diff --git a/.github/workflows/workflow.yaml b/.github/workflows/workflow.yaml
index 0ba01fc33..15fc47c8a 100644
--- a/.github/workflows/workflow.yaml
+++ b/.github/workflows/workflow.yaml
@@ -6,7 +6,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-10.15] # TODO: this job does not yet work on more recent macOS (macos-11)
+        os: 
+          - ubuntu-latest
+          - macos-11
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v2.4.0
@@ -32,7 +34,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest] # TODO: this job does not yet work on any version of macOS
+        os: 
+          - ubuntu-latest
+          - macos-11
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v2.4.0
@@ -49,8 +53,25 @@ jobs:
           EOF
       - name: Build & test
         run: |
+          skip() {
+            echo "Will skip $(head -n1 $2/README.md) ${1%_nix} Nix"
+            local p="$1[@]"
+            read -a ${1} <<< $(echo ${!p//$2})
+          }
+
           cd examples/toolchains
-          for dir in *; do
+          with_nix=( $(ls) )
+          without_nix=( cc go rust )
+
+          if [ "${{ runner.os }}" == "macOS" ]; then
+            # Python - https://github.com/tweag/rules_nixpkgs/issues/186
+            skip with_nix python
+            # Rust - https://github.com/tweag/rules_nixpkgs/issues/187
+            skip with_nix rust
+            skip without_nix rust
+          fi
+
+          for dir in "${with_nix[@]}"; do
               cd "$dir"
               echo
               echo Running $(head -n1 README.md) with Nix
@@ -58,7 +79,7 @@ jobs:
               # TODO: all toolchains should run without Nixpkgs
               cd ..
           done
-          for dir in cc go rust; do
+          for dir in "${without_nix[@]}"; do
               cd "$dir"
               echo
               echo Running $(head -n1 README.md) without Nix
diff --git a/WORKSPACE b/WORKSPACE
index 27a2706f7..da8457af3 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -41,8 +41,8 @@ bazel_skylib_workspace()
 nixpkgs_git_repository(
     name = "remote_nixpkgs",
     remote = "https://github.com/NixOS/nixpkgs",
-    revision = "18.09",
-    sha256 = "6451af4083485e13daa427f745cbf859bc23cb8b70454c017887c006a13bd65e",
+    revision = "21.11",
+    sha256 = "c77bb41cf5dd82f4718fa789d49363f512bb6fa6bc25f8d60902fe2d698ed7cc",
 )
 
 nixpkgs_local_repository(
diff --git a/examples/toolchains/cc/nixpkgs.json b/examples/toolchains/cc/nixpkgs.json
new file mode 100644
index 000000000..a7e06e9e9
--- /dev/null
+++ b/examples/toolchains/cc/nixpkgs.json
@@ -0,0 +1,7 @@
+{
+  "owner": "NixOS",
+  "repo": "nixpkgs",
+  "branch": "21.11",
+  "rev": "506445d88e183bce80e47fc612c710eb592045ed",
+  "sha256": "162dywda2dvfj1248afxc45kcrg83appjd0nmdb541hl7rnncf02"
+}
diff --git a/examples/toolchains/cc/nixpkgs.nix b/examples/toolchains/cc/nixpkgs.nix
new file mode 100644
index 000000000..b06b74462
--- /dev/null
+++ b/examples/toolchains/cc/nixpkgs.nix
@@ -0,0 +1,9 @@
+let
+  # nixpkgs-unstable as of 2021-02-19
+  spec = builtins.fromJSON (builtins.readFile ./nixpkgs.json);
+  nixpkgs = fetchTarball {
+    url = "https://github.com/${spec.owner}/${spec.repo}/archive/${spec.rev}.tar.gz";
+    sha256 = spec.sha256;
+  };
+in
+import nixpkgs
diff --git a/examples/toolchains/cc/shell.nix b/examples/toolchains/cc/shell.nix
index 8443bdce4..8f4baf9ce 100644
--- a/examples/toolchains/cc/shell.nix
+++ b/examples/toolchains/cc/shell.nix
@@ -1,6 +1,3 @@
-{ pkgs ? import (builtins.fetchTarball {
-  url = "https://github.com/NixOS/nixpkgs/archive/21.11.tar.gz";
-  sha256 = "162dywda2dvfj1248afxc45kcrg83appjd0nmdb541hl7rnncf02";
-}) { } }:
+{ pkgs ? import ./nixpkgs.nix { } }:
 
 pkgs.mkShell { nativeBuildInputs = [ pkgs.bazel_4 ]; }
diff --git a/examples/toolchains/cc_with_deps/nixpkgs.json b/examples/toolchains/cc_with_deps/nixpkgs.json
new file mode 100644
index 000000000..a7e06e9e9
--- /dev/null
+++ b/examples/toolchains/cc_with_deps/nixpkgs.json
@@ -0,0 +1,7 @@
+{
+  "owner": "NixOS",
+  "repo": "nixpkgs",
+  "branch": "21.11",
+  "rev": "506445d88e183bce80e47fc612c710eb592045ed",
+  "sha256": "162dywda2dvfj1248afxc45kcrg83appjd0nmdb541hl7rnncf02"
+}
diff --git a/examples/toolchains/cc_with_deps/nixpkgs.nix b/examples/toolchains/cc_with_deps/nixpkgs.nix
new file mode 100644
index 000000000..b06b74462
--- /dev/null
+++ b/examples/toolchains/cc_with_deps/nixpkgs.nix
@@ -0,0 +1,9 @@
+let
+  # nixpkgs-unstable as of 2021-02-19
+  spec = builtins.fromJSON (builtins.readFile ./nixpkgs.json);
+  nixpkgs = fetchTarball {
+    url = "https://github.com/${spec.owner}/${spec.repo}/archive/${spec.rev}.tar.gz";
+    sha256 = spec.sha256;
+  };
+in
+import nixpkgs
diff --git a/examples/toolchains/cc_with_deps/shell.nix b/examples/toolchains/cc_with_deps/shell.nix
index 8443bdce4..8f4baf9ce 100644
--- a/examples/toolchains/cc_with_deps/shell.nix
+++ b/examples/toolchains/cc_with_deps/shell.nix
@@ -1,6 +1,3 @@
-{ pkgs ? import (builtins.fetchTarball {
-  url = "https://github.com/NixOS/nixpkgs/archive/21.11.tar.gz";
-  sha256 = "162dywda2dvfj1248afxc45kcrg83appjd0nmdb541hl7rnncf02";
-}) { } }:
+{ pkgs ? import ./nixpkgs.nix { } }:
 
 pkgs.mkShell { nativeBuildInputs = [ pkgs.bazel_4 ]; }
diff --git a/examples/toolchains/go/nixpkgs.json b/examples/toolchains/go/nixpkgs.json
new file mode 100644
index 000000000..a7e06e9e9
--- /dev/null
+++ b/examples/toolchains/go/nixpkgs.json
@@ -0,0 +1,7 @@
+{
+  "owner": "NixOS",
+  "repo": "nixpkgs",
+  "branch": "21.11",
+  "rev": "506445d88e183bce80e47fc612c710eb592045ed",
+  "sha256": "162dywda2dvfj1248afxc45kcrg83appjd0nmdb541hl7rnncf02"
+}
diff --git a/examples/toolchains/go/nixpkgs.nix b/examples/toolchains/go/nixpkgs.nix
new file mode 100644
index 000000000..b06b74462
--- /dev/null
+++ b/examples/toolchains/go/nixpkgs.nix
@@ -0,0 +1,9 @@
+let
+  # nixpkgs-unstable as of 2021-02-19
+  spec = builtins.fromJSON (builtins.readFile ./nixpkgs.json);
+  nixpkgs = fetchTarball {
+    url = "https://github.com/${spec.owner}/${spec.repo}/archive/${spec.rev}.tar.gz";
+    sha256 = spec.sha256;
+  };
+in
+import nixpkgs
diff --git a/examples/toolchains/go/shell.nix b/examples/toolchains/go/shell.nix
index 8443bdce4..8f4baf9ce 100644
--- a/examples/toolchains/go/shell.nix
+++ b/examples/toolchains/go/shell.nix
@@ -1,6 +1,3 @@
-{ pkgs ? import (builtins.fetchTarball {
-  url = "https://github.com/NixOS/nixpkgs/archive/21.11.tar.gz";
-  sha256 = "162dywda2dvfj1248afxc45kcrg83appjd0nmdb541hl7rnncf02";
-}) { } }:
+{ pkgs ? import ./nixpkgs.nix { } }:
 
 pkgs.mkShell { nativeBuildInputs = [ pkgs.bazel_4 ]; }
diff --git a/examples/toolchains/python/nixpkgs.json b/examples/toolchains/python/nixpkgs.json
new file mode 100644
index 000000000..a7e06e9e9
--- /dev/null
+++ b/examples/toolchains/python/nixpkgs.json
@@ -0,0 +1,7 @@
+{
+  "owner": "NixOS",
+  "repo": "nixpkgs",
+  "branch": "21.11",
+  "rev": "506445d88e183bce80e47fc612c710eb592045ed",
+  "sha256": "162dywda2dvfj1248afxc45kcrg83appjd0nmdb541hl7rnncf02"
+}
diff --git a/examples/toolchains/python/nixpkgs.nix b/examples/toolchains/python/nixpkgs.nix
new file mode 100644
index 000000000..b06b74462
--- /dev/null
+++ b/examples/toolchains/python/nixpkgs.nix
@@ -0,0 +1,9 @@
+let
+  # nixpkgs-unstable as of 2021-02-19
+  spec = builtins.fromJSON (builtins.readFile ./nixpkgs.json);
+  nixpkgs = fetchTarball {
+    url = "https://github.com/${spec.owner}/${spec.repo}/archive/${spec.rev}.tar.gz";
+    sha256 = spec.sha256;
+  };
+in
+import nixpkgs
diff --git a/examples/toolchains/python/shell.nix b/examples/toolchains/python/shell.nix
index 8443bdce4..8f4baf9ce 100644
--- a/examples/toolchains/python/shell.nix
+++ b/examples/toolchains/python/shell.nix
@@ -1,6 +1,3 @@
-{ pkgs ? import (builtins.fetchTarball {
-  url = "https://github.com/NixOS/nixpkgs/archive/21.11.tar.gz";
-  sha256 = "162dywda2dvfj1248afxc45kcrg83appjd0nmdb541hl7rnncf02";
-}) { } }:
+{ pkgs ? import ./nixpkgs.nix { } }:
 
 pkgs.mkShell { nativeBuildInputs = [ pkgs.bazel_4 ]; }
diff --git a/examples/toolchains/rust/nixpkgs.json b/examples/toolchains/rust/nixpkgs.json
new file mode 100644
index 000000000..a7e06e9e9
--- /dev/null
+++ b/examples/toolchains/rust/nixpkgs.json
@@ -0,0 +1,7 @@
+{
+  "owner": "NixOS",
+  "repo": "nixpkgs",
+  "branch": "21.11",
+  "rev": "506445d88e183bce80e47fc612c710eb592045ed",
+  "sha256": "162dywda2dvfj1248afxc45kcrg83appjd0nmdb541hl7rnncf02"
+}
diff --git a/examples/toolchains/rust/nixpkgs.nix b/examples/toolchains/rust/nixpkgs.nix
new file mode 100644
index 000000000..b06b74462
--- /dev/null
+++ b/examples/toolchains/rust/nixpkgs.nix
@@ -0,0 +1,9 @@
+let
+  # nixpkgs-unstable as of 2021-02-19
+  spec = builtins.fromJSON (builtins.readFile ./nixpkgs.json);
+  nixpkgs = fetchTarball {
+    url = "https://github.com/${spec.owner}/${spec.repo}/archive/${spec.rev}.tar.gz";
+    sha256 = spec.sha256;
+  };
+in
+import nixpkgs
diff --git a/examples/toolchains/rust/shell.nix b/examples/toolchains/rust/shell.nix
index 8443bdce4..8f4baf9ce 100644
--- a/examples/toolchains/rust/shell.nix
+++ b/examples/toolchains/rust/shell.nix
@@ -1,6 +1,3 @@
-{ pkgs ? import (builtins.fetchTarball {
-  url = "https://github.com/NixOS/nixpkgs/archive/21.11.tar.gz";
-  sha256 = "162dywda2dvfj1248afxc45kcrg83appjd0nmdb541hl7rnncf02";
-}) { } }:
+{ pkgs ? import ./nixpkgs.nix { } }:
 
 pkgs.mkShell { nativeBuildInputs = [ pkgs.bazel_4 ]; }
diff --git a/nixpkgs.json b/nixpkgs.json
index 4b6e9203f..72056c155 100644
--- a/nixpkgs.json
+++ b/nixpkgs.json
@@ -2,6 +2,6 @@
   "owner": "NixOS",
   "repo": "nixpkgs",
   "branch": "nixpkgs-unstable",
-  "rev": "ad4db3f4d8ae54482c63c31c14921cb73953548d",
-  "sha256": "1fwl898f6wznkjpwq11brgadz6iff5w5f4lwj2l7ax2rz7r03mnn"
+  "rev": "506445d88e183bce80e47fc612c710eb592045ed",
+  "sha256": "162dywda2dvfj1248afxc45kcrg83appjd0nmdb541hl7rnncf02"
 }