diff --git a/ci/main.go b/ci/main.go
index 4d2e7d15..6f9b1c4e 100644
--- a/ci/main.go
+++ b/ci/main.go
@@ -29,7 +29,7 @@ const (
 	kclLSPVersion     = "v0.11.2" // renovate: datasource=github-releases depName=kcl-lang/kcl
 	// Base images are pulled from GHCR and ECR Public rather than Docker Hub
 	// to avoid anonymous pull rate limits.
-	nixImage    = "ghcr.io/nixos/nix:2.34.7"                      // renovate: datasource=docker depName=ghcr.io/nixos/nix
+	nixImage    = "ghcr.io/nixos/nix:2.35.1"                      // renovate: datasource=docker depName=ghcr.io/nixos/nix
 	debianImage = "public.ecr.aws/docker/library/debian:13-slim" // renovate: datasource=docker depName=public.ecr.aws/docker/library/debian
 
 	// macosSDKStorePath is the pinned nixpkgs apple-sdk store path, substituted