From 9606246af0b73dcc5a48f903d22921686b99856a Mon Sep 17 00:00:00 2001
From: Michael Hoang <enzime@users.noreply.github.com>
Date: Fri, 17 Apr 2026 23:14:39 +0200
Subject: [PATCH 1/2] terraform-providers: fix quoting in update script

---
 .../networking/cluster/terraform-providers/update-provider    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/update-provider b/pkgs/applications/networking/cluster/terraform-providers/update-provider
index b54b1cdccc7a..82d2d15c78b0 100755
--- a/pkgs/applications/networking/cluster/terraform-providers/update-provider
+++ b/pkgs/applications/networking/cluster/terraform-providers/update-provider
@@ -86,7 +86,7 @@ update_attr() {
 repo_root=$(git rev-parse --show-toplevel)
 
 generate_hash() {
-  nurl --expr "(import ${repo_root} {}).terraform-providers.${provider}.$1"
+  nurl --expr "(import ${repo_root} {}).terraform-providers.\"${provider}\".$1"
 }
 
 echo_provider() {
@@ -167,7 +167,7 @@ fi
 # Check that the provider builds
 if [[ ${build} == 1 ]]; then
   echo_provider "building"
-  nix-build --no-out-link "${repo_root}" -A "terraform-providers.${provider}"
+  nix-build --no-out-link "${repo_root}" -A "terraform-providers.\"${provider}\""
 fi
 
 popd >/dev/null

From 41a3c8fbd4be7c7855d6705c88ad93e4330ec1d3 Mon Sep 17 00:00:00 2001
From: Michael Hoang <enzime@users.noreply.github.com>
Date: Fri, 17 Apr 2026 23:24:58 +0200
Subject: [PATCH 2/2] terraform-providers/1password_onepassword: 2.2.0 -> 3.3.1

---
 .../networking/cluster/terraform-providers/default.nix   | 9 +++++++++
 .../cluster/terraform-providers/providers.json           | 6 +++---
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/default.nix b/pkgs/applications/networking/cluster/terraform-providers/default.nix
index 04b54b868e26..c1ef75053831 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/default.nix
@@ -108,6 +108,15 @@ let
       propagatedBuildInputs = [ cdrtools ];
     });
     aminueza_minio = automated-providers.aminueza_minio.override { spdx = "AGPL-3.0-only"; };
+    # proxyVendor is necessary because enabling CGO causes `go mod vendor` to include
+    # platform-specific files leading to vendorHash varying across platforms.
+    "1password_onepassword" =
+      (automated-providers."1password_onepassword".override { proxyVendor = true; }).overrideAttrs
+        (finalAttrs: {
+          env = finalAttrs.env // {
+            CGO_ENABLED = "1";
+          };
+        });
   };
 
   # Put all the providers we not longer support in this list.
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 580980abb969..d560a5d496e3 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1,12 +1,12 @@
 {
   "1password_onepassword": {
-    "hash": "sha256-4wEKPTBt9F8N9jPk/PUu+ewrCJ8IztU9CblfJxA7h1k=",
+    "hash": "sha256-BK6rKoEva8ChSARBXZNUAAphjG+Y+eeje8Gdi4DAJoc=",
     "homepage": "https://registry.terraform.io/providers/1Password/onepassword",
     "owner": "1Password",
     "repo": "terraform-provider-onepassword",
-    "rev": "v2.2.0",
+    "rev": "v3.3.1",
     "spdx": "MIT",
-    "vendorHash": "sha256-n01cHzyG9FvxCb92sFccKY1h7Pa0zmi+CUxSYHM5Elc="
+    "vendorHash": "sha256-RTfj2Omiqe92Ad0swEY/aGIMvcXb39bdQoObYKiekiw="
   },
   "a10networks_thunder": {
     "hash": "sha256-RX3mP5btzyvuBjoMNiUL6ZeFLEo5SqmwwSK/eE0gWEw=",