diff --git a/flake.lock b/flake.lock
index 8af6033f5..830d6fd03 100644
--- a/flake.lock
+++ b/flake.lock
@@ -20,16 +20,16 @@
     },
     "nixpkgsUnstable": {
       "locked": {
-        "lastModified": 1733376361,
-        "narHash": "sha256-aLJxoTDDSqB+/3orsulE6/qdlX6MzDLIITLZqdgMpqo=",
-        "owner": "NixOS",
+        "lastModified": 1743496247,
+        "narHash": "sha256-RtiLfqe+Wt1MC1LnG1mYNKwIlg27LnRwkr2b0vTmEIM=",
+        "owner": "msanft",
         "repo": "nixpkgs",
-        "rev": "929116e316068c7318c54eb4d827f7d9756d5e9c",
+        "rev": "ef4cdcad9eaa74c2ff07c065e08b4017be3665c4",
         "type": "github"
       },
       "original": {
-        "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
+        "owner": "msanft",
+        "ref": "msanft/mkosi/fix",
         "repo": "nixpkgs",
         "type": "github"
       }
diff --git a/flake.nix b/flake.nix
index 16bd15b4a..87498a7ed 100644
--- a/flake.nix
+++ b/flake.nix
@@ -3,7 +3,9 @@
 
   inputs = {
     nixpkgsUnstable = {
-      url = "github:NixOS/nixpkgs/nixpkgs-unstable";
+      # TODO(msanft): Go back to upstream once the following PR lands:
+      # https://github.com/NixOS/nixpkgs/pull/395114
+      url = "github:msanft/nixpkgs/msanft/mkosi/fix";
     };
     flake-utils = {
       url = "github:numtide/flake-utils";
@@ -19,17 +21,47 @@
     flake-utils.lib.eachDefaultSystem (
       system:
       let
-        pkgsUnstable = import nixpkgsUnstable { inherit system; };
+        overlay = final: prev: {
+          rpm = prev.rpm.overrideAttrs (old: {
+            nativeBuildInputs = old.nativeBuildInputs ++ [ prev.makeWrapper ];
+            postFixup = ''
+              wrapProgram $out/lib/rpm/sysusers.sh \
+                --set PATH ${
+                  prev.lib.makeBinPath (
+                    with prev;
+                    [
+                      coreutils
+                      findutils
+                      su.out
+                      gnugrep
+                    ]
+                  )
+                }
+            '';
+          });
+
+          # dnf5 assumes a TTY with a very small width by default, truncating its output instead of line-wrapping
+          # it. Force it to use more VT columns to avoid this, and make debugging errors easier.
+          dnf5-stub = prev.writeScriptBin "dnf5" ''
+            #!/usr/bin/env bash
+            FORCE_COLUMNS=200 ${final.dnf5}/bin/dnf5 $@
+          '';
+        };
+
+        pkgsUnstable = import nixpkgsUnstable {
+          inherit system;
+          overlays = [ overlay ];
+        };
 
         callPackage = pkgsUnstable.callPackage;
 
         mkosiDev = (
-          pkgsUnstable.mkosi.overrideAttrs (oldAttrs: {
-            propagatedBuildInputs =
-              oldAttrs.propagatedBuildInputs
-              ++ (with pkgsUnstable; [
+          pkgsUnstable.mkosi.override {
+            extraDeps = (
+              with pkgsUnstable;
+              [
                 # package management
-                dnf5
+                dnf5-stub
                 rpm
                 createrepo_c
 
@@ -47,8 +79,9 @@
                 # utils
                 gnused # sed
                 gnugrep # grep
-              ]);
-          })
+              ]
+            );
+          }
         );
       in
       {