diff --git a/pkgs/servers/code-server/default.nix b/pkgs/servers/code-server/default.nix
index 7c038451b7c7..aaf3152f9b9c 100644
--- a/pkgs/servers/code-server/default.nix
+++ b/pkgs/servers/code-server/default.nix
@@ -71,18 +71,18 @@ let
   # To compute the commit when upgrading this derivation, do:
   # `$ git rev-parse <git-rev>` where <git-rev> is the git revision of the `src`
   # Example: `$ git rev-parse v4.16.1`
-  commit = "0c98611e6b43803a9d5dba222d7023b569abfb49";
+  commit = "9a28bc29dbddb6886dfe03dc1c31320249a901ce";
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "code-server";
-  version = "4.19.1";
+  version = "4.23.1";
 
   src = fetchFromGitHub {
     owner = "coder";
     repo = "code-server";
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-J+6zuqVf1YKQjiRiqO4867DEwYzZsgQYgbsRXPo2hwY=";
+    hash = "sha256-nOfdEbnnNLfePhqGSXD/2A0DxqoJCo8U18VFYnNvFMU=";
   };
 
   yarnCache = stdenv.mkDerivation {
@@ -114,7 +114,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     outputHashMode = "recursive";
     outputHashAlgo = "sha256";
-    outputHash = "sha256-g2rwB+PuWuYgrzIuW0ngia7cdPMC8s7ffBEkbmPPzB4=";
+    outputHash = "sha256-MxUQ9Gw7MabLKPs5j8+Q4v7IULr68Pd/OIBWpfZ+rVU=";
   };
 
   nativeBuildInputs = [
@@ -130,9 +130,12 @@ stdenv.mkDerivation (finalAttrs: {
     quilt
   ];
 
-  buildInputs = lib.optionals (!stdenv.isDarwin) [ libsecret ]
-    ++ (with xorg; [ libX11 libxkbfile ])
-    ++ lib.optionals stdenv.isDarwin [
+  buildInputs = [
+    xorg.libX11
+    xorg.libxkbfile
+  ] ++ lib.optionals (!stdenv.isDarwin) [
+    libsecret
+  ] ++ lib.optionals stdenv.isDarwin [
     AppKit
     Cocoa
     CoreServices
@@ -154,9 +157,9 @@ stdenv.mkDerivation (finalAttrs: {
 
     # inject git commit
     substituteInPlace ./ci/build/build-vscode.sh \
-      --replace '$(git rev-parse HEAD)' "${commit}"
+      --replace-fail '$(git rev-parse HEAD)' "${commit}"
     substituteInPlace ./ci/build/build-release.sh \
-      --replace '$(git rev-parse HEAD)' "${commit}"
+      --replace-fail '$(git rev-parse HEAD)' "${commit}"
   '';
 
   configurePhase = ''
@@ -193,29 +196,15 @@ stdenv.mkDerivation (finalAttrs: {
   buildPhase = ''
     runHook preBuild
 
-    # install code-server dependencies
-    yarn --offline --ignore-scripts
-
-    # apply patches
+    # Apply patches.
     quilt push -a
 
-    # patch shebangs of everything to allow binary packages to build
-    patchShebangs .
-
     export PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1
     export SKIP_SUBMODULE_DEPS=1
-    export NODE_OPTIONS=--openssl-legacy-provider
+    export NODE_OPTIONS="--openssl-legacy-provider --max-old-space-size=4096"
 
-    # rebuild binary packages now that scripts have been patched
-    echo "----- NPM rebuild"
-    npm rebuild --prefer-offline
-
-    # Replicate ci/dev/postinstall.sh
-    echo "----- Replicate ci/dev/postinstall.sh"
-    yarn --cwd "./vendor" install --modules-folder modules --offline --ignore-scripts --frozen-lockfile
-
-    # remove all built-in extensions, as these are 3rd party extensions that
-    # get downloaded from vscode marketplace
+    # Remove all built-in extensions, as these are 3rd party extensions that
+    # get downloaded from the VS Code marketplace.
     jq --slurp '.[0] * .[1]' "./lib/vscode/product.json" <(
       cat << EOF
     {
@@ -224,26 +213,42 @@ stdenv.mkDerivation (finalAttrs: {
     EOF
     ) | sponge ./lib/vscode/product.json
 
-    # disable automatic updates
+    # Disable automatic updates.
     sed -i '/update.mode/,/\}/{s/default:.*/default: "none",/g}' \
       lib/vscode/src/vs/platform/update/common/update.config.contribution.ts
 
-    # Patch out remote download of nodejs from build script
+    # Patch out remote download of nodejs from build script.
     patch -p1 -i ${./remove-node-download.patch}
 
-    # Fetch packages for vscode
-    find ./lib/vscode -name "yarn.lock" -printf "%h\n" | \
+    # Install dependencies.
+    patchShebangs .
+    find . -name "yarn.lock" -printf "%h\n" | \
         xargs -I {} yarn --cwd {} \
-          --frozen-lockfile --ignore-scripts --ignore-engines
-
-    # patch shebangs of everything to allow binary packages to build
+          --offline --frozen-lockfile --ignore-scripts --ignore-engines
     patchShebangs .
 
+    # Use esbuild from nixpkgs.
     ${patchEsbuild "./lib/vscode/build" "0.12.6"}
     ${patchEsbuild "./lib/vscode/extensions" "0.11.23"}
+
+    # Kerberos errors while building, so remove it for now as it is not
+    # required.
+    yarn remove kerberos --cwd lib/vscode/remote --offline --frozen-lockfile --ignore-scripts --ignore-engines
+
+    # Put ripgrep binary into bin, so post-install does not try to download it.
+    find -name ripgrep -type d \
+      -execdir mkdir -p {}/bin \; \
+      -execdir ln -s ${ripgrep}/bin/rg {}/bin/rg \;
+
+    # Run post-install scripts after patching.
+    find ./lib/vscode \( -path "*/node_modules/*" -or -path "*/extensions/*" \) \
+      -and -type f -name "yarn.lock" -printf "%h\n" | \
+        xargs -I {} sh -c 'jq -e ".scripts.postinstall" {}/package.json >/dev/null && yarn --cwd {} postinstall --frozen-lockfile --offline || true'
+    patchShebangs .
+
   '' + lib.optionalString stdenv.isDarwin ''
-    # use prebuilt binary for @parcel/watcher, which requires macOS SDK 10.13+
-    # (see issue #101229)
+    # Use prebuilt binary for @parcel/watcher, which requires macOS SDK 10.13+
+    # (see issue #101229).
     pushd ./lib/vscode/remote/node_modules/@parcel/watcher
     mkdir -p ./build/Release
     mv ./prebuilds/darwin-x64/node.napi.glibc.node ./build/Release/watcher.node
@@ -251,23 +256,15 @@ stdenv.mkDerivation (finalAttrs: {
     popd
   '' + ''
 
-    # put ripgrep binary into bin, so postinstall does not try to download it
-    find -name ripgrep -type d \
-      -execdir mkdir -p {}/bin \; \
-      -execdir ln -s ${ripgrep}/bin/rg {}/bin/rg \;
+    # Build binary packages (argon2, node-pty, etc).
+    npm rebuild --offline
+    npm rebuild --offline --prefix lib/vscode/remote
 
-    # run postinstall scripts after patching
-    find ./lib/vscode \( -path "*/node_modules/*" -or -path "*/extensions/*" \) \
-      -and -type f -name "yarn.lock" -printf "%h\n" | \
-        xargs -I {} sh -c 'jq -e ".scripts.postinstall" {}/package.json >/dev/null && yarn --cwd {} postinstall --frozen-lockfile --offline || true'
-
-    # build code-server
+    # Build code-server and VS Code.
     yarn build
-
-    # build vscode
     VERSION=${finalAttrs.version} yarn build:vscode
 
-    # inject version into package.json
+    # Inject version into package.json.
     jq --slurp '.[0] * .[1]' ./package.json <(
       cat << EOF
     {
@@ -276,8 +273,12 @@ stdenv.mkDerivation (finalAttrs: {
     EOF
     ) | sponge ./package.json
 
-    # create release
-    yarn release
+    # Create release, keeping all dependencies.
+    KEEP_MODULES=1 yarn release
+
+    # Prune development dependencies.  We only need to do this for the root as
+    # the VS Code build process already does this for VS Code.
+    npm prune --omit=dev --prefix release
 
     runHook postBuild
   '';
@@ -290,9 +291,6 @@ stdenv.mkDerivation (finalAttrs: {
     # copy release to libexec path
     cp -R -T release "$out/libexec/code-server"
 
-    # install only production dependencies
-    yarn --offline --cwd "$out/libexec/code-server" --production
-
     # create wrapper
     makeWrapper "${nodejs}/bin/node" "$out/bin/code-server" \
       --add-flags "$out/libexec/code-server/out/node/entry.js"