The traditional way is to reduce the surface area of the core package as much as possible, such that it sees less changes/releases overall. The way I would do

The traditional way is to reduce the surface area of the core package as much as possible, such that it sees less changes/releases overall. The way I would do it with nix is: because everything gets hashed, just check that the built output with a new nix-pkg version matches the hash with the old version and fail out/fetch the older version as a second step. The rest is just finding ways to cache that build fail information so that you can share the result across users transparently.