Flatpak >=1.18.0 leaks the NixOS host environment into the sandbox, breaking glycin-svg icon loading (e.g. OpenDeck). Pin services.flatpak.package to a nixpkgs-flatpak input locked to a revision with Flatpak 1.16.6, scoped to the Flatpak service only, until flatpak/flatpak#6721 lands in nixpkgs. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>