diff --git a/pkgs/anisette-v3-server/default.nix b/pkgs/anisette-v3-server/default.nix
index 742a6fc..f509275 100644
--- a/pkgs/anisette-v3-server/default.nix
+++ b/pkgs/anisette-v3-server/default.nix
@@ -19,6 +19,11 @@ buildDubPackage rec {
 
   dubLock = ./dub-lock.json;
 
+  # openssl_1_1 is EOL and marked insecure in nixpkgs, but it's only a
+  # build-time link dependency (vibe-d 0.9.8 TLS needs symbols removed in
+  # OpenSSL 3). The resulting binary statically links it.
+  permittedInsecurePackages = [ "openssl-1.1.1w" ];
+
   buildInputs = [ zlib openssl_1_1 ];
 
   meta = {