diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml
index 19cf08b..80427d0 100644
--- a/.github/workflows/nix.yml
+++ b/.github/workflows/nix.yml
@@ -19,6 +19,7 @@ jobs:
           - nixos-unstable
           - nixos-24.05
           - nixos-24.11
+          - nixos-25.05
         system:
           - aarch64-linux
           - x86_64-linux
@@ -67,6 +68,7 @@ jobs:
           - nixos-unstable
           - nixos-24.05
           - nixos-24.11
+          - nixos-25.05
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 7367dc9..39638db 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -12,3 +12,4 @@ build:
       - NIXPKGS_CHANNEL:
           - nixos-24.05
           - nixos-24.11
+          - nixos-25.05
diff --git a/README.md b/README.md
index 58522ff..3b9cbe2 100644
--- a/README.md
+++ b/README.md
@@ -41,6 +41,7 @@ nixpkgs channel describes.
 | ---            | ---         | ---                                               |
 | nixos-24.05    | nixos-24.05 | only minor versions that include security updates |
 | nixos-24.11    | nixos-24.11 | only minor versions that include security updates |
+| nixos-25.05    | nixos-25.05 | only minor versions that include security updates |
 | nixos-unstable | latest      | latest and greatest, major versions might change  |
 
 ## List of images
diff --git a/images/devcontainer/default.nix b/images/devcontainer/default.nix
index 342b2f1..c3127a0 100644
--- a/images/devcontainer/default.nix
+++ b/images/devcontainer/default.nix
@@ -42,7 +42,11 @@ let
       nix
 
       # runtime dependencies of nix
-      cacert
+      # HACK: don't include the "hashed" output. It has overlapping files with
+      #       the "unbundled" output, and that breaks the build.
+      (cacert // {
+        outputs = builtins.filter (x: x != "hashed") cacert.outputs;
+      })
       gitReallyMinimal
       gnutar
       gzip