From 920ca4c52a787247f4d52d5a1b4a591357588ca9 Mon Sep 17 00:00:00 2001
From: Ad <me@skissue.xyz>
Date: Sat, 20 Dec 2025 23:36:08 -0500
Subject: [PATCH 1/2] polkit: 126 -> 127

Fixes: #472582
---
 pkgs/by-name/po/polkit/package.nix | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/po/polkit/package.nix b/pkgs/by-name/po/polkit/package.nix
index f804931304d8..31231f32d736 100644
--- a/pkgs/by-name/po/polkit/package.nix
+++ b/pkgs/by-name/po/polkit/package.nix
@@ -42,7 +42,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "polkit";
-  version = "126";
+  version = "127";
 
   outputs = [
     "bin"
@@ -55,19 +55,13 @@ stdenv.mkDerivation rec {
     owner = "polkit-org";
     repo = "polkit";
     rev = version;
-    hash = "sha256-ZSqgW//q5DFIsmY17U93mJcK/CHSCHphKTHsTxp40q8=";
+    hash = "sha256-YTugETy0rqu/bv53jV1UeGqSK79bRXR52EJNcTblvzo=";
   };
 
   patches = [
     # Allow changing base for paths in pkg-config file as before.
     # https://gitlab.freedesktop.org/polkit/polkit/-/merge_requests/100
     ./0001-build-Use-datarootdir-in-Meson-generated-pkg-config-.patch
-
-    (fetchpatch {
-      name = "elogind.patch";
-      url = "https://github.com/polkit-org/polkit/commit/55ee1b70456eca8281dda9612c485c619122f202.patch";
-      hash = "sha256-XOsDyYFBDWxs0PGAgqm3OSUycKR8fYa2ySZqBl8EX7E=";
-    })
   ];
 
   depsBuildBuild = [

From 92848a8fa03d4f0cee162876e570eac934b8a769 Mon Sep 17 00:00:00 2001
From: Ad <me@skissue.xyz>
Date: Wed, 24 Dec 2025 12:29:43 -0500
Subject: [PATCH 2/2] nixos/polkit: remove SUID wrapper for
 polkit-agent-helper-1

Polkit v127 no longer requires a SUID `polkit-agent-helper-1` and instead
recommends using a socket-activated `polkit-agent-helper` service[1].

[1] <https://github.com/polkit-org/polkit/pull/501>
---
 nixos/modules/security/polkit.nix | 20 +++++++-------------
 1 file changed, 7 insertions(+), 13 deletions(-)

diff --git a/nixos/modules/security/polkit.nix b/nixos/modules/security/polkit.nix
index 27a70c7c4896..ca0a88246528 100644
--- a/nixos/modules/security/polkit.nix
+++ b/nixos/modules/security/polkit.nix
@@ -78,6 +78,8 @@ in
     ];
     systemd.services.polkit.stopIfChanged = false;
 
+    systemd.sockets."polkit-agent-helper".wantedBy = [ "sockets.target" ];
+
     # The polkit daemon reads action/rule files
     environment.pathsToLink = [ "/share/polkit-1" ];
 
@@ -94,19 +96,11 @@ in
 
     security.pam.services.polkit-1 = { };
 
-    security.wrappers = {
-      pkexec = {
-        setuid = true;
-        owner = "root";
-        group = "root";
-        source = "${cfg.package.bin}/bin/pkexec";
-      };
-      polkit-agent-helper-1 = {
-        setuid = true;
-        owner = "root";
-        group = "root";
-        source = "${cfg.package.out}/lib/polkit-1/polkit-agent-helper-1";
-      };
+    security.wrappers.pkexec = {
+      setuid = true;
+      owner = "root";
+      group = "root";
+      source = "${cfg.package.bin}/bin/pkexec";
     };
 
     systemd.tmpfiles.rules = [