diff --git a/flake.nix b/flake.nix
index f2110b6..c2defa0 100644
--- a/flake.nix
+++ b/flake.nix
@@ -80,7 +80,10 @@
       # Separate nixpkgs for qt5webengine-heavy packages to avoid rebuild churn
       qt-pinned = import inputs.nixpkgs-qt {
         system = prev.stdenv.hostPlatform.system;
-        config.allowUnfree = true;
+        config = {
+          allowUnfree = true;
+          permittedInsecurePackages = [ "qtwebengine-5.15.19" ];
+        };
       };
       custom = prev.callPackage ./packages {};
       # Compatibility: bitwarden renamed to bitwarden-desktop in unstable
diff --git a/roles/kodi/default.nix b/roles/kodi/default.nix
index e8c2225..d594213 100644
--- a/roles/kodi/default.nix
+++ b/roles/kodi/default.nix
@@ -80,12 +80,12 @@ in
         firefox
         jellyfinMediaPlayerPkg
         kodiPkg
-        stremio
+        qt-pinned.stremio
         wget
       ] ++ optional cfg.appLauncherServer.enable pkgs.custom.app-launcher-server;
 
       nixpkgs.config.permittedInsecurePackages = lib.warn
-        "Allowing insecure package qtwebengine-5.15.19 as a jellyfin-media-player dependency. Remove this once jellyfin is updated to use qt6"
+        "Allowing insecure package qtwebengine-5.15.19 as a jellyfin-media-player/stremio dependency. These are pinned to nixpkgs-qt to avoid rebuilds - update that input separately when you have time."
         [
           "qtwebengine-5.15.19"
         ];