diff --git a/nightly.nix b/nightly.nix
index f5ea44b..384990e 100644
--- a/nightly.nix
+++ b/nightly.nix
@@ -2,7 +2,7 @@
 # Auto-updated by scripts/update-nightly.sh — do not edit manually.
 { pkgs }:
 pkgs.callPackage ./package.nix {
-  pinVersion = "0.3.0-unstable-2026-03-22";
-  pinRev = "43bca6d107c86efc7e60a4a35ca8a55e1b4b4c1e";
-  pinHash = "sha256-cd9jDrphEwjJqNLR3FNrg/xze2sFWhIzmvWLYa2CV5E=";
+  pinVersion = "0.4.0-unstable-2026-03-25";
+  pinRev = "e5691eed38716bce6d55fa83e62d92e3c327c437";
+  pinHash = "sha256-+tJLd9PSdULdm4gsoWaonRx9NrZsNiiZ0wMUOP7Adek=";
 }
diff --git a/package.nix b/package.nix
index 216ddb6..02fd246 100644
--- a/package.nix
+++ b/package.nix
@@ -9,9 +9,9 @@
   ripgrep,
   ffmpeg,
   git,
-  pinVersion ? "0.3.0",
-  pinRev ? "6ebb816e5611aaf1f3f7187ba8b10e985e899c75",
-  pinHash ? "sha256-JGjusff/jGjvCCdUtl9IErBTGmpIq6BVA5Gj8mwqVYg=",
+  pinVersion ? "0.4.0",
+  pinRev ? "8416bc2142ad7494b3d72b055cd5a86a80472fe4",
+  pinHash ? "sha256-dKilXoJbu5thhCRpDYKTX9fAOq1JTqdBvuf9Ji1iY64=",
 }:
 
 let
@@ -26,6 +26,10 @@ let
         # pytest-services fails with PermissionError in Nix sandbox (/tmp/service-locks)
         doCheck = false;
       });
+      cherrypy = prev.cherrypy.overridePythonAttrs (_old: {
+        # cherrypy test_logging tests crash in macOS Nix sandbox (signal 0)
+        doCheck = false;
+      });
     };
   };
   pythonPackages = python.pkgs;
diff --git a/scripts/update-pins.sh b/scripts/update-pins.sh
index 5aa06cc..448517c 100755
--- a/scripts/update-pins.sh
+++ b/scripts/update-pins.sh
@@ -46,7 +46,7 @@ fi
 log "Parsed version: $upstream_version"
 
 # --- Compare with current ---
-current_version=$(awk -F'"' '/^  version = /{print $2}' "$package_file" | head -1)
+current_version=$(awk -F'"' '/pinVersion \? "/{print $2}' "$package_file" | head -1)
 log "Current pinned version: $current_version"
 
 if [[ "$current_version" == "$upstream_version" ]]; then
@@ -95,10 +95,10 @@ log "Computing fetchFromGitHub hash (with submodules)..."
 # Save original
 cp "$package_file" "$package_file.bak"
 
-# Update version, rev, and set hash to empty
-perl -0pi -e "s|version = \"[^\"]+\";|version = \"${upstream_version}\";|" "$package_file"
-perl -0pi -e "s|rev = \"[^\"]+\";|rev = \"${tag_sha}\";|" "$package_file"
-perl -0pi -e 's|hash = "sha256-[^"]+";|hash = "";|' "$package_file"
+# Update pinVersion, pinRev, and set pinHash to empty
+perl -0pi -e "s|pinVersion \\? \"[^\"]+\"|pinVersion \\? \"${upstream_version}\"|" "$package_file"
+perl -0pi -e "s|pinRev \\? \"[^\"]+\"|pinRev \\? \"${tag_sha}\"|" "$package_file"
+perl -0pi -e 's|pinHash \? "sha256-[^"]+"|pinHash \? ""|' "$package_file"
 
 # Build and capture the correct hash from the error
 build_log=$(mktemp)
@@ -121,7 +121,7 @@ log "Source hash: $source_hash"
 
 # Update with the correct hash
 if [[ -n "$source_hash" ]]; then
-  perl -0pi -e "s|hash = \"[^\"]*\";|hash = \"${source_hash}\";|" "$package_file"
+  perl -0pi -e "s|pinHash \\? \"[^\"]*\"|pinHash \\? \"${source_hash}\"|" "$package_file"
 fi
 
 # --- Validate build ---