diff --git a/hosts/containers/grafana/default.nix b/hosts/containers/grafana/default.nix
index b641c1f0..bc450fb5 100644
--- a/hosts/containers/grafana/default.nix
+++ b/hosts/containers/grafana/default.nix
@@ -68,6 +68,11 @@ in {
     }
   ) {} restartServices;
 
+  # TODO: workaround for https://github.com/NixOS/nixpkgs/pull/157931
+  nixpkgs.config.permittedInsecurePackages = [
+    "xen-4.10.4"
+  ];
+
   # This value determines the NixOS release with which your system is to be
   # compatible, in order to avoid breaking some software such as database
   # servers. You should change this only after NixOS release notes say you