diff --git a/flake.nix b/flake.nix
index 00d1618aa..5d8511b52 100644
--- a/flake.nix
+++ b/flake.nix
@@ -83,13 +83,15 @@
         formatter = pkgs.nixpkgs-fmt;
 
         devShells.default = pkgs.mkShell {
+          # include dependencies of the default package
+          inputsFrom = [ self.packages.${localSystem}.default ];
+
           # build-time inputs
           nativeBuildInputs = [
             # Development
             pkgs.just
             pkgs.nixpkgs-fmt
             pkgs.nodePackages.prettier
-            pkgs.pkg-config
 
             # Rust
             pkgs.cargo-edit
@@ -108,12 +110,6 @@
             # Deployment
             pkgs.skopeo
           ];
-
-          # runtime inputs
-          buildInputs = [
-            pkgs.openssl
-            pkgs.protobuf
-          ];
         };
 
         # This performance-testing shell will only work on Linux.
diff --git a/nix/app.nix b/nix/app.nix
index f62e20381..84aee212e 100644
--- a/nix/app.nix
+++ b/nix/app.nix
@@ -24,18 +24,18 @@ let
       in
       lib.cleanSourceWith { src = craneLib.path ./..; filter = isSourceFile; };
 
+    strictDeps = true;
+
     buildInputs = [
-      openssl
+      openssl # required for TLS connection to PostgreSQL
+      protobuf # required by opentelemetry-proto, a dependency of axum-tracing-opentelemetry
     ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      # macOS-specific dependencies
       libiconv
+      darwin.apple_sdk.frameworks.CoreFoundation
       darwin.apple_sdk.frameworks.Security
       darwin.apple_sdk.frameworks.SystemConfiguration
     ];
-
-    nativeBuildInputs = [
-      pkg-config # required for non-static builds
-      protobuf # required by opentelemetry-proto, a dependency of axum-tracing-opentelemetry
-    ];
   };
 
   # Build the dependencies first.