Pin nixpkgs to a stable release (nixos-26.05) instead of unstable? #11

New issue

Closed

opened 2026-06-18 08:37:04 +00:00 by bram.buijs · 1 comment

bram.buijs commented

2026-06-18 08:37:04 +00:00

Collaborator

Observation

flake.nix tracks nixos-unstable with a nixos-25.11 stable fallback. 25.11
is close to end of life, and unstable means the workstation moves with the
rolling channel.

For a government workstation a pinned stable release is usually the safer
posture (predictable, security-patched within the release). I've been running
the config on nixos-26.05 (the current stable) and it evaluates green across
the hosts.

Question

Is nixos-unstable a deliberate choice (tracking latest), or would a pin to
nixos-26.05 be welcome? If welcome I'll open the (small) PR. Flagging it as a
question first rather than just sending the PR, since it's a repo-wide policy
call.

## Observation `flake.nix` tracks `nixos-unstable` with a `nixos-25.11` stable fallback. 25.11 is close to end of life, and unstable means the workstation moves with the rolling channel. For a government workstation a pinned stable release is usually the safer posture (predictable, security-patched within the release). I've been running the config on `nixos-26.05` (the current stable) and it evaluates green across the hosts. ## Question Is `nixos-unstable` a deliberate choice (tracking latest), or would a pin to `nixos-26.05` be welcome? If welcome I'll open the (small) PR. Flagging it as a question first rather than just sending the PR, since it's a repo-wide policy call.

bram.buijs referenced this issue

2026-06-18 08:37:05 +00:00

feat: overheid baseline (hardening opt-in, users, T495s host, 26.05 pin) #7

rutger.putter commented

2026-06-18 09:38:58 +00:00

Collaborator

Agreed an approved ✅. This might prevent some "unexplained" behavior in the unstable branch.
I would still like to have an overlay for unstable packages if we require an more updated version of a specific package.

If you have the bandwidth: go ahead and create the PR and I'll review/merge.

Agreed an approved ✅. This might prevent some "unexplained" behavior in the unstable branch. I would still like to have an overlay for unstable packages if we require an more updated version of a specific package. If you have the bandwidth: go ahead and create the PR and I'll review/merge.

bram.buijs referenced this issue from a pull request that will close it,

2026-06-18 12:08:11 +00:00

feat(nixpkgs): pin nixos-26.05 and add an unstable overlay #17

bram.buijs referenced this issue

2026-06-18 12:13:30 +00:00

docs(architecture): record key design decisions as ADRs #22

rutger.putter closed this issue

2026-06-22 08:42:33 +00:00

rutger.putter referenced this issue from a commit

2026-06-22 08:42:34 +00:00

feat(nixpkgs): add an unstable overlay for cherry-picking newer packages

rutger.putter added the