{
  lib,
  stdenv,
  fetchurl,
  dpkg,
  autoPatchelfHook,
  makeWrapper,
  alsa-lib,
  at-spi2-atk,
  cairo,
  cups,
  dbus,
  expat,
  gdk-pixbuf,
  glib,
  gtk3,
  gtk4,
  libdrm,
  libgbm,
  libGL,
  libnotify,
  libpulseaudio,
  libsecret,
  libx11,
  libxcb,
  libxcomposite,
  libxdamage,
  libxext,
  libxfixes,
  libxkbcommon,
  libxrandr,
  libxshmfence,
  nspr,
  nss,
  pango,
  pciutils,
  pipewire,
  speechd-minimal,
  systemd,
  vulkan-loader,
}:

let
  version = "2026.10.17";

  # Release tags use dotted dates (v2026.10.17), but the Debian artifacts use
  # the release date with a build suffix (2026.1017.0).
  versionParts = lib.splitString "." version;
  debVersion = "${lib.elemAt versionParts 0}.${lib.elemAt versionParts 1}${lib.elemAt versionParts 2}.0";

  arch =
    {
      x86_64-linux = "x64";
      aarch64-linux = "arm64";
    }
    .${stdenv.hostPlatform.system}
      or (throw "pilotdeck: unsupported system ${stdenv.hostPlatform.system}");

  hashes = {
    # The release publishes one Debian package per architecture. nix-update
    # refreshes only the host architecture's hash; update the other one by hand
    # from release.json in the GitHub release.
    x86_64-linux = "sha256-vBqewHabntIz1hKbf10q9hkWX22m0U2mqJMXvX7cJOc=";
    aarch64-linux = "sha256-paEEmWYkITfYTa3AsYD0WfVqtzzQ1GMlt5yjp7oXROY=";
  };

  runtimeLibs = [
    alsa-lib
    at-spi2-atk
    cairo
    cups
    dbus
    expat
    gdk-pixbuf
    glib
    gtk3
    gtk4
    libdrm
    libgbm
    libGL
    libnotify
    libpulseaudio
    libsecret
    libx11
    libxcb
    libxcomposite
    libxdamage
    libxext
    libxfixes
    libxkbcommon
    libxrandr
    libxshmfence
    nspr
    nss
    pango
    pciutils
    pipewire
    speechd-minimal
    stdenv.cc.cc.lib
    systemd
    vulkan-loader
  ];
in
stdenv.mkDerivation {
  pname = "pilotdeck";
  inherit version;

  src = fetchurl {
    url = "https://github.com/OpenBMB/PilotDeck/releases/download/v${version}/PilotDeck-${debVersion}-linux-${arch}.deb";
    hash = hashes.${stdenv.hostPlatform.system};
  };

  nativeBuildInputs = [
    dpkg
    autoPatchelfHook
    makeWrapper
  ];

  buildInputs = runtimeLibs;

  # The Debian package contains the complete Electron application, including
  # the bundled Node.js runtime and the built web UI.
  unpackPhase = ''
    runHook preUnpack
    dpkg-deb --extract $src .
    runHook postUnpack
  '';

  dontBuild = true;
  dontStrip = true;

  installPhase = ''
    runHook preInstall

    mkdir -p $out/opt
    cp -a opt/PilotDeck $out/opt/PilotDeck

    mkdir -p $out/share/applications
    substitute usr/share/applications/pilotdeck-desktop.desktop \
      $out/share/applications/pilotdeck.desktop \
      --replace-fail 'Exec=/opt/PilotDeck/pilotdeck-desktop %U' 'Exec=pilotdeck %U' \
      --replace-fail 'Icon=pilotdeck-desktop' 'Icon=pilotdeck'

    mkdir -p $out/share/icons/hicolor/256x256/apps
    cp usr/share/icons/hicolor/256x256/apps/pilotdeck-desktop.png \
      $out/share/icons/hicolor/256x256/apps/pilotdeck.png

    makeWrapper $out/opt/PilotDeck/pilotdeck-desktop $out/bin/pilotdeck \
      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath runtimeLibs}"

    runHook postInstall
  '';

  # bcrypt ships glibc and musl prebuilds side by side; only the glibc one is
  # used here, so the musl libc reference of the other prebuild stays unresolved.
  autoPatchelfIgnoreMissingDeps = [
    "libc.musl-x86_64.so.1"
    "libc.musl-aarch64.so.1"
  ];

  passthru = {
    category = "AI Agents";
    updateScript = [
      "nix-update"
      "--flake"
      ".#pilotdeck"
    ];
  };

  meta = with lib; {
    description = "Task-oriented AI Agent productivity platform";
    homepage = "https://github.com/OpenBMB/PilotDeck";
    changelog = "https://github.com/OpenBMB/PilotDeck/releases/tag/v${version}";
    license = licenses.agpl3Only;
    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
    mainProgram = "pilotdeck";
    platforms = [
      "x86_64-linux"
      "aarch64-linux"
    ];
  };
}