diff --git a/flake.lock b/flake.lock
index 6e0fb09..81a811a 100644
--- a/flake.lock
+++ b/flake.lock
@@ -20,16 +20,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1780203844,
-        "narHash": "sha256-K5sT4jTpGs15ADhviMKNBH38REpPf5Q6mM1+N6cArVE=",
+        "lastModified": 1792593785,
+        "narHash": "sha256-dEQs/r/DSIvSjw5pQro/BAqsUnFNNZ3I/qmFYzatGvc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "b51242d7d43689db2f3be91bd05d5b24fbb469c4",
+        "rev": "8c259fc0dd1f3ccc1aaf4f9156ab16b7328b5a4f",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-26.05",
+        "ref": "nixos-26.05-small",
         "repo": "nixpkgs",
         "type": "github"
       }
diff --git a/flake.nix b/flake.nix
index 6a02ab4..0b0303c 100644
--- a/flake.nix
+++ b/flake.nix
@@ -4,7 +4,7 @@
       url = "github:numtide/flake-utils";
     };
     nixpkgs = {
-      url = "github:NixOS/nixpkgs/nixos-26.05";
+      url = "github:NixOS/nixpkgs/nixos-26.05-small";
     };
   };
 
@@ -19,10 +19,25 @@
       let
         pkgs = import nixpkgs { inherit system; };
         version = pkgs.lib.fileContents ./internal/index/version.txt;
+        # Go 1.27.3 rejects chains through the compromised eMudhra
+        # intermediates (CVE-2026-111943). The default pkgs.go is an
+        # older 1.26 release without the fix.
+        go = pkgs.go_1_27;
+        # NSS 3.131.1 removes the emSign ECC Root CA - G3 root that
+        # the compromised eMudhra intermediates chain to. Until nixpkgs
+        # ships it, drop the root ourselves so git and other OpenSSL
+        # clients reject those chains too. (The bundle already excludes
+        # AAA Certificate Services, the root of the Sectigo cross-signs,
+        # from TLS trust.)
+        cacert =
+          if pkgs.lib.versionOlder pkgs.cacert.version "3.131.1" then
+            pkgs.cacert.override { blacklist = [ "emSign ECC Root CA - G3" ]; }
+          else
+            pkgs.cacert;
       in
       {
         packages = {
-          scip-go = pkgs.buildGoModule {
+          scip-go = (pkgs.buildGoModule.override { inherit go; }) {
             pname = "scip-go";
             inherit version;
             src = ./.;
@@ -44,9 +59,9 @@
             tag = version;
             contents = [
               self.packages.${system}.scip-go
-              pkgs.go
+              go
               pkgs.git
-              pkgs.dockerTools.caCertificates
+              (pkgs.dockerTools.override { inherit cacert; }).caCertificates
               pkgs.dockerTools.usrBinEnv
               pkgs.dockerTools.fakeNss
               pkgs.busybox
@@ -103,7 +118,7 @@
         devShells = {
           default = pkgs.mkShellNoCC {
             buildInputs = [
-              pkgs.go
+              go
               pkgs.gotools
               pkgs.nixfmt
             ];