diff --git a/default.nix b/default.nix
index f1a38c0..546af4f 100644
--- a/default.nix
+++ b/default.nix
@@ -4,7 +4,14 @@
 
 with pkgs.haskell.lib;
 
-let inherit (pkgs) lib; in rec {
+rec {
+  inherit (import ./dep/gitignore.nix { inherit (pkgs) lib; }) gitignoreSource;
+  lib = pkgs.callPackage ./lib.nix {
+    inherit gitignoreSource;
+    inherit (pkgs) fetchgitPrivate;
+  };
+  inherit (lib) thunkSource mapSubdirectories;
+
   # The version of nixpkgs that we use for fetching packing thunks (by
   # themselves). Not to be used for building packages.
   packedThunkNixpkgs = builtins.fetchTarball {
@@ -105,52 +112,6 @@ let inherit (pkgs) lib; in rec {
 
   command = generateOptparseApplicativeCompletion "nix-thunk" (justStaticExecutables haskellPackages.nix-thunk);
 
-  inherit (import ./dep/gitignore.nix { inherit lib; }) gitignoreSource;
-
-  # Retrieve source that is controlled by the hack-* scripts; it may be either a stub or a checked-out git repo
-  thunkSource = p:
-    let
-      contents = builtins.readDir p;
-
-      contentsMatch = { required, optional }:
-           (let all = required // optional; in all // contents == all)
-        && builtins.intersectAttrs required contents == required;
-
-      # Newer obelisk thunks include the feature of hackGet with a thunk.nix file in the thunk.
-      isObeliskThunkWithThunkNix =
-        let
-          packed = jsonFileName: {
-            required = { ${jsonFileName} = "regular"; "default.nix" = "regular"; "thunk.nix" = "regular"; };
-            optional = { ".attr-cache" = "directory"; };
-          };
-        in builtins.any (n: contentsMatch (packed n)) [ "git.json" "github.json" ];
-
-      filterArgs = x: removeAttrs x [ "branch" ];
-      hasValidThunk = name: if builtins.pathExists (p + ("/" + name))
-        then
-          contentsMatch {
-            required = { ${name} = "regular"; };
-            optional = { "default.nix" = "regular"; ".attr-cache" = "directory"; };
-          }
-          || throw "Thunk at ${toString p} has files in addition to ${name} and optionally default.nix and .attr-cache. Remove either ${name} or those other files to continue (check for leftover .git too)."
-        else false;
-    in
-      if isObeliskThunkWithThunkNix then import (p + "/thunk.nix")
-      else if hasValidThunk "git.json" then (
-        let gitArgs = filterArgs (builtins.fromJSON (builtins.readFile (p + "/git.json")));
-        in if builtins.elem "@" (lib.stringToCharacters gitArgs.url)
-          then pkgs.fetchgitPrivate gitArgs
-          else pkgs.fetchgit gitArgs
-        )
-      else if hasValidThunk "github.json" then
-        pkgs.fetchFromGitHub (filterArgs (builtins.fromJSON (builtins.readFile (p + "/github.json"))))
-      else {
-        name = baseNameOf p;
-        outPath = gitignoreSource p;
-      };
-
-  #TODO: This really shouldn't include *all* symlinks, just ones that point at directories
-  mapSubdirectories = f: dir: lib.mapAttrs (name: _: f (dir + "/${name}")) (lib.filterAttrs (_: type: type == "directory" || type == "symlink") (builtins.readDir dir));
 
   ##############################################################################
   # Deprecated functions
diff --git a/lib.nix b/lib.nix
new file mode 100644
index 0000000..264ef80
--- /dev/null
+++ b/lib.nix
@@ -0,0 +1,47 @@
+{ lib, fetchgit, fetchgitPrivate, gitignoreSource, fetchFromGitHub }:
+rec {
+  # Retrieve source that is controlled by the hack-* scripts; it may be either a stub or a checked-out git repo
+  thunkSource = p:
+    let
+      contents = builtins.readDir p;
+
+      contentsMatch = { required, optional }:
+           (let all = required // optional; in all // contents == all)
+        && builtins.intersectAttrs required contents == required;
+
+      # Newer obelisk thunks include the feature of hackGet with a thunk.nix file in the thunk.
+      isObeliskThunkWithThunkNix =
+        let
+          packed = jsonFileName: {
+            required = { ${jsonFileName} = "regular"; "default.nix" = "regular"; "thunk.nix" = "regular"; };
+            optional = { ".attr-cache" = "directory"; };
+          };
+        in builtins.any (n: contentsMatch (packed n)) [ "git.json" "github.json" ];
+
+      filterArgs = x: removeAttrs x [ "branch" ];
+      hasValidThunk = name: if builtins.pathExists (p + ("/" + name))
+        then
+          contentsMatch {
+            required = { ${name} = "regular"; };
+            optional = { "default.nix" = "regular"; ".attr-cache" = "directory"; };
+          }
+          || throw "Thunk at ${toString p} has files in addition to ${name} and optionally default.nix and .attr-cache. Remove either ${name} or those other files to continue (check for leftover .git too)."
+        else false;
+    in
+      if isObeliskThunkWithThunkNix then import (p + "/thunk.nix")
+      else if hasValidThunk "git.json" then (
+        let gitArgs = filterArgs (builtins.fromJSON (builtins.readFile (p + "/git.json")));
+        in if builtins.elem "@" (lib.stringToCharacters gitArgs.url)
+          then fetchgitPrivate gitArgs
+          else fetchgit gitArgs
+        )
+      else if hasValidThunk "github.json" then
+        fetchFromGitHub (filterArgs (builtins.fromJSON (builtins.readFile (p + "/github.json"))))
+      else {
+        name = baseNameOf p;
+        outPath = gitignoreSource p;
+      };
+
+  #TODO: This really shouldn't include *all* symlinks, just ones that point at directories
+  mapSubdirectories = f: dir: lib.mapAttrs (name: _: f (dir + "/${name}")) (lib.filterAttrs (_: type: type == "directory" || type == "symlink") (builtins.readDir dir));
+}