diff --git a/flake.lock b/flake.lock
index 20317b8ab..fac867869 100644
--- a/flake.lock
+++ b/flake.lock
@@ -20,16 +20,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1743689281,
-        "narHash": "sha256-y7Hg5lwWhEOgflEHRfzSH96BOt26LaYfrYWzZ+VoVdg=",
-        "owner": "NixOS",
+        "lastModified": 1743773130,
+        "narHash": "sha256-zyuQDjjsQOqCFPmk+4jRP44d3cejb0gIgjDocO5otuQ=",
+        "owner": "msanft",
         "repo": "nixpkgs",
-        "rev": "2bfc080955153be0be56724be6fa5477b4eefabb",
+        "rev": "0f8342b5f490334c96e2f2984c089a6d21b01032",
         "type": "github"
       },
       "original": {
-        "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
+        "owner": "msanft",
+        "ref": "msanft/mkosi/python3",
         "repo": "nixpkgs",
         "type": "github"
       }
diff --git a/flake.nix b/flake.nix
index d160d9852..8f3c744c5 100644
--- a/flake.nix
+++ b/flake.nix
@@ -3,7 +3,8 @@
 
   inputs = {
     nixpkgs = {
-      url = "github:NixOS/nixpkgs/nixpkgs-unstable";
+      # TODO: change to unstable before merging
+      url = "github:msanft/nixpkgs/msanft/mkosi/python3";
     };
     flake-utils = {
       url = "github:numtide/flake-utils";
@@ -19,6 +20,33 @@
     flake-utils.lib.eachDefaultSystem (
       system:
       let
+        overlay = final: prev: {
+          rpm = prev.rpm.overrideAttrs (old: {
+            nativeBuildInputs = old.nativeBuildInputs ++ [ prev.makeWrapper ];
+            postFixup = ''
+              wrapProgram $out/lib/rpm/sysusers.sh \
+                --set PATH ${
+                  prev.lib.makeBinPath (
+                    with prev;
+                    [
+                      coreutils
+                      findutils
+                      su.out
+                      gnugrep
+                    ]
+                  )
+                }
+            '';
+          });
+
+          # dnf5 assumes a TTY with a very small width by default, truncating its output instead of line-wrapping
+          # it. Force it to use more VT columns to avoid this, and make debugging errors easier.
+          dnf5-stub = prev.writeScriptBin "dnf5" ''
+            #!/usr/bin/env bash
+            FORCE_COLUMNS=200 ${final.dnf5}/bin/dnf5 $@
+          '';
+        };
+
         pkgs = import nixpkgs {
           inherit system;
           config.allowUnfree = true;
@@ -26,18 +54,19 @@
           overlays = [
             (_final: prev: (import ./nix/packages { inherit (prev) lib callPackage; }))
             (_final: prev: { lib = prev.lib // (import ./nix/lib { inherit (prev) lib callPackage; }); })
+            overlay
           ];
         };
 
         callPackage = pkgs.callPackage;
 
         mkosiDev = (
-          pkgs.mkosi.overrideAttrs (oldAttrs: {
-            propagatedBuildInputs =
-              oldAttrs.propagatedBuildInputs
-              ++ (with pkgs; [
+          pkgs.mkosi.override {
+            extraDeps = (
+              with pkgs;
+              [
                 # package management
-                dnf5
+                dnf5-stub
                 rpm
                 createrepo_c
 
@@ -55,8 +84,9 @@
                 # utils
                 gnused # sed
                 gnugrep # grep
-              ]);
-          })
+              ]
+            );
+          }
         );
       in
       {