diff --git a/lib/default.nix b/lib/default.nix
index e90c8f11..bb82f1aa 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -105,6 +105,7 @@ lib
         # Build-time-only dep of karakeep's frontend; CVEs don't reach
         # the runtime closure. Remove once nixpkgs bumps it.
         "pnpm-9.15.9"
+        "keybase-gui-6.5.1"
       ];
       config.allowUnfree = true;
     }