh
index 8797c5132395..61c85b671837 100644
--- a/pkgs/by-name/we/wechat-uos/update.sh
+++ b/pkgs/by-name/we/wechat-uos/update.sh
@@ -40,7 +40,7 @@ do
     }
     ')
     url+=("https://pro-store-packages.uniontech.com/appstore/pool/appstore/c/com.tencent.wechat/com.tencent.wechat_"$version"_"$i".deb")
-    hash+=("$(nix hash to-sri --type sha256 $sha256sum)")
+    hash+=("$(nix --extra-experimental-features nix-command hash to-sri --type sha256 $sha256sum)")
 done
 
 cat >sources.nix <<EOF
diff --git a/pkgs/by-name/wh/whisparr/update.sh b/pkgs/by-name/wh/whisparr/update.sh
index 6e9b69e65a02..0ef19ea4d8ad 100755
--- a/pkgs/by-name/wh/whisparr/update.sh
+++ b/pkgs/by-name/wh/whisparr/update.sh
@@ -24,7 +24,7 @@ updateHash()
   echo "Updating the hash for the \`${system}\` system..."
   url="https://whisparr.servarr.com/v1/update/nightly/updatefile?runtime=netcore&version=${version}&arch=${arch}&os=${os}"
   hash=$(nix-prefetch-url --type sha256 --name "whisparr-$system-$version.tar.gz" "$url")
-  sriHash="$(nix hash to-sri --type sha256 "$hash")"
+  sriHash="$(nix --extra-experimental-features nix-command hash to-sri --type sha256 "$hash")"
 
   sed -i "s#$hashKey = \"[a-zA-Z0-9\/+-=]*\"#$hashKey = \"$sriHash\"#" "$dirname/package.nix"
 }
diff --git a/pkgs/by-name/xu/xunlei-uos/update.sh b/pkgs/by-name/xu/xunlei-uos/update.sh
index d931853a1c3d..78b1769b3504 100644
--- a/pkgs/by-name/xu/xunlei-uos/update.sh
+++ b/pkgs/by-name/xu/xunlei-uos/update.sh
@@ -40,7 +40,7 @@ do
     }
     ')
     url+=("https://pro-store-packages.uniontech.com/appstore/pool/appstore/c/com.xunlei.download/com.xunlei.download_"$version"_"$i".deb")
-    hash+=("$(nix hash convert --to sri --hash-algo sha256 $sha256sum)")
+    hash+=("$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 $sha256sum)")
 done
 
 cat >sources.nix <<EOF
diff --git a/pkgs/by-name/ya/yazi/plugins/update.py b/pkgs/by-name/ya/yazi/plugins/update.py
index 999b04b4f079..2a6cbfbafc6f 100755
--- a/pkgs/by-name/ya/yazi/plugins/update.py
+++ b/pkgs/by-name/ya/yazi/plugins/update.py
@@ -134,12 +134,12 @@ def calculate_sri_hash(owner: str, repo: str, latest_commit: str) -> str:
         new_hash = run_command(f"nix-prefetch-url --unpack --type sha256 {prefetch_url} 2>/dev/null")
 
         if not new_hash.startswith("sha256-"):
-            new_hash = run_command(f"nix hash to-sri --type sha256 {new_hash} 2>/dev/null")
+            new_hash = run_command(f"nix --extra-experimental-features nix-command hash to-sri --type sha256 {new_hash} 2>/dev/null")
 
             if not new_hash.startswith("sha256-"):
                 print("Warning: Failed to get SRI hash directly, trying alternative method...")
                 raw_hash = run_command(f"nix-prefetch-url --type sha256 {prefetch_url} 2>/dev/null")
-                new_hash = run_command(f"nix hash to-sri --type sha256 {raw_hash} 2>/dev/null")
+                new_hash = run_command(f"nix --extra-experimental-features nix-command hash to-sri --type sha256 {raw_hash} 2>/dev/null")
     except Exception as e:
         raise RuntimeError(f"Error calculating hash: {e}")
 
diff --git a/pkgs/by-name/zo/zoom-us/update.sh b/pkgs/by-name/zo/zoom-us/update.sh
index b7d7be55f1b8..d307058ceb5d 100755
--- a/pkgs/by-name/zo/zoom-us/update.sh
+++ b/pkgs/by-name/zo/zoom-us/update.sh
@@ -21,9 +21,9 @@ echo >&2 "=== Downloading packages and computing hashes..."
 # causes cross compiling headaches; using nix-prefetch-url with
 # hard-coded URLs is simpler.  Keep these URLs in sync with the ones
 # in package.nix where `srcs` is defined.
-hash_aarch64_darwin=$(nix hash to-sri --type sha256 $(nix-prefetch-url --type sha256 "https://zoom.us/client/${version_aarch64_darwin}/zoomusInstallerFull.pkg?archType=arm64"))
-hash_x86_64_darwin=$(nix hash to-sri --type sha256 $(nix-prefetch-url --type sha256 "https://zoom.us/client/${version_x86_64_darwin}/zoomusInstallerFull.pkg"))
-hash_x86_64_linux=$(nix hash to-sri --type sha256 $(nix-prefetch-url --type sha256 "https://zoom.us/client/${version_x86_64_linux}/zoom_x86_64.pkg.tar.xz"))
+hash_aarch64_darwin=$(nix --extra-experimental-features nix-command hash to-sri --type sha256 $(nix-prefetch-url --type sha256 "https://zoom.us/client/${version_aarch64_darwin}/zoomusInstallerFull.pkg?archType=arm64"))
+hash_x86_64_darwin=$(nix --extra-experimental-features nix-command hash to-sri --type sha256 $(nix-prefetch-url --type sha256 "https://zoom.us/client/${version_x86_64_darwin}/zoomusInstallerFull.pkg"))
+hash_x86_64_linux=$(nix --extra-experimental-features nix-command hash to-sri --type sha256 $(nix-prefetch-url --type sha256 "https://zoom.us/client/${version_x86_64_linux}/zoom_x86_64.pkg.tar.xz"))
 
 echo >&2 "=== Updating package.nix ..."
 # update-source-version expects to be at the root of nixpkgs
diff --git a/pkgs/development/compilers/dotnet/update.sh b/pkgs/development/compilers/dotnet/update.sh
index 2eb3d9cc234e..2e4b41244d70 100755
--- a/pkgs/development/compilers/dotnet/update.sh
+++ b/pkgs/development/compilers/dotnet/update.sh
@@ -43,7 +43,7 @@ platform_sources () {
 
         [[ -z "$url" || -z "$hash" ]] && continue
 
-        hash=$(nix hash convert --to sri --hash-algo sha512 "$hash")
+        hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha512 "$hash")
 
         echo "      $rid = {
         url = \"$url\";
@@ -73,7 +73,7 @@ generate_package_list() {
         if hash=$(curl -s --head "$url" -o /dev/null -w '%header{x-ms-meta-sha512}') && [[ -n "$hash" ]]; then
             # Undocumented fast path for nuget.org
             # https://github.com/NuGet/NuGetGallery/issues/9433#issuecomment-1472286080
-            hash=$(nix hash convert --to sri --hash-algo sha512 "$hash")
+            hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha512 "$hash")
         elif {
             catalog_url=$(curl -sL --compressed "${nuget_registration_base_url}${pkg,,}/${version,,}.json" | jq -r ".catalogEntry") && [[ -n "$catalog_url" ]] &&
             catalog=$(curl -sL "$catalog_url") && [[ -n "$catalog" ]] &&
@@ -81,11 +81,11 @@ generate_package_list() {
             hash=$(jq -er '.packageHash' <<<"$catalog") && [[ -n "$hash" ]]
         }; then
             # Documented but slower path (requires 2 requests)
-            hash=$(nix hash convert --to sri --hash-algo "${hash_algorithm,,}" "$hash")
+            hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo "${hash_algorithm,,}" "$hash")
         elif hash=$(nix-prefetch-url "$url" --type sha512); then
             # Fallback to downloading and hashing locally
             echo "Failed to fetch hash from nuget for $url, falling back to downloading locally" >&2
-            hash=$(nix hash convert --to sri --hash-algo sha512 "$hash")
+            hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha512 "$hash")
         else
             echo "Failed to fetch hash for $url" >&2
             exit 1
diff --git a/pkgs/development/compilers/graalvm/graalvm-oracle/hashes.nix b/pkgs/development/compilers/graalvm/graalvm-oracle/hashes.nix
index 52d5f2212b1b..ea5de7396f10 100644
--- a/pkgs/development/compilers/graalvm/graalvm-oracle/hashes.nix
+++ b/pkgs/development/compilers/graalvm/graalvm-oracle/hashes.nix
@@ -2,7 +2,7 @@
 # https://www.oracle.com/java/technologies/javase/graalvm-jdk23-archive-downloads.html
 # Then run this script:
 # $ rg -No "(https://.+)\"" -r '$1' pkgs/development/compilers/graalvm/graalvm-oracle/hashes.nix | \
-#   parallel -k 'echo {}; nix hash convert --hash-algo sha256 --to sri $(curl -s {}.sha256)'
+#   parallel -k 'echo {}; nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri $(curl -s {}.sha256)'
 {
   "23" = {
     "aarch64-linux" = {
diff --git a/pkgs/development/libraries/libcef/update.sh b/pkgs/development/libraries/libcef/update.sh
index 04bfeb627a52..556337c5333d 100755
--- a/pkgs/development/libraries/libcef/update.sh
+++ b/pkgs/development/libraries/libcef/update.sh
@@ -38,6 +38,6 @@ declare -a platforms=(
 for platform in "${platforms[@]}"; do
     read -r system arch <<< "$platform"
     url="https://cef-builds.spotifycdn.com/cef_binary_${cef_version}+g${git_revision}+chromium-${chromium_version}_linux${arch}_minimal.tar.bz2"
-    hash=$(nix hash convert --to sri --hash-algo sha256 "$(nix-prefetch-url --quiet "$url")")
+    hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 "$(nix-prefetch-url --quiet "$url")")
     update-source-version libcef "$cef_version" "$hash" --system="$system" --ignore-same-version
 done
diff --git a/pkgs/development/libraries/science/math/libtorch/prefetch.sh b/pkgs/development/libraries/science/math/libtorch/prefetch.sh
index d8680d3a60cf..4ae96be7aa75 100755
--- a/pkgs/development/libraries/science/math/libtorch/prefetch.sh
+++ b/pkgs/development/libraries/science/math/libtorch/prefetch.sh
@@ -23,7 +23,7 @@ for url_and_key in "${url_and_key_list[@]}"; do
   name=$(echo "$url_and_key" | cut -d' ' -f3)
 
   echo "prefetching ${url}..."
-  hash=$(nix hash to-sri --type sha256 $(nix-prefetch-url --unpack "$url" --name "$name"))
+  hash=$(nix --extra-experimental-features nix-command hash to-sri --type sha256 $(nix-prefetch-url --unpack "$url" --name "$name"))
 
   echo "    $key = {" >> $hashfile
   echo "      name = \"$name\";" >> $hashfile
diff --git a/pkgs/development/python-modules/jaxlib/prefetch.sh b/pkgs/development/python-modules/jaxlib/prefetch.sh
index 1a4f38daa6a7..d90cb0e97ff9 100755
--- a/pkgs/development/python-modules/jaxlib/prefetch.sh
+++ b/pkgs/development/python-modules/jaxlib/prefetch.sh
@@ -6,7 +6,7 @@ prefetch() {
     url=$(NIX_PATH=.. nix-instantiate --eval -E "$expr" | jq -r)
     echo "$url"
     sha256=$(nix-prefetch-url "$url")
-    nix hash convert --to sri --hash-algo sha256 "$sha256"
+    nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 "$sha256"
     echo
 }
 
diff --git a/pkgs/development/python-modules/mypy-boto3/update.sh b/pkgs/development/python-modules/mypy-boto3/update.sh
index 53622b479ed4..3e9b90693ad2 100755
--- a/pkgs/development/python-modules/mypy-boto3/update.sh
+++ b/pkgs/development/python-modules/mypy-boto3/update.sh
@@ -368,7 +368,7 @@ for package in "${packages[@]}"; do
   if [ "${version}" != "${old_version}" ]; then
     url="https://pypi.io/packages/source/m/${package//-/_}/${package//-/_}-${version}.tar.gz"
     hash=$(nix-prefetch-url --type sha256 $url)
-    sri_hash="$(nix hash to-sri --type sha256 $hash)"
+    sri_hash="$(nix --extra-experimental-features nix-command hash to-sri --type sha256 $hash)"
 
     awk -i inplace -v pkg="\"$package_short_name\"" -v new_version="$version" -v new_sha256="$sri_hash" '
       # Match the line containing the package name
diff --git a/pkgs/development/python-modules/ray/prefetch.sh b/pkgs/development/python-modules/ray/prefetch.sh
index e12eb5e06558..e91ca7d77f8f 100755
--- a/pkgs/development/python-modules/ray/prefetch.sh
+++ b/pkgs/development/python-modules/ray/prefetch.sh
@@ -13,7 +13,7 @@ prefetch() {
     url=$(NIX_PATH=.. nix-instantiate --eval -E "$expr" | jq -r)
 
     sha256=$(nix-prefetch-url "$url")
-    hash=$(nix hash convert --to sri --hash-algo sha256 "$sha256")
+    hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 "$sha256")
 
     echo -e "  cp${1} = \"${hash}\";" >>$outfile
     echo
diff --git a/pkgs/development/python-modules/torch/bin/prefetch.sh b/pkgs/development/python-modules/torch/bin/prefetch.sh
index 169d5f802ab0..bfb942c2cad2 100755
--- a/pkgs/development/python-modules/torch/bin/prefetch.sh
+++ b/pkgs/development/python-modules/torch/bin/prefetch.sh
@@ -37,7 +37,7 @@ for url_and_key in "${url_and_key_list[@]}"; do
     name=$(echo "$url_and_key" | cut -d' ' -f3)
 
     echo "prefetching ${url}..."
-    hash=$(nix hash convert --hash-algo sha256 $(nix-prefetch-url "$url" --name "$name"))
+    hash=$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 $(nix-prefetch-url "$url" --name "$name"))
 
     echo "    $key = {" >>$hashfile
     echo "      name = \"$name\";" >>$hashfile
diff --git a/pkgs/development/python-modules/torchaudio/prefetch.sh b/pkgs/development/python-modules/torchaudio/prefetch.sh
index 466e4a4c043f..b3c22e498664 100755
--- a/pkgs/development/python-modules/torchaudio/prefetch.sh
+++ b/pkgs/development/python-modules/torchaudio/prefetch.sh
@@ -37,7 +37,7 @@ for url_and_key in "${url_and_key_list[@]}"; do
     name=$(echo "$url_and_key" | cut -d' ' -f3)
 
     echo "prefetching ${url}..."
-    hash=$(nix hash convert --hash-algo sha256 $(nix-prefetch-url "$url" --name "$name"))
+    hash=$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 $(nix-prefetch-url "$url" --name "$name"))
 
     echo "    $key = {" >>$hashfile
     echo "      name = \"$name\";" >>$hashfile
diff --git a/pkgs/development/python-modules/torchvision/prefetch.sh b/pkgs/development/python-modules/torchvision/prefetch.sh
index 06decb3e3b09..d4d631cc96b5 100755
--- a/pkgs/development/python-modules/torchvision/prefetch.sh
+++ b/pkgs/development/python-modules/torchvision/prefetch.sh
@@ -36,7 +36,7 @@ for url_and_key in "${url_and_key_list[@]}"; do
     name=$(echo "$url_and_key" | cut -d' ' -f3)
 
     echo "prefetching ${url}..."
-    hash=$(nix hash convert --hash-algo sha256 $(nix-prefetch-url "$url" --name "$name"))
+    hash=$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 $(nix-prefetch-url "$url" --name "$name"))
 
     echo "    $key = {" >>$hashfile
     echo "      name = \"$name\";" >>$hashfile
diff --git a/pkgs/development/python-modules/types-aiobotocore/update.sh b/pkgs/development/python-modules/types-aiobotocore/update.sh
index b9dd1c209a9e..de00ff30f3ff 100755
--- a/pkgs/development/python-modules/types-aiobotocore/update.sh
+++ b/pkgs/development/python-modules/types-aiobotocore/update.sh
@@ -371,7 +371,7 @@ for package in "${packages[@]}"; do
 
   url="https://pypi.io/packages/source/t/${package}/${package//-/_}-${version}.tar.gz"
   hash=$(nix-prefetch-url --type sha256 $url)
-  sri_hash="$(nix hash convert --hash-algo sha256 --to sri $hash)"
+  sri_hash="$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri $hash)"
   package_short="${package#types-aiobotocore-}"
 
   awk -i inplace -v pkg="$package" -v pkg_short="$package_short" -v ver="$version" -v hash="$sri_hash" '
diff --git a/pkgs/development/tools/continuous-integration/woodpecker/update.sh b/pkgs/development/tools/continuous-integration/woodpecker/update.sh
index a52906ac8c98..e1b4eb449dba 100755
--- a/pkgs/development/tools/continuous-integration/woodpecker/update.sh
+++ b/pkgs/development/tools/continuous-integration/woodpecker/update.sh
@@ -28,5 +28,5 @@ sed -i -E -e "s#version = \".*\"#version = \"$version\"#" common.nix
 
 # Woodpecker repository
 src_hash=$(nix-prefetch-url --type sha256 --unpack "https://github.com/woodpecker-ci/woodpecker/releases/download/v$version/woodpecker-src.tar.gz")
-src_hash=$(nix hash to-sri --type sha256 "$src_hash")
+src_hash=$(nix --extra-experimental-features nix-command hash to-sri --type sha256 "$src_hash")
 sed -i -E -e "s#srcHash = \".*\"#srcHash = \"$src_hash\"#" common.nix
diff --git a/pkgs/development/tools/infisical/update.sh b/pkgs/development/tools/infisical/update.sh
index d0ad2342f415..dc2a855d9cf0 100755
--- a/pkgs/development/tools/infisical/update.sh
+++ b/pkgs/development/tools/infisical/update.sh
@@ -29,7 +29,7 @@ printf "{ \"_comment\": \"@generated by pkgs/development/tools/infisical/update.
 for arch in "${ARCHS[@]}"; do
     IFS=: read -r arch_name arch_target <<< "$arch"
     sha256hash="$(nix-prefetch-url --type sha256 "https://github.com/infisical/infisical/releases/download/${RELEASE_NAME}/infisical_${VERSION}_${arch_target}.tar.gz")"
-    srihash="$(nix hash to-sri --type sha256 "$sha256hash")"
+    srihash="$(nix --extra-experimental-features nix-command hash to-sri --type sha256 "$sha256hash")"
     echo ", \"$arch_name\": \"$srihash\"" >> "$HFILE"
 done
 echo "}" >> "$HFILE"
diff --git a/pkgs/development/tools/rover/update.sh b/pkgs/development/tools/rover/update.sh
index a9a5bdb6ad6c..4cb5d448da34 100755
--- a/pkgs/development/tools/rover/update.sh
+++ b/pkgs/development/tools/rover/update.sh
@@ -24,7 +24,7 @@ rover_tar_url="https://github.com/apollographql/rover/archive/refs/tags/${rover_
 } < <(nix-prefetch-url "$rover_tar_url" --unpack --type sha256 --print-path)
 
 # Convert hash to SRI representation
-rover_sri_hash=$(nix hash to-sri --type sha256 "$rover_hash")
+rover_sri_hash=$(nix --extra-experimental-features nix-command hash to-sri --type sha256 "$rover_hash")
 
 # Update rover version.
 sed --in-place \
diff --git a/pkgs/misc/lilypond/update.sh b/pkgs/misc/lilypond/update.sh
index a2dc8e48242d..5d5f855dbd7c 100755
--- a/pkgs/misc/lilypond/update.sh
+++ b/pkgs/misc/lilypond/update.sh
@@ -21,5 +21,5 @@ echo "[{\"commitMessage\":\"$ATTR: $PREV -> $NEXT\"}]"
 
 # update hash
 PREV=$(nix eval --raw -f default.nix $ATTR.src.outputHash)
-NEXT=$(nix hash to-sri --type sha256 $(nix-prefetch-url --type sha256 --unpack $(nix eval --raw -f default.nix $ATTR.src.url)))
+NEXT=$(nix --extra-experimental-features nix-command hash to-sri --type sha256 $(nix-prefetch-url --type sha256 --unpack $(nix eval --raw -f default.nix $ATTR.src.url)))
 sed -i "s|$PREV|$NEXT|" "$FILE"
diff --git a/pkgs/os-specific/linux/batman-adv/version.nix b/pkgs/os-specific/linux/batman-adv/version.nix
index 51bd7732b1e5..ac3b657e4a6e 100644
--- a/pkgs/os-specific/linux/batman-adv/version.nix
+++ b/pkgs/os-specific/linux/batman-adv/version.nix
@@ -4,7 +4,7 @@
   # To get these, run:
   #
   # ```
-  # for tool in alfred batctl batman-adv; do nix-prefetch-url https://downloads.open-mesh.org/batman/releases/batman-adv-2025.2/$tool-2025.2.tar.gz --type sha256 | xargs nix hash convert --hash-algo sha256 --to sri; done
+  # for tool in alfred batctl batman-adv; do nix-prefetch-url https://downloads.open-mesh.org/batman/releases/batman-adv-2025.2/$tool-2025.2.tar.gz --type sha256 | xargs nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri; done
   # ```
   sha256 = {
     alfred = "sha256-Q0fR5LB5Svv2sXGoV7mjx9UaKR/FTxbNrZLH99HNtRo=";
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/bootstrap-sources.nix b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/bootstrap-sources.nix
index 200e2d51bc69..4f247197dc13 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/bootstrap-sources.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/bootstrap-sources.nix
@@ -22,7 +22,7 @@ rec {
 
     Run the following command:
     ```
-    nix hash path $(nix build --print-out-paths -f '<nixpkgs>' make-minimal-bootstrap-sources)
+    nix --extra-experimental-features nix-command hash path $(nix build --print-out-paths -f '<nixpkgs>' make-minimal-bootstrap-sources)
     ```
 
     # Why do we need this `.nar` archive?
diff --git a/pkgs/servers/etcd/3.5/update.sh b/pkgs/servers/etcd/3.5/update.sh
index 6c11ce1be748..2a3d9b108707 100755
--- a/pkgs/servers/etcd/3.5/update.sh
+++ b/pkgs/servers/etcd/3.5/update.sh
@@ -27,7 +27,7 @@ OLD_VERSION="$(nix-instantiate --eval -E "with import $NIXPKGS_PATH {}; \
 if [ ! "$OLD_VERSION" = "$LATEST_VERSION" ]; then
     echo "Attempting to update etcd from $OLD_VERSION to $LATEST_VERSION"
     ETCD_SRC_HASH=$(nix-prefetch-url --quiet --unpack https://github.com/etcd-io/etcd/archive/refs/tags/${LATEST_TAG}.tar.gz)
-    ETCD_SRC_HASH=$(nix hash to-sri --type sha256 $ETCD_SRC_HASH)
+    ETCD_SRC_HASH=$(nix --extra-experimental-features nix-command hash to-sri --type sha256 $ETCD_SRC_HASH)
 
     setKV () {
         sed -i "s|$1 = \".*\"|$1 = \"${2:-}\"|" "$ETCD_PATH/default.nix"
diff --git a/pkgs/servers/lidarr/update.sh b/pkgs/servers/lidarr/update.sh
index e87f6888a8dd..a0712f299113 100755
--- a/pkgs/servers/lidarr/update.sh
+++ b/pkgs/servers/lidarr/update.sh
@@ -15,7 +15,7 @@ updateHash()
 
     url="https://github.com/Lidarr/Lidarr/releases/download/v$version/Lidarr.master.$version.$os-core-$arch.tar.gz"
     hash=$(nix-prefetch-url --type sha256 $url)
-    sriHash="$(nix hash to-sri --type sha256 $hash)"
+    sriHash="$(nix --extra-experimental-features nix-command hash to-sri --type sha256 $hash)"
 
     sed -i "s|$hashKey = \"[a-zA-Z0-9\/+-=]*\";|$hashKey = \"$sriHash\";|g" "$dirname/default.nix"
 }
diff --git a/pkgs/tools/admin/ibmcloud-cli/update.sh b/pkgs/tools/admin/ibmcloud-cli/update.sh
index c2b80cb104f2..26f1525a3202 100755
--- a/pkgs/tools/admin/ibmcloud-cli/update.sh
+++ b/pkgs/tools/admin/ibmcloud-cli/update.sh
@@ -23,7 +23,7 @@ for system in \
     aarch64-darwin; do
     tmp=$(mktemp -d)
     curl -fsSL -o $tmp/ibmcloud-cli $(nix-instantiate --eval -E "with import ./. {}; ibmcloud-cli.src.url" --system "$system" | tr -d '"')
-    hash=$(nix hash file $tmp/ibmcloud-cli)
+    hash=$(nix --extra-experimental-features nix-command hash file $tmp/ibmcloud-cli)
     update-source-version ibmcloud-cli $latestVersion $hash --system=$system --ignore-same-version
     rm -rf $tmp
 done
diff --git a/pkgs/tools/misc/xvfb-run/update.sh b/pkgs/tools/misc/xvfb-run/update.sh
index e592323154e2..11b6449495e7 100755
--- a/pkgs/tools/misc/xvfb-run/update.sh
+++ b/pkgs/tools/misc/xvfb-run/update.sh
@@ -7,7 +7,7 @@ set -e
 info=$(nix-prefetch-git --quiet --url "https://github.com/archlinux/svntogit-packages" --rev "refs/heads/packages/xorg-server")
 
 rev=$(jq -r '.rev' <<< "$info")
-sha256=$(nix hash to-sri --type sha256 "$(jq -r '.sha256' <<< "$info")")
+sha256=$(nix --extra-experimental-features nix-command hash to-sri --type sha256 "$(jq -r '.sha256' <<< "$info")")
 dir=$(jq -r '.path' <<< "$info")
 
 newXvfbsha=$(sha256sum "$dir/trunk/xvfb-run")