diff --git a/nix/manual-overrides.nix b/nix/manual-overrides.nix
index 7545ed0032b..d0aa544405c 100644
--- a/nix/manual-overrides.nix
+++ b/nix/manual-overrides.nix
@@ -84,8 +84,8 @@ hself: hsuper: {
   # -----------------
   cryptostore = hlib.addBuildDepends (hlib.dontCheck (hlib.appendConfigureFlags hsuper.cryptostore [ "-fuse_crypton" ]))
     [ hself.crypton hself.crypton-x509 hself.crypton-x509-validation ];
-  # Make hoogle static to reduce size of the hoogle image
-  hoogle = hlib.justStaticExecutables hsuper.hoogle;
+  # doJailbreak because upstreams requires a specific crypton-connection version we don't have
+  hoogle = hlib.justStaticExecutables (hlib.doJailbreak (hlib.dontCheck (hsuper.hoogle)));
   http2-manager = hlib.enableCabalFlag hsuper.http2-manager "-f-test-trailing-dot";
   sodium-crypto-sign = hlib.addPkgconfigDepend hsuper.sodium-crypto-sign libsodium.dev;
   types-common-journal = hlib.addBuildTool hsuper.types-common-journal protobuf;
diff --git a/nix/sources.json b/nix/sources.json
index 05e854e4f6a..8bfa8cf9928 100644
--- a/nix/sources.json
+++ b/nix/sources.json
@@ -5,10 +5,10 @@
         "homepage": "https://github.com/NixOS/nixpkgs",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "154bcb95ad51bc257c2ce4043a725de6ca700ef6",
-        "sha256": "0gv8wgjqldh9nr3lvpjas7sk0ffyahmvfrz5g4wd8l2r15wyk67f",
+        "rev": "4f31540079322e6013930b5b2563fd10f96917f0",
+        "sha256": "12748r3h44hy3a41slm5hcihn1nhrxjlgp75qz6iwzazkxnclx00",
         "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/154bcb95ad51bc257c2ce4043a725de6ca700ef6.tar.gz",
+        "url": "https://github.com/NixOS/nixpkgs/archive/4f31540079322e6013930b5b2563fd10f96917f0.tar.gz",
         "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
     }
 }
diff --git a/nix/wire-server.nix b/nix/wire-server.nix
index 9f3eed3d4e4..2eedb4991da 100644
--- a/nix/wire-server.nix
+++ b/nix/wire-server.nix
@@ -518,7 +518,7 @@ in
       pkgs.netcat
       pkgs.niv
       pkgs.haskellPackages.apply-refact
-      (pkgs.python310.withPackages
+      (pkgs.python3.withPackages
         (ps: with ps; [
           black
           bokeh
diff --git a/services/galley/test/resources/foo.sh b/services/galley/test/resources/generate_keys.sh
similarity index 94%
rename from services/galley/test/resources/foo.sh
rename to services/galley/test/resources/generate_keys.sh
index 1d57fccbc5a..5b40e8db369 100755
--- a/services/galley/test/resources/foo.sh
+++ b/services/galley/test/resources/generate_keys.sh
@@ -1,3 +1,4 @@
+#!/usr/bin/env bash
 openssl genpkey -algorithm ed25519 > ed25519.pem
 openssl genpkey -algorithm ec -pkeyopt ec_paramgen_curve:P-256 > ecdsa_secp256r1_sha256.pem
 openssl genpkey -algorithm ec -pkeyopt ec_paramgen_curve:P-384 > ecdsa_secp384r1_sha384.pem