From 38a6cd2358bfb560a5d76bc4c3446b3daa6b693d Mon Sep 17 00:00:00 2001
From: Carl Tashian <carl@smallstep.com>
Date: Wed, 26 Aug 2026 15:53:15 -0700
Subject: [PATCH] Update the nixpkgs pin so the flake evaluates again

The lock pointed at nixpkgs from 2024-04-07, which predates
tpm2-openssl. Every step-agent derivation from 0.69.0 on requires it,
and flake.nix builds the packages output by filtering the whole version
set, so one unevaluable file broke nix build/run/flake show for every
attribute when the repo's own lock was used. Customers following the
README were unaffected because inputs.nixpkgs.follows overrides the
lock.

CI never caught this: build.yml evaluates against live channel tarballs
via NIX_PATH, not the flake lock.
---
 flake.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/flake.lock b/flake.lock
index 78cf35d..4b6a7af 100644
--- a/flake.lock
+++ b/flake.lock
@@ -2,11 +2,11 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1712449641,
-        "narHash": "sha256-U9DDWMexN6o5Td2DznEgguh8TRIUnIl9levmit43GcI=",
+        "lastModified": 1787631388,
+        "narHash": "sha256-vMiXptXarfSdJb1Gkc+FYVOAibuBRj7qxGa8z68q1Uw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "600b15aea1b36eeb43833a50b0e96579147099ff",
+        "rev": "ac6b2166e7a9375683b8e98f860f273222337b16",
         "type": "github"
       },
       "original": {