diff --git a/flake.lock b/flake.lock
index 207a0b0..6c5d414 100644
--- a/flake.lock
+++ b/flake.lock
@@ -299,18 +299,15 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1760782625,
-        "narHash": "sha256-qeSmHF66cMiHObiBhm8IngmqDBEcqNdBSSoAjuE6tTw=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "f2ee78c4eb601be36a277e1779a7a87655419dad",
-        "type": "github"
+        "lastModified": 1763509821,
+        "narHash": "sha256-ibZr0ONEUA1W2WAdTzgm9/6jBE+tM20j1YW2FK4RZ/k=",
+        "rev": "659aa6fa27619d04de231b4cc0c938905dfa01e9",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixos/25.05-small/nixos-25.05.812929.659aa6fa2761/nixexprs.tar.xz?lastModified=1763509821&rev=659aa6fa27619d04de231b4cc0c938905dfa01e9"
       },
       "original": {
-        "owner": "nixos",
-        "ref": "nixos-25.05-small",
-        "repo": "nixpkgs",
-        "type": "github"
+        "type": "tarball",
+        "url": "https://channels.nixos.org/nixos-25.05-small/nixexprs.tar.xz"
       }
     },
     "pre-commit-hooks": {
diff --git a/flake.nix b/flake.nix
index 334f73c..ae23cb6 100644
--- a/flake.nix
+++ b/flake.nix
@@ -2,7 +2,7 @@
   description = "tlater.net host configuration";
 
   inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-25.05-small";
+    nixpkgs.url = "https://channels.nixos.org/nixos-25.05-small/nixexprs.tar.xz";
 
     ## Nix/OS utilities
 
@@ -63,7 +63,6 @@
       self,
       nixpkgs,
       sops-nix,
-      deploy-rs,
       ...
     }@inputs:
     let
@@ -78,6 +77,22 @@
           ./configuration/hardware-specific/vm.nix
         ];
       };
+
+      # deploy-rs unfortunately uses an `import nixpkgs`, and its
+      # library functions depend on an instantiated nixpkgs, so we
+      # can't get around multi-nixpkgs-eval.
+      deployRsPackages = import nixpkgs {
+        inherit system;
+        overlays = [
+          inputs.deploy-rs.overlays.default
+          (final: prev: {
+            deploy-rs = {
+              inherit (nixpkgs.legacyPackages.${system}) deploy-rs;
+              inherit (prev.deploy-rs) lib;
+            };
+          })
+        ];
+      };
     in
     {
       ##################
@@ -105,7 +120,7 @@
 
           profiles.system = {
             user = "root";
-            path = deploy-rs.lib.${system}.activate.nixos self.nixosConfigurations.hetzner-1;
+            path = deployRsPackages.deploy-rs.lib.${system}.activate.nixos self.nixosConfigurations.hetzner-1;
           };
 
           sshUser = "tlater";
@@ -159,7 +174,7 @@
 
           packages = nixpkgs.lib.attrValues {
             inherit (sops-nix.packages.${system}) sops-import-keys-hook sops-init-gpg-key;
-            inherit (deploy-rs.packages.${system}) default;
+            inherit (deployRsPackages.deploy-rs) deploy-rs;
           };
         };