diff --git a/config/default.nix b/config/default.nix
index 34de6372..3e4e2270 100644
--- a/config/default.nix
+++ b/config/default.nix
@@ -134,6 +134,7 @@
     ];
     registry.nixpkgs.flake = nixos;
     settings = {
+      extra-experimental-features = "ca-derivations";
       # if a download from hydra fails, we want to stop and retry it, instead of building it
       fallback = false;
       trusted-public-keys = [
diff --git a/flake.lock b/flake.lock
index 11aaec7b..9a86e6db 100644
--- a/flake.lock
+++ b/flake.lock
@@ -363,11 +363,11 @@
     },
     "nixos": {
       "locked": {
-        "lastModified": 1706633832,
-        "narHash": "sha256-8bx7ZwvB+sfg9UVNAiQ59U9FYM2OTP1zPolltNdWzzk=",
+        "lastModified": 1706697866,
+        "narHash": "sha256-CZZ1ytGsB3YYnYp1shlqbixk6ahElAV8wM1s9Gb3V0w=",
         "owner": "SuperSandro2000",
         "repo": "nixpkgs",
-        "rev": "a2e78dcf58d713ca45396243728c0a97d2cc695c",
+        "rev": "6075985329173e80b46d25e90b01f5cba7fefa92",
         "type": "github"
       },
       "original": {
@@ -402,11 +402,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1706608774,
-        "narHash": "sha256-kbMofnGXCRPInXWm7UAfMYcvIAuHIZO0vBytNhWt+nc=",
+        "lastModified": 1706740920,
+        "narHash": "sha256-uFwu44BZf17WYMAEmYIcdtVyNLDRVselv3rNsm7PYeE=",
         "owner": "SuperSandro2000",
         "repo": "nixos-modules",
-        "rev": "2dae76c258451a2c98e3dee5d1144f5061878e2a",
+        "rev": "453f941ff2cde75a5aac5d99c695d368fa28b7e1",
         "type": "github"
       },
       "original": {
@@ -415,6 +415,22 @@
         "type": "github"
       }
     },
+    "nixos-unstable": {
+      "locked": {
+        "lastModified": 1706696174,
+        "narHash": "sha256-cX1eVXs0mYA7NSIiVuYtljHEEpA0sIYTV7CmBXWQFVE=",
+        "owner": "SuperSandro2000",
+        "repo": "nixpkgs",
+        "rev": "1bfc579bd714bcffa395f0ae127676cf0db1af95",
+        "type": "github"
+      },
+      "original": {
+        "owner": "SuperSandro2000",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "oparl-scraper": {
       "flake": false,
       "locked": {
@@ -456,11 +472,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1706611863,
-        "narHash": "sha256-BGAeiyC3KCBGG1pEUzoNnmYmEblEGbOulOwcOdCYR7k=",
+        "lastModified": 1706738755,
+        "narHash": "sha256-vpfsqVGkdgXHkndUN+nn6WC8uBzQDPPVCrzf824wfbo=",
         "owner": "astro",
         "repo": "nix-openwrt-imagebuilder",
-        "rev": "887cd2b6f7c44a7ed52642e0632ac2ddc4fe1461",
+        "rev": "27853f566ec8b4c59bfaa3a75902f41d761c2a5f",
         "type": "github"
       },
       "original": {
@@ -489,6 +505,7 @@
         "nixos": "nixos",
         "nixos-hardware": "nixos-hardware",
         "nixos-modules": "nixos-modules",
+        "nixos-unstable": "nixos-unstable",
         "oparl-scraper": "oparl-scraper",
         "openwrt": "openwrt",
         "openwrt-imagebuilder": "openwrt-imagebuilder",
@@ -533,11 +550,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1705696331,
-        "narHash": "sha256-jTWF4EIjwdsiL0W1vwK5fyFrpJjMKYMGXz7OHkAyq8I=",
+        "lastModified": 1706634984,
+        "narHash": "sha256-xn7lGPE8gRGBe3Lt8ESoN/uUHm7IrbiV7siupwjHX1o=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "d20edfd8d4f053f3466c7bb5ca53ed2e70a0bc35",
+        "rev": "883b84c426107a8ec020e7124f263d7c35a5bb9f",
         "type": "github"
       },
       "original": {
@@ -808,11 +825,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1706396267,
-        "narHash": "sha256-cU0QeDQ6BG5m+wrrQCueI0oSzWqwyVzXipSqktVCpaU=",
+        "lastModified": 1706732838,
+        "narHash": "sha256-UeDm2pzGQRSb/8GdtuiRVK5/6Qcvgh3KRiP/0CUJ9KQ=",
         "ref": "refs/heads/master",
-        "rev": "797886af1e6834a8401be47b0a400490e6d2b2e2",
-        "revCount": 1926,
+        "rev": "85340e955d5b40b018a17977374bf2b181fea334",
+        "revCount": 1934,
         "type": "git",
         "url": "https://gitea.c3d2.de/zentralwerk/network.git"
       },
diff --git a/flake.nix b/flake.nix
index a8b90968..98ed0c94 100644
--- a/flake.nix
+++ b/flake.nix
@@ -9,6 +9,7 @@
   inputs = {
     # use sandro's fork full with cherry-picked fixes
     nixos.url = "github:SuperSandro2000/nixpkgs/nixos-23.11";
+    nixos-unstable.url = "github:SuperSandro2000/nixpkgs/nixos-unstable";
     nixos-hardware.url = "github:nixos/nixos-hardware";
 
     affection-src = {
@@ -403,6 +404,7 @@
         };
 
         home-assistant = nixosSystem' {
+          nixos = inputs.nixos-unstable;
           modules = [
             self.nixosModules.microvm
             ./hosts/home-assistant
diff --git a/hosts/home-assistant/default.nix b/hosts/home-assistant/default.nix
index 7ea9915c..6a645a2a 100644
--- a/hosts/home-assistant/default.nix
+++ b/hosts/home-assistant/default.nix
@@ -32,6 +32,10 @@ in
     };
   };
 
+  nixpkgs.config.permittedInsecurePackages = [
+    "openssl-1.1.1w"
+  ];
+
   services = {
     avahi.enable = true;