diff --git a/flake.lock b/flake.lock
index e69d082..77f7982 100644
--- a/flake.lock
+++ b/flake.lock
@@ -258,11 +258,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1791594108,
-        "narHash": "sha256-XK4KceonkwD8LuMAt/vNrz982mXJM5jeHAxMwsUXXAQ=",
+        "lastModified": 1792773339,
+        "narHash": "sha256-rZLrzrC6i+jnTAlvPZHogKDulY7WWDEv9hJeHieO7Zw=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "6510408d147d8c5e6d76043e899e9251756f6a75",
+        "rev": "3ec636362e1816bc2f0888fa0fa2c69f1bc9e504",
         "type": "github"
       },
       "original": {
diff --git a/modules/nixos/bootloader.nix b/modules/nixos/bootloader.nix
index f0fb590..708cd4b 100644
--- a/modules/nixos/bootloader.nix
+++ b/modules/nixos/bootloader.nix
@@ -9,9 +9,6 @@
     efi.canTouchEfiVariables = true;
   };
 
-  # enable systemd initrd
-  boot.initrd.systemd.enable = true;
-
   # plymouth
   boot.plymouth = {
     enable = true;
diff --git a/modules/nixos/certificates.nix b/modules/nixos/certificates.nix
index 79767dc..cc90cb5 100644
--- a/modules/nixos/certificates.nix
+++ b/modules/nixos/certificates.nix
@@ -17,9 +17,4 @@ in
   security.pki.certificates = [
     caddyRootCA # self-signed pki ca for my home-lab
   ];
-
-  # Temporary: eMudhra intermediates under this root have recoverable private
-  # keys (https://bugzilla.mozilla.org/show_bug.cgi?id=2083449). Remove once
-  # nixos-unstable ships cacert >= 3.131.1 (nixpkgs f903b88).
-  security.pki.caCertificateBlacklist = [ "emSign ECC Root CA - G3" ];
 }