diff --git a/nixos/lib/tests/test_openssl.nix b/nixos/lib/tests/test_openssl.nix
index 44c13ff105bb4d31035b5ff45fdc9285365709f1..a651657f40e19d4ed8e1d728c07ea4650981eee1 100644
--- a/nixos/lib/tests/test_openssl.nix
+++ b/nixos/lib/tests/test_openssl.nix
@@ -1,6 +1,18 @@
 openssl:
-{ test_version =
+{ test_package_version =
   { expected = "1.1.1k";
     expr = "${openssl.version}";
   };
+  test_runtime_version_matches =
+  { expected = "${openssl.version}";
+    expr =
+      let
+        pkgs = import <nixpkgs> { };
+        cmd = "${openssl}/bin/openssl version";
+        drv = pkgs.runCommand "version" {} "${cmd} > $out";
+        runtime_version = builtins.readFile drv;
+        pieces = pkgs.lib.splitString " " runtime_version;
+      in
+        builtins.elemAt pieces 1;
+  };
 }
diff --git a/nixpkgs.nix b/nixpkgs.nix
new file mode 100644
index 0000000000000000000000000000000000000000..923a7c8ee294ed1e81e4e1099d60fa4e558ffcad
--- /dev/null
+++ b/nixpkgs.nix
@@ -0,0 +1,16 @@
+{ overlays ? true }:
+let
+  nixpkgs-pin = {
+    name = "nixpkgs";
+    url = "https://github.com/NixOS/nixpkgs-channels/archive/353333ef340952c05332e3c271dff953264cb017.tar.gz";
+    sha256 = "sha256:0bv34yz892yxhx2kb8a1yr5pm0g8ck5w021yj87r7kfnp416apdh";
+    };
+
+  nixpkgs-src = builtins.fetchTarball nixpkgs-pin;
+  args =
+    if overlays
+    then { overlays = [ (import <psio/nixos/openssl-111k.nix>) ]; }
+    else { };
+  nixpkgs = import nixpkgs-src args;
+in
+  nixpkgs
diff --git a/shell.nix b/shell.nix
index e2e54ee08ef60c4947363acab547200fd1dd512f..40c98b33da29b48a4ec05ce8b7e5ead01e514215 100644
--- a/shell.nix
+++ b/shell.nix
@@ -1,11 +1,4 @@
-let
-  nixpkgs-pin = builtins.fromJSON (builtins.readFile ./nixpkgs.json);
-  nixpkgs-src = builtins.fetchTarball nixpkgs-pin;
-  nixpkgs = import nixpkgs-src {
-    overlays = [ (import ./nixos/openssl-111k.nix) ];
-  };
-in
-{ pkgs ? nixpkgs }:
+{ pkgs ? import ./nixpkgs.nix { overlays = false; } }:
 let
   # Get a version of Morph known to work with our version of NixOS.
   morph-src = pkgs.fetchFromGitHub {
@@ -17,7 +10,7 @@ let
   morph = pkgs.callPackage (morph-src + "/nix-packaging") { };
 in
 pkgs.mkShell {
-  NIX_PATH = "nixpkgs=${nixpkgs.path}";
+  NIX_PATH = "nixpkgs=${./nixpkgs.nix}:psio=${./.}";
   buildInputs = [
     morph
   ];