diff --git a/pkgs/development/tools/apko/default.nix b/pkgs/development/tools/apko/default.nix
index ecd45791e77b..eb72de76af7b 100644
--- a/pkgs/development/tools/apko/default.nix
+++ b/pkgs/development/tools/apko/default.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
     owner = "chainguard-dev";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-02W9YOnV/zXopH3C9UNKu5gepNVS2gzoGa10uaKYu94=";
+    hash = "sha256-02W9YOnV/zXopH3C9UNKu5gepNVS2gzoGa10uaKYu94=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -24,7 +24,7 @@ buildGoModule rec {
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  vendorSha256 = "sha256-h1uAAL3FBskx6Qv9E5WY+UPeXK49WW/hFoNN4QyKevU=";
+  vendorHash = "sha256-h1uAAL3FBskx6Qv9E5WY+UPeXK49WW/hFoNN4QyKevU=";
 
   nativeBuildInputs = [ installShellFiles ];
 
@@ -41,14 +41,11 @@ buildGoModule rec {
     ldflags+=" -X sigs.k8s.io/release-utils/version.buildDate=$(cat SOURCE_DATE_EPOCH)"
   '';
 
-  preCheck = ''
-    # disable tests that require network access
-    rm pkg/apk/impl/implementation_test.go
-  '';
-
-  doCheck = true;
-
-  doInstallCheck = true;
+  checkFlags = [
+    # networking required to fetch alpine-keys
+    # pulled out into a separate library next release
+    "-skip=TestInitDB"
+  ];
 
   postInstall = ''
     installShellCompletion --cmd apko \
@@ -57,6 +54,7 @@ buildGoModule rec {
       --zsh <($out/bin/apko completion zsh)
   '';
 
+  doInstallCheck = true;
   installCheckPhase = ''
     runHook preInstallCheck