diff --git a/flake.lock b/flake.lock
index 5562579bf..8c4aa7dfc 100644
--- a/flake.lock
+++ b/flake.lock
@@ -21,11 +21,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1705309234,
-        "narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=",
+        "lastModified": 1710146030,
+        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26",
+        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
         "type": "github"
       },
       "original": {
@@ -36,11 +36,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1707619277,
-        "narHash": "sha256-vKnYD5GMQbNQyyQm4wRlqi+5n0/F1hnvqSQgaBy4BqY=",
+        "lastModified": 1724748588,
+        "narHash": "sha256-NlpGA4+AIf1dKNq76ps90rxowlFXUsV9x7vK/mN37JM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "f3a93440fbfff8a74350f4791332a19282cc6dc8",
+        "rev": "a6292e34000dc93d43bccf78338770c1c5ec8a99",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index 5b9fb3f4d..96b6e2464 100644
--- a/flake.nix
+++ b/flake.nix
@@ -40,7 +40,12 @@
     };
   };
 
-  outputs = { self, nixpkgs, flake-utils, flake-compat }: let
+  outputs = {
+    self,
+    nixpkgs,
+    flake-utils,
+    flake-compat,
+  }: let
     # tailscaleRev is the git commit at which this flake was imported,
     # or the empty string when building from a local checkout of the
     # tailscale repo.
@@ -62,36 +67,37 @@
     # So really, this flake is for tailscale devs to dogfood with, if
     # you're an end user you should be prepared for this flake to not
     # build periodically.
-    tailscale = pkgs: pkgs.buildGo122Module rec {
-      name = "tailscale";
+    tailscale = pkgs:
+      pkgs.buildGo123Module rec {
+        name = "tailscale";
 
-      src = ./.;
-      vendorHash = pkgs.lib.fileContents ./go.mod.sri;
-      nativeBuildInputs = pkgs.lib.optionals pkgs.stdenv.isLinux [ pkgs.makeWrapper ];
-      ldflags = ["-X tailscale.com/version.gitCommitStamp=${tailscaleRev}"];
-      CGO_ENABLED = 0;
-      subPackages = [ "cmd/tailscale" "cmd/tailscaled" ];
-      doCheck = false;
+        src = ./.;
+        vendorHash = pkgs.lib.fileContents ./go.mod.sri;
+        nativeBuildInputs = pkgs.lib.optionals pkgs.stdenv.isLinux [pkgs.makeWrapper];
+        ldflags = ["-X tailscale.com/version.gitCommitStamp=${tailscaleRev}"];
+        CGO_ENABLED = 0;
+        subPackages = ["cmd/tailscale" "cmd/tailscaled"];
+        doCheck = false;
 
-      # NOTE: We strip the ${PORT} and $FLAGS because they are unset in the
-      # environment and cause issues (specifically the unset PORT). At some
-      # point, there should be a NixOS module that allows configuration of these
-      # things, but for now, we hardcode the default of port 41641 (taken from
-      # ./cmd/tailscaled/tailscaled.defaults).
-      postInstall = pkgs.lib.optionalString pkgs.stdenv.isLinux ''
-        wrapProgram $out/bin/tailscaled --prefix PATH : ${pkgs.lib.makeBinPath [ pkgs.iproute2 pkgs.iptables pkgs.getent pkgs.shadow ]}
-        wrapProgram $out/bin/tailscale --suffix PATH : ${pkgs.lib.makeBinPath [ pkgs.procps ]}
+        # NOTE: We strip the ${PORT} and $FLAGS because they are unset in the
+        # environment and cause issues (specifically the unset PORT). At some
+        # point, there should be a NixOS module that allows configuration of these
+        # things, but for now, we hardcode the default of port 41641 (taken from
+        # ./cmd/tailscaled/tailscaled.defaults).
+        postInstall = pkgs.lib.optionalString pkgs.stdenv.isLinux ''
+          wrapProgram $out/bin/tailscaled --prefix PATH : ${pkgs.lib.makeBinPath [pkgs.iproute2 pkgs.iptables pkgs.getent pkgs.shadow]}
+          wrapProgram $out/bin/tailscale --suffix PATH : ${pkgs.lib.makeBinPath [pkgs.procps]}
 
-        sed -i \
-          -e "s#/usr/sbin#$out/bin#" \
-          -e "/^EnvironmentFile/d" \
-          -e 's/''${PORT}/41641/' \
-          -e 's/$FLAGS//' \
-          ./cmd/tailscaled/tailscaled.service
+          sed -i \
+            -e "s#/usr/sbin#$out/bin#" \
+            -e "/^EnvironmentFile/d" \
+            -e 's/''${PORT}/41641/' \
+            -e 's/$FLAGS//' \
+            ./cmd/tailscaled/tailscaled.service
 
-        install -D -m0444 -t $out/lib/systemd/system ./cmd/tailscaled/tailscaled.service
-      '';
-    };
+          install -D -m0444 -t $out/lib/systemd/system ./cmd/tailscaled/tailscaled.service
+        '';
+      };
 
     # This whole blob makes the tailscale package available for all
     # OS/CPU combos that nix supports, as well as a dev shell so that
@@ -112,7 +118,7 @@
           gotools
           graphviz
           perl
-          go_1_22
+          go_1_23
           yarn
         ];
       };