diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index d0b6992f28aa..bc89c77a65dc 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -13336,10 +13336,12 @@
     name = "Julius Rickert";
   };
   julm = {
-    email = "julm+nixpkgs@sourcephile.fr";
+    email = "julm@sourcephile.fr";
+    matrix = "@julm:matrix.org";
     github = "ju1m";
     githubId = 21160136;
     name = "Julien Moutinho";
+    keys = [ { fingerprint = "4FE4 6703 4C11 017B 429B  AC53 A58C D81C 3863 926F"; } ];
   };
   Julow = {
     email = "jules@j3s.fr";
diff --git a/pkgs/tools/networking/bitmask-vpn/default.nix b/pkgs/tools/networking/bitmask-vpn/default.nix
index 4242ac59a666..70c52da296f9 100644
--- a/pkgs/tools/networking/bitmask-vpn/default.nix
+++ b/pkgs/tools/networking/bitmask-vpn/default.nix
@@ -23,9 +23,10 @@
   qtwayland,
   provider ? "riseup",
 }:
-let
-  version = "0.24.8";
 
+buildGoModule (finalAttrs: {
+  pname = "${provider}-vpn";
+  version = "0.24.8";
   src = fetchFromGitLab {
     domain = "0xacab.org";
     owner = "leap";
@@ -34,39 +35,6 @@ let
     leaveDotGit = true;
     sha256 = "sha256-XUgCVHnTLZXFU+r0s1yuYryWNBJRgQrFlf3g1iRrLWs=";
   };
-
-  # bitmask-root is only used on GNU/Linux
-  # and may one day be replaced by pkg/helper
-  bitmask-root = stdenv.mkDerivation {
-    inherit src version;
-    sourceRoot = "${src.name}/helpers";
-    pname = "bitmask-root";
-    nativeBuildInputs = [ python3Packages.wrapPython ];
-    postPatch = ''
-      substituteInPlace bitmask-root \
-        --replace 'swhich("ip")' '"${iproute2}/bin/ip"' \
-        --replace 'swhich("iptables")' '"${iptables}/bin/iptables"' \
-        --replace 'swhich("ip6tables")' '"${iptables}/bin/ip6tables"' \
-        --replace 'swhich("sysctl")' '"${procps}/bin/sysctl"' \
-        --replace /usr/sbin/openvpn ${openvpn}/bin/openvpn
-      substituteInPlace se.leap.bitmask.policy \
-        --replace /usr/sbin/bitmask-root $out/bin/bitmask-root
-    '';
-    installPhase = ''
-      runHook preInstall
-
-      install -m 755 -D -t $out/bin bitmask-root
-      install -m 444 -D -t $out/share/polkit-1/actions se.leap.bitmask.policy
-      wrapPythonPrograms
-
-      runHook postInstall
-    '';
-  };
-in
-
-buildGoModule rec {
-  inherit src version;
-  pname = "${provider}-vpn";
   vendorHash = null;
 
   patches = [
@@ -90,7 +58,7 @@ buildGoModule rec {
       --replace "provider = bitmask" "provider = ${provider}"
 
     substituteInPlace branding/templates/debian/app.desktop-template \
-      --replace "Icon=icon" "Icon=${pname}"
+      --replace "Icon=icon" "Icon=${finalAttrs.pname}"
 
     patchShebangs gui/build.sh
     wrapPythonProgramsIn branding/scripts
@@ -100,7 +68,7 @@ buildGoModule rec {
       --replace /usr/sbin/openvpn ${openvpn}/bin/openvpn
     substituteInPlace pkg/launcher/launcher_linux.go \
       --replace /usr/sbin/openvpn ${openvpn}/bin/openvpn \
-      --replace /usr/sbin/bitmask-root ${bitmask-root}/bin/bitmask-root \
+      --replace /usr/sbin/bitmask-root ${finalAttrs.passthru.bitmask-root}/bin/bitmask-root \
       --replace /usr/bin/lxpolkit /run/wrappers/bin/polkit-agent-helper-1 \
       --replace '"polkit-gnome-authentication-agent-1",' '"polkit-gnome-authentication-agent-1","polkitd",'
   '';
@@ -125,6 +93,19 @@ buildGoModule rec {
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [ qtwayland ];
 
+  # Workaround qmake looking for lrelease in wrong package
+  # Issue: https://github.com/NixOS/nixpkgs/issues/214765
+  qmakeFlags = [
+    "QT_TOOL.lrelease.binary=${lib.getDev qttools}/bin/lrelease"
+  ];
+
+  preConfigure = ''
+    # Workaround QMAKE being set by qtbase-setup-hook.sh
+    # https://github.com/NixOS/nixpkgs/blob/f6ca41c08b059c0836d6868a4e43be346d8e2a7c/pkgs/development/libraries/qt-6/hooks/qtbase-setup-hook.sh#L19
+    # to @qttools@/bin/qmake, which does not exist.
+    unset QMAKE
+  '';
+
   # FIXME: building on Darwin currently fails
   # due to missing debug symbols for Qt,
   # this should be fixable once darwin.apple_sdk >= 10.13
@@ -149,22 +130,50 @@ buildGoModule rec {
   '';
 
   postInstall = ''
-    install -m 755 -D -t $out/bin build/qt/release/${pname}
+    install -m 755 -D -t $out/bin build/qt/release/${finalAttrs.pname}
 
-    VERSION=${version} VENDOR_PATH=providers branding/scripts/generate-debian branding/templates/debian/data.json
+    VERSION=${finalAttrs.version} VENDOR_PATH=providers branding/scripts/generate-debian branding/templates/debian/data.json
     (cd branding/templates/debian && ${python3Packages.python}/bin/python3 generate.py)
-    install -m 444 -D branding/templates/debian/app.desktop $out/share/applications/${pname}.desktop
-    install -m 444 -D providers/${provider}/assets/icon.svg $out/share/icons/hicolor/scalable/apps/${pname}.svg
+    install -m 444 -D branding/templates/debian/app.desktop $out/share/applications/${finalAttrs.pname}.desktop
+    install -m 444 -D providers/${provider}/assets/icon.svg $out/share/icons/hicolor/scalable/apps/${finalAttrs.pname}.svg
   ''
   + lib.optionalString stdenv.hostPlatform.isLinux ''
-    install -m 444 -D -t $out/share/polkit-1/actions ${bitmask-root}/share/polkit-1/actions/se.leap.bitmask.policy
+    install -m 444 -D -t $out/share/polkit-1/actions ${finalAttrs.passthru.bitmask-root}/share/polkit-1/actions/se.leap.bitmask.policy
   '';
 
   # Some tests need access to the Internet:
   # Post "https://api.black.riseup.net/3/cert": dial tcp: lookup api.black.riseup.net on [::1]:53: read udp [::1]:56553->[::1]:53: read: connection refused
   doCheck = false;
 
-  passthru = { inherit bitmask-root; };
+  passthru = {
+    # bitmask-root is only used on GNU/Linux
+    # and may one day be replaced by pkg/helper
+    bitmask-root = stdenv.mkDerivation {
+      inherit (finalAttrs) src version;
+      sourceRoot = "${finalAttrs.src.name}/helpers";
+      pname = "bitmask-root";
+      nativeBuildInputs = [ python3Packages.wrapPython ];
+      postPatch = ''
+        substituteInPlace bitmask-root \
+          --replace 'swhich("ip")' '"${iproute2}/bin/ip"' \
+          --replace 'swhich("iptables")' '"${iptables}/bin/iptables"' \
+          --replace 'swhich("ip6tables")' '"${iptables}/bin/ip6tables"' \
+          --replace 'swhich("sysctl")' '"${procps}/bin/sysctl"' \
+          --replace /usr/sbin/openvpn ${openvpn}/bin/openvpn
+        substituteInPlace se.leap.bitmask.policy \
+          --replace /usr/sbin/bitmask-root $out/bin/bitmask-root
+      '';
+      installPhase = ''
+        runHook preInstall
+
+        install -m 755 -D -t $out/bin bitmask-root
+        install -m 444 -D -t $out/share/polkit-1/actions se.leap.bitmask.policy
+        wrapPythonPrograms
+
+        runHook postInstall
+      '';
+    };
+  };
 
   meta = {
     description = "Generic VPN client by LEAP";
@@ -175,7 +184,7 @@ buildGoModule rec {
       a variety of trusted service provider all from one app.
       Current providers include Riseup Networks
       and The Calyx Institute, where the former is default.
-      The <literal>${pname}</literal> executable should appear
+      The <literal>${finalAttrs.pname}</literal> executable should appear
       in your desktop manager's XDG menu or could be launch in a terminal
       to get an execution log. A new icon should then appear in your systray
       to control the VPN and configure some options.
@@ -186,4 +195,4 @@ buildGoModule rec {
     # darwin requires apple_sdk >= 10.13
     platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/tools/networking/bitmask-vpn/fix_paths.patch b/pkgs/tools/networking/bitmask-vpn/fix_paths.patch
index afc444952fbb..87efa3fbaf51 100644
--- a/pkgs/tools/networking/bitmask-vpn/fix_paths.patch
+++ b/pkgs/tools/networking/bitmask-vpn/fix_paths.patch
@@ -10,4 +10,4 @@ index a858a81..ac43f52 100755
 +    sed -i 's|@qtbase@/bin/lrelease|@qttools@/bin/lrelease|g' $QTBUILD/Makefile
  }
 
- function renameOutput {
\ No newline at end of file
+ function renameOutput {