fetchPnpmDeps is definitely not the best thing in the world but sadly the best we have at the moment.

Maybe I can interest you in my importPnpmLock.nix (also mirrored to GitHub). Though that is only a solution if you are okay with IFD