diff --git a/flake.nix b/flake.nix
index 8dd6c6a..cef0de1 100644
--- a/flake.nix
+++ b/flake.nix
@@ -24,16 +24,13 @@
     flake-utils.lib.eachDefaultSystem (
       system:
       let
-        pkgs = nixpkgs.legacyPackages.${system}.extend (
-          final: prev: {
-            config = prev.config // {
-              permittedInsecurePackages = (prev.config.permittedInsecurePackages or [ ]) ++ [
-                # openssl_1_1 is EOL but needed to link vibe-d 0.9.8 TLS
-                "openssl-1.1.1w"
-              ];
-            };
-          }
-        );
+        # openssl_1_1 is EOL and marked insecure in nixpkgs, but it's only a
+        # build-time link dependency (vibe-d 0.9.8 TLS needs symbols removed in
+        # OpenSSL 3). The resulting binary statically links it.
+        pkgs = import nixpkgs {
+          inherit system;
+          config.permittedInsecurePackages = [ "openssl-1.1.1w" ];
+        };
       in
       {
         packages = import ./pkgs {