diff --git a/flake.nix b/flake.nix
index f9426f8..db0ae0e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -60,6 +60,12 @@
           # darwin requires cgo for libproc, linux uses pure go with /proc
           env.CGO_ENABLED = if isDarwin then "1" else "0";
           env.GOTOOLCHAIN = "local";
+          # go 1.25 crypto/x509 uses SecTrustCopyCertificateChain (macOS 12+)
+          env.MACOSX_DEPLOYMENT_TARGET = pkgs.lib.optionalString isDarwin "12.0";
+          buildInputs = pkgs.lib.optionals isDarwin [
+            pkgs.darwin.apple_sdk.frameworks.Security
+            pkgs.darwin.apple_sdk.frameworks.CoreFoundation
+          ];
           ldflags = [
             "-s"
             "-w"