diff --git a/pkgs/development/compilers/dotnet/dotnet-sdk-setup-hook.sh b/pkgs/development/compilers/dotnet/dotnet-sdk-setup-hook.sh
--- a/pkgs/development/compilers/dotnet/dotnet-sdk-setup-hook.sh	(revision c70d04efdede54181fa5901b796c84e7c87166f2)
+++ b/pkgs/development/compilers/dotnet/dotnet-sdk-setup-hook.sh	(date 1734541198688)
@@ -100,6 +100,18 @@
             -i /configuration/packageSources/__new -t attr -n value -v "$nugetSource"
             -r /configuration/packageSources/__new -v add)
 
+        if [[ -n ${keepNugetConfig-} ]] && ! xmlstarlet select -t -i "/configuration/packageSources/clear" -nl "$rootConfig"; then
+            @xmlstarlet@/bin/xmlstarlet ed --inplace \
+                -s /configuration -t elem -n "packageSources" \
+                -d "/configuration/packageSources[position() != 1]" \
+                -s "/configuration/packageSources" -t elem -n __unused \
+                -i "/configuration/packageSources/*[1]" -t elem -n add \
+                -i "/configuration/packageSources/*[1]" -t attr -n key -v "nuget" \
+                -i "/configuration/packageSources/*[1]" -t attr -n value -v "https://api.nuget.org/v3/index.json" \
+                -d "/configuration/packageSources/__unused" \
+                "$rootConfig"
+        fi
+
         if [[ -z ${keepNugetConfig-} ]]; then
             xmlConfigArgs+=(-d '//configuration/*')
             xmlRootConfigArgs+=("${xmlSourceConfigArgs[@]}")

seems to work fine

got something working

diff --git a/pkgs/build-support/dotnet/add-nuget-deps/default.nix b/pkgs/build-support/dotnet/add-nuget-deps/default.nix
--- a/pkgs/build-support/dotnet/add-nuget-deps/default.nix	(revision c70d04efdede54181fa5901b796c84e7c87166f2)
+++ b/pkgs/build-support/dotnet/add-nuget-deps/default.nix	(date 1734548430924)
@@ -48,15 +48,32 @@
       fetch-drv =
         let
           pkg' = finalPackage.overrideAttrs (old: {
+            pname = "${old.pname}-fetch-deps-inner";
+
             buildInputs = attrs.buildInputs or [ ];
             nativeBuildInputs = old.nativeBuildInputs or [ ] ++ [ cacert ];
             keepNugetConfig = true;
-            dontBuild = true;
-            doCheck = false;
-            dontInstall = true;
-            doInstallCheck = false;
-            dontFixup = true;
-            doDist = false;
+
+            __impure = true;
+
+            phases = [
+              "unpackPhase"
+              "patchPhase"
+              "configureNuget"
+              "configurePhase"
+              "fetchDepsPhase"
+            ];
+
+            fetchDepsPhase = ''
+              mkdir -p "$out"
+
+              (
+                  echo -e "# This file was automatically generated by passthru.fetch-deps.\n# Please dont edit it manually, your changes might get overwritten!\n"
+                  ${lib.getExe buildPackages.nuget-to-nix} "''${NUGET_PACKAGES%/}"
+              ) > "$out/deps.nix"
+
+              ${lib.getExe buildPackages.nixfmt-rfc-style} "$out/deps.nix"
+            '';
           });
         in
         pkg'.overrideAttrs overrideFetchAttrs;
@@ -64,14 +81,6 @@
         let
           drv = builtins.unsafeDiscardOutputDependency fetch-drv.drvPath;
 
-          innerScript = substituteAll {
-            src = ./fetch-deps.sh;
-            isExecutable = true;
-            inherit (buildPackages) cacert;
-            nugetToNix = buildPackages.nuget-to-nix;
-            nixfmt = buildPackages.nixfmt-rfc-style;
-          };
-
           defaultDepsFile =
             # Wire in the depsFile such that running the script with no args
             # runs it agains the correct deps file by default.
@@ -89,23 +98,14 @@
 
           echo 'fetching dependencies for' ${lib.escapeShellArg finalPackage.name} >&2
 
-          # this needs to be before TMPDIR is changed, so the output isn't deleted
-          # if it uses mktemp
           depsFile=$(realpath "''${1:-${lib.escapeShellArg defaultDepsFile}}")
 
-          export TMPDIR
-          TMPDIR=$(mktemp -d -t fetch-deps-${lib.escapeShellArg finalPackage.name}.XXXXXX)
-          trap 'chmod -R +w "$TMPDIR" && rm -fr "$TMPDIR"' EXIT
-
-          export NUGET_HTTP_CACHE_PATH=''${NUGET_HTTP_CACHE_PATH-~/.local/share/NuGet/v3-cache}
+          out=$(${buildPackages.nix}/bin/nix build --no-link --print-out-paths --print-build-logs \
+              --option sandbox true \
+              "${drv}^*")
 
-          HOME=$TMPDIR/home
-          mkdir "$HOME"
-
-          cd "$TMPDIR"
-
-          NIX_BUILD_SHELL=${lib.escapeShellArg buildPackages.runtimeShell} ${buildPackages.nix}/bin/nix-shell \
-            --pure --keep NUGET_HTTP_CACHE_PATH --run 'source '${lib.escapeShellArg innerScript}' '"''${depsFile@Q}" "${drv}"
+          cp "$out/deps.nix" "$depsFile"
+          echo "Succesfully wrote lockfile to $depsFile"
         '';
     };
 }

This is by design, sources are unordered and they are searched by order of the quickest response rather than by order of how they show up in file.

https://github.com/NuGet/Home/issues/3676