diff --git a/pkgs/by-name/dh/dhcpcd/package.nix b/pkgs/by-name/dh/dhcpcd/package.nix
index 4a9cd199ae05..3f470ffd9cd8 100644
--- a/pkgs/by-name/dh/dhcpcd/package.nix
+++ b/pkgs/by-name/dh/dhcpcd/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dhcpcd";
-  version = "10.2.4";
+  version = "10.3.0";
 
   src = fetchFromGitHub {
     owner = "NetworkConfiguration";
     repo = "dhcpcd";
     rev = "v${version}";
-    sha256 = "sha256-ysaKgF4Cu/S6yhSn/4glA0+Ey54KNp3/1Oh82yE0/PY=";
+    sha256 = "sha256-XbXZkws1eHvN7OEq7clq2kziwwdk04lNrWbJ9RdHExU=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/by-name/na/nano/package.nix b/pkgs/by-name/na/nano/package.nix
index 4273405a1456..abc61d66afd3 100644
--- a/pkgs/by-name/na/nano/package.nix
+++ b/pkgs/by-name/na/nano/package.nix
@@ -31,11 +31,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "nano";
-  version = "8.7";
+  version = "8.7.1";
 
   src = fetchurl {
     url = "mirror://gnu/nano/${pname}-${version}.tar.xz";
-    hash = "sha256-r9KHqmcsSLjhqT/bbGWIRT1SdRDZZoIraH8oNfDZhuk=";
+    hash = "sha256-dvDcskjy4vElHU7NIP0w+0AKNgo6N8bDQOClLC0c3t8=";
   };
 
   nativeBuildInputs = [ texinfo ] ++ lib.optional enableNls gettext;
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd b/pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd
index bc7f09e036d1..43b8c233e290 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd
@@ -272,6 +272,9 @@ It must be one of the following:
 	When set, *nixos-rebuild* prefixes activation commands with sudo.
 	Setting this option allows deploying as a non-root user.
 
+	You can set sudo options by defining the NIX_SUDOOPTS environment
+	variable.
+
 *--ask-sudo-password*, *-S*
 	When set, *nixos-rebuild* will ask for sudo password for remote
 	activation (i.e.: on *--target-host*) at the start of the build process.
@@ -339,6 +342,9 @@ NIX_PATH
 NIX_SSHOPTS
 	Additional options to be passed to ssh on the command line.
 
+NIX_SUDOOPTS
+	Additional options to be passed to sudo on the command line.
+
 # FILES
 
 /etc/nixos/flake.nix
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py
index 902797189c69..4a03e86ed4e9 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py
@@ -142,7 +142,8 @@ def run_wrapper(
         if extra_env:
             env = os.environ | extra_env
         if sudo:
-            run_args = ["sudo", *run_args]
+            sudo_args = shlex.split(os.getenv("NIX_SUDOOPTS", ""))
+            run_args = ["sudo", *sudo_args, *run_args]
 
     logger.debug(
         "calling run with args=%r, kwargs=%r, extra_env=%r",
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_process.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_process.py
index 84b5c084bf38..b11e039adf60 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_process.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_process.py
@@ -160,3 +160,21 @@ def test_ssh_host() -> None:
         remote = m.Remote.from_arg(host_input, None, False)
         assert remote is not None
         assert remote.ssh_host() == expected
+
+
+@patch("subprocess.run", autospec=True)
+def test_custom_sudo_args(mock_run: Any) -> None:
+    with patch.dict(p.os.environ, {"NIX_SUDOOPTS": "--custom sudo --args"}):
+        p.run_wrapper(
+            ["test"],
+            check=False,
+            sudo=True,
+        )
+    mock_run.assert_called_with(
+        ["sudo", "--custom", "sudo", "--args", "test"],
+        check=False,
+        env=None,
+        input=None,
+        text=True,
+        errors="surrogateescape",
+    )
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index ddb925e9d5b7..f086165ae3e8 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,37 +1,37 @@
 {
     "testing": {
-        "version": "6.19-rc7",
-        "hash": "sha256:03isv8zwasq8shq06wryyzii1zvf1kqzs310mvyqbq22iifm71f7",
+        "version": "6.19-rc8",
+        "hash": "sha256:1vwlhsk3cry48p9v2kqqxkmrsw2sjgspfylv3c7r5430yk7fhyg1",
         "lts": false
     },
     "6.1": {
-        "version": "6.1.161",
-        "hash": "sha256:0aasgrq6mv5nj7b8ashzx0pxlaah5y0f3sq7d8w00di2lyync5ml",
+        "version": "6.1.162",
+        "hash": "sha256:12fhqsz61g64wdx3hx637fx4zn7ks7kv9h7b26llx8mr94m44rlp",
         "lts": true
     },
     "5.15": {
-        "version": "5.15.198",
-        "hash": "sha256:0hwpwbvjh6y4dhbpp34x9j25nc6x48fbiz65zzavplqdb2a0jk2x",
+        "version": "5.15.199",
+        "hash": "sha256:0bmx5y10mbn05qv0cvh7w6zhgzar88vj2kdm3j4m32hk9jpd7h01",
         "lts": true
     },
     "5.10": {
-        "version": "5.10.248",
-        "hash": "sha256:01g05n856c9q7m46dmn48pq7hfph4b1kpvrjvrykg8q4z7qy9rmm",
+        "version": "5.10.249",
+        "hash": "sha256:0ihh9pjnaz3lq9my6yhlikacadc5lldsypifjcpm8j8i4qsfv45r",
         "lts": true
     },
     "6.6": {
-        "version": "6.6.122",
-        "hash": "sha256:1mlrna10449cf7whz86wgj3bijlbahj03nqbfjwjzvsbw2fhv3nl",
+        "version": "6.6.123",
+        "hash": "sha256:1ca5x6ri5i8xcm4dc5hv6b0xyv9npb9dy0wfvzi9g44al6sx85m6",
         "lts": true
     },
     "6.12": {
-        "version": "6.12.68",
-        "hash": "sha256:1dr58bfp883g4dnxak5gr25hib6hs8jq3c0ys06m5nnl9d8cfryk",
+        "version": "6.12.69",
+        "hash": "sha256:0rbnbynhm7w4ig8snq97px4ljr5k4zq1a97jqhwk4w0qy9bkcjab",
         "lts": true
     },
     "6.18": {
-        "version": "6.18.8",
-        "hash": "sha256:1zwczw98ylqa3nhlqnvjbylaaqg8jn3z0j3xx02ddha2qbawbw1p",
+        "version": "6.18.9",
+        "hash": "sha256:0y05jg6126h946pac5mkl5myh573qgml1p29hinm7jxlizzia083",
         "lts": false
     }
 }