diff --git a/flake.lock b/flake.lock
index e22ea6e63..bd2e5728e 100644
--- a/flake.lock
+++ b/flake.lock
@@ -819,11 +819,11 @@
     },
     "stable": {
       "locked": {
-        "lastModified": 1778430510,
-        "narHash": "sha256-Ti+ZBvW6yrWWAg2szExVTwCd4qOJ3KlVr1tFHfyfi8Q=",
+        "lastModified": 1779102034,
+        "narHash": "sha256-vZJZjLo513IeI8hjzHFc6TDezUd4uCE2Eq4SNO3DNNg=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "8fd9daa3db09ced9700431c5b7ad0e8ba199b575",
+        "rev": "687f05a9184cad4eaf905c48b63649e3a86f5433",
         "type": "github"
       },
       "original": {
diff --git a/modules/home/dev.nix b/modules/home/dev.nix
index 31ab7b31b..e6e032fe4 100644
--- a/modules/home/dev.nix
+++ b/modules/home/dev.nix
@@ -23,6 +23,7 @@ _: {
           cacert
           cachix
           cb
+          cmake
           codespell
           coreutils-full
           curl
diff --git a/modules/nixos/desktop-base.nix b/modules/nixos/desktop-base.nix
index 0c4f268d6..550293b2a 100644
--- a/modules/nixos/desktop-base.nix
+++ b/modules/nixos/desktop-base.nix
@@ -305,6 +305,15 @@ in
         gtk3
       ];
 
+      # nix-ld's NIX_LD_LIBRARY_PATH is only consulted when nix-ld itself
+      # is the dynamic loader. Nix-built interpreters (e.g. the python in
+      # uv's PEP 517 build envs when it picks up a system python) use the
+      # regular loader and won't see it. Exposing the same lib bundle on
+      # LD_LIBRARY_PATH lets those processes resolve libstdc++.so.6 et al
+      # — needed for grpc_tools._protoc_compiler and similar prebuilt
+      # wheels invoked during source builds.
+      environment.sessionVariables.LD_LIBRARY_PATH = "/run/current-system/sw/share/nix-ld/lib";
+
       environment.etc."determinate/config.json".text = builtins.toJSON {
         authentication.additionalNetrcSources = [ "/etc/nix/netrc" ];
       };