diff --git a/hosts/puter/hardware-configuration.nix b/hosts/puter/hardware-configuration.nix
index 8306ddf..0aa59b4 100644
--- a/hosts/puter/hardware-configuration.nix
+++ b/hosts/puter/hardware-configuration.nix
@@ -80,5 +80,8 @@
 
   boot.blacklistedKernelModules = ["b43" "ssb" "brcmfmac" "brcmsmac" "bcma"];
 
-  nixpkgs.config.permittedInsecurePackages = ["broadcom-sta-6.30.223.271-57-6.12.40" "python-2.7.18.8"];
+  nixpkgs.config.allowInsecurePredicate = pkg:
+    builtins.elem (lib.getName pkg) [
+      "broadcom-sta" # aka “wl”
+    ];
 }