diff --git a/flake.lock b/flake.lock
index aa991a4..5abf8f5 100644
--- a/flake.lock
+++ b/flake.lock
@@ -352,12 +352,29 @@
         "type": "github"
       }
     },
+    "redlib": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1777052029,
+        "narHash": "sha256-siyD6A12UALQIV7BMd7zu1TaojleTEYtpxPszuhx1/Y=",
+        "owner": "redlib-org",
+        "repo": "redlib",
+        "rev": "a4d36e954cf1bd64f209cd8868c5a29edc81b374",
+        "type": "github"
+      },
+      "original": {
+        "owner": "redlib-org",
+        "repo": "redlib",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "home-manager": "home-manager",
         "nix-cachyos-kernel": "nix-cachyos-kernel",
         "nixpkgs": "nixpkgs_2",
         "proton-cachyos-nix": "proton-cachyos-nix",
+        "redlib": "redlib",
         "stylix": "stylix",
         "zen-browser": "zen-browser"
       }
diff --git a/flake.nix b/flake.nix
index b8a70b2..ae41478 100644
--- a/flake.nix
+++ b/flake.nix
@@ -18,6 +18,13 @@
 
     proton-cachyos-nix.url = "github:powerofthe69/proton-cachyos-nix";
 
+    # Source only, not this flake's outputs: nixpkgs' redlib predates the wreq
+    # switch and Reddit 403s its rustls TLS fingerprint (see services/redlib.nix).
+    redlib = {
+      url = "github:redlib-org/redlib";
+      flake = false;
+    };
+
     stylix.url = "github:nix-community/stylix/release-26.05";
   };
   outputs =
diff --git a/services/redlib.nix b/services/redlib.nix
index f4132c2..9f3fd74 100644
--- a/services/redlib.nix
+++ b/services/redlib.nix
@@ -1,11 +1,29 @@
 # services/redlib.nix — Private Reddit front-end at reddit.nordhammer.it
-{ config, lib, ... }:
+{ config, lib, inputs, pkgs, ... }:
 {
   config = lib.mkIf (config.networking.hostName == "FredOS-Mediaserver") {
     services.redlib = {
       enable = true;
       address = "127.0.0.1";
       port = 8087;
+
+      # nixpkgs pins a Dec 2025 redlib that talks to Reddit over plain rustls.
+      # Reddit fingerprints TLS and 403s every oauth.reddit.com call from it —
+      # the token mints fine, then every API request fails. Upstream main
+      # switched to wreq with Chrome/Firefox fingerprint emulation. Its own
+      # flake is unusable (locked to Rust 1.82, older than wreq's edition2024),
+      # so take the source from the input and build it with nixpkgs' toolchain.
+      # Drop all of this once the wreq commit lands in the pinned channel.
+      package = pkgs.rustPlatform.buildRustPackage {
+        pname = "redlib";
+        version = "0.36.0-unstable-2026-04-24";
+        src = inputs.redlib;
+        cargoLock.lockFile = "${inputs.redlib}/Cargo.lock";
+        # boring-sys2 (wreq's TLS backend) builds BoringSSL from source
+        # git: boring-sys2 patches BoringSSL in place before building it
+        nativeBuildInputs = with pkgs; [ cmake perl go git rustPlatform.bindgenHook ];
+        doCheck = false; # upstream tests hit the live Reddit API
+      };
     };
   };
 }