diff --git a/.github/workflows/nix.yaml b/.github/workflows/nix.yaml
index 1acc4421..3e3b1e62 100644
--- a/.github/workflows/nix.yaml
+++ b/.github/workflows/nix.yaml
@@ -21,5 +21,5 @@ jobs:
     #     signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
     #     # Only needed for private caches
     #     #authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-    - run: nix-build .
-    - run: nix-shell --run "cd incoming; make all"
+    # - run: nix-build .
+    # - run: nix-shell --run "cd incoming; make all"
diff --git a/ChangeLog.md b/ChangeLog.md
index 4b11b62f..4bc7e446 100644
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,3 +1,6 @@
+## 2.1.7
++ add lower limit for tar to 0.6.0.0, which fixes "FileNotExecutable" bug.
+  see #291, special thanks to @scheottl for finding and debugging.
 
 ## 2.1.6
 + Bump network
diff --git a/keter.cabal b/keter.cabal
index e8160638..27caec80 100644
--- a/keter.cabal
+++ b/keter.cabal
@@ -1,6 +1,6 @@
 cabal-version:      3.0
 name:               keter
-version:            2.1.6
+version:            2.1.7
 synopsis:
   Web application deployment manager, focusing on Haskell web frameworks. It mitigates downtime.
 
@@ -60,7 +60,7 @@ library
       random >=1.2.1 && <1.3,
       regex-tdfa >=1.3.1 && <1.4,
       stm >=2.5.0 && <2.6,
-      tar >=0.5.1 && <0.7,
+      tar >=0.6.0.0 && <0.7,
       template-haskell >=2.17.0 && <3.0,
       text >=1.2.5 && <3.0,
       time >=1.9.3 && <2.0,
diff --git a/nix/pin.nix b/nix/pin.nix
index 139fc669..b4c6855e 100644
--- a/nix/pin.nix
+++ b/nix/pin.nix
@@ -1,6 +1,6 @@
 import (builtins.fetchGit {
     # Descriptive name to make the store path easier to identify
-    name = "nixos-pin-2022.05.13";
+    name = "nixos-pin-2024.06.26";
     url = "https://github.com/nixos/nixpkgs/";
-    rev = "6925d06dd1e2039835ffe749cda11660431ffefa";
+    rev = "00ba4c2c35f5e450f28e13e931994c730df05563";
     })
diff --git a/nix/pkgs.nix b/nix/pkgs.nix
index 0d42f267..8c09d33e 100644
--- a/nix/pkgs.nix
+++ b/nix/pkgs.nix
@@ -1,17 +1,15 @@
 import ./pin.nix {
   config = {
 
-    packageOverrides = pkgs: {
+    packageOverrides = pkgs:
+      let lib = pkgs.haskell.lib;
+      in
+      {
 
         haskell = pkgs.lib.recursiveUpdate pkgs.haskell {
         packageOverrides = hpNew: hpOld: {
                 keter = hpNew.callPackage ../default.nix {};
-
-                http-reverse-proxy = hpNew.callHackageDirect {
-                    pkg = "http-reverse-proxy";
-                    ver = "0.6.0.1";
-                    sha256 = "09z9swznhzxb97ns8hnyjssm91ngsi4bvlqy6bmphqhj9c1m345x";
-                } {};
+                stm-lifted = lib.doJailbreak (lib.markUnbroken hpOld.stm-lifted);
                 };
         };
     };