diff --git a/flake.nix b/flake.nix
index 8223c60..8dd6c6a 100644
--- a/flake.nix
+++ b/flake.nix
@@ -24,7 +24,16 @@
     flake-utils.lib.eachDefaultSystem (
       system:
       let
-        pkgs = nixpkgs.legacyPackages.${system};
+        pkgs = nixpkgs.legacyPackages.${system}.extend (
+          final: prev: {
+            config = prev.config // {
+              permittedInsecurePackages = (prev.config.permittedInsecurePackages or [ ]) ++ [
+                # openssl_1_1 is EOL but needed to link vibe-d 0.9.8 TLS
+                "openssl-1.1.1w"
+              ];
+            };
+          }
+        );
       in
       {
         packages = import ./pkgs {
diff --git a/pkgs/anisette-v3-server/default.nix b/pkgs/anisette-v3-server/default.nix
index f509275..742a6fc 100644
--- a/pkgs/anisette-v3-server/default.nix
+++ b/pkgs/anisette-v3-server/default.nix
@@ -19,11 +19,6 @@ buildDubPackage rec {
 
   dubLock = ./dub-lock.json;
 
-  # openssl_1_1 is EOL and marked insecure in nixpkgs, but it's only a
-  # build-time link dependency (vibe-d 0.9.8 TLS needs symbols removed in
-  # OpenSSL 3). The resulting binary statically links it.
-  permittedInsecurePackages = [ "openssl-1.1.1w" ];
-
   buildInputs = [ zlib openssl_1_1 ];
 
   meta = {