diff --git a/pkgs/clan-cli/clan_cli/nix/__init__.py b/pkgs/clan-cli/clan_cli/nix/__init__.py
index 4678b1f8b..2cb150312 100644
--- a/pkgs/clan-cli/clan_cli/nix/__init__.py
+++ b/pkgs/clan-cli/clan_cli/nix/__init__.py
@@ -105,6 +105,7 @@ def nix_metadata(flake_url: str | Path) -> dict[str, Any]:
     return data
 
 
+# Deprecated: use run_cmd() instead
 def nix_shell(packages: list[str], cmd: list[str]) -> list[str]:
     # we cannot use nix-shell inside the nix sandbox
     # in our tests we just make sure we have all the packages
diff --git a/pkgs/clan-cli/clan_cli/nix/allowed-programs.json b/pkgs/clan-cli/clan_cli/nix/allowed-programs.json
index 441e9e3f5..ddf5df471 100644
--- a/pkgs/clan-cli/clan_cli/nix/allowed-programs.json
+++ b/pkgs/clan-cli/clan_cli/nix/allowed-programs.json
@@ -12,6 +12,7 @@
   "pass",
   "sops",
   "sshpass",
+  "netcat",
   "tor",
   "virtiofsd",
   "zbar",
diff --git a/pkgs/clan-cli/clan_cli/ssh/host.py b/pkgs/clan-cli/clan_cli/ssh/host.py
index 72eb69ed8..0cebdd101 100644
--- a/pkgs/clan-cli/clan_cli/ssh/host.py
+++ b/pkgs/clan-cli/clan_cli/ssh/host.py
@@ -12,7 +12,7 @@ from typing import Any
 from clan_cli.cmd import CmdOut, RunOpts, run
 from clan_cli.colors import AnsiColor
 from clan_cli.errors import ClanError
-from clan_cli.nix import nix_shell
+from clan_cli.nix import run_cmd
 from clan_cli.ssh.host_key import HostKeyCheck
 
 cmdlog = logging.getLogger(__name__)
@@ -186,7 +186,7 @@ class Host:
         packages = []
         password_args = []
         if password:
-            packages.append("nixpkgs#sshpass")
+            packages.append("sshpass")
             password_args = [
                 "sshpass",
                 "-p",
@@ -205,7 +205,7 @@ class Host:
             ssh_opts.extend(["-i", self.key])
 
         if tor_socks:
-            packages.append("nixpkgs#netcat")
+            packages.append("netcat")
             ssh_opts.append("-o")
             ssh_opts.append("ProxyCommand=nc -x 127.0.0.1:9050 -X 5 %h %p")
 
@@ -216,7 +216,7 @@ class Host:
             *ssh_opts,
         ]
 
-        return nix_shell(packages, cmd)
+        return run_cmd(packages, cmd)
 
     def connect_ssh_shell(
         self, *, password: str | None = None, tor_socks: bool = False