{ nix-thunk }: self: super: rec {
  botan2 =
    (super.botan2.overrideAttrs (old: {
      # Get rid of some patches that nixpkgs was applying to botan2 and which didn't apply to the branch.
      patches = [];
      # The --with-openssl flag didn't work for some reason, might need further figuring out.
      configurePhase = builtins.replaceStrings [ "--with-openssl" ] [ " " ] old.configurePhase;
      # Here, we use nix-thunk to get the source of the correct branch of the botan repo via a thunk.
      # Nix thunks are essentially references to git repositories that can be unpacked to their
      # source in-place when working on the project, or packed up into a few small files.
      # After installing the nix-thunk command from https://github.com/obsidiansystems/nix-thunk
      # you can run:
      # nix-thunk unpack dep/botan
      # from the top level of this repo to clone a copy of the botan git repo at the appropriate
      # commit, and work on it from there. Similarly,
      # nix-thunk pack dep/botan
      # will pack it back up again, provided that the changes have been pushed somewhere.
      # Note: there's a bug in the current version of Obelisk which occasionally gives it some trouble
      # if certain repos are unpacked. If you have any trouble running an ob command
      # (ob run, ob repl, etc.) with a thunk unpacked, try adding the flag  --no-interpret dep
      # and hopefully that will sort it out.
      src = nix-thunk.thunkSource ./dep/botan;
    })).override (old: {
      # Also, turn on debugging.
      extraConfigureFlags = "--debug-mode";
    });
  # For whatever reason, it seems callCabal2nix for tahoe-chk
  # wants to use the botan package rather than botan2.
  # We could override the pkgconfigDepends of the resulting
  # package if we needed both, but this is easier.
  botan = self.botan2;

  # Next, we'll try to obtain challenge-bypass-ristretto-ffi, for which we have a nix flake.
  # To use the flake, we'll obtain Eelco Dolstra's flake-compat.
  flake-compat = import (fetchTarball {
    url = "https://github.com/edolstra/flake-compat/archive/35bb57c0c8d8b62bbfd284272c928ceb64ddbde9.tar.gz";
    sha256 = "sha256:1prd9b1xx8c0sfwnyzkspplh30m613j42l1k789s521f4kv4c2z2";
  });
  # This has the top level of the flake...
  challenge-bypass-ristretto-ffi-flake =
    (self.flake-compat { src = nix-thunk.thunkSource ./dep/python-challenge-bypass-ristretto ; }).defaultNix;
  # ... from which we can extract whatever packages we need.
  challenge-bypass-ristretto-ffi =
    challenge-bypass-ristretto-ffi-flake.packages."${builtins.currentSystem}".libchallenge_bypass_ristretto_ffi;
  challenge-bypass-ristretto-ffi-android =
    challenge-bypass-ristretto-ffi-flake.legacyPackages."${builtins.currentSystem}".pkgsCross.aarch64-android.libchallenge_bypass_ristretto_ffi;
  # We can branch on the target platform to choose between the different architecture libraries from the flake. Modifying the flake might be easier.
  libchallenge_bypass_ristretto_ffi = if self.stdenv.targetPlatform.isAndroid
    then challenge-bypass-ristretto-ffi-flake.legacyPackages.${builtins.currentSystem}.pkgsCross.aarch64-android.libchallenge_bypass_ristretto_ffi
    else challenge-bypass-ristretto-ffi-flake.packages.${builtins.currentSystem}.libchallenge_bypass_ristretto_ffi;
}