diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml
index 9727c48b1..03ea1b1a1 100644
--- a/.github/workflows/nix.yml
+++ b/.github/workflows/nix.yml
@@ -5,8 +5,6 @@ on:
 jobs:
   tests:
     runs-on: ubuntu-latest
-    env:
-      NIXPKGS_ALLOW_INSECURE: 1
     steps:
       - name: Checkout tree
         uses: actions/checkout@v4
@@ -14,5 +12,7 @@ jobs:
           submodules: true
       - uses: cachix/install-nix-action@v30
         with:
-          nix_path: nixpkgs=channel:nixos-unstable
-      - run: nix develop -c dune build @runtest @check
+          extra_nix_config: |
+            extra-substituters = https://anmonteiro.nix-cache.workers.dev
+            extra-trusted-public-keys = ocaml.nix-cache.com-1:/xI2h2+56rwFfKyyFVbkJSeGqSIYMC/Je+7XXqGKDIY=
+      - run: nix develop -L .# -c dune build @runtest @check
diff --git a/flake.lock b/flake.lock
index 95e638b1d..c5a6bd70c 100644
--- a/flake.lock
+++ b/flake.lock
@@ -5,29 +5,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1710146030,
-        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_2": {
-      "inputs": {
-        "systems": "systems_2"
-      },
-      "locked": {
-        "lastModified": 1710146030,
-        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
         "type": "github"
       },
       "original": {
@@ -38,15 +20,14 @@
     },
     "nixpkgs": {
       "inputs": {
-        "flake-utils": "flake-utils_2",
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1725916231,
-        "narHash": "sha256-kaU41Z43Uv2As0Sor8FPACJfWjkbUsWnZMtbCgqicvU=",
+        "lastModified": 1734153276,
+        "narHash": "sha256-/cvtpMFp0HArEpFi0PrPMsheauc3IJ7qWpSHnw8so2M=",
         "owner": "nix-ocaml",
         "repo": "nix-overlays",
-        "rev": "d63aa7b62251c70bbf0a28a67c30555077a2b758",
+        "rev": "4247b28ce426ccdea09a1ec014fa52785bc7ba1d",
         "type": "github"
       },
       "original": {
@@ -57,17 +38,17 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1725857262,
-        "narHash": "sha256-m9n0PncgZepVgmjOO1rfVXMgUACDOwZbhjSRjJ/NUpM=",
+        "lastModified": 1734100912,
+        "narHash": "sha256-93T/KB1ppdhnaV4u5uSwO6HutSq2RzcnkqVX9YKYslE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "5af6aefbcc55670e36663fd1f8a796e1e323001a",
+        "rev": "2a7ebf12140f6d97941d5f8cc38e9323212ecbad",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "5af6aefbcc55670e36663fd1f8a796e1e323001a",
+        "rev": "2a7ebf12140f6d97941d5f8cc38e9323212ecbad",
         "type": "github"
       }
     },
@@ -91,21 +72,6 @@
         "repo": "default",
         "type": "github"
       }
-    },
-    "systems_2": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
     }
   },
   "root": "root",
diff --git a/flake.nix b/flake.nix
index c02dfced2..da89e0e1b 100644
--- a/flake.nix
+++ b/flake.nix
@@ -37,13 +37,14 @@
           default = http;
           http = pkg {
             pname = "http";
+            propagatedBuildInputs = [ ppx_expect ];
             checkInputs = [ alcotest base_quickcheck ppx_expect crowbar ];
           };
           cohttp = pkg {
             pname = "cohttp";
             checkInputs = [ fmt alcotest ];
             propagatedBuildInputs = [
-              stringext http re uri uri-sexp logs sexplib0 ppx_sexp_conv
+              base64 stringext http re uri uri-sexp logs sexplib0 ppx_sexp_conv
             ];
           };
           cohttp-top = pkg {
@@ -56,8 +57,9 @@
           };
           cohttp-curl-lwt = pkg {
             pname = "cohttp-curl-lwt";
-            checkInputs = [ cohttp-lwt-unix cohttp cohttp-lwt conduit-lwt ounit2 uri ];
-            propagatedBuildInputs = [ ocurl http stringext lwt ];
+            checkInputs = [ alcotest cohttp-lwt-unix cohttp cohttp-lwt conduit-lwt ounit2 uri ];
+            propagatedBuildInputs = [ ocurl cohttp-curl http stringext lwt ];
+            __darwinAllowLocalNetworking = true;
           };
           cohttp-curl-async = pkg {
             pname = "cohttp-curl-async";
@@ -94,6 +96,7 @@
               http cohttp cohttp-lwt cmdliner lwt conduit-lwt
               conduit-lwt-unix fmt ppx_sexp_conv magic-mime logs
             ];
+            __darwinAllowLocalNetworking = true;
           };
           cohttp-server-lwt-unix = pkg {
             pname = "cohttp-server-lwt-unix";