Try #1055:

lib/call-cabal-project-to-nix.nix

@@ -385,7 +385,11 @@ let
     LANG = "en_US.UTF-8";
     meta.platforms = pkgs.lib.platforms.all;
     preferLocalBuild = false;
-    outputs = ["out" "json"];
+    outputs = [
+      "out"     # The results of plan-to-nix
+      "json"    # The `plan.json` file generated by cabal and used for `plan-to-nix` input
+      "freeze"  # The `cabal.project.freeze` file created by `cabal v2-freeze`
+    ];
   } ''
     tmp=$(mktemp -d)
     cd $tmp
@@ -421,10 +425,15 @@ let
     ${pkgs.lib.optionalString (cabalProjectFreeze != null) ''
       cp ${pkgs.evalPackages.writeText "cabal.project.freeze" cabalProjectFreeze} \
         cabal.project.freeze
+      chmod +w cabal.project.freeze
     ''}
     export SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt
     export GIT_SSL_CAINFO=${cacert}/etc/ssl/certs/ca-bundle.crt
 
+    # Using `cabal v2-freeze` will configure the project (since
+    # it is not configured yet), taking the existing `cabal.project.freeze`
+    # file into account.  Then it "writes out a freeze file which
+    # records all of the versions and flags that are picked" (from cabal docs).
     echo "Using index-state ${index-state-found}"
     HOME=${
       # This creates `.cabal` directory that is as it would have
@@ -436,7 +445,7 @@ let
         index-state = cached-index-state;
         sha256 = index-sha256-found;
       }
-    } cabal v2-configure \
+    } cabal v2-freeze \
         --index-state=${
             # Setting the desired `index-state` here in case it was not
             # from the cabal.project file. This will further restrict the
@@ -453,6 +462,10 @@ let
             "--ghcjs --with-ghcjs=js-unknown-ghcjs-ghc --with-ghcjs-pkg=js-unknown-ghcjs-ghc-pkg"} \
         ${configureArgs}
 
+    cp cabal.project.freeze $freeze
+    # Not needed any more (we don't want it to wind up in the $out hash)
+    rm cabal.project.freeze
+
     mkdir -p $out
 
     # ensure we have all our .cabal files (also those generated from package.yaml) files.