diff --git a/flake.lock b/flake.lock
index 143b18c..97bd3a4 100644
--- a/flake.lock
+++ b/flake.lock
@@ -2,17 +2,17 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1751274312,
-        "narHash": "sha256-/bVBlRpECLVzjV19t5KMdMFWSwKLtb5RyXdjz3LJT+g=",
+        "lastModified": 1785734586,
+        "narHash": "sha256-ODZkEK9Gy50yg6h98u7KkitZ3oc/uuTFK00bh1CRdNA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "50ab793786d9de88ee30ec4e4c24fb4236fc2674",
+        "rev": "531670d871c0e29724a02f3cbcac170adc65b58c",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "50ab793786d9de88ee30ec4e4c24fb4236fc2674",
+        "rev": "531670d871c0e29724a02f3cbcac170adc65b58c",
         "type": "github"
       }
     },
@@ -29,17 +29,17 @@
         ]
       },
       "locked": {
-        "lastModified": 1750119275,
-        "narHash": "sha256-Rr7Pooz9zQbhdVxux16h7URa6mA80Pb/G07T4lHvh0M=",
+        "lastModified": 1783174389,
+        "narHash": "sha256-aCWC8ngycU7OdJrU2+Je3qf+1a2ykuBvpPhZT/9tXMc=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "77c423a03b9b2b79709ea2cb63336312e78b72e2",
+        "rev": "f1406619a3884cd5c47992a70b8b35c9c0fcb4c9",
         "type": "github"
       },
       "original": {
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "77c423a03b9b2b79709ea2cb63336312e78b72e2",
+        "rev": "f1406619a3884cd5c47992a70b8b35c9c0fcb4c9",
         "type": "github"
       }
     }
diff --git a/flake.nix b/flake.nix
index 48ffb7a..39fb727 100644
--- a/flake.nix
+++ b/flake.nix
@@ -2,13 +2,17 @@
   description = "cc-ci — Co-op Cloud recipe CI server (NixOS)";
 
   inputs = {
-    # Pinned to the exact revision cc-ci already runs, so the first rebuild from
-    # this repo is a true no-op-then-base (M0). Bump deliberately, not drift.
-    nixpkgs.url = "github:NixOS/nixpkgs/50ab793786d9de88ee30ec4e4c24fb4236fc2674";
+    # Pinned to the nixos-26.05 channel tip (2026-08-03). Matches the orchestrator host's
+    # channel so both boxes share a nixpkgs and CVEs get patched. Bump deliberately, not drift.
+    # Previous pin: 50ab793 (nixos-24.11, 2025-06-30) — 24.11 was EOL; this is a 3-release jump
+    # (24.11 -> 25.05 -> 25.11 -> 26.05). Notable 26.05 changes: systemd Stage 1 boot by default,
+    # dbus-broker default, bash nixos-rebuild removed (Python rewrite mandatory), MySQL 8.0 removed.
+    nixpkgs.url = "github:NixOS/nixpkgs/531670d871c0e29724a02f3cbcac170adc65b58c";
 
-    # Pinned to a commit that still uses plain `buildGoModule` — sops-nix master moved to
-    # `buildGo125Module` (Go 1.25), which our pinned nixpkgs 24.11 (2025-06-30) does not have.
-    sops-nix.url = "github:Mic92/sops-nix/77c423a03b9b2b79709ea2cb63336312e78b72e2";
+    # sops-nix master (buildGo125Module / Go 1.25), which builds against nixpkgs 26.05.
+    # Previous pin (77c423a) held back to plain buildGoModule for nixpkgs 24.11 compat — no
+    # longer needed on 26.05.
+    sops-nix.url = "github:Mic92/sops-nix/f1406619a3884cd5c47992a70b8b35c9c0fcb4c9";
     sops-nix.inputs.nixpkgs.follows = "nixpkgs";
   };
 
diff --git a/nix/hosts/cc-ci-hetzner/networking.nix b/nix/hosts/cc-ci-hetzner/networking.nix
index e2c58a1..dde909e 100644
--- a/nix/hosts/cc-ci-hetzner/networking.nix
+++ b/nix/hosts/cc-ci-hetzner/networking.nix
@@ -14,7 +14,18 @@
       "185.12.64.1"
       "185.12.64.2"
     ];
-    defaultGateway = "172.31.1.1";
+    # The interface MUST be explicit here. Since NixOS 25.05 the scripted-networking
+    # module installs the default route from the gateway interface's
+    # network-addresses-<iface>.service, and it finds that interface either by
+    # `defaultGateway.interface` or by the gateway address being inside one of the
+    # interface's subnets. With Hetzner's off-subnet point-to-point gateway
+    # (91.98.47.73/32 on eth0, gateway 172.31.1.1) neither matched when this was a
+    # bare string, so NO default route was installed and the 26.05 rebuild on
+    # 2026-08-03 took the host off the network (recovered via rescue mode).
+    defaultGateway = {
+      address = "172.31.1.1";
+      interface = "eth0";
+    };
     # No IPv6 on this Hetzner instance (link-local only) — nixos-infect emitted an empty
     # defaultGateway6/ipv6.route which made network-addresses-eth0.service fail
     # ("ip route add /128" with no prefix). v4-only box, so no IPv6 gateway/route declared.