Still on NixOS 25.05? Upstream support is long gone, but we've patched eMudhra, PHP, and hundreds of other CVEs. Get critical security patches today without migrating to a new release. Determinate Secure Packages 25.05 (Emergency Legacy Extension) now available: determinate.systems/blog/emergen...

Emergency Legacy Extension now available for NixOS 25.05

Determinate Secure Packages 25.05 (Emergency Legacy Extension) brings critical security support to NixOS 25.05.

determinate.systems

We've released updates for today's PHP remote exec vulnerabilities to Determinate Secure Packages (plus FIPS variants). This is in addition to already-pushed fixes for the eMudhra CA compromise. Please update your flakes ASAP. For more, see our status page. status.determinate.systems

We're pleased to report that we have pushed fixes for the eMudhra intermediate CA compromise for all distributions of Determinate Secure Packages (including FIPS variants). We urge all customers to update their flakes as soon as possible. status.determinate.systems

We at DetSys are fully aware of the eMudhra intermediate CA compromise and are pushing fixes to all distributions of Determinate Secure Packages ⛔ 🔏 We'll notify you when we have done so and we advise you to update your flakes at that time. status.determinate.systems

Determinate Nix 3.23.3 is now out 🎉 ❄️ 🚀 and the multi-version changelog for this release covers security fixes for some Nix CVEs, a new feature we're calling "baked flakes," OpenTelemetry tracing, improvements to Wasm support and parallel eval, and so much more. determinate.systems/blog/changel...

Changelog: security fixes, OpenTelemetry tracing, baked flakes, fiber-based parallel evaluation, and more

Determinate Nix 3.23.3 fixes four security vulnerabilities, exports OpenTelemetry traces, introduces baked flakes that require almost no evaluation, fixes several garbage collector races, moves…

determinate.systems

Great news for people who use Nix on macOS: our Native Linux Builder for Determinate Nix is now officially GA 🎉 🙌 🍎 That means that you can install Determinate Nix, log into FlakeHub, and immediately use it, without a request for access. Read more on our blog 🔗 determinate.systems/blog/native-...

You may have seen a recent security advisory for Nix involving CVE-2026-110449, CVE-2026-110450, and a few others. Providing the most secure Nix possible is a top-line commitment for us, and we're happy to report that these were fixed in Determinate Nix v3.23.2 🔐 ❄️ 🚀 github.com/Determina%E2...

Release v3.23.2 · DeterminateSystems/nix-src

Release 3.23.2 (2026-10-13) Based on upstream Nix 2.35.3. Fix GHSA-25vp-6h23-hj3g, GHSA-92x5-h528-wrmw, GHSA-jwvx-xq5j-gc56, GHSA-m4vq-qf6v-82pj This release contains critical fixes for security ...

github.com

Determinate Nix can now export OpenTelemetry traces 🔭 ❄️ 🚀 If you have questions like "where is Nix spending its time in CI?" you now have a wellspring of data that you can push to Grafana, Datadog, Honeycomb, and many others. Happy observing 😎 determinate.systems/blog/determi...

OpenTelemetry tracing for Determinate Nix

Determinate Nix now exports OpenTelemetry traces of evaluations, builds, substitutions, HTTP requests, and daemon connections to any OTLP backend, including Honeycomb, Grafana Tempo, Jaeger, and…

determinate.systems

We're excited to announce a change to Determinate Secure Packages with the introduction of long-term support (LTS). We now support some distributions for a full 5 years, starting with 26.05 🎉 LTS is available to all customers starting now 🔗 🚀 ❄️ determinate.systems/blog/determi...

Introducing Determinate Secure Packages LTS

We're replacing our original Determinate Secure Packages product with a long-term support (LTS) offering with 5 years of support for a subset of distributions, providing our customers with…

determinate.systems

If you’re at NixCon 2026 in the lovely Kraków 🇵🇱, we have a booth! Several of us will be camped out here throughout the conference, so don’t hesitate to come say hello and talk anything Nix, supply chain, Linux, and much more.

We’re proud to sponsor NixCon 2026! Nix has moved well beyond being a powerful tool for individual developers and has become core infrastructure for the world' most important companies. At DetSys, we’re building the platform enterprises need to adopt Nix with confidence. See you in Kraków.

Good news for GitHub Enterprise users: FlakeHub now supports auth via Enterprise Managed Users 🔐 🎉 If your org uses an IdP like Entra, Okta, or a SAML/SCIM-based solution, they can now log into FlakeHub that way, providing a crucial identity governance win ❄️ 🚀 🔗 determinate.systems/blog/flakehu...

FlakeHub now supports GitHub Enterprise Managed Users

FlakeHub now works for organizations on GitHub Enterprise Managed Users, extending the single sign-on, SCIM provisioning, and Conditional Access Policy rules your identity provider already enforces…

determinate.systems

If you're headed to Kraków 🇵🇱 for NixCon, come chat with other Nix folks (and us!) at our DetSys Happy Hour on Thursday, Sept 24th. No agenda, just free drinks/snacks, a lovely venue, and convivial Nix-y times. Register at the link below to find out the place and time 🔗 ❄️ 🚀 🍻 luma.com/detsys-1ts6

DetSys Happy Hour at NixCon 2026 · Luma

Kick off NixCon 2026 a little early with Determinate Systems! Join us the night before NixCon for a casual happy hour with fellow Nix users, contributors,…

luma.com

Yesterday, we announced our new CVE remediation dashboard for Determinate Secure Packages 📈 ❄️ 🚀 Take a look if you haven't seen it yet 👀 security.determinate.systems/cves/dashboard Or for a more detailed perspective, check out the new post on our blog 🔗 determinate.systems/blog/secure-...

A window into our security processes: introducing the Determinate Secure Packages CVE Remediation Dashboard

A live, public view of every CVE we're tracking in Determinate Secure Packages, its SLA deadline, and where it stands right now.

determinate.systems

Every CVE we fix for Determinate Secure Packages is now visible on a public dashboard 📊 🔒 We've made our remediation process fully trackable. As of today: 988 CVEs fixed within SLA in the last 30 days, 0 overdue 😊 Take a look for yourself ❄️ 🚀 security.determinate.systems

Determinate Secure Packages CVE Remediation Dashboard

Every CVE in Determinate Secure Packages, its fix deadline under our service-level agreement, and where it currently stands.

security.determinate.systems

Determinate Nix 3.22.2 is now out! 🎉 That means a new upstream base (2.35.2), 5-12% faster evaluation with mimalloc, HTTP/3 binary cache fetching, faster `nix copy` over slow links, GC roots for `nix eval`, Replit auth for FlakeHub, and more ❄️ 🚀 🔗 determinate.systems/blog/changel...

Changelog: a new upstream base, GC roots for nix eval, and a faster nix copy

Determinate Nix 3.22.2 moves onto upstream Nix 2.35, gives nix eval a --drv-link flag that keeps the garbage collector away from freshly instantiated derivations, and makes nix copy fast again…

determinate.systems

We are proud sponsors of NixCon 2026 and we are excited to see many of you there! Let us know if you are attending using the linked form so you can receive invites to the events we are hosting outside of the conference. More details soon! forms.gle/MqH29QpubqGW...

NixCon 2026 with DetSys

DetSys will be at NixCon 2026 in Kraków, Poland and we want to see you there! Use this form to let us know if you'll be attending and what type of events you'd be interested in. Submitting this form…

forms.gle

Periodic reminder that FlakeHub serves flakes as tarballs from S3, completely independently of GitHub’s infrastructure. This is a great option to consider if you’re looking to harden your Nix workflows against GitHub outages 🔗 flakehub.com

The EU Cyber Resilience Act's 24-hour reporting clock starts September 11 🇪🇺 📋 But don't fret! Instead, read our new blog post to see how Nix and Determinate Secure Packages can put you on such exceptional supply chain footing that the CRA will be a breeze 🔗 ❄️ 🚀 determinate.systems/blog/nix-cyb...

The EU Cyber Resilience Act is coming, and Determinate is the missing link in your supply chain

The CRA will take effect in two stages, with reporting obligations beginning on September 11, 2026. Compliance is likely to be a hurdle for many enterprises, but we're confident that Nix and…

determinate.systems

Determinate Nix 3.21.9 is now out! And it includes faster evaluation thanks to a fix in the store path cache plus an important cache key config change targeted to users of FlakeHub Cache in our FedRAMP environment. This is the one you really want, folks ❄️ 🚀 🔗 determinate.systems/blog/changel...

Changelog: faster evaluation and FedRAMP cache keys

Determinate Nix 3.21.9 makes evaluation measurably faster by reusing fetcher cache results, and teaches Determinate Nixd to pick the right trusted cache keys when you point it at FlakeHub's FedRAMP…

determinate.systems

Determinate Systems co-founders @grahamc.com and @niksnut.bsky.social recently joined the Full Time Nix podcast to talk Determinate Nix, FedRAMP High Authorization for FlakeHub, post-quantum cryptography, and running Nix in arenas like finance and defense 🎤 ❄️ 🚀 fulltimenix.com/episodes/det...

Full Time Nix | Determinate Systems with Graham and Eelco

Determinate Systems2025 Community Survey ResultsDeterminate NixApril Fools episodeFlakeHubDeterminate Secure PackagesFIPS General Information | NISTFlakeHub now has FedRAMP High AuthorizationCNSA 2...

fulltimenix.com

Introducing FlakeAudit, a CLI for evaluating SBOMs against custom policies 🔍 📋 ❄️ 🚀 It checks licenses, vulnerabilities, and much more to determine if your software is actually shippable. And it combines beautifully with FlakeBOM and Determinate Secure Packages. determinate.systems/blog/introdu...

Introducing FlakeAudit, a CLI for evaluating CycloneDX SBOMs against custom policies

It's the Rust-native, Nix-aware companion to FlakeBOM that turns SBOMs from a report on what exists on a system into something you can act on

determinate.systems

Determinate Nix 3.21.8 is out 🎉 🚀 ❄️ FlakeHub Cache now routes to your nearest node (faster in Australia, Asia, and Africa) and Determinate Nixd applies config changes automatically. Plus three reliability improvements. To upgrade: sudo determinate-nixd upgrade determinate.systems/blog/changel...

Changelog: FlakeHub Cache edge routing and a few crash fixes

Determinate Nixd now routes FlakeHub Cache requests to the nearest cache node, making substitution faster for most users, especially those outside the United States

determinate.systems

Defense tech teams using Nix can now use FlakeHub for CUI workflows in a FedRAMP Class D (High) environment! Nix delivers reproducible builds. FlakeHub adds private flakes, caching, access controls, and provenance, with less infrastructure to manage. Learn more here: flakehub.com/fedramp

FlakeHub now has FedRAMP High Authorization

FlakeHub, our platform providing secure Nix binary caching, private flakes, and more, has achieved FedRAMP High Authorization and is now listed in the FedRAMP Marketplace, bringing enterprise Nix to…

determinate.systems

We are hosting another Nix meetup in Portland, Oregon, next week. Join us on Monday, July 27, for casual drinks and conversations about Nix with members of the Determinate Systems team and other Nix enthusiasts from around the Rose City. See more details and RSVP here: luma.com/pj3eprqz

Portland Nix happy hour with Determinate Systems · Luma

Come hang out with fellow Nix users, NixOS obsessives, and Nix-curious folks at a casual Portland happy hour hosted by Determinate Systems. We’ve got a private…

luma.com

A new release of Determinate Nix is out 🎉🚀❄️ Version 3.21.7 comes with a whole bunch of fixes, performance improvements, and DX upgrades. Most importantly, Determinate Nix is now built with Determinate Secure Packages. Folks, this is the one you really want 😎 determinate.systems/blog/changel...

Changelog: Determinate Nix 3.21.7

An all-and-sundry batch of performance work, a faster `nix copy`, multi-threaded store optimization, and speedier binary caches, remote stores, and parallel evaluation, plus some changes to…

determinate.systems

FlakeHub has achieved FedRAMP High Authorization and is now listed in the FedRAMP Marketplace 🎉🏛️🔐 That means secure Nix packages, caching, private flakes, and more are now available to federal agencies and orgs handling Controlled Unclassified Information (CUI). determinate.systems/blog/flakehu...

FlakeHub now has FedRAMP High Authorization

FlakeHub, our platform providing secure Nix binary caching, private flakes, and more, has achieved FedRAMP High Authorization and is now listed in the FedRAMP Marketplace, bringing enterprise Nix to…

determinate.systems

📣 Portland (Oregon) Nix friends, we’re doing it again! 🎉 Join the Determinate Systems team on July 27 for drinks, pizza, and plenty of Nix talk with fellow reproducible systems enthusiasts. More details and RSVP here: luma.com/pj3eprqz

Portland Nix happy hour with Determinate Systems · Luma

Come hang out with fellow Nix users, NixOS obsessives, and Nix-curious folks at a casual Portland happy hour hosted by Determinate Systems. We’ve got a private…

luma.com

For people using flake schemas with Determinate Nix, please be aware that we've made a change to how schemas work. It isn't a breaking change yet but we wanted to provide ample forewarning. Have a read and update your flakes accordingly 🍁 ❄️ 🔄 determinate.systems/blog/flake-s...

An interface change for flake schemas

We're introducing an `exportedSchemas` output to provide a more intuitive experience.

determinate.systems

Need to generate an SBOM from a Nix flake? We’re hosting a live walkthrough this Thursday, June 18 at 9am PT / 12pm ET. We’ll show how FlakeBOM turns Nix flakes into SBOMs, then connect that to a broader supply chain security workflow with Determinate Secure Packages. Register: luma.com/flakebom

Supply chain security reimagined with FlakeBOM and Determinate Secure Packages · Zoom · Luma

In this webinar, you'll learn how Determinate Nix provides a stronger foundation for managing supply chain risk, and see how FlakeBOM and Determinate Secure…

luma.com