diff --git a/flake.nix b/flake.nix
index 3576e3a0af..592e66a318 100644
--- a/flake.nix
+++ b/flake.nix
@@ -124,7 +124,22 @@
     in rec {
       # `nix develop`
       devShell = pkgs.mkShell {
-        buildInputs = devDeps;
+        buildInputs =
+          devDeps
+          ++ [
+            (pkgs.writeShellScriptBin
+              "nix-vendor-sri"
+              ''
+                set -eu
+
+                OUT=$(mktemp -d -t nar-hash-XXXXXX)
+                rm -rf "$OUT"
+
+                go mod vendor -o "$OUT"
+                go run tailscale.com/cmd/nardump --sri "$OUT"
+                rm -rf "$OUT"
+              '')
+          ];
 
         shellHook = ''
           export PATH="$PWD/result/bin:$PATH"