diff --git a/flake.lock b/flake.lock
index dbb6bec..8e486ee 100644
--- a/flake.lock
+++ b/flake.lock
@@ -2,16 +2,16 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1765687488,
-        "narHash": "sha256-7YAJ6xgBAQ/Nr+7MI13Tui1ULflgAdKh63m1tfYV7+M=",
+        "lastModified": 1766201043,
+        "narHash": "sha256-eplAP+rorKKd0gNjV3rA6+0WMzb1X1i16F5m5pASnjA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "d02bcc33948ca19b0aaa0213fe987ceec1f4ebe1",
+        "rev": "b3aad468604d3e488d627c0b43984eb60e75e782",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-25.05",
+        "ref": "nixos-25.11",
         "repo": "nixpkgs",
         "type": "github"
       }
diff --git a/flake.nix b/flake.nix
index 133d43e..ee9b063 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1,7 +1,7 @@
 {
   description = "snitch - a friendlier ss/netstat for humans";
 
-  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
 
   outputs = { self, nixpkgs }:
     let
@@ -48,9 +48,9 @@
         let
           rev = self.shortRev or self.dirtyShortRev or "unknown";
           version = "nix-${rev}";
+          isDarwin = pkgs.stdenv.isDarwin;
           go = mkGo125 pkgs;
           buildGoModule = pkgs.buildGoModule.override { inherit go; };
-          isDarwin = pkgs.stdenv.isDarwin;
         in
         buildGoModule {
           pname = "snitch";
@@ -60,9 +60,8 @@
           # darwin requires cgo for libproc, linux uses pure go with /proc
           env.CGO_ENABLED = if isDarwin then "1" else "0";
           env.GOTOOLCHAIN = "local";
-          # go 1.25 crypto/x509 uses SecTrustCopyCertificateChain (macOS 12+)
-          env.MACOSX_DEPLOYMENT_TARGET = pkgs.lib.optionalString isDarwin "12.0";
-          # nixpkgs 25.05+ uses system SDK directly, no explicit framework buildInputs needed
+          # darwin: use macOS 15 SDK for SecTrustCopyCertificateChain (Go 1.25 crypto/x509)
+          buildInputs = pkgs.lib.optionals isDarwin [ pkgs.apple-sdk_15 ];
           ldflags = [
             "-s"
             "-w"