really good question.

right now I have bought into the Nix koolaid a bit.

I have NixOS Linux machines and then nix-darwin on my Mac.

I use Nix to install Brew and then Brew to manage casks for things like Chrome what I'm sure updates itself. So the "flake.lock" probably isn't super accurate for the apps you described.