diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 83ebbd0..fc34d19 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -12,6 +12,8 @@ jobs:
           - nixpkgs=https://github.com/NixOS/nixpkgs/archive/nixpkgs-unstable.tar.gz
         os: [ ubuntu-latest, macos-latest ]
     runs-on: ${{ matrix.os }}
+    env:
+      ACTIONS_ALLOW_UNSECURE_COMMANDS: 'true'
     steps:
     - uses: actions/checkout@v2
     - uses: cachix/install-nix-action@v12
diff --git a/pkgs/sops-install-secrets/default.nix b/pkgs/sops-install-secrets/default.nix
index 16eb681..1e7a0dc 100644
--- a/pkgs/sops-install-secrets/default.nix
+++ b/pkgs/sops-install-secrets/default.nix
@@ -20,7 +20,10 @@ buildGoModule {
   postBuild = ''
     go test -c ./pkgs/sops-install-secrets
     install -D ./sops-install-secrets.test $unittest/bin/sops-install-secrets.test
-    remove-references-to -t ${go} $unittest/bin/sops-install-secrets.test
+    # newer versions of nixpkgs no longer require this step
+    if command -v remove-references-to; then
+      remove-references-to -t ${go} $unittest/bin/sops-install-secrets.test
+    fi
   '';
 
   inherit vendorSha256;