diff --git a/Cargo.lock b/Cargo.lock
index 734a32e8bd..53c7967778 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -11422,7 +11422,6 @@ dependencies = [
  "fs-err",
  "futures",
  "macaddr",
- "md5",
  "reqwest",
  "serde",
  "sha2",
diff --git a/dev-tools/xtask/Cargo.toml b/dev-tools/xtask/Cargo.toml
index 9268eafc3e..acf225cd9d 100644
--- a/dev-tools/xtask/Cargo.toml
+++ b/dev-tools/xtask/Cargo.toml
@@ -17,7 +17,6 @@ flate2.workspace = true
 futures.workspace = true
 fs-err.workspace = true
 macaddr.workspace = true
-md5 = "0.7.0"
 reqwest = { workspace = true, features = [ "default-tls" ] }
 serde.workspace = true
 sha2.workspace = true
diff --git a/dev-tools/xtask/src/download.rs b/dev-tools/xtask/src/download.rs
index 3002837507..2790a638a7 100644
--- a/dev-tools/xtask/src/download.rs
+++ b/dev-tools/xtask/src/download.rs
@@ -257,23 +257,6 @@ async fn streaming_download(url: &str, path: &Utf8Path) -> Result<()> {
     Ok(())
 }
 
-/// Returns the hex, lowercase md5 checksum of a file at `path`.
-async fn md5_checksum(path: &Utf8Path) -> Result<String> {
-    let mut buf = vec![0u8; 65536];
-    let mut file = tokio::fs::File::open(path).await?;
-    let mut ctx = md5::Context::new();
-    loop {
-        let n = file.read(&mut buf).await?;
-        if n == 0 {
-            break;
-        }
-        ctx.write_all(&buf[0..n])?;
-    }
-
-    let digest = ctx.compute();
-    Ok(format!("{digest:x}"))
-}
-
 /// Returns the hex, lowercase sha2 checksum of a file at `path`.
 async fn sha2_checksum(path: &Utf8Path) -> Result<String> {
     let mut buf = vec![0u8; 65536];
@@ -382,14 +365,12 @@ async fn set_permissions(path: &Utf8Path, mode: u32) -> Result<()> {
 }
 
 enum ChecksumAlgorithm {
-    Md5,
     Sha2,
 }
 
 impl ChecksumAlgorithm {
     async fn checksum(&self, path: &Utf8Path) -> Result<String> {
         match self {
-            ChecksumAlgorithm::Md5 => md5_checksum(path).await,
             ChecksumAlgorithm::Sha2 => sha2_checksum(path).await,
         }
     }
@@ -459,7 +440,7 @@ impl<'a> Downloader<'a> {
 
         let checksums_path = self.versions_dir.join("clickhouse_checksums");
         let [checksum] = get_values_from_file(
-            [&format!("CIDL_MD5_{}", os.env_name())],
+            [&format!("CIDL_SHA256_{}", os.env_name())],
             &checksums_path,
         )
         .await?;
@@ -491,7 +472,7 @@ impl<'a> Downloader<'a> {
             &self.log,
             &tarball_path,
             &tarball_url,
-            ChecksumAlgorithm::Md5,
+            ChecksumAlgorithm::Sha2,
             &checksum,
         )
         .await?;
diff --git a/flake.lock b/flake.lock
index 7c6acc0815..5a70a42881 100644
--- a/flake.lock
+++ b/flake.lock
@@ -1,23 +1,5 @@
 {
   "nodes": {
-    "flake-utils": {
-      "inputs": {
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1705309234,
-        "narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1712791164,
@@ -42,17 +24,16 @@
     },
     "rust-overlay": {
       "inputs": {
-        "flake-utils": "flake-utils",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1712888034,
-        "narHash": "sha256-SmBeT3oxdwOzheSfxZmk+3xmv98Z3zlzjlnl9nBdOIE=",
+        "lastModified": 1719368303,
+        "narHash": "sha256-vhkKOUs9eOZgcPrA6wMw7a7J48pEjVuhzQfitVwVv1g=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "96fbdc73dec8eaa5a9d4a9b307b75c9a856e5dec",
+        "rev": "32415b22fd3b454e4a1385af64aa5cef9766ff4c",
         "type": "github"
       },
       "original": {
@@ -60,21 +41,6 @@
         "repo": "rust-overlay",
         "type": "github"
       }
-    },
-    "systems": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
     }
   },
   "root": "root",
diff --git a/flake.nix b/flake.nix
index 6828577403..831a0aaea2 100644
--- a/flake.nix
+++ b/flake.nix
@@ -255,12 +255,12 @@
         let
           name = "clickhouse";
           version = readVersionFile "${name}_version";
-          # N.B. that unlike maghemite and dendrite, the Clickhouse hashes
-          # in `tools/clickhouse_checksums` are MD5 rather than SHA256, so we
-          # can't give Nix those hashes and must instead determine it ourselves.
-          # this means that we will have to update this SHA if the clickhouse
-          # version changes.
-          sha256 = "0wx8w9sdms5hsc9f835ivsissf15wjzdb9cvxr65xdi384i9pkzx";
+          sha256 =
+            let
+              shaFile = builtins.readFile  ./tools/${name}_checksums;
+              shas = lib.strings.splitString "\n" shaFile;
+            in
+            findSha shas "CIDL_SHA256_LINUX";
           src = builtins.fetchurl
             {
               inherit sha256;
diff --git a/tools/clickhouse_checksums b/tools/clickhouse_checksums
index afddb15cab..54ffaddb3d 100644
--- a/tools/clickhouse_checksums
+++ b/tools/clickhouse_checksums
@@ -1,3 +1,3 @@
-CIDL_MD5_DARWIN="3e20c3284b7e6b0cfcfedf622ecf547a"
-CIDL_MD5_LINUX="f6c30a25a86deac3bad6c50dcf758fd5"
-CIDL_MD5_ILLUMOS="409222de8ecb59e5dd97dcc942ccdffe"
+CIDL_SHA256_DARWIN="275843f5942bf84a27cfededa2314d70d4a3300d7762045e1f1b5cd93e97c6a1"
+CIDL_SHA256_LINUX="fdcf9b224123b65e4cee9ba5d5bee42538ada3deb10ce412d3b0e8da74e2a873"
+CIDL_SHA256_ILLUMOS="29ad158e985b088f6b8987b33dac96dcbaed9bdffc95ae0e880273cc125320b3"