The hosts and devenv run on nixos-unstable pinned by flake.lock, because only unstable ships Stalwart 0.16 (stalwart_0_16) and stalwart-cli 1.x. nixos-26.05 has only 0.15.5 of both.

Decision (2026-09-30, user): stay on pinned unstable for now. That’s acceptable while staging (mx99.eu.sovrn.at, deployed first by CI) and the VM tests (nix build .#checks.x86_64-linux.<name>) catch breakage. Switch to the stable channel once nixos-26.11 is released (expected late November 2026).

When 26.11 is out: 1. Check that it ships stalwart_0_16 at the version pinned in nix/overlay.nix (or later, reviewed) and stalwart-cli 1.x. If it doesn’t, pull just those two from a pinned unstable input via the overlay and keep everything else stable. 2. Change inputs.nixpkgs.url in flake.nix to github:NixOS/nixpkgs/nixos-26.11, and have update-nixpkgs keep devenv.yaml on the same revision. 3. Leave system.stateVersion = "26.05" in nix/modules/base.nix alone (it’s the install baseline, not the channel). 4. Run the VM tests, deploy staging, then production hosts.