diff --git a/pkgs/build-support/rust/default.nix b/pkgs/build-support/rust/default.nix
index 45d706b8c562..6a5e4b86194f 100644
--- a/pkgs/build-support/rust/default.nix
+++ b/pkgs/build-support/rust/default.nix
@@ -1,5 +1,5 @@
 { stdenv, cacert, git, rustc, cargo, rustRegistry }:
-{ name, src, depsSha256, buildInputs ? [], ... } @ args:
+{ name, src, depsSha256, buildInputs ? [], cargoUpdateHook ? "", ... } @ args:
 
 let
   fetchDeps = import ./fetchcargo.nix {
@@ -7,12 +7,12 @@ let
   };
 
   cargoDeps = fetchDeps {
-    inherit name src;
+    inherit name src cargoUpdateHook;
     sha256 = depsSha256;
   };
 
 in stdenv.mkDerivation (args // {
-  inherit cargoDeps rustRegistry;
+  inherit cargoDeps rustRegistry cargoUpdateHook;
 
   buildInputs = [ git cargo rustc ] ++ buildInputs;
 
@@ -23,8 +23,15 @@ in stdenv.mkDerivation (args // {
     (
         cd $sourceRoot
         ln -s $rustRegistry ./cargo-rust-registry
-        cargo clean
+
+        substituteInPlace Cargo.lock \
+            --replace "registry+https://github.com/rust-lang/crates.io-index" \
+                      "registry+file:///proc/self/cwd/cargo-rust-registry"
+
+        eval "$cargoUpdateHook"
+
         cargo fetch
+        cargo clean
     )
   '' + (args.postUnpack or "");
 
diff --git a/pkgs/build-support/rust/fetch-cargo-deps b/pkgs/build-support/rust/fetch-cargo-deps
index d6579fe94bda..f0a21e673cd9 100755
--- a/pkgs/build-support/rust/fetch-cargo-deps
+++ b/pkgs/build-support/rust/fetch-cargo-deps
@@ -1,6 +1,8 @@
-#! /bin/sh -eu
+#! /bin/sh
 
-set -o pipefail
+source $stdenv/setup
+
+set -euo pipefail
 
 src=$(realpath $1)
 out=$(realpath $2)
@@ -38,6 +40,15 @@ EOF
 
 export CARGO_HOME=$out
 cd $src
+
+set +u
+substituteInPlace Cargo.lock \
+    --replace "registry+https://github.com/rust-lang/crates.io-index" \
+              "registry+file:///proc/self/cwd/cargo-rust-registry"
+set -u
+
+eval "$cargoUpdateHook"
+
 cargo fetch --verbose
 
 # TODO: check that Cargo.lock exists, and hasn't changed
diff --git a/pkgs/build-support/rust/fetchcargo.nix b/pkgs/build-support/rust/fetchcargo.nix
index cd5d69e06d0d..7ebd02a485d7 100644
--- a/pkgs/build-support/rust/fetchcargo.nix
+++ b/pkgs/build-support/rust/fetchcargo.nix
@@ -1,12 +1,12 @@
 { stdenv, cacert, git, rustc, cargo, rustRegistry }:
-{ name ? "cargo-deps", src, sha256 }:
+{ name ? "cargo-deps", src, sha256, cargoUpdateHook ? "" }:
 
 stdenv.mkDerivation {
   name = "${name}-fetch";
   buildInputs = [ rustc cargo git ];
   builder = ./fetch-builder.sh;
   fetcher = ./fetch-cargo-deps;
-  inherit src rustRegistry;
+  inherit src rustRegistry cargoUpdateHook;
 
   outputHashAlgo = "sha256";
   outputHashMode = "recursive";
diff --git a/pkgs/development/tools/build-managers/cargo/default.nix b/pkgs/development/tools/build-managers/cargo/default.nix
index 894b77b96e32..3235157b015f 100644
--- a/pkgs/development/tools/build-managers/cargo/default.nix
+++ b/pkgs/development/tools/build-managers/cargo/default.nix
@@ -15,7 +15,15 @@ buildRustPackage rec {
     leaveDotGit = true;
   };
 
-  depsSha256 = "1yi39asmnrya8w83jrjxym658cf1a5ffp8ym8502rqqvx30y0yx4";
+  cargoUpdateHook = ''
+    # Updating because version 2.1.4 has an invalid Cargo.toml
+    cargo update -p libressl-pnacl-sys --precise 2.1.5
+
+    # Updating because version 0.1.3 has a build failure with recent rustc
+    cargo update -p threadpool --precise 0.1.4
+  '';
+
+  depsSha256 = "12d2v4b85qabagrypvqiam2iybd4jwcg0sky0gqarfhjh2dhwfm6";
 
   buildInputs = [ file curl pkgconfig python openssl cmake zlib ];