{
  lib,
  stdenvNoCC,
  makeWrapper,
  coreutils,
  nixos-rebuild,
  openssh,
}: let
  inherit (lib) makeBinPath;
  runtimeInputs = [
    coreutils
    nixos-rebuild
    openssh
  ];
in
  stdenvNoCC.mkDerivation {
    name = "remote-updater";
    src = ./src;
    nativeBuildInputs = [makeWrapper];
    buildInputs = runtimeInputs;
    installPhase = ''
      mkdir -p $out/bin
      cp $src/remote-updater.sh $out/bin/remote-updater
      chmod +x $out/bin/remote-updater
    '';
    postFixup = ''
      wrapProgram $out/bin/remote-updater     \
        --set PATH ${makeBinPath runtimeInputs}
    '';
  }