diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index 562fbbbb3061f..c527731bb6921 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -1,4 +1,5 @@
 { stdenv, lib, fetchurl, fetchpatch
+, fetchzip, zstd
 , buildPackages
 , pkgsBuildBuild
 , pkgsBuildTarget
@@ -152,9 +153,30 @@ let
     inherit (upstream-info) version;
     inherit packageName buildType buildPath;
 
-    src = fetchurl {
+    src = fetchzip {
+      name = "chromium-${version}.tar.zstd";
       url = "https://commondatastorage.googleapis.com/chromium-browser-official/chromium-${version}.tar.xz";
       inherit (upstream-info) sha256;
+
+      nativeBuildInputs = [ zstd ];
+
+      postFetch = ''
+        echo removing unused code from tarball to stay under hydra limit
+        rm -r $out/third_party/{rust-src,llvm}
+
+        echo moving remains out of \$out
+        mv $out source
+
+        echo recompressing final contents into new tarball
+        # try to make a deterministic tarball
+        tar \
+          --use-compress-program "zstd -T$NIX_BUILD_CORES" \
+          --sort name \
+          --mtime 1970-01-01 \
+          --owner=root --group=root \
+          --numeric-owner --mode=go=rX,u+rw,a-s \
+          -cf $out source
+      '';
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.nix b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
index b180e08add9b2..3086f82c9c48c 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@@ -8,7 +8,7 @@
         version = "2023-08-01";
       };
     };
-    sha256 = "1wf0j189cxpayy6ffmj5j6h5yg3amivryilimjc2ap0jkyj4xrbi";
+    sha256 = "0c3adrrgpnhm8g1546ask9pf17qj1sjgb950mj0rv4snxvddi75j";
     sha256bin64 = "11w1di146mjb9ql30df9yk9x4b9amc6514jzyfbf09mqsrw88dvr";
     version = "117.0.5938.22";
   };
@@ -21,7 +21,7 @@
         version = "2023-08-10";
       };
     };
-    sha256 = "1z01b6w4sgndrlcd26jgimk3rhv3wzpn67nv1fd5ln7dwfwkyq20";
+    sha256 = "16dq27lsywrn2xlgr5g46gdv15p30sihfamli4vkv3zxzfxdjisv";
     sha256bin64 = "11y09hsy7y1vg65xfilq44ffsmn15dqy80fa57psj1kin4a52v2x";
     version = "118.0.5966.0";
   };
@@ -41,7 +41,7 @@
         version = "2023-08-10";
       };
     };
-    sha256 = "0gcrnvm3ar7x0fv38kjvdzgb8lflx1sckcqy89yawgfy6jkh1vj9";
+    sha256 = "1g8rllmnmhmmpjzrmi3cww0nszxicq0kim2wd0l0ip2mzk2p8qlp";
     sha256bin64 = "1bq170l0g9yq17x6xlg6fjar6gv3hdi0zijwmx4s02pmw6727484";
     version = "118.0.5993.70";
   };
@@ -58,7 +58,7 @@
         sha256 = "0k6684cy1ks6yba2bdz17g244f05qy9769cvis4h2jzhgbf5rysh";
       };
     };
-    sha256 = "0gcrnvm3ar7x0fv38kjvdzgb8lflx1sckcqy89yawgfy6jkh1vj9";
+    sha256 = "1g8rllmnmhmmpjzrmi3cww0nszxicq0kim2wd0l0ip2mzk2p8qlp";
     sha256bin64 = "1bq170l0g9yq17x6xlg6fjar6gv3hdi0zijwmx4s02pmw6727484";
     version = "118.0.5993.70";
   };