diff --git a/flake.nix b/flake.nix
index 9f4ff2eeb..0f3ffeb51 100644
--- a/flake.nix
+++ b/flake.nix
@@ -683,6 +683,7 @@
             runtimeInputs = with pkgs;
               [process-compose postgresql_14 caddy dnsmasq dnsutils curl jq git nodejs_22 yarn openssl packages'.hydrant-bin nixpkgs-pds.legacyPackages.${system}.bluesky-pds]
               ++ lib.optionals stdenv.hostPlatform.isLinux [socat slirp4netns util-linux iproute2 iptables procps gawk qemu_kvm e2fsprogs patchelf]
+              ++ lib.optionals stdenv.hostPlatform.isDarwin [stdenv.cc]
               ++ lib.concatMap (name: let
                 file = ./localinfra/pc/services + "/${name}/packages";
               in
@@ -695,6 +696,12 @@
               # only macos ships the sqlite the libsqlite3 tag needs
               export CGO_CFLAGS="-I${packages'.sqlite-lib}/include''${CGO_CFLAGS:+ $CGO_CFLAGS}"
               export CGO_LDFLAGS="-L${packages'.sqlite-lib}/lib''${CGO_LDFLAGS:+ $CGO_LDFLAGS}"
+              ${pkgs.lib.optionalString pkgs.stdenv.hostPlatform.isDarwin ''
+                # .cargo/config.toml names the static shell's prefixed cc, which this app doesn't have
+                export CARGO_TARGET_AARCH64_APPLE_DARWIN_LINKER=cc
+                # rusqlite links the system sqlite, which the nix toolchain can't see
+                export LIBRARY_PATH="${packages'.sqlite-lib}/lib''${LIBRARY_PATH:+:$LIBRARY_PATH}"
+              ''}
               ${pkgs.lib.optionalString pkgs.stdenv.hostPlatform.isLinux ''
                 export OPENSSL_INCLUDE_DIR=${pkgs.openssl.dev}/include
                 export OPENSSL_LIB_DIR=${pkgs.openssl.out}/lib