For now, the source hashes will continue to be stored in the Nixpkgs tree. The package update instructions are updated.