diff --git a/flake.lock b/flake.lock
index 836d098524..e381b678b3 100644
--- a/flake.lock
+++ b/flake.lock
@@ -248,6 +248,19 @@
         "url": "https://nixos.org/channels/nixpkgs-unstable/nixexprs.tar.xz"
       }
     },
+    "nixpkgs-2211": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1690939524,
+        "narHash": "sha256-wZ8ktcD7KUPzOMSQXbbuvM2/YS5+sihPqnNymFQ58Mg=",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixos/22.11/nixos-22.11.4773.ea4c80b39be4/nixexprs.tar.xz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://channels.nixos.org/nixos-22.11/nixexprs.tar.xz"
+      }
+    },
     "nixpkgs-lib": {
       "locked": {
         "lastModified": 1761765539,
@@ -264,6 +277,7 @@
       }
     },
     "nixpkgs-oldstable": {
+      "flake": false,
       "locked": {
         "lastModified": 1712666087,
         "narHash": "sha256-WwjUkWsjlU8iUImbivlYxNyMB1L5YVqE8QotQdL9jWc=",
@@ -304,6 +318,7 @@
         "nix-eval-jobs": "nix-eval-jobs",
         "nix2container": "nix2container",
         "nixpkgs": "nixpkgs_2",
+        "nixpkgs-2211": "nixpkgs-2211",
         "nixpkgs-oldstable": "nixpkgs-oldstable",
         "rust-overlay": "rust-overlay",
         "treefmt-nix": "treefmt-nix"
diff --git a/flake.nix b/flake.nix
index b952a57089..afbb66cd11 100644
--- a/flake.nix
+++ b/flake.nix
@@ -26,6 +26,10 @@
     # Pin to a specific nixpkgs version that has compatible v8 and curl versions
     # for extensions that require older package versions
     nixpkgs-oldstable.url = "github:NixOS/nixpkgs/a76c4553d7e741e17f289224eda135423de0491d";
+    nixpkgs-oldstable.flake = false;
+    # Older clang and glibc for building extensions on old pgrx versions (before 0.11.3)
+    nixpkgs-2211.url = "https://channels.nixos.org/nixos-22.11/nixexprs.tar.xz";
+    nixpkgs-2211.flake = false;
     nixpkgs.url = "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz";
     rust-overlay.inputs.nixpkgs.follows = "nixpkgs";
     rust-overlay.url = "github:oxalica/rust-overlay";
diff --git a/nix/cargo-pgrx/mkPgrxExtension.nix b/nix/cargo-pgrx/mkPgrxExtension.nix
index d1190817ed..7d540bb712 100644
--- a/nix/cargo-pgrx/mkPgrxExtension.nix
+++ b/nix/cargo-pgrx/mkPgrxExtension.nix
@@ -1,11 +1,12 @@
 {
-  callPackage,
+  lib,
   pkgs,
+  callPackage,
+  clang11,
   rustVersion,
   pgrxVersion,
   makeRustPlatform,
   rust-bin,
-  stdenv,
 }:
 let
   inherit ((callPackage ./default.nix { inherit rustVersion rust-bin; })) mkCargoPgrx;
@@ -38,20 +39,15 @@ let
     };
 
   bindgenHook =
-    # Fix bindgen error on aarch64-linux for versions using pgrx with bindgen 0.68.1
-    # This affects pgrx 0.6.1 through 0.11.2 which have issues with ARM NEON vector ABI
-    if (builtins.compareVersions "0.11.3" pgrxVersion > 0) then
-      let
-        nixos2211 = (
-          import (builtins.fetchTarball {
-            url = "https://channels.nixos.org/nixos-22.11/nixexprs.tar.xz";
-            sha256 = "1j7h75a9hwkkm97jicky5rhvzkdwxsv5v46473rl6agvq2sj97y1";
-          }) { inherit (stdenv.hostPlatform) system; }
-        );
-      in
+    # pgrx 0.6.1 through 0.11.2 use old bindgen versions that break with current clang and glibc:
+    # - bindgen 0.60.x panics on how clang 16+ names anonymous structs
+    #   ("(unnamed at /path/file.h:N:M)"), which glibc and macOS SDK headers contain.
+    # - on aarch64-linux, bindgen fails on the ARM NEON vector functions that newer glibc headers declare.
+    # So build them with clang and glibc headers from nixos-22.11, on every platform.
+    if lib.versionOlder pgrxVersion "0.11.3" then
       rustPlatform.bindgenHook.overrideAttrs {
-        libclang = nixos2211.clang.cc.lib;
-        clang = nixos2211.clang;
+        libclang = clang11.cc.lib;
+        clang = clang11;
       }
     else
       rustPlatform.bindgenHook;
diff --git a/nix/nixpkgs.nix b/nix/nixpkgs.nix
index c4622d4606..39ab3e67d7 100644
--- a/nix/nixpkgs.nix
+++ b/nix/nixpkgs.nix
@@ -6,7 +6,6 @@
       _module.args.pkgs = import inputs.nixpkgs {
         inherit system;
         config.allowUnfree = true;
-        permittedInsecurePackages = [ "v8-9.7.106.18" ];
         overlays = [
           # Patch tzdata to 2026f until nixpkgs catches up.
           # Drop once the pinned nixpkgs ships >= 2026f (the assertion below trips):
@@ -97,13 +96,12 @@
           (
             let
               # Provide older versions of packages required by some extensions
-              oldstable = import inputs.nixpkgs-oldstable {
-                inherit system;
-                config.allowUnfree = true;
-              };
+              oldstable = import inputs.nixpkgs-oldstable { inherit system; };
+              nixos2211 = import inputs.nixpkgs-2211 { inherit system; };
             in
             _final: _prev: {
               v8_oldstable = oldstable.v8;
+              clang11 = nixos2211.clang;
             }
           )
         ];