diff --git a/flake.lock b/flake.lock
index 98d6efc2..536d6696 100644
--- a/flake.lock
+++ b/flake.lock
@@ -1,5 +1,21 @@
 {
   "nodes": {
+    "asc": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1792367351,
+        "narHash": "sha256-johba6Axn48WC13Qd4ZGk76kD4x7HNhlZCHOKNm13SY=",
+        "owner": "LGUG2Z",
+        "repo": "komorebi-application-specific-configuration",
+        "rev": "7bc0e8bedf824a76ce68355a953629a6becbce6b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "LGUG2Z",
+        "repo": "komorebi-application-specific-configuration",
+        "type": "github"
+      }
+    },
     "crane": {
       "locked": {
         "lastModified": 1766774972,
@@ -125,6 +141,7 @@
     },
     "root": {
       "inputs": {
+        "asc": "asc",
         "crane": "crane",
         "flake-parts": "flake-parts",
         "git-hooks-nix": "git-hooks-nix",
@@ -140,11 +157,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1766890375,
-        "narHash": "sha256-0Zi7ChAtjq/efwQYmp7kOJPcSt6ya9ynSUe6ppgZhsQ=",
+        "lastModified": 1793174968,
+        "narHash": "sha256-u5nUf4cewaT36iIzG1s/VECktqUMiZaGF5BsgervsvQ=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "91e1f7a0017065360f447622d11b7ce6ed04772f",
+        "rev": "19ecdd08213836b36c4296a3a4f4af5a3d5308db",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index 0723eb58..7d8a4801 100644
--- a/flake.nix
+++ b/flake.nix
@@ -11,6 +11,10 @@
     treefmt-nix.inputs.nixpkgs.follows = "nixpkgs";
     git-hooks-nix.url = "github:cachix/git-hooks.nix";
     git-hooks-nix.inputs.nixpkgs.follows = "nixpkgs";
+    asc = {
+      url = "github:LGUG2Z/komorebi-application-specific-configuration";
+      flake = false;
+    };
   };
 
   outputs =
@@ -35,14 +39,20 @@
 
           outputHashAlgo = "sha256";
           outputHashMode = "recursive";
-          outputHash = "sha256-6cLS5q1BDRpLPScfmmKpTTEHUzsgKTKD1+mKvGX9Deo=";
+          outputHash = "sha256-UFQjsFVBwcF/9e9tVFoG0Z1JySxyTnFqoaRwr/tUWzA=";
 
           buildCommand = ''
             export HOME=$(mktemp -d)
+            # keep the cache on the same filesystem as $out, as xwin moves
+            # files from the cache into the output and rename(2) fails with
+            # EXDEV when the build dir and the store are separate mounts
+            mkdir -p $out
             xwin --accept-license \
+              --cache-dir $out/.xwin-cache \
               --sdk-version ${windowsSdkVersion} \
               --crt-version ${windowsCrtVersion} \
               splat --output $out
+            rm -rf $out/.xwin-cache
           '';
         };
 
@@ -119,6 +129,9 @@
           commonArgs = {
             inherit src version;
             strictDeps = true;
+            # komorebic/build.rs downloads applications.json if it is missing, which
+            # is not possible in the sandbox, so provide the pinned copy instead
+            preBuild = "mkdir -p komorebic && cp ${inputs.asc}/applications.json komorebic/applications.json";
             COMMIT_HASH = self.rev or (pkgs.lib.removeSuffix "-dirty" self.dirtyRev);
 
             # build inputs for cross-compilation
@@ -126,8 +139,17 @@
               pkgs.llvmPackages.clang-unwrapped
               pkgs.llvmPackages.lld
               pkgs.llvmPackages.llvm
+              # komorebic build script uses reqwest, which runs on the build host
+              pkgs.pkg-config
+              pkgs.openssl
+              pkgs.openssl.dev
             ];
 
+            # point the host-side openssl-sys build at the nix openssl
+            OPENSSL_NO_VENDOR = "1";
+            OPENSSL_LIB_DIR = "${pkgs.openssl.out}/lib";
+            OPENSSL_INCLUDE_DIR = "${pkgs.openssl.dev}/include";
+
             # cross-compilation environment
             inherit (msvcEnv)
               CARGO_TARGET_X86_64_PC_WINDOWS_MSVC_LINKER