diff --git a/nix-darwin/flake.lock b/nix-darwin/flake.lock
index 68b06f49..f8c705c6 100644
--- a/nix-darwin/flake.lock
+++ b/nix-darwin/flake.lock
@@ -48,6 +48,23 @@
       }
     },
     "brew-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1776478798,
+        "narHash": "sha256-ERStG27tf83VbCfYMxtDSs+sa8FUMJ/3jSu/QfX9rKE=",
+        "owner": "Homebrew",
+        "repo": "brew",
+        "rev": "3aae056b8d072624255bc8fd27febb7f327b2265",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Homebrew",
+        "ref": "5.1.7",
+        "repo": "brew",
+        "type": "github"
+      }
+    },
+    "brew-src_2": {
       "flake": false,
       "locked": {
         "lastModified": 1774235677,
@@ -473,7 +490,7 @@
     },
     "nix-homebrew": {
       "inputs": {
-        "brew-src": "brew-src"
+        "brew-src": "brew-src_2"
       },
       "locked": {
         "lastModified": 1774720267,
@@ -560,6 +577,7 @@
     "root": {
       "inputs": {
         "agenix": "agenix",
+        "brew-src": "brew-src",
         "claude-code-nix": "claude-code-nix",
         "codex-cli-nix": "codex-cli-nix",
         "flake-utils": "flake-utils_3",
diff --git a/nix-darwin/flake.nix b/nix-darwin/flake.nix
index 192338a2..fd4fd8d0 100644
--- a/nix-darwin/flake.nix
+++ b/nix-darwin/flake.nix
@@ -14,6 +14,10 @@
       url = "git+ssh://gitea@dev.railbird.ai:1123/railbird/secrets-flake.git";
     };
     nix-homebrew.url = "github:zhaofengli-wip/nix-homebrew";
+    brew-src = {
+      url = "github:Homebrew/brew/5.1.7";
+      flake = false;
+    };
 
     # Optional: Declarative tap management
     homebrew-core = {
@@ -229,6 +233,7 @@
       # Homebrew casks (managed by nix-darwin, installed by nix-homebrew)
       homebrew = {
         enable = true;
+        taps = builtins.attrNames config.nix-homebrew.taps;
         casks = [
           "codex-app"
           "ghostty"
@@ -310,6 +315,10 @@
             enable = true;
             user = "kat";
             autoMigrate = true;
+            package = inputs.brew-src // {
+              name = "brew-5.1.7";
+              version = "5.1.7";
+            };
             taps = {
               "homebrew/homebrew-core" = inputs.homebrew-core;
               "homebrew/homebrew-cask" = inputs.homebrew-cask;