diff --git a/docs/release-checklist.rst b/docs/release-checklist.rst
index 953904f63..48a65ff0a 100644
--- a/docs/release-checklist.rst
+++ b/docs/release-checklist.rst
@@ -59,6 +59,10 @@ Create Branch and Apply Updates
   - summarize major changes
   - commit it
 
+- update "nix/tahoe-lafs.nix"
+
+  - change the value given for `version` from `OLD.post1` to `NEW.post1`
+
 - update "CREDITS"
 
   - are there any new contributors in this release?
diff --git a/newsfragments/3712.installation b/newsfragments/3712.installation
new file mode 100644
index 000000000..b80e1558b
--- /dev/null
+++ b/newsfragments/3712.installation
@@ -0,0 +1 @@
+The Nix package now includes correct version information.
\ No newline at end of file
diff --git a/nix/tahoe-lafs.nix b/nix/tahoe-lafs.nix
index 6c3c68343..8370b0943 100644
--- a/nix/tahoe-lafs.nix
+++ b/nix/tahoe-lafs.nix
@@ -7,7 +7,20 @@
 , html5lib, pyutil, distro, configparser
 }:
 python.pkgs.buildPythonPackage rec {
-  version = "1.14.0.dev";
+  # Most of the time this is not exactly the release version (eg 1.15.1).
+  # Give it a `post` component to make it look newer than the release version
+  # and we'll bump this up at the time of each release.
+  #
+  # It's difficult to read the version from Git the way the Python code does
+  # for two reasons.  First, doing so involves populating the Nix expression
+  # with values from the source.  Nix calls this "import from derivation" or
+  # "IFD" (<https://nixos.wiki/wiki/Import_From_Derivation>).  This is
+  # discouraged in most cases - including this one, I think.  Second, the
+  # Python code reads the contents of `.git` to determine its version.  `.git`
+  # is not a reproducable artifact (in the sense of "reproducable builds") so
+  # it is excluded from the source tree by default.  When it is included, the
+  # package tends to be frequently spuriously rebuilt.
+  version = "1.15.1.post1";
   name = "tahoe-lafs-${version}";
   src = lib.cleanSourceWith {
     src = ../.;
@@ -22,20 +35,22 @@ python.pkgs.buildPythonPackage rec {
         # Build up a bunch of knowledge about what kind of file this is.
         isTox = type == "directory" && basename == ".tox";
         isTrialTemp = type == "directory" && basename == "_trial_temp";
-        isVersion = basename == "version.py";
+        isVersion = basename == "_version.py";
         isBytecode = ext == "pyc" || ext == "pyo";
         isBackup = lib.hasSuffix "~" basename;
         isTemporary = lib.hasPrefix "#" basename && lib.hasSuffix "#" basename;
         isSymlink = type == "symlink";
+        isGit = type == "directory" && basename == ".git";
       in
       # Exclude all these things
-      ! (isTrialTemp
-      || isTox
+      ! (isTox
+      || isTrialTemp
       || isVersion
       || isBytecode
       || isBackup
       || isTemporary
       || isSymlink
+      || isGit
       );
   };
 
@@ -60,7 +75,21 @@ python.pkgs.buildPythonPackage rec {
     # Since we're deleting files, this complains they're missing. For now Nix
     # is Python 2-only, anyway, so these tests don't add anything yet.
     rm src/allmydata/test/test_python3.py
-  '';
+
+    # Generate _version.py ourselves since we can't rely on the Python code
+    # extracting the information from the .git directory we excluded.
+    cat > src/allmydata/_version.py <<EOF
+
+# This _version.py is generated from metadata by nix/tahoe-lafs.nix.
+
+__pkgname__ = "tahoe-lafs"
+real_version = "${version}"
+full_version = "${version}"
+branch = "master"
+verstr = "${version}"
+__version__ = verstr
+EOF
+'';
 
 
   nativeBuildInputs = [