diff --git a/flake.lock b/flake.lock
index e5e576b8a..e81241610 100644
--- a/flake.lock
+++ b/flake.lock
@@ -18,16 +18,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1704018918,
-        "narHash": "sha256-erjg/HrpC9liEfm7oLqb8GXCqsxaFwIIPqCsknW5aFY=",
+        "lastModified": 1709884566,
+        "narHash": "sha256-NSYJg2sfdO/XS3L8XN/59Zhzn0dqWm7XtVnKI2mHq3w=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "2c9c58e98243930f8cb70387934daa4bc8b00373",
+        "rev": "2be119add7b37dc535da2dd4cba68e2cf8d1517e",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-23.05-small",
+        "ref": "nixos-23.11-small",
         "repo": "nixpkgs",
         "type": "github"
       }
diff --git a/flake.nix b/flake.nix
index 3e5e83b3e..76e8ecf9a 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1,7 +1,7 @@
 {
   description = "The purely functional package manager";
 
-  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-23.05-small";
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-23.11-small";
   inputs.nixpkgs-regression.url = "github:NixOS/nixpkgs/215d4d0fd80ca5163643b03a33fde804a29cc1e2";
   inputs.flake-compat = { url = "github:edolstra/flake-compat"; flake = false; };
 
@@ -9,6 +9,7 @@
 
     let
       inherit (nixpkgs) lib;
+      inherit (lib) fileset;
 
       officialRelease = true;
 
@@ -47,14 +48,6 @@
             })
             stdenvs);
 
-      # Experimental fileset library: https://github.com/NixOS/nixpkgs/pull/222981
-      # Not an "idiomatic" flake input because:
-      #  - Propagation to dependent locks: https://github.com/NixOS/nix/issues/7730
-      #  - Subflake would download redundant and huge parent flake
-      #  - No git tree hash support: https://github.com/NixOS/nix/issues/6044
-      inherit (import (builtins.fetchTarball { url = "https://github.com/NixOS/nix/archive/1bdcd7fc8a6a40b2e805bad759b36e64e911036b.tar.gz"; sha256 = "sha256:14ljlpdsp4x7h1fkhbmc4bd3vsqnx8zdql4h3037wh09ad6a0893"; }))
-        fileset;
-
       baseFiles =
         # .gitignore has already been processed, so any changes in it are irrelevant
         # at this point. It is not represented verbatim for test purposes because
@@ -84,7 +77,7 @@
 
       nixSrc = fileset.toSource {
         root = ./.;
-        fileset = fileset.intersect baseFiles (fileset.unions [
+        fileset = fileset.intersection baseFiles (fileset.unions [
           configureFiles
           topLevelBuildFiles
           ./boehmgc-coroutine-sp-fallback.diff
@@ -114,6 +107,8 @@
             overlays = [
               (overlayFor (p: p.${stdenv}))
             ];
+
+            config.permittedInsecurePackages = [ "nix-2.13.6" ];
           };
           stdenvs = forAllStdenvs (make-pkgs null);
           native = stdenvs.stdenvPackages;
@@ -284,7 +279,7 @@
 
         src = fileset.toSource {
           root = ./.;
-          fileset = fileset.intersect baseFiles (fileset.unions [
+          fileset = fileset.intersection baseFiles (fileset.unions [
             configureFiles
             topLevelBuildFiles
             functionalTestFiles
@@ -309,7 +304,9 @@
           mkdir -p $out
         '';
 
-        installCheckPhase = ''
+        installCheckPhase = (optionalString pkgs.stdenv.hostPlatform.isDarwin ''
+          export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES
+        '') + ''
           mkdir -p src/nix-channel
           make installcheck -j$NIX_BUILD_CORES -l$NIX_BUILD_CORES
         '';
@@ -476,6 +473,10 @@
             installCheckFlags = "sysconfdir=$(out)/etc";
             installCheckTarget = "installcheck"; # work around buggy detection in stdenv
 
+            preInstallCheck = lib.optionalString stdenv.hostPlatform.isDarwin ''
+              export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES
+            '';
+
             separateDebugInfo = !currentStdenv.hostPlatform.isStatic;
 
             strictDeps = true;
diff --git a/tests/nixos/default.nix b/tests/nixos/default.nix
index 4d4c61b70..fcc83b842 100644
--- a/tests/nixos/default.nix
+++ b/tests/nixos/default.nix
@@ -58,7 +58,7 @@ in
     imports = [ ./remote-builds.nix ];
     builders.config = { lib, pkgs, ... }: {
       imports = [ checkOverrideNixVersion ];
-      nix.package = lib.mkForce pkgs.nixVersions.nix_2_3;
+      nix.package = lib.mkForce pkgs.nixVersions.nix_2_13;
     };
   });