Import nixpkgs with permittedInsecurePackages config

flake.nix

@@ -24,16 +24,13 @@
     flake-utils.lib.eachDefaultSystem (
       system:
       let
-        pkgs = nixpkgs.legacyPackages.${system}.extend (
+        # openssl_1_1 is EOL and marked insecure in nixpkgs, but it's only a
-          final: prev: {
+        # build-time link dependency (vibe-d 0.9.8 TLS needs symbols removed in
-            config = prev.config // {
+        # OpenSSL 3). The resulting binary statically links it.
-              permittedInsecurePackages = (prev.config.permittedInsecurePackages or [ ]) ++ [
+        pkgs = import nixpkgs {
-                # openssl_1_1 is EOL but needed to link vibe-d 0.9.8 TLS
+          inherit system;
-                "openssl-1.1.1w"
+          config.permittedInsecurePackages = [ "openssl-1.1.1w" ];
-              ];
         };
-          }
-        );
       in
       {
         packages = import ./pkgs {