diff --git a/pkgs/by-name/de/den-http-get-updater/package.nix b/pkgs/by-name/de/den-http-get-updater/package.nix
index 91d8581..3293811 100644
--- a/pkgs/by-name/de/den-http-get-updater/package.nix
+++ b/pkgs/by-name/de/den-http-get-updater/package.nix
@@ -44,7 +44,16 @@
 }:
 
 let
-  realFileLocation = builtins.toString fileLocation;
+  assertNoStorePathPrefix = path:
+    assert lib.assertMsg (!lib.hasPrefix builtins.storeDir path) ''
+      The path '${path}' is a store path.
+
+      den-http-get-updater must be evaluated in impure mode,
+      in order to modify target files, and this cannot be done
+      with files in the store.
+    ''; path;
+
+  realFileLocation = assertNoStorePathPrefix (builtins.toString fileLocation);
 
   prefetchList' = lib.map (x:
     assert builtins.isNull x.prefetchUrlLocation || lib.isAttrs x.prefetchUrlLocation;
@@ -58,7 +67,7 @@ let
       name = if x.unpack or unpack then "source" else null;
       mark = builtins.hashString "sha256" x.previousHash;
       markRegexEscape = lib.escapeRegex mark;
-      realFileLocation = builtins.toString x.fileLocation or fileLocation;
+      realFileLocation = assertNoStorePathPrefix (builtins.toString x.realFileLocation or fileLocation);
       realFileLocationShellEscape = lib.escapeShellArg realFileLocation;
       prefetchUrlLocationShellEscape = lib.mapAttrs (_: lib.escapeShellArg) x.prefetchUrlLocation;
       previousHashRegexEscape = lib.escapeRegex x.previousHash;