diff --git a/nix/checked-candidate.nix b/nix/checked-candidate.nix
index 9446844..5af96c9 100644
--- a/nix/checked-candidate.nix
+++ b/nix/checked-candidate.nix
@@ -81,7 +81,12 @@ let
     else
       assert platformSource.repository == root.lock.quixos.repository;
       assert platformSource.commit == root.lock.quixos.commit;
-      builtins.getFlake "path:${builtins.storePath platformSource.directory}";
+      # getFlake accepts a context-free flake reference. storePath first checks
+      # presence; the resulting flake retains its immutable source as an input.
+      # Dropping string context here does not permit an authored mutable path.
+      builtins.getFlake (
+        builtins.unsafeDiscardStringContext "path:${builtins.storePath platformSource.directory}"
+      );
   runtimePackages = runtime.packages.${system};
   resourceClosure =
     includeBuild: node: