diff --git a/flake.nix b/flake.nix
index d700857ac..92f8442a1 100644
--- a/flake.nix
+++ b/flake.nix
@@ -15,10 +15,43 @@
           rustChannelOf = args: let
             orig = pkgs.rustChannelOf args;
             patchRustPkg = pkg: (pkg.overrideAttrs (oA: {
-              buildCommand = builtins.replaceStrings
+              buildCommand = (builtins.replaceStrings
                 [ "rustc,rustdoc" ]
                 [ "rustc,rustdoc,clippy-driver,cargo-clippy" ]
-                oA.buildCommand;
+                oA.buildCommand) + (let
+                  wrapperPath = pkgs.path + "/pkgs/build-support/bintools-wrapper/ld-wrapper.sh";
+                  baseOut = pkgs.clangStdenv.cc.bintools.out;
+                  getStdenvAttrs = drv: (drv.overrideAttrs (oA: {
+                    passthru.origAttrs = oA;
+                  })).origAttrs;
+                  baseEnv = (getStdenvAttrs pkgs.clangStdenv.cc.bintools).env;
+                  baseSubstitutedWrapper = pkgs.replaceVars wrapperPath
+                    {
+                      inherit (baseEnv)
+                        shell coreutils_bin suffixSalt mktemp rm;
+                      use_response_file_by_default = "0";
+                      prog = null;
+                      out = null;
+                    };
+                in ''
+                  # work around a bug in the overlay
+                  ${oA.postInstall}
+
+                  # copy over helper scripts that the wrapper needs
+                  (cd "${baseOut}"; find . -type f \( -name '*.sh' -or -name '*.bash' \) -print0) | while read -d $'\0' script; do
+                    mkdir -p "$out/$(dirname "$script")"
+                    substitute "${baseOut}/$script" "$out/$script" --replace-quiet "${baseOut}" "$out"
+                  done
+
+                  # TODO: Work out how to make this work with cross builds
+                  ldlld="$out/lib/rustlib/${pkgs.clangStdenv.targetPlatform.config}/bin/gcc-ld/ld.lld";
+                  if [ -e "$ldlld" ]; then
+                    export prog="$(readlink -f "$ldlld")"
+                    rm "$ldlld"
+                    substitute ${baseSubstitutedWrapper} "$ldlld" --subst-var "out" --subst-var "prog"
+                    chmod +x "$ldlld"
+                  fi
+                '');
             })) // {
               targetPlatforms = [ "x86_64-linux" ];
               badTargetPlatforms = [ ];
@@ -42,27 +75,19 @@
           # for rustfmt and old toolchains to verify MSRV
           toolchains = lib.mapAttrs (_: customisedRustChannelOf) {
             stable = {
-              # Stay on 1.87 for development due to the
-              # quickly-reversed default enablement of
-              # #[warn(clippy::uninlined_format_args)]
-              date = "2025-05-15";
+              date = "2025-09-18";
               channel = "stable";
-              sha256 = "sha256-KUm16pHj+cRedf8vxs/Hd2YWxpOrWZ7UOrwhILdSJBU=";
+              sha256 = "sha256-SJwZ8g0zF2WrKDVmHrVG3pD2RGoQeo24MEXnNx5FyuI=";
             };
             nightly = {
               date = "2025-07-29";
               channel = "nightly";
               sha256 = "sha256-6D2b7glWC3jpbIGCq6Ta59lGCKN9sTexhgixH4Y7Nng=";
             };
-            "1.85" = {
-              date = "2025-02-20";
-              channel = "stable";
-              sha256 = "sha256-AJ6LX/Q/Er9kS15bn9iflkUwcgYqRQxiOIL2ToVAXaU=";
-            };
-            "1.86" = {
-              date = "2025-04-03";
+            "1.88" = {
+              date = "2025-06-26";
               channel = "stable";
-              sha256 = "sha256-X/4ZBHO3iW0fOenQ3foEvscgAPJYl2abspaBThDOukI=";
+              sha256 = "sha256-Qxt8XAuaUR2OMdKbN4u8dBJOhSHxS+uS06Wl9+flVEk=";
             };
           };
 
@@ -107,7 +132,7 @@
           pname = "hyperlight";
           version = "0.0.0";
           src = lib.cleanSource ./.;
-          cargoHash = "sha256-hoeJEBdxaoyLlhQQ4X4Wk5X1QVtQ7RRQYaxkiGg8rWA=";
+          cargoLock.lockFile = ./Cargo.lock;
 
           nativeBuildInputs = [
             azure-cli
@@ -124,6 +149,7 @@
             jq
             jaq
             gdb
+            zlib
           ];
           buildInputs = [
             pango
@@ -140,7 +166,7 @@
           RUST_NIGHTLY = "${toolchains.nightly.rust}";
           # Set this through shellHook rather than nativeBuildInputs to be
           # really sure that it overrides the real cargo.
-          shellHook = ''
+          postHook = ''
             export PATH="${fake-rustup}/bin:$PATH"
           '';
         }).overrideAttrs(oA: {