diff --git a/packages/romm-mcp/package.nix b/packages/romm-mcp/package.nix
index 9e067c0..76b5ca4 100644
--- a/packages/romm-mcp/package.nix
+++ b/packages/romm-mcp/package.nix
@@ -10,7 +10,7 @@ buildNpmPackage rec {
 
   src = fetchzip {
     url = "https://registry.npmjs.org/${pname}/-/${pname}-${version}.tgz";
-    hash = "sha256-Cg4Pa2jxwmMyuc2LyFJA1uNjFgaLaPgMXyvpY2HrPFM=";
+    hash = "sha256-SOYzG0CtNSvIrxOYJq3UDXRlXylqbDjo2f5qfpbiYmI=";
   };
 
   # Upstream publishes no package-lock.json (only package.json), and
@@ -18,7 +18,7 @@ buildNpmPackage rec {
   # from the published tarball itself -- `npm install --package-lock-only
   # --ignore-scripts` inside the extracted 1.0.5 package -- so it locks exactly
   # the dependency tree that shipped with this version.
-  npmDepsHash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+  npmDepsHash = "sha256-oSlECdIf2ZP8ZZhOUChkcJAmUTj6TFTdeTJLY5RwLGo=";
 
   postPatch = ''
     cp ${./package-lock.json} package-lock.json