diff --git a/maintainers/scripts/bootstrap-files/refresh-tarballs.bash b/maintainers/scripts/bootstrap-files/refresh-tarballs.bash
index 775d7ef1379d..4b0380f09745 100755
--- a/maintainers/scripts/bootstrap-files/refresh-tarballs.bash
+++ b/maintainers/scripts/bootstrap-files/refresh-tarballs.bash
@@ -67,14 +67,8 @@ NATIVE_TARGETS=(
     i686-unknown-linux-gnu
     x86_64-unknown-linux-gnu
     x86_64-unknown-linux-musl
-
-    # TODO: add darwin here once a few prerequisites are satisfied:
-    #   - bootstrap-files are factored out into a separate file
-    #   - the build artifacts are factored out into an `on-server`
-    #     directory. Right onw if does not match `linux` layout.
-    #
-    #aarch64-apple-darwin
-    #x86_64-apple-darwin
+    aarch64-apple-darwin
+    x86_64-apple-darwin
 )
 
 is_native() {
@@ -106,6 +100,18 @@ is_cross() {
     return 1
 }
 
+nar_sri_get() {
+    local ouput sri
+    output=$(nix-build  --expr \
+        'import <nix/fetchurl.nix> {
+           url = "'"$1"'";
+           unpack = true;
+         }' 2>&1 || true)
+    sri=$(echo "$output" | awk '/^\s+got:\s+/{ print $2 }')
+    [[ -z "$sri" ]] && die "$output"
+    echo "$sri"
+}
+
 # collect passed options
 
 targets=()
@@ -222,6 +228,7 @@ EOF
           case "$fname" in
               bootstrap-tools.tar.xz) attr=bootstrapTools ;;
               busybox) attr=$fname ;;
+              unpack.nar.xz) attr=unpack ;;
               *) die "Don't know how to map '$fname' to attribute name. Please update me."
           esac
 
@@ -229,18 +236,27 @@ EOF
           executable_nix=
           if [[ -x "$p" ]]; then
               executable_arg="--executable"
-              executable_nix="    executable = true;"
+              executable_nix="executable = true;"
+          fi
+          unpack_nix=
+          if [[ $fname = *.nar.* ]]; then
+              unpack_nix="unpack = true;"
+              sri=$(nar_sri_get "file://$p")
+          else
+              sha256=$(nix-prefetch-url $executable_arg --name "$fname" "file://$p")
+              [[ $? -ne 0 ]] && die "Failed to get the hash for '$p'"
+              sri=$(nix-hash --to-sri "sha256:$sha256")
+              [[ $? -ne 0 ]] && die "Failed to convert '$sha256' hash to an SRI form"
           fi
-          sha256=$(nix-prefetch-url $executable_arg --name "$fname" "file://$p")
-          [[ $? -ne 0 ]] && die "Failed to get the hash for '$p'"
-          sri=$(nix-hash --to-sri "sha256:$sha256")
-          [[ $? -ne 0 ]] && die "Failed to convert '$sha256' hash to an SRI form"
 
           # individual file entries
           cat <<EOF
   $attr = import <nix/fetchurl.nix> {
     url = "http://tarballs.nixos.org/${s3_prefix}/${nixpkgs_revision}/$fname";
-    hash = "${sri}";$(printf "\n%s" "${executable_nix}")
+    hash = "${sri}";$(
+    [[ -n ${executable_nix} ]] && printf "\n    %s" "${executable_nix}"
+    [[ -n ${unpack_nix} ]]     && printf "\n    %s" "${unpack_nix}"
+)
   };
 EOF
       done