diff --git a/flake.lock b/flake.lock
index 414aa7b..67ab892 100644
--- a/flake.lock
+++ b/flake.lock
@@ -129,6 +129,22 @@
         "type": "github"
       }
     },
+    "nixpkgs-23-05": {
+      "locked": {
+        "lastModified": 1699291058,
+        "narHash": "sha256-5ggduoaAMPHUy4riL+OrlAZE14Kh7JWX4oLEs22ZqfU=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "41de143fda10e33be0f47eab2bfe08a50f234267",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-23.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "nixpkgs-lib": {
       "locked": {
         "dir": "lib",
@@ -181,6 +197,7 @@
         "flake-utils": "flake-utils",
         "napalm": "napalm",
         "nixpkgs": "nixpkgs",
+        "nixpkgs-23-05": "nixpkgs-23-05",
         "poetry2nix": "poetry2nix"
       }
     },
diff --git a/flake.nix b/flake.nix
index 6607a34..9cbf8dd 100644
--- a/flake.nix
+++ b/flake.nix
@@ -8,7 +8,10 @@
       url = "github:edolstra/flake-compat";
       flake = false;
     };
+    # nixos-unstable required for go 1.21 until 23.11 release
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    # explicitly required for go 1.18 (terraform-provider)
+    nixpkgs-23-05.url = "github:NixOS/nixpkgs/nixos-23.05";
     poetry2nix = {
       url = "github:nix-community/poetry2nix";
       inputs = {
@@ -32,6 +35,7 @@
   outputs = inputs@{
     self,
     nixpkgs,
+    nixpkgs-23-05,
     flake-parts,
     poetry2nix,
     napalm,
@@ -185,17 +189,17 @@
               --prefix PYTHONPATH : ${staticWorkdirDeps}
           '';
           # terraform provider
-          terraform-provider-authentik = pkgs.buildGo118Module rec {
+          terraform-provider-authentik = inputs.nixpkgs-23-05.legacyPackages.${system}.buildGo118Module rec {
             pname = "terraform-provider-authentik";
-            version = "2023.8.0";
+            version = "2023.10.0";
             src = pkgs.fetchFromGitHub {
               owner = "goauthentik";
               repo = pname;
               rev = "v${version}";
-              sha256 = "sha256-AIf+l26TqFS8Nfe/Qu0rZtCEHzWO1Jao8/KIY1IrriQ=";
+              sha256 = "sha256-eyWpssvYe3KKr2vfMRBfE4W1xrZZFeP55VmAQoitamc=";
             };
             doCheck = false; # tests are run against authentik -> vm test
-            vendorSha256 = "sha256-U4dYBFPQodmVyIXsapsstSe50G3HmBv9bvPfJq84CDU=";
+            vendorSha256 = "sha256-aDExL3uFLhCqFibrepb2zVOJ7aW5CWjuqtx73w7p1qc=";
             postInstall = ''
               path="$out/libexec/terraform-providers/registry.terraform.io/goauthentik/authentik/${version}/''${GOOS}_''${GOARCH}/"
               mkdir -p "$path"