diff --git a/modules/extern/nixos/krb5.nix b/modules/extern/nixos/krb5.nix
index f8e051ac..99779cca 100644
--- a/modules/extern/nixos/krb5.nix
+++ b/modules/extern/nixos/krb5.nix
@@ -414,8 +414,9 @@ in {
 
   config = {
     nixpkgs = mkIf cfg.enable {
-      overlays = [
-        gensokyo-zone.overlays.krb5
+      overlays = mkMerge [
+        [gensokyo-zone.overlays.krb5]
+        (mkIf cfg.nfs.enable [gensokyo-zone.overlays.nfs])
       ];
     };
     security = {
diff --git a/overlays/nfs.nix b/overlays/nfs.nix
index ebd3fe6d..d88082a7 100644
--- a/overlays/nfs.nix
+++ b/overlays/nfs.nix
@@ -1,13 +1,10 @@
 final: prev: {
-  # https://github.com/NixOS/nixpkgs/pull/286793
+  # https://github.com/NixOS/nixpkgs/pull/342130
   nfs-utils-ldap = prev.nfs-utils.overrideAttrs (old: {
     buildInputs =
       old.buildInputs
       ++ [
-        final.openldap
-        (final.cyrus_sasl.override {
-          openssl = final.openssl_legacy;
-        })
+        final.cyrus_sasl
       ];
     configureFlags =
       old.configureFlags