diff --git a/pkgs/os-specific/darwin/sourceRelease/default.nix b/pkgs/os-specific/darwin/sourceRelease/default.nix
new file mode 100644
index 000000000000..1006db4c465f
--- /dev/null
+++ b/pkgs/os-specific/darwin/sourceRelease/default.nix
@@ -0,0 +1,25 @@
+# Returns the raw source from apple-oss-distributions repo.
+# This is mostly useful for copying private headers needed to build other source releases.
+#
+# Note: The source releases are mostly not used to build the SDK. Unless they can be used to build binaries,
+# they’re not used.
+
+let
+  lockfile = builtins.fromJSON (builtins.readFile ./versions.json);
+in
+
+{ fetchFromGitHub }:
+
+name:
+let
+  lockinfo = lockfile.${name};
+in
+fetchFromGitHub {
+  owner = "apple-oss-distributions";
+  repo = name;
+  rev = lockinfo.rev or "${name}-${lockinfo.version}";
+  inherit (lockinfo) hash;
+}
+// {
+  inherit (lockinfo) version;
+}
diff --git a/pkgs/os-specific/darwin/sourceRelease/update-source-releases.sh b/pkgs/os-specific/darwin/sourceRelease/update-source-releases.sh
new file mode 100755
index 000000000000..8e416bfc3483
--- /dev/null
+++ b/pkgs/os-specific/darwin/sourceRelease/update-source-releases.sh
@@ -0,0 +1,138 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p coreutils curl git gnutar jq moreutils nix
+
+set -eu -o pipefail
+
+if [ ! -v 1 ]; then
+    echo "usage: update-source-releases.sh <macOS version>" >&2
+    echo " <macOS version>   Decimal-separated version number." >&2
+    echo "                   Must correspond to a tag in https://github.com/apple-oss-distributions/distribution-macOS" >&2
+    exit 1
+fi
+
+pkgdir=$(dirname "$(realpath "$0")")
+
+lockfile=$pkgdir/versions.json
+if [ -e "$lockfile" ]; then
+    echo '{}' > "$lockfile"
+fi
+
+workdir=$(mktemp -d)
+trap 'rm -rf -- "$workdir"' EXIT
+
+sdkVersion=$1; shift
+tag="macos-${sdkVersion//.}"
+
+declare -a packages=(
+  AvailabilityVersions
+  CarbonHeaders
+  CommonCrypto
+  Csu
+  ICU
+  IOAudioFamily
+  IOBDStorageFamily
+  IOCDStorageFamily
+  IODVDStorageFamily
+  IOFWDVComponents
+  IOFireWireAVC
+  IOFireWireFamily
+  IOFireWireSBP2
+  IOFireWireSerialBusProtocolTransport
+  IOGraphics
+  IOHIDFamily
+  IOKitTools
+  IOKitUser
+  IONetworkingFamily
+  IOSerialFamily
+  IOStorageFamily
+  IOUSBFamily
+  Libc
+  Libinfo
+  Libm
+  Libnotify
+  Librpcsvc
+  Libsystem
+  OpenDirectory
+  PowerManagement
+  Security
+  adv_cmds
+  architecture
+  basic_cmds
+  bootstrap_cmds
+  configd
+  copyfile
+  developer_cmds
+  diskdev_cmds
+  doc_cmds
+  dtrace
+  dyld
+  eap8021x
+  file_cmds
+  hfs
+  launchd
+  libclosure
+  libdispatch
+  libffi
+  libiconv
+  libmalloc
+  libpcap
+  libplatform
+  libpthread
+  libresolv
+  libutil
+  mDNSResponder
+  mail_cmds
+  misc_cmds
+  network_cmds
+  objc4
+  patch_cmds
+  ppp
+  remote_cmds
+  removefile
+  shell_cmds
+  system_cmds
+  text_cmds
+  top
+  xnu
+)
+
+echo "Locking versions for macOS $sdkVersion using tag '$tag'..."
+
+pushd "$workdir" > /dev/null
+
+git clone --branch "$tag" https://github.com/apple-oss-distributions/distribution-macOS.git &> /dev/null
+cd distribution-macOS
+
+for package in "${packages[@]}"; do
+    # If the tag exists in `release.json`, use that as an optimization to avoid downloading unnecessarily from Github.
+    packageTag=$(jq -r --arg package "$package" '.projects[] | select(.project == $package) | .tag' release.json)
+    packageCommit=$(git ls-tree -d HEAD "$package" | awk '{print $3}')
+
+    if [ ! -d "$package" ]; then
+        packageCommit=HEAD
+    fi
+
+    # However, sometimes it doesn’t exist. In that case, fall back to cloning the repo and check manually
+    # which tag corresponds to the commit from the submodule.
+    if [ -z "$packageTag" ]; then
+        git clone --no-checkout "https://github.com/apple-oss-distributions/$package.git" ../source &> /dev/null
+        pushd ../source > /dev/null
+        packageTag=$(git tag --points-at "$packageCommit")
+        popd > /dev/null
+        rm -rf ../source
+    fi
+
+    packageVersion=${packageTag##"$package"-}
+
+    curl -OL "https://github.com/apple-oss-distributions/$package/archive/$packageTag.tar.gz" &> /dev/null
+    tar axf "$packageTag.tar.gz"
+
+    packageHash=$(nix --extra-experimental-features nix-command hash path "$package-$packageTag")
+
+    pkgsjson="{\"$package\": {\"version\": \"$packageVersion\", \"hash\": \"$packageHash\"}}"
+
+    echo "   - Locking $package to version $packageVersion with hash '$packageHash'"
+    jq --argjson pkg "$pkgsjson" -S '. * $pkg' "$lockfile" | sponge "$lockfile"
+done
+
+popd > /dev/null
diff --git a/pkgs/os-specific/darwin/sourceRelease/versions.json b/pkgs/os-specific/darwin/sourceRelease/versions.json
new file mode 100644
index 000000000000..cc0231d6ccbc
--- /dev/null
+++ b/pkgs/os-specific/darwin/sourceRelease/versions.json
@@ -0,0 +1,282 @@
+{
+  "AvailabilityVersions": {
+    "hash": "sha256-eQ46qHk4AuHA+hRZq1IG2UtvZr/X2vtlOvi6hnG+FyA=",
+    "version": "151"
+  },
+  "CarbonHeaders": {
+    "hash": "sha256-nIPXnLr21yVnpBhx9K5q3l/nPARA6JL/dED08MeyhP8=",
+    "version": "18.1"
+  },
+  "CommonCrypto": {
+    "hash": "sha256-/VoOR9wJuKnmGE1CWGGXxX8SpmALHnEooNTa3QM+ITc=",
+    "version": "600028.100.1"
+  },
+  "Csu": {
+    "hash": "sha256-l8RI8aiin7ovZuoDh54thDmd/b502w+dtjN5ZoISZBg=",
+    "version": "88"
+  },
+  "ICU": {
+    "hash": "sha256-dIgrTjHcQm8dy2Ku5wNIHuPjHfoV+48TM0PNDDn6ZPk=",
+    "version": "76104.4"
+  },
+  "IOAudioFamily": {
+    "hash": "sha256-VSk3jvsITJugtL67Qt0m4qJ879i7Fj6B/NGBFVCwpiU=",
+    "version": "540.3"
+  },
+  "IOBDStorageFamily": {
+    "hash": "sha256-UgLMsQBe1QLzlbScmPmASBN7VH4YBmNOUX2CEDezjmE=",
+    "version": "22"
+  },
+  "IOCDStorageFamily": {
+    "hash": "sha256-p/2qM5zjXFDRb/DISpEHxQEdvmuLlRGt/Ygc71Yu2rI=",
+    "version": "61"
+  },
+  "IODVDStorageFamily": {
+    "hash": "sha256-1Sa8aZBGNtqJBNHva+YXxET6Wcdm2PgVrTzYT/8qrN4=",
+    "version": "45"
+  },
+  "IOFWDVComponents": {
+    "hash": "sha256-WkfkWnzRupEh20U7vjsTta89clhus6GTkOpXQWXw/bM=",
+    "version": "208"
+  },
+  "IOFireWireAVC": {
+    "hash": "sha256-IUytBKhhCgg0vtI+7q8d5kxpOUgO3tQD7TMy++jrorc=",
+    "version": "431"
+  },
+  "IOFireWireFamily": {
+    "hash": "sha256-W0KOF4hkA7kFOnL1ThAeFU/YlhFVqoqk9uzGjcBppX8=",
+    "version": "487"
+  },
+  "IOFireWireSBP2": {
+    "hash": "sha256-bItnRQIaGUxMyiU0q+4N8e5+jYiDEOUPmsrKhBFXvok=",
+    "version": "445"
+  },
+  "IOFireWireSerialBusProtocolTransport": {
+    "hash": "sha256-P7egeaD9SSa+YyrIRzM44gILKbIL7vezXK3M6q3MBOI=",
+    "version": "260"
+  },
+  "IOGraphics": {
+    "hash": "sha256-Ag37fd3tZJLXLVq1yzHOCWGOYYfwwTkC8hnvNaTEaWg=",
+    "version": "598"
+  },
+  "IOHIDFamily": {
+    "hash": "sha256-fmYTJsquAOBwzsgRmqPyjSJJi1hGcfnMmqLIcTe8W1s=",
+    "version": "2031.100.16"
+  },
+  "IOKitTools": {
+    "hash": "sha256-Oknsvzn4nv77WU7f0WPS446iwR2BM2q4iw46r/qctAE=",
+    "version": "125"
+  },
+  "IOKitUser": {
+    "hash": "sha256-1bqRiLvyr2GQfbWwhXHXXIOtIka9YDw5GbKV6bd2k4k=",
+    "version": "100076.101.1"
+  },
+  "IONetworkingFamily": {
+    "hash": "sha256-J3cLeWKrQ8ypIaqgwRH9eU5JbjEDBVoezj3a2Lvwu5k=",
+    "version": "177"
+  },
+  "IOSerialFamily": {
+    "hash": "sha256-wVS4QTx6MBOS0VrwyCZ3s5Usezwaf8rWzmNnfdDTXTU=",
+    "version": "93"
+  },
+  "IOStorageFamily": {
+    "hash": "sha256-cllpJX11c3CX8zEYdOT2TC63sx7NUAHh33yRHhrG2Ro=",
+    "version": "315"
+  },
+  "IOUSBFamily": {
+    "hash": "sha256-Z0E3TfKP49toYo1Fo9kElRap8CZ+mVDHy5RIexgJTpA=",
+    "version": "630.4.5"
+  },
+  "Libc": {
+    "hash": "sha256-fxBM4KbPwQNVEJl7PCKP+1nUk9Oce/O2+0lVBxyngew=",
+    "version": "1592.100.35"
+  },
+  "Libinfo": {
+    "hash": "sha256-zZr6Mmou8Q+G6/wS+k0k7R+XirB94TNCUGS5dhi96ZE=",
+    "version": "583.0.1"
+  },
+  "Libm": {
+    "hash": "sha256-p4BndAag9d0XSMYWQ+c4myGv5qXbKx5E1VghudSbpTk=",
+    "version": "2026"
+  },
+  "Libnotify": {
+    "hash": "sha256-7X+6S3C7ZOTXJUeDXOOg5EmoZyLZvtE06x3Is0TGgSU=",
+    "version": "317.100.2"
+  },
+  "Librpcsvc": {
+    "hash": "sha256-UWYdCQ9QsBqwM01bWr+igINAHSdSluB/FrOclC5AjTI=",
+    "version": "31"
+  },
+  "Libsystem": {
+    "hash": "sha256-HsItciWrwyXujQ2hwqzv0JKOkkuynXYIqejLAEPJbMc=",
+    "version": "1345.100.2"
+  },
+  "OpenDirectory": {
+    "hash": "sha256-6fSl8PasCZSBfe0ftaePcBuSEO3syb6kK+mfDI6iR7A=",
+    "version": "146"
+  },
+  "PowerManagement": {
+    "hash": "sha256-ssg655SPT7gWnJWDaxambMKCopr+vLPYERW0IMKT0T8=",
+    "version": "1754.140.4"
+  },
+  "Security": {
+    "hash": "sha256-NgTGbaw5JkpboDQpt1fSgUr9NYGS+bIOrEMQX7mLAME=",
+    "version": "61123.100.169"
+  },
+  "adv_cmds": {
+    "hash": "sha256-O+SB8sj3yqPv7GEBQQgvq+Y7kQRZI/i/UVa17J/OhZM=",
+    "version": "235"
+  },
+  "architecture": {
+    "hash": "sha256-PRNUrhzSOrwmxSPkKmV0LV7yEIik65sdkfKdBqcwFhU=",
+    "version": "282"
+  },
+  "basic_cmds": {
+    "hash": "sha256-RQve2GqS9ke9hd8kupRMgoOKalTS229asi5tBGrBmS8=",
+    "version": "70"
+  },
+  "bootstrap_cmds": {
+    "hash": "sha256-6JG0sysgqLlgcpIOXfN+F0/gxpIIHZZ5et3gmDBoBGQ=",
+    "version": "138"
+  },
+  "configd": {
+    "hash": "sha256-+3xesYxqfsNjWCW3T87OA7+Z1hBqmGEh/I8kP8Ajbso=",
+    "version": "1300.100.9"
+  },
+  "copyfile": {
+    "hash": "sha256-hIHlY0prIFY0j8z0Hvlv2psrwLj41jYfKBM0KutLxew=",
+    "version": "224"
+  },
+  "developer_cmds": {
+    "hash": "sha256-jgQUjN9zmqi0/7XpqzbRsJjZIYeMrxXT1Zf3qi7+o+8=",
+    "version": "83"
+  },
+  "diskdev_cmds": {
+    "hash": "sha256-TD/sJkzIquTgq1zP/B7eBArxeTcp1Lqa8e8cJ1jnkHU=",
+    "version": "737.140.4"
+  },
+  "doc_cmds": {
+    "hash": "sha256-nnwKXKKjgJXcLCArD38Dme2L1WyR1U0rwn7zI+NCftw=",
+    "version": "69"
+  },
+  "dtrace": {
+    "hash": "sha256-04Q35rCKnM5Csv5poFJKpK0VplWq4hvy251/Cb2Kl80=",
+    "version": "401.100.3"
+  },
+  "dyld": {
+    "hash": "sha256-pbpSD5OeSMOcMJFAd7kyLINPROjqsafsCSphVGyIPyg=",
+    "version": "1286.10"
+  },
+  "eap8021x": {
+    "hash": "sha256-Ky6KSlJhyX1NRufGhVBcp+ZFmqYrAxwC/5QvJhC2PhU=",
+    "version": "354.100.3"
+  },
+  "file_cmds": {
+    "hash": "sha256-Rf/XA6uEaj7Wps2s8Oc/OhQVBjz8XiqJlj+cxjiQfQU=",
+    "version": "457.140.3"
+  },
+  "hfs": {
+    "hash": "sha256-+YUVOttZU7C8I14CC6t3ZH2KxAjjTA2nB0y5bPgLxZM=",
+    "version": "650.0.2"
+  },
+  "launchd": {
+    "hash": "sha256-8mW9bnuHmRXCx9py8Wy28C5b2QPICW0rlAps5njYa00=",
+    "version": "842.1.4"
+  },
+  "libclosure": {
+    "hash": "sha256-M/jnIHzKYvdFCO0tJ1JXiD/UcZtJhLIoulaCQQUbn30=",
+    "version": "90"
+  },
+  "libdispatch": {
+    "hash": "sha256-igqIA5DMVHjG30WMHZZpYY7LRM9hZyMWItD+UxeTehY=",
+    "version": "1477.100.9"
+  },
+  "libffi": {
+    "hash": "sha256-xHefZVsZg9kUXV0t/HLdjPkkD/hn/4bvdRVJ4PsQLeM=",
+    "version": "40"
+  },
+  "libiconv": {
+    "hash": "sha256-50DC6LePtvdAh9FLa/esiwCUmYDxKofN6hCiv9+dmgQ=",
+    "version": "109.100.2"
+  },
+  "libmalloc": {
+    "hash": "sha256-Sh4/z7lGWRMldOPURkP5vLOAb5Ou6AUsVJEWz9wk9hI=",
+    "version": "521.100.59"
+  },
+  "libpcap": {
+    "hash": "sha256-DqINoombdui5N6lNHcZ07c7LrVum4f8fFK89ymdCd0c=",
+    "version": "140"
+  },
+  "libplatform": {
+    "hash": "sha256-gojt3sWOr7XO2yYI/B1CmNLTPFieSfoNtlOgQahOCok=",
+    "version": "316.100.10"
+  },
+  "libpthread": {
+    "hash": "sha256-phjfN8+IU8ibPsflR6LktnSi3giy89ghI+cFyrhiQNo=",
+    "version": "519.101.1"
+  },
+  "libresolv": {
+    "hash": "sha256-GtPVlL1mD58um5hOFd3HQKQ7pqutBe9jZKgQw8pOkPE=",
+    "version": "91"
+  },
+  "libutil": {
+    "hash": "sha256-tUsl22Z0HUVSkSoohFXkhicNFCW+RARvpTS0q6yaQFk=",
+    "version": "72"
+  },
+  "mDNSResponder": {
+    "hash": "sha256-0ECbWeMnIRTsi03BeBEe5boyR/84JJPbxzPQze8hHSA=",
+    "version": "2200.100.94.0.2"
+  },
+  "mail_cmds": {
+    "hash": "sha256-ET1nga9nwgBtN7fuvsPs1yqe5OhQ62PVl7LxqbsAPqU=",
+    "version": "38.0.1"
+  },
+  "misc_cmds": {
+    "hash": "sha256-04uBS16nNrg73Fqh4Obev7nQDjTTlY4f5+pEv3i0FIU=",
+    "version": "45"
+  },
+  "network_cmds": {
+    "hash": "sha256-sfZX6aA8mspfRKARIYFXX+bmlLHDoi485HQOvbRNP1Y=",
+    "version": "705.100.5"
+  },
+  "objc4": {
+    "hash": "sha256-eUVSpbyTEOMEdHoxSv6lZIZwB+cW/YWIaTZTcHgGOjo=",
+    "version": "912.3"
+  },
+  "patch_cmds": {
+    "hash": "sha256-fDY2NOT3DnU5pm06cHSs+JJcA/EFP8Lxjg7sErUerJ0=",
+    "version": "72"
+  },
+  "ppp": {
+    "hash": "sha256-8+QUA79sHf85yvGSPE9qCmGsrZDT3NZnbgZVroJw/Hg=",
+    "version": "1016"
+  },
+  "remote_cmds": {
+    "hash": "sha256-8c/NgQZ+K6jJ3aoYK78/BsEkM1gmRS+9z0437+SvcCw=",
+    "version": "306"
+  },
+  "removefile": {
+    "hash": "sha256-Z5UD0mk/s80CQB0PZWDzSl2JWXmnVmwUvlNb28+hR3k=",
+    "version": "81"
+  },
+  "shell_cmds": {
+    "hash": "sha256-hoMssbZCrmzyJTgEAzOS4L7DhY9z/yXIcvHRhL6W5qc=",
+    "version": "326"
+  },
+  "system_cmds": {
+    "hash": "sha256-mEo+v0m+aP42XHHwibGKPkT55JFYLTOD5YT5IYQ8Hr0=",
+    "version": "1026.140.2"
+  },
+  "text_cmds": {
+    "hash": "sha256-5BBH/v1mJpExz65VDX6oh3dFCz49E+JMqJxkO96Y/xo=",
+    "version": "195"
+  },
+  "top": {
+    "hash": "sha256-e+k/jE49BMZZ24ge9JCa2ct5f1og6ewWb6U5ZMWdIEc=",
+    "version": "139.40.2"
+  },
+  "xnu": {
+    "hash": "sha256-j5Ep1RX5DTJqTGszrF4d/JtzUqZ6nA6XoExqcIQ0RVQ=",
+    "version": "10063.101.15"
+  }
+}
diff --git a/pkgs/top-level/darwin-packages.nix b/pkgs/top-level/darwin-packages.nix
index 51680985fa64..fa9b60790eff 100644
--- a/pkgs/top-level/darwin-packages.nix
+++ b/pkgs/top-level/darwin-packages.nix
@@ -95,6 +95,8 @@ makeScopeWithSplicing' {
         bintools = self.binutilsDualAs-unwrapped;
       };
 
+      sourceRelease = self.callPackage ../os-specific/darwin/sourceRelease { };
+
       inherit (self.file_cmds) xattr;
 
       # Note: Not in `packages.nix` because it’s a package set not a derivation.