diff --git a/tools/dep_updaters/update-nixpkgs-pin.sh b/tools/dep_updaters/update-nixpkgs-pin.sh
index 32900b4a705e..2128742ac029 100755
--- a/tools/dep_updaters/update-nixpkgs-pin.sh
+++ b/tools/dep_updaters/update-nixpkgs-pin.sh
@@ -81,7 +81,16 @@ nix-instantiate -I "nixpkgs=$NIXPKGS_PIN_FILE" --eval --strict --json -E "
   }
 " | jq -r '"{
   pkgs ? import ./pkgs.nix {
-    config.permittedInsecurePackages = [ \(.permittedInsecurePackages | if length > 0 then "\(map(@json) | join(" ")) " else "" end)];
+    config.permittedInsecurePackages = [\(
+    .permittedInsecurePackages |
+      if length == 0 then
+        " "
+      elif length == 1 then
+        " \(first | @json) "
+      else
+        "\n      \(map(@json) | join("\n      "))\n    "
+      end
+    )];
   },
 }:
 
diff --git a/tools/nix/openssl-matrix.nix b/tools/nix/openssl-matrix.nix
index 6e86f3c51050..7187d707281d 100644
--- a/tools/nix/openssl-matrix.nix
+++ b/tools/nix/openssl-matrix.nix
@@ -1,6 +1,9 @@
 {
   pkgs ? import ./pkgs.nix {
-    config.permittedInsecurePackages = [ ];
+    config.permittedInsecurePackages = [
+      "openssl-1.1.1w"
+      "openssl-3.0.22"
+    ];
   },
 }:
 
@@ -11,6 +14,8 @@
   # Other OpenSSL variants we want to test for:
   inherit (pkgs)
     boringssl
+    openssl_1_1
+    openssl_3
     openssl_3_6
     openssl_4_0
     ;
diff --git a/tools/nix/pkgs.nix b/tools/nix/pkgs.nix
index 52ef60358b58..ef4dce6fd26b 100644
--- a/tools/nix/pkgs.nix
+++ b/tools/nix/pkgs.nix
@@ -15,6 +15,12 @@ if builtins.currentSystem == "x86_64-darwin" then
 else
   nixpkgs
   // {
+    # OpenSSL 1.1.x and 3.0.x were removed from unstable, we want to keep testing with it
+    inherit (import ./pkgs-26.05.nix arg)
+      openssl_1_1
+      openssl_3
+      ;
+
     # TODO: remove pin once https://github.com/mozilla/sccache/issues/2869 is resolved
     sccache = nixpkgs.callPackage (builtins.fetchurl {
       url = "${repo}/raw/aff8a0b28396750446e5537a96461bc4facdb287/pkgs/by-name/sc/sccache/package.nix";