Thanks, this is what worked for me (I ended up using docker-archive tarballs in the end):
skopeo --insecure-policy --debug copy docker-archive:"$(nix-build)" docker://registry.fly.io/$PROJECT_NAME:latest --dest-creds x:"$(flyctl auth token)" --format v2s2
flyctl deploy -i registry.fly.io/$PROJECT_NAME:latest --remote-only
While it isn’t super complicated, there are a number of things that must go right before things start working. If this was somehow integrated into flyctl deploy, that would be ideal.