diff --git a/build-aux/pkg.nix b/build-aux/pkg.nix
index 5d774f8e6..d32abc106 100644
--- a/build-aux/pkg.nix
+++ b/build-aux/pkg.nix
@@ -57,6 +57,7 @@ stdenv.mkDerivation (finalAttrs: {
     autoreconfHook
     gitMinimal
     pkg-config
+    fontconfig # fc-match
     jq
     cargo
     rustc
@@ -78,19 +79,18 @@ stdenv.mkDerivation (finalAttrs: {
     sed -i -e 's/tarball-version/flake-version/' configure.ac
   '';
 
-  buildInputs =
-    [
-      finalAttrs.finalPackage.passthru.luaEnv
-      cargo-edit
-      harfbuzz
-      icu
-      fontconfig
-      libiconv
-      libxslt
-      stylua
-      taplo
-      typos
-    ];
+  buildInputs = [
+    finalAttrs.finalPackage.passthru.luaEnv
+    cargo-edit
+    harfbuzz
+    icu
+    fontconfig
+    libiconv
+    libxslt
+    stylua
+    taplo
+    typos
+  ];
 
   configureFlags =
     [
@@ -123,6 +123,9 @@ stdenv.mkDerivation (finalAttrs: {
     ];
   };
 
+  strictDeps = true;
+  env.LUA = "${finalAttrs.finalPackage.passthru.luaEnv}/bin/lua";
+
   enableParallelBuilding = true;
 
   # See commentary in bootstrap.sh; we're getting AMINCCLUDE stuff inlined
diff --git a/flake.lock b/flake.lock
index 625f696c7..3eac234fd 100644
--- a/flake.lock
+++ b/flake.lock
@@ -72,11 +72,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1735821806,
-        "narHash": "sha256-cuNapx/uQeCgeuhUhdck3JKbgpsml259sjUQnWM7zW8=",
+        "lastModified": 1737003892,
+        "narHash": "sha256-RCzJE9wKByLCXmRBp+z8LK9EgdW+K+W/DXnJS4S/NVo=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "d6973081434f88088e5321f83ebafe9a1167c367",
+        "rev": "ae06b9c2d83cb5c8b12d7d0e32692e93d1379713",
         "type": "github"
       },
       "original": {