diff --git a/nix/build-support/check-zig-cache-hash.sh b/nix/build-support/check-zig-cache-hash.sh
index 2fd1ead5b..49ea29ffb 100755
--- a/nix/build-support/check-zig-cache-hash.sh
+++ b/nix/build-support/check-zig-cache-hash.sh
@@ -25,16 +25,19 @@ elif [ "$1" != "--update" ]; then
   exit 1
 fi
 
-TMP_CACHE_DIR="$(mktemp --directory --suffix nix-zig-cache)"
+ZIG_GLOBAL_CACHE_DIR="$(mktemp --directory --suffix nix-zig-cache)"
+export ZIG_GLOBAL_CACHE_DIR
+
 # This is not 100% necessary in CI but is helpful when running locally to keep
 # a local workstation clean.
-trap 'rm -rf "${TMP_CACHE_DIR}"' EXIT
+trap 'rm -rf "${ZIG_GLOBAL_CACHE_DIR}"' EXIT
 
 # Run Zig and download the cache to the temporary directory.
-zig build --fetch --global-cache-dir "${TMP_CACHE_DIR}"
+
+sh ./nix/build-support/fetch-zig-cache.sh
 
 # Now, calculate the hash.
-ZIG_CACHE_HASH="sha256-$(nix-hash --type sha256 --to-base64 "$(nix-hash --type sha256 "${TMP_CACHE_DIR}")")"
+ZIG_CACHE_HASH="sha256-$(nix-hash --type sha256 --to-base64 "$(nix-hash --type sha256 "${ZIG_GLOBAL_CACHE_DIR}")")"
 
 if [ "${OLD_CACHE_HASH}" == "${ZIG_CACHE_HASH}" ]; then
   echo -e "\nOK: Zig cache store hash unchanged."
diff --git a/nix/build-support/fetch-zig-cache.sh b/nix/build-support/fetch-zig-cache.sh
new file mode 100644
index 000000000..56b94e35d
--- /dev/null
+++ b/nix/build-support/fetch-zig-cache.sh
@@ -0,0 +1,39 @@
+#!/bin/sh
+
+set -e
+
+# Because Zig does not fetch recursive dependencies when you run `zig build
+# --fetch` (see https://github.com/ziglang/zig/issues/20976) we need to do some
+# extra work to fetch everything that we actually need to build without Internet
+# access (such as when building a Nix package).
+#
+# An example of this happening:
+#
+# error: builder for '/nix/store/cx8qcwrhjmjxik2547fw99v5j6np5san-ghostty-0.1.0.drv' failed with exit code 1;
+#        la/build/tmp.xgHOheUF7V/p/12208cfdda4d5fdbc81b0c44b82e4d6dba2d4a86bff644a153e026fdfc80f8469133/build.zig.zon:7:20: error: unable to discover remote git server capabilities: TemporaryNameServerFailure
+#        >             .url = "git+https://github.com/zigimg/zigimg#3a667bdb3d7f0955a5a51c8468eac83210c1439e",
+#        >                    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#        > /build/tmp.xgHOheUF7V/p/12208cfdda4d5fdbc81b0c44b82e4d6dba2d4a86bff644a153e026fdfc80f8469133/build.zig.zon:16:20: error: unable to discover remote git server capabilities: TemporaryNameServerFailure
+#        >             .url = "git+https://github.com/mitchellh/libxev#f6a672a78436d8efee1aa847a43a900ad773618b",
+#        >                    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#        >
+#        For full logs, run 'nix log /nix/store/cx8qcwrhjmjxik2547fw99v5j6np5san-ghostty-0.1.0.drv'.
+#
+# To update this script, add any failing URLs with a line like this:
+#
+#    zig fetch <url>
+#
+# Periodically old URLs may need to be cleaned out.
+#
+# Hopefully when the Zig issue is fixed this script can be eliminated in favor
+# of a plain `zig build --fetch`.
+
+if [ -z ${ZIG_GLOBAL_CACHE_DIR+x} ]
+then
+  echo "must set ZIG_GLOBAL_CACHE_DIR!"
+  exit 1
+fi
+
+zig build --fetch
+zig fetch git+https://github.com/zigimg/zigimg#3a667bdb3d7f0955a5a51c8468eac83210c1439e
+zig fetch git+https://github.com/mitchellh/libxev#f6a672a78436d8efee1aa847a43a900ad773618b
diff --git a/nix/package.nix b/nix/package.nix
index b8d69eef9..fccaf1c92 100644
--- a/nix/package.nix
+++ b/nix/package.nix
@@ -56,6 +56,7 @@
         ../vendor
         ../build.zig
         ../build.zig.zon
+        ./build-support/fetch-zig-cache.sh
       ]
     );
   };
@@ -90,7 +91,7 @@
     buildPhase = ''
       runHook preBuild
 
-      zig build --fetch
+      sh ./nix/build-support/fetch-zig-cache.sh
 
       runHook postBuild
     '';
diff --git a/nix/zigCacheHash.nix b/nix/zigCacheHash.nix
index 92e656264..f11d67db1 100644
--- a/nix/zigCacheHash.nix
+++ b/nix/zigCacheHash.nix
@@ -1,3 +1,3 @@
 # This file is auto-generated! check build-support/check-zig-cache-hash.sh for
 # more details.
-"sha256-qFt9sC3GekfU940Gd9oV9Gcbs5MdxVMojIMbkDo3m2A="
+"sha256-JsAEfg1jp20aGz9YXG/QEp4MS5K5J5U7zFS2Orw2K/s="