Switch to secure packages

.github/workflows/build.yaml

@@ -18,9 +18,6 @@ jobs:
           - nix-system: aarch64-darwin
             runner: macos-15
             system: ARM64-macOS
-          - nix-system: x86_64-darwin
-            runner: macos-13
-            system: X64-macOS
           - nix-system: aarch64-linux
             runner: ubuntu-24.04-arm
             system: ARM64-Linux
@@ -38,9 +35,6 @@ jobs:
         uses: DeterminateSystems/flakehub-cache-action@main
 
       - name: Build and cache dev shell for ${{ matrix.systems.nix-system }} on ${{ matrix.systems.runner }}
-        # We still support this system but caching the dev shell fails due to system support mismatch,
-        # and we don't really need this cached anyway
-        if: ${{ matrix.systems.nix-system != 'x86_64-darwin' }}
         run: |
           nix build -L ".#devShells.${{ matrix.systems.nix-system }}.default"
 

flake.nix

@@ -1,6 +1,6 @@
 {
   inputs = {
-    nixpkgs.url = "https://flakehub.com/f/NixOS/nixpkgs/0";
+    nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure/0";
 
     fenix = {
       url = "https://flakehub.com/f/nix-community/fenix/0";
@@ -27,7 +27,6 @@
       supportedSystems = [
         "x86_64-linux"
         "aarch64-linux"
-        "x86_64-darwin"
         "aarch64-darwin"
       ];