diff --git a/doc/languages-frameworks/php.section.md b/doc/languages-frameworks/php.section.md
index 9f221679ce22..988fa659f0aa 100644
--- a/doc/languages-frameworks/php.section.md
+++ b/doc/languages-frameworks/php.section.md
@@ -214,6 +214,12 @@ code, while others choose not to.
 
 In Nix, there are multiple approaches to building a Composer-based project.
 
+::: {.warning}
+`buildComposerProject2` has a [known bug](https://github.com/NixOS/nixpkgs/issues/451395)
+where the `vendorHash` changes every time a Composer release happens that changes the
+`autoload.php` or vendored composer code.
+:::
+
 One such method is the `php.buildComposerProject2` helper function, which serves
 as a wrapper around `mkDerivation`.
 
diff --git a/pkgs/by-name/ag/agorakit/package.nix b/pkgs/by-name/ag/agorakit/package.nix
index c1c9595eccac..c5f8c722327d 100644
--- a/pkgs/by-name/ag/agorakit/package.nix
+++ b/pkgs/by-name/ag/agorakit/package.nix
@@ -27,7 +27,7 @@ php82.buildComposerProject2 (finalAttrs: {
     runHook postInstall
   '';
 
-  vendorHash = "sha256-tBB3Zl/N1XqPTD84at5WoGrD0G5rJbobk4E8BFOSm+M=";
+  vendorHash = "sha256-cg9OIBvWX69yU6U6Ag/T3jScG2OUdpTqc+KwP6VyUHo=";
   composerStrictValidation = false;
 
   passthru.updateScript = nix-update-script { };
diff --git a/pkgs/by-name/ba/baikal/package.nix b/pkgs/by-name/ba/baikal/package.nix
index 32213d3922ff..08103ccf5225 100644
--- a/pkgs/by-name/ba/baikal/package.nix
+++ b/pkgs/by-name/ba/baikal/package.nix
@@ -21,5 +21,7 @@ php.buildComposerProject2 (finalAttrs: {
     homepage = "https://sabre.io/baikal/";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ wrvsrx ];
+    # vendorHash non-reproducible
+    broken = true;
   };
 })
diff --git a/pkgs/by-name/co/composer-require-checker/package.nix b/pkgs/by-name/co/composer-require-checker/package.nix
index 1a914083b8d8..239debebbb08 100644
--- a/pkgs/by-name/co/composer-require-checker/package.nix
+++ b/pkgs/by-name/co/composer-require-checker/package.nix
@@ -16,7 +16,7 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-UAofdc8mqSnJXhCTABSf9JZERqur86lzNDI66EHgEQE=";
   };
 
-  vendorHash = "sha256-bNeQEfwXly3LFuEKeSK6J6pRfQF6TNwUqu3SdTswmFI=";
+  vendorHash = "sha256-TlBrL4KyMVHaxqlfvnTkj3TkmU8h5/0BRC5e8yWrhCI=";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
diff --git a/pkgs/by-name/de/deployer/package.nix b/pkgs/by-name/de/deployer/package.nix
index c75b5e1d27a7..9423c04e1a55 100644
--- a/pkgs/by-name/de/deployer/package.nix
+++ b/pkgs/by-name/de/deployer/package.nix
@@ -15,7 +15,7 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-wtkixHexsJNKsLnnlHssh0IzxwWYMPKDcaf/D0zUNKk=";
   };
 
-  vendorHash = "sha256-0uBI30n31W0eDVA9/W366O0Qo2jWZBqEL+YbJx4J7P0=";
+  vendorHash = "sha256-/bf1rvoG1N6GNqisBwMqY05qhTsy7gMeWXarXgElU/M=";
 
   meta = {
     changelog = "https://github.com/deployphp/deployer/releases/tag/v${finalAttrs.version}";
diff --git a/pkgs/by-name/en/engelsystem/package.nix b/pkgs/by-name/en/engelsystem/package.nix
index 27a089230b82..7da12fd84620 100644
--- a/pkgs/by-name/en/engelsystem/package.nix
+++ b/pkgs/by-name/en/engelsystem/package.nix
@@ -23,7 +23,7 @@ php.buildComposerProject2 (finalAttrs: {
 
   inherit php;
 
-  vendorHash = "sha256-0Mv48mB/pTQtYd2do6wTdhD/c2zwbU1gTYsdU7rELPY=";
+  vendorHash = "sha256-ODJgsvECw+q3sAA6pWNw4X2Png7f4G2Jty9AQSj/SgE=";
   composoerNoDev = true;
   composerStrictValidation = false;
 
diff --git a/pkgs/by-name/fl/flarum/package.nix b/pkgs/by-name/fl/flarum/package.nix
index 9d83dacbca08..0043123e347b 100644
--- a/pkgs/by-name/fl/flarum/package.nix
+++ b/pkgs/by-name/fl/flarum/package.nix
@@ -17,7 +17,7 @@ php.buildComposerProject2 (finalAttrs: {
 
   composerLock = ./composer.lock;
   composerStrictValidation = false;
-  vendorHash = "sha256-pup+ZfPEnqoA3wEXQNn4pWTYXri6d4XzMfuc8k1SeQk=";
+  vendorHash = "sha256-4wB8MRnqnruo9VXupMmAqiRSZx8F2i+8zcOphTeDp1g=";
 
   meta = with lib; {
     changelog = "https://github.com/flarum/framework/blob/main/CHANGELOG.md";
diff --git a/pkgs/by-name/gr/grocy/package.nix b/pkgs/by-name/gr/grocy/package.nix
index ee2b76bd91a4..94fc34a56679 100644
--- a/pkgs/by-name/gr/grocy/package.nix
+++ b/pkgs/by-name/gr/grocy/package.nix
@@ -19,7 +19,7 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-MnN6TIkNZWT+pAQf0+z5l3hj/7K/d3BfI7VAaUEKG8s=";
   };
 
-  vendorHash = "sha256-n+6yNXqarWRZt6VEuHrFe3nrTiGeHnkURmO2UuB/BVc=";
+  vendorHash = "sha256-6vWV8+4tETUFBLeEoG7d8lHKILXvM7ezWbDiG11GA/s=";
 
   offlineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/yarn.lock";
diff --git a/pkgs/by-name/mo/movim/package.nix b/pkgs/by-name/mo/movim/package.nix
index 0cb5ed73e7f4..06d7be4dd40b 100644
--- a/pkgs/by-name/mo/movim/package.nix
+++ b/pkgs/by-name/mo/movim/package.nix
@@ -88,7 +88,7 @@ php.buildComposerProject2 (finalAttrs: {
     ++ lib.optional minify.style.enable lightningcss
     ++ lib.optional minify.svg.enable scour;
 
-  vendorHash = "sha256-xkFyjs3jW7j+8WosRaxBEYQU2dwQlDr4/nrdtW03xvA=";
+  vendorHash = "sha256-Ke+bh/mvKUk5qxjlBZo4jJhLneyFRq0HYXTwK/KZMBs=";
 
   postPatch = ''
     # Our modules are already wrapped, removes missing *.so warnings;
diff --git a/pkgs/by-name/pd/pdepend/package.nix b/pkgs/by-name/pd/pdepend/package.nix
index aa72fe80e91f..d8bd332f8fbe 100644
--- a/pkgs/by-name/pd/pdepend/package.nix
+++ b/pkgs/by-name/pd/pdepend/package.nix
@@ -17,7 +17,7 @@ php.buildComposerProject2 (finalAttrs: {
   };
 
   composerLock = ./composer.lock;
-  vendorHash = "sha256-szKVZhWcd8p4307irNqgSAK2+hl8AW+gCPyf0EEco8A=";
+  vendorHash = "sha256-uK+nJFXDVPYFbosAUxqu+mmNsD7AnZ18NnIN9FYAaPQ=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
diff --git a/pkgs/by-name/pe/pest/package.nix b/pkgs/by-name/pe/pest/package.nix
index 6cc3bbb88e97..a5be5a24b227 100644
--- a/pkgs/by-name/pe/pest/package.nix
+++ b/pkgs/by-name/pe/pest/package.nix
@@ -16,7 +16,7 @@ php.buildComposerProject2 (finalAttrs: {
   };
 
   composerLock = ./composer.lock;
-  vendorHash = "sha256-rOJ6PFp4Xfe89usoH455EAT30d2Tu3zd3+C/6K/kGBw=";
+  vendorHash = "sha256-4CpyerXmfXbwsNsK16V+GY3Rzo4BfavGpOVITD14p8w=";
 
   meta = {
     changelog = "https://github.com/pestphp/pest/releases/tag/v${finalAttrs.version}";
diff --git a/pkgs/by-name/ph/phpactor/package.nix b/pkgs/by-name/ph/phpactor/package.nix
index 402970157526..96310ff421b7 100644
--- a/pkgs/by-name/ph/phpactor/package.nix
+++ b/pkgs/by-name/ph/phpactor/package.nix
@@ -16,7 +16,7 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-9XWlWwq+xvqPgKIc7IGoMVTxajjYsrPo/ra/0JIE168=";
   };
 
-  vendorHash = "sha256-3xkt0QjytW4BOCgZdevat7zkSuZTPPvwz3yptiq5zoo=";
+  vendorHash = "sha256-91Yz78nh4r+Gr7gKSwelTdO436ehENVTPUWcnDaU7zg=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/ph/phpdocumentor/package.nix b/pkgs/by-name/ph/phpdocumentor/package.nix
index 92e583031735..6026aacb1073 100644
--- a/pkgs/by-name/ph/phpdocumentor/package.nix
+++ b/pkgs/by-name/ph/phpdocumentor/package.nix
@@ -17,7 +17,7 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-iQA19FrXvVLzg+LaY1BcNmG8amMfKPVFwYbZ7dr+H9Q=";
   };
 
-  vendorHash = "sha256-sFRy9Hy9CVNjjYqbPbKH0XhoUdu4HlkiuHDDovTGono=";
+  vendorHash = "sha256-iXkj0Pa4ln8GX/ARCpnijaWdFM4VYZuj42RP0GS2LW8=";
 
   nativeBuildInputs = [ makeBinaryWrapper ];
 
diff --git a/pkgs/by-name/pr/pretty-php/package.nix b/pkgs/by-name/pr/pretty-php/package.nix
index 35a132174ecc..3e8a806249f8 100644
--- a/pkgs/by-name/pr/pretty-php/package.nix
+++ b/pkgs/by-name/pr/pretty-php/package.nix
@@ -15,7 +15,7 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-zBhxuEViLxeQ9m3u1L0wYqeL+YEWWwvJS7PtsFPO5QU=";
   };
 
-  vendorHash = "sha256-vnmp/HLzaOzHu22lzugRXIHL43YQ/hm223gcUbIiLT4=";
+  vendorHash = "sha256-Y1/wNFPXza2aO07ZFybpwI3XbTVBhEvFHs9ygHQbcSo=";
 
   passthru = {
     tests.version = testers.testVersion {
diff --git a/pkgs/by-name/ps/psysh/package.nix b/pkgs/by-name/ps/psysh/package.nix
index 709efc36a5f4..a286afa171f5 100644
--- a/pkgs/by-name/ps/psysh/package.nix
+++ b/pkgs/by-name/ps/psysh/package.nix
@@ -58,6 +58,7 @@ php.buildComposerProject2 (finalAttrs: {
     mainProgram = "psysh";
     license = lib.licenses.mit;
     homepage = "https://psysh.org/";
-    teams = [ lib.teams.php ];
+    # `composerVendor` doesn't build
+    broken = true;
   };
 })
diff --git a/pkgs/by-name/ro/roave-backward-compatibility-check/package.nix b/pkgs/by-name/ro/roave-backward-compatibility-check/package.nix
index 3200cfe2af7e..2c1c0a83957d 100644
--- a/pkgs/by-name/ro/roave-backward-compatibility-check/package.nix
+++ b/pkgs/by-name/ro/roave-backward-compatibility-check/package.nix
@@ -16,7 +16,7 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-4rhIaPdyyLiIhVYC4KNKbPAbVsHKnK6BOsebFjmmDeI=";
   };
 
-  vendorHash = "sha256-k+zFpBHE+r0a67gqUry+luMIhJZ5wo1RpEaF4c7vAmI=";
+  vendorHash = "sha256-uZqstfVp5uY7Sec32XLK7RvuUtP8Hj21W7tayhhuf2g=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/by-name/ro/robo/package.nix b/pkgs/by-name/ro/robo/package.nix
index c1e0ee1fc92c..480fe8ebeb24 100644
--- a/pkgs/by-name/ro/robo/package.nix
+++ b/pkgs/by-name/ro/robo/package.nix
@@ -16,7 +16,7 @@ php82.buildComposerProject2 (finalAttrs: {
     hash = "sha256-bAT4jHvqWeYcACeyGtBwVBA2Rz+AvkZcUGLDwSf+fLg=";
   };
 
-  vendorHash = "sha256-vketnTu5VEgt3HBbtnTppWl3+sSSIsCB2MpvL27bxv4=";
+  vendorHash = "sha256-Rg8WTZUnWA4bemNmE7hxFwfnlMtYyPkeltAQEWJ2VDU=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/development/php-packages/box/default.nix b/pkgs/development/php-packages/box/default.nix
index 2c998d510279..8d43a6d27127 100644
--- a/pkgs/development/php-packages/box/default.nix
+++ b/pkgs/development/php-packages/box/default.nix
@@ -16,7 +16,7 @@ php82.buildComposerProject2 (finalAttrs: {
     hash = "sha256-giJAcH2R9hAlUTbwRi7rbmUP+WV8Nfb9XmoHHs4RcbI=";
   };
 
-  vendorHash = "sha256-7oZtuQ7PhB7q9vNO2TLI46kg2q9BgdLjGUduGXAHc0E=";
+  vendorHash = "sha256-A/hAw0J4Q3kun6soxI6h7kpyGef9q0EFg8HAQHHZUro=";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
diff --git a/pkgs/development/php-packages/composer/default.nix b/pkgs/development/php-packages/composer/default.nix
index e44f8f9777a6..c36e401e3b15 100644
--- a/pkgs/development/php-packages/composer/default.nix
+++ b/pkgs/development/php-packages/composer/default.nix
@@ -14,6 +14,13 @@
   versionCheckHook,
 }:
 
+/*
+    XXX IMPORTANT
+
+    Make sure to check if the `vendorHash` of `buildComposerProject2` changes when updating!
+    See https://github.com/NixOS/nixpkgs/issues/451395
+*/
+
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "composer";
   version = "2.8.12";
diff --git a/pkgs/development/php-packages/phing/default.nix b/pkgs/development/php-packages/phing/default.nix
index 6edfcbe0426a..7d76d08f7753 100644
--- a/pkgs/development/php-packages/phing/default.nix
+++ b/pkgs/development/php-packages/phing/default.nix
@@ -17,7 +17,7 @@
       hash = "sha256-gY6ocmkd7eJIMaBrewfxYL7gTr+1qNHTkuAp+w9ApUU=";
     };
 
-    vendorHash = "sha256-3frpoQzHtJA2/jJpZT+yIRatEwiY6LIUGzEZBa8hXbM=";
+    vendorHash = "sha256-zrHOw7Uyq8H7AyxrfCo5VthX1EeoSB44ynrRt38u3Sk=";
 
     nativeInstallCheckInputs = [
       versionCheckHook
diff --git a/pkgs/development/php-packages/phive/default.nix b/pkgs/development/php-packages/phive/default.nix
index 5d0a9f26b1b3..35c108c5200d 100644
--- a/pkgs/development/php-packages/phive/default.nix
+++ b/pkgs/development/php-packages/phive/default.nix
@@ -15,7 +15,7 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-dv9v1KCLNheFmrRQ7cID5WFvoiH0OWVPWSrN023dEqA=";
   };
 
-  vendorHash = "sha256-H1QJ+ML0tbZzEBKknP0GHhUhw+ujiIH/QNmEgA2zSmM=";
+  vendorHash = "sha256-U6BHAd4tWQKm6uCJ5sM51PltXhF3J4ieTnbC060+8Jg=";
 
   meta = {
     changelog = "https://github.com/phar-io/phive/releases/tag/${finalAttrs.version}";
diff --git a/pkgs/development/php-packages/php-parallel-lint/default.nix b/pkgs/development/php-packages/php-parallel-lint/default.nix
index bed0420642c7..e7f93224f1ab 100644
--- a/pkgs/development/php-packages/php-parallel-lint/default.nix
+++ b/pkgs/development/php-packages/php-parallel-lint/default.nix
@@ -17,7 +17,7 @@ php.buildComposerProject2 (finalAttrs: {
   };
 
   composerLock = ./composer.lock;
-  vendorHash = "sha256-ySdLlqlGKZ6LgmAOBMkBNoCAqWrgMwE/Cj6ZEPEsCko=";
+  vendorHash = "sha256-AQAASj5vrSE1xkJ/SZHU4GwOWNobe9ES0Yo+YrLH354=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
diff --git a/pkgs/development/php-packages/phpinsights/default.nix b/pkgs/development/php-packages/phpinsights/default.nix
index 5562277b4cd7..13d0ebf7b640 100644
--- a/pkgs/development/php-packages/phpinsights/default.nix
+++ b/pkgs/development/php-packages/phpinsights/default.nix
@@ -17,7 +17,7 @@ php.buildComposerProject2 (finalAttrs: {
   };
 
   composerLock = ./composer.lock;
-  vendorHash = "sha256-CwIfRmwJREz24Qj6J2PKQp+ix+/ZXo1oamcHc1fPUoc=";
+  vendorHash = "sha256-uy8/bkgjDXnt544S70IOwX9I8U0lMLAkbiBDYXyJBcY=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/development/php-packages/phpmd/default.nix b/pkgs/development/php-packages/phpmd/default.nix
index c254fe239871..06533e74a241 100644
--- a/pkgs/development/php-packages/phpmd/default.nix
+++ b/pkgs/development/php-packages/phpmd/default.nix
@@ -19,7 +19,7 @@ php.buildComposerProject2 (finalAttrs: {
   # Missing `composer.lock` from the repository.
   # Issue open at https://github.com/phpmd/phpmd/issues/1056
   composerLock = ./composer.lock;
-  vendorHash = "sha256-AahAs3Gq1OQ+CW3+rU8NnWcR3hKzVNq7s3llsO4mQ38=";
+  vendorHash = "sha256-tiL8PL6Muc/i4Il1rCeEKenCmIEVn3rHFZInbUGQW9o=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "--version";