diff --git a/.github/workflows/test-shared.yml b/.github/workflows/test-shared.yml
index e43063438540..423af2079519 100644
--- a/.github/workflows/test-shared.yml
+++ b/.github/workflows/test-shared.yml
@@ -255,7 +255,7 @@ jobs:
     with:
       runner: ubuntu-24.04-arm
       v8-nar: ${{ needs.build-aarch64-linux-v8.outputs.local-cache && 'libv8-aarch64-linux.nar' }}
-      pkcs11-store-test: ${{ matrix.openssl.attr == 'openssl' }}
+      pkcs11-store-test: ${{ matrix.openssl.attr == 'openssl_3_5' }}
       # Override just the `openssl` attr of the default shared-lib set with
       # the matrix-selected nixpkgs attribute (e.g. `openssl_3_6`). All
       # other shared libs (brotli, cares, libuv, …) keep their defaults.
diff --git a/tools/nix/openssl-fips.nix b/tools/nix/openssl-fips.nix
index 1da44c409a8c..e9aa1d9ef21a 100644
--- a/tools/nix/openssl-fips.nix
+++ b/tools/nix/openssl-fips.nix
@@ -1,5 +1,5 @@
 {
-  openssl ? (import ./openssl-matrix.nix { }).openssl,
+  openssl ? (import ./openssl-matrix.nix { }).openssl_3_5,
 }:
 
 openssl.overrideAttrs (oldAttrs: {
diff --git a/tools/nix/openssl-matrix.nix b/tools/nix/openssl-matrix.nix
index b035f893568b..0a91f08c1642 100644
--- a/tools/nix/openssl-matrix.nix
+++ b/tools/nix/openssl-matrix.nix
@@ -1,20 +1,18 @@
 {
   pkgs ? import ./pkgs.nix {
-    config.permittedInsecurePackages = [
-      "openssl-3.0.22"
-    ];
+    config.permittedInsecurePackages = [ "openssl-3.0.22" ];
   },
 }:
 
 {
   # "default" OpenSSL release line, should be kept in sync with the bundled version:
-  openssl = pkgs.openssl_3_5;
+  openssl = pkgs.openssl_4_1;
 
   # Other OpenSSL variants we want to test for:
   inherit (pkgs)
     boringssl
     openssl_3
-    openssl_3_6
+    openssl_3_5
     openssl_4_0
     ;
 
diff --git a/tools/nix/pkcs11.nix b/tools/nix/pkcs11.nix
index 748d3d4de0ed..630ef2bfd260 100644
--- a/tools/nix/pkcs11.nix
+++ b/tools/nix/pkcs11.nix
@@ -10,7 +10,7 @@
   # pkcs11-provider is dlopen'd into the libcrypto Node.js itself links, so it
   # has to be built against that very OpenSSL. SoftHSM links OpenSSL too;
   # building it against the same one keeps a single libcrypto in the process.
-  openssl ? (import ./openssl-matrix.nix { inherit pkgs; }).openssl,
+  openssl ? (import ./openssl-matrix.nix { inherit pkgs; }).openssl_3_5,
 
   pin ? "1234",
 }:
diff --git a/tools/nix/pkgs-26.05.nix b/tools/nix/pkgs-26.05.nix
index efe2f96ef6d3..d90a1d8ba931 100644
--- a/tools/nix/pkgs-26.05.nix
+++ b/tools/nix/pkgs-26.05.nix
@@ -1,10 +1,10 @@
 arg:
 let
   repo = "https://github.com/NixOS/nixpkgs";
-  rev = "752cbac9446602fbb78bdd1c3597455a3dd38432";
+  rev = "c0ae35c6460f00dcac6a59063e080f826e620b28";
   nixpkgs = import (builtins.fetchTarball {
     url = "${repo}/archive/${rev}.tar.gz";
-    sha256 = "0h4w0f8nkmpmmpjky3blvc2r147s515pc0z4hisywln4ryryr29z";
+    sha256 = "0hbdqzpiv8p44li7jng01mlg2zbb1ff18z3r250f4rjbqflbiwxs";
   }) arg;
 in
 # Unstable channel no longer supports Intel architecture for macOS. We can use the 26.05 channel
diff --git a/tools/nix/pkgs.nix b/tools/nix/pkgs.nix
index 850cfa995177..dfe1d9c75f6b 100644
--- a/tools/nix/pkgs.nix
+++ b/tools/nix/pkgs.nix
@@ -1,10 +1,10 @@
 arg:
 let
   repo = "https://github.com/NixOS/nixpkgs";
-  rev = "901c54c08bdc20e00c2b3c73716b97497b1b3c74";
+  rev = "0bb2eedc20e4739f29e8045034f2828ad7054f8f";
   nixpkgs = import (builtins.fetchTarball {
     url = "${repo}/archive/${rev}.tar.gz";
-    sha256 = "0bicjz6w8n0ahwxxj837rbg494siw57vfk7ff3w8v3gvnykzxlia";
+    sha256 = "008j4dj5yrzww91qvp1lp2c9d1lkwc6i2dpainf5nkdkr3rwj8vy";
   }) arg;
 in
 # Unstable channel no longer supports Intel architecture for macOS. We can use the 26.05 channel
@@ -15,9 +15,10 @@ if builtins.currentSystem == "x86_64-darwin" then
 else
   nixpkgs
   // {
-    # OpenSSL 3.0.x was removed from unstable, but we want to keep testing it.
+    # OpenSSL versions we want to keep testing with that have been removed from the unstable channel.
     inherit (import ./pkgs-26.05.nix arg)
       openssl_3
+      openssl_4_0
       ;
 
     boringssl =
@@ -44,4 +45,17 @@ else
       url = "${repo}/raw/aff8a0b28396750446e5537a96461bc4facdb287/pkgs/by-name/sc/sccache/package.nix";
       sha256 = "09dlc99sam9ld9jvzgcc00r4v4ls1cmbb0yim3mr895fpbs8b3qa";
     }) { };
+
+    # TODO: remove this override once the pin we use has picked up https://github.com/NixOS/nixpkgs/pull/575002
+    uvwasi = nixpkgs.uvwasi.overrideAttrs (old: {
+      patches = old.patches ++ [
+        (nixpkgs.fetchpatch2 {
+          url = "https://github.com/nodejs/uvwasi/commit/fe602a6911207efd8dcfc070a752bcf76813c978.patch?full_index=1";
+          hash = "sha256-MyFvRuEhcqZR+Bz2pY9vani8U1iyQrDeni2kKKnJGEI=";
+        })
+      ];
+
+      buildInputs = [ ];
+      propagatedBuildInputs = old.buildInputs;
+    });
   }
diff --git a/tools/nix/sharedLibDeps.nix b/tools/nix/sharedLibDeps.nix
index 6a104497314e..c5775716e46d 100644
--- a/tools/nix/sharedLibDeps.nix
+++ b/tools/nix/sharedLibDeps.nix
@@ -19,6 +19,7 @@
     nghttp2
     simdjson
     simdutf
+    uvwasi
     zlib
     zstd
     ;
@@ -27,19 +28,6 @@
   hdr-histogram = pkgs.hdrhistogram_c;
   highway = pkgs.libhwy;
   http-parser = pkgs.llhttp;
-
-  # TODO: remove this override once the pin we use has picked up https://github.com/NixOS/nixpkgs/pull/575002
-  uvwasi = pkgs.uvwasi.overrideAttrs (old: {
-    patches = old.patches ++ [
-      (pkgs.fetchpatch2 {
-        url = "https://github.com/nodejs/uvwasi/commit/fe602a6911207efd8dcfc070a752bcf76813c978.patch?full_index=1";
-        hash = "sha256-MyFvRuEhcqZR+Bz2pY9vani8U1iyQrDeni2kKKnJGEI=";
-      })
-    ];
-
-    buildInputs = [ ];
-    propagatedBuildInputs = old.buildInputs;
-  });
 }
 // (pkgs.lib.optionalAttrs withLief {
   # TODO: remove this override once the pin we use has picked up a new LIEF version that includes that patch.