Where are the source packages?

It’s reproducible, so random updates are a no-no. You can however just dump the Git URL in your flake.nix inputs and then override the src of the package with that. The source gets updated when you do nix flake update next time. Something like this:

inputs {
    ...
    mypackage_src.url = "github:myorg/mypackage";
    mypackage_src.flake = false;
    ...
}

pkgs.mypackage.overrideAttrs (oldAttrs: {
              src = mypackage_src;
              version = "nightly-${mypackage_src.shortRev or "src"}";
            })