From da1850066083f804f24edf600f07754b3ad8bed8 Mon Sep 17 00:00:00 2001
From: John Ogle <john@ogle.fyi>
Date: Thu, 12 Feb 2026 22:35:27 -0800
Subject: [PATCH] fix(kodi): use qt-pinned for stremio to avoid qtwebengine
 rebuilds

- Add permittedInsecurePackages to qt-pinned config in flake.nix
- Use qt-pinned.stremio instead of pkgs.stremio
- Update warning message to reference nixpkgs-qt

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 flake.nix              | 5 ++++-
 roles/kodi/default.nix | 4 ++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/flake.nix b/flake.nix
index f2110b6..c2defa0 100644
--- a/flake.nix
+++ b/flake.nix
@@ -80,7 +80,10 @@
       # Separate nixpkgs for qt5webengine-heavy packages to avoid rebuild churn
       qt-pinned = import inputs.nixpkgs-qt {
         system = prev.stdenv.hostPlatform.system;
-        config.allowUnfree = true;
+        config = {
+          allowUnfree = true;
+          permittedInsecurePackages = [ "qtwebengine-5.15.19" ];
+        };
       };
       custom = prev.callPackage ./packages {};
       # Compatibility: bitwarden renamed to bitwarden-desktop in unstable
diff --git a/roles/kodi/default.nix b/roles/kodi/default.nix
index e8c2225..d594213 100644
--- a/roles/kodi/default.nix
+++ b/roles/kodi/default.nix
@@ -80,12 +80,12 @@ in
         firefox
         jellyfinMediaPlayerPkg
         kodiPkg
-        stremio
+        qt-pinned.stremio
         wget
       ] ++ optional cfg.appLauncherServer.enable pkgs.custom.app-launcher-server;
 
       nixpkgs.config.permittedInsecurePackages = lib.warn
-        "Allowing insecure package qtwebengine-5.15.19 as a jellyfin-media-player dependency. Remove this once jellyfin is updated to use qt6"
+        "Allowing insecure package qtwebengine-5.15.19 as a jellyfin-media-player/stremio dependency. These are pinned to nixpkgs-qt to avoid rebuilds - update that input separately when you have time."
         [
           "qtwebengine-5.15.19"
         ];