diff --git a/pkgs/by-name/co/conmon/package.nix b/pkgs/by-name/co/conmon/package.nix
index 5cdf2d780249..ad0840384a40 100644
--- a/pkgs/by-name/co/conmon/package.nix
+++ b/pkgs/by-name/co/conmon/package.nix
@@ -6,26 +6,38 @@
   glib,
   glibc,
   libseccomp,
-  systemd,
+  systemdMinimal,
   nixosTests,
+  versionCheckHook,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "conmon";
   version = "2.1.13";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "conmon";
-    rev = "v${version}";
-    hash = "sha256-XsVWcJsUc0Fkn7qGRJDG5xrQAsJr6KN7zMy3AtPuMTo=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-/Kt49c8a+R/+Z3KmFLpRTG+BdfPDAOEUtSis3alLAUQ=";
+    leaveDotGit = true;
+    postFetch = ''
+      cd $out
+      git rev-parse HEAD > COMMIT
+      rm -rf .git
+    '';
   };
 
+  preConfigure = ''
+    substituteInPlace Makefile \
+      --replace-fail "(GIT_COMMIT)" "(shell cat COMMIT)"
+  '';
+
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     glib
     libseccomp
-    systemd
+    systemdMinimal
   ]
   ++ lib.optionals (!stdenv.hostPlatform.isMusl) [
     glibc
@@ -35,7 +47,6 @@ stdenv.mkDerivation rec {
   # manpage requires building the vendored go-md2man
   makeFlags = [
     "bin/conmon"
-    "VERSION=${version}"
   ];
 
   installPhase = ''
@@ -49,13 +60,17 @@ stdenv.mkDerivation rec {
 
   passthru.tests = { inherit (nixosTests) cri-o podman; };
 
-  meta = with lib; {
-    changelog = "https://github.com/containers/conmon/releases/tag/${src.rev}";
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+
+  meta = {
+    changelog = "https://github.com/containers/conmon/releases/tag/${finalAttrs.src.tag}";
     homepage = "https://github.com/containers/conmon";
     description = "OCI container runtime monitor";
-    license = licenses.asl20;
-    teams = [ teams.podman ];
-    platforms = platforms.linux;
+    license = lib.licenses.asl20;
+    teams = [ lib.teams.podman ];
+    platforms = lib.platforms.linux;
     mainProgram = "conmon";
   };
-}
+})
diff --git a/pkgs/by-name/cr/crun/package.nix b/pkgs/by-name/cr/crun/package.nix
index d180b228c02e..6c2fa30a251b 100644
--- a/pkgs/by-name/cr/crun/package.nix
+++ b/pkgs/by-name/cr/crun/package.nix
@@ -8,10 +8,11 @@
   libcap,
   libseccomp,
   python3,
-  systemd,
+  systemdMinimal,
   yajl,
   nixosTests,
   criu,
+  versionCheckHook,
 }:
 
 let
@@ -38,16 +39,22 @@ let
   ];
 
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "crun";
   version = "1.25.1";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "crun";
-    rev = version;
+    tag = finalAttrs.version;
     hash = "sha256-WBAwyDODMrUDlgonRbxaNQ+aN8K6YicY2JVArXDJem8=";
     fetchSubmodules = true;
+    leaveDotGit = true;
+    postFetch = ''
+      cd $out
+      git rev-parse HEAD > COMMIT
+      rm -rf .git
+    '';
   };
 
   nativeBuildInputs = [
@@ -61,23 +68,25 @@ stdenv.mkDerivation rec {
     criu
     libcap
     libseccomp
-    systemd
+    systemdMinimal
     yajl
   ];
 
   enableParallelBuilding = true;
   strictDeps = true;
 
-  NIX_LDFLAGS = "-lcriu";
+  env = {
+    NIX_LDFLAGS = "-lcriu";
+  };
 
   # we need this before autoreconfHook does its thing in order to initialize
   # config.h with the correct values
   postPatch = ''
-    echo ${version} > .tarball-version
-    echo '#define GIT_VERSION "${src.rev}"' > git-version.h
+    echo ${finalAttrs.version} > .tarball-version
+    echo "#define GIT_VERSION \"$(cat COMMIT)\"" > git-version.h
 
     ${lib.concatMapStringsSep "\n" (
-      e: "substituteInPlace Makefile.am --replace 'tests/${e}' ''"
+      e: "substituteInPlace Makefile.am --replace-fail 'tests/${e}' ''"
     ) disabledTests}
   '';
 
@@ -85,8 +94,12 @@ stdenv.mkDerivation rec {
 
   passthru.tests = { inherit (nixosTests) podman; };
 
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+
   meta = {
-    changelog = "https://github.com/containers/crun/releases/tag/${version}";
+    changelog = "https://github.com/containers/crun/releases/tag/${finalAttrs.version}";
     description = "Fast and lightweight fully featured OCI runtime and C library for running containers";
     homepage = "https://github.com/containers/crun";
     license = lib.licenses.gpl2Plus;
@@ -94,4 +107,4 @@ stdenv.mkDerivation rec {
     teams = [ lib.teams.podman ];
     mainProgram = "crun";
   };
-}
+})
diff --git a/pkgs/by-name/po/podman/package.nix b/pkgs/by-name/po/podman/package.nix
index 74d743260233..6b7dd7cb6c10 100644
--- a/pkgs/by-name/po/podman/package.nix
+++ b/pkgs/by-name/po/podman/package.nix
@@ -11,7 +11,7 @@
   libapparmor,
   libseccomp,
   libselinux,
-  systemd,
+  systemdMinimal,
   go-md2man,
   nixosTests,
   python3,
@@ -83,7 +83,7 @@ buildGoModule (finalAttrs: {
     libseccomp
     libselinux
     lvm2
-    systemd
+    systemdMinimal
   ];
 
   env = {
@@ -134,7 +134,7 @@ buildGoModule (finalAttrs: {
 
   postFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
     RPATH=$(patchelf --print-rpath $out/bin/.podman-wrapped)
-    patchelf --set-rpath "${lib.makeLibraryPath [ systemd ]}":$RPATH $out/bin/.podman-wrapped
+    patchelf --set-rpath "${lib.makeLibraryPath [ systemdMinimal ]}":$RPATH $out/bin/.podman-wrapped
     substituteInPlace "$out/share/systemd/user/podman-user-wait-network-online.service" \
       --replace-fail sleep '${coreutils}/bin/sleep' \
       --replace-fail /bin/sh '${runtimeShell}'