diff --git a/doc/release-notes/rl-2605.section.md b/doc/release-notes/rl-2605.section.md
index 2cbe63791ba2..e18d349108a9 100644
--- a/doc/release-notes/rl-2605.section.md
+++ b/doc/release-notes/rl-2605.section.md
@@ -196,8 +196,6 @@
 - `openrgb` was updated to 1.0rc2, which now uses Plugin API version 4.
   Some existing OpenRGB plugins may be incompatible or require updates.
 
-- the `neovim` wrapper sets provider-related configuration in its generated config rather than as wrapper arguments. It should not affect configuration unless you set `wrapRc` to false.
-
 - We now use the upstream wrapper script for Gradle, supporting both the `JAVA_HOME` and `GRADLE_OPTS` environment variables.
 
 ## Nixpkgs Library {#sec-nixpkgs-release-26.05-lib}
diff --git a/nixos/modules/services/misc/n8n.nix b/nixos/modules/services/misc/n8n.nix
index edb387fa8bca..7e302a190a87 100644
--- a/nixos/modules/services/misc/n8n.nix
+++ b/nixos/modules/services/misc/n8n.nix
@@ -30,8 +30,35 @@ let
       path = "${pkg}/lib/node_modules/${pkg.pname}";
     }) cfg.customNodes
   );
+
+  # Runners
+  runnersCfg = cfg.taskRunners;
+  runnersEnv = partitionEnv runnersCfg.environment;
+  commonAllowedEnv = lib.attrNames runnersEnv.regular;
+  enabledRunners = lib.filterAttrs (_name: runnerCfg: runnerCfg.enable) runnersCfg.runners;
+  anyRunnerEnabled = runnersCfg.enable && (enabledRunners != { });
+  runnerTypes = lib.attrNames enabledRunners;
+  runnersStateDir = "n8n-task-runners";
+  taskRunnerConfigs = lib.mapAttrsToList (runnerType: runnerCfg: {
+    runner-type = runnerType;
+    workdir = "/var/lib/${runnersStateDir}";
+    command = runnerCfg.command;
+    args = runnerCfg.args;
+    allowed-env = commonAllowedEnv;
+    env-overrides = runnerCfg.environment;
+    health-check-server-port = toString runnerCfg.healthCheckPort;
+  }) enabledRunners;
+
+  launcherConfigFile = pkgs.writeText "n8n-task-runners.json" (
+    builtins.toJSON { task-runners = taskRunnerConfigs; }
+  );
 in
 {
+  meta.maintainers = with lib.maintainers; [
+    sweenu
+    gepbird
+  ];
+
   imports = [
     (lib.mkRemovedOptionModule [ "services" "n8n" "settings" ] "Use services.n8n.environment instead.")
     (lib.mkRemovedOptionModule [
@@ -128,13 +155,188 @@ in
               When enabled, n8n sends notifications of new versions and security updates.
             '';
           };
+          N8N_CUSTOM_EXTENSIONS = lib.mkOption {
+            internal = true;
+            type = with lib.types; nullOr path;
+            default = if cfg.customNodes != [ ] then toString customNodesDir else null;
+            description = ''
+              Specify the path to directories containing your custom nodes.
+            '';
+          };
+          N8N_RUNNERS_MODE = lib.mkOption {
+            internal = true;
+            type =
+              with lib.types;
+              enum [
+                "internal"
+                "external"
+              ];
+            default = if runnersCfg.enable then "external" else "internal";
+            description = ''
+              How to launch and run the task runner.
+              `internal` means n8n will launch a task runner as child process.
+              `external` means an external orchestrator will launch the task runner.
+            '';
+          };
+          N8N_RUNNERS_BROKER_PORT = lib.mkOption {
+            type = with lib.types; coercedTo port toString str;
+            default = 5679;
+            description = ''
+              Port the task broker listens on for task runner connections.
+            '';
+          };
+          N8N_RUNNERS_BROKER_LISTEN_ADDRESS = lib.mkOption {
+            type = lib.types.str;
+            default = "127.0.0.1";
+            description = ''
+              Address the task broker listens on.
+            '';
+          };
+          N8N_RUNNERS_AUTH_TOKEN_FILE = lib.mkOption {
+            type = with lib.types; nullOr path;
+            default = null;
+            description = ''
+              Path to a file containing the shared authentication token
+              used between the n8n server (task broker) and the task runners.
+
+              This option is required when {option}`services.n8n.taskRunners.enable` is true.
+              The file should be readable by the service and not stored in the Nix store.
+              Use tools like `agenix` or `sops-nix` to manage this secret.
+            '';
+          };
         };
       };
       default = { };
     };
+
+    taskRunners = {
+      enable = lib.mkEnableOption "n8n task runners for sandboxed Code node execution";
+
+      launcherPackage = lib.mkPackageOption pkgs "n8n-task-runner-launcher" { };
+
+      environment = lib.mkOption {
+        description = ''
+          Environment variables for the task runner launcher and runners.
+          These are common to all runners and passed via `allowed-env` in the launcher config.
+          See <https://docs.n8n.io/hosting/configuration/environment-variables/task-runners/> for available options.
+
+          Environment variables ending with `_FILE` are automatically handled as secrets:
+          they are loaded via systemd credentials for secure access with `DynamicUser=true`.
+
+          Note: The authentication token should be set via {option}`services.n8n.environment.N8N_RUNNERS_AUTH_TOKEN_FILE`.
+        '';
+        example = lib.literalExpression ''
+          {
+            N8N_RUNNERS_AUTO_SHUTDOWN_TIMEOUT = 15;
+            N8N_RUNNERS_MAX_CONCURRENCY = 10;
+          }
+        '';
+        type = lib.types.submodule {
+          freeformType =
+            with lib.types;
+            attrsOf (oneOf [
+              str
+              (coercedTo int toString str)
+              (coercedTo bool builtins.toJSON str)
+            ]);
+          options = {
+            N8N_RUNNERS_CONFIG_PATH = lib.mkOption {
+              internal = true;
+              type = with lib.types; nullOr path;
+              default = launcherConfigFile;
+              description = ''
+                Path to the configuration file for the task runner launcher.
+              '';
+            };
+            N8N_RUNNERS_AUTH_TOKEN_FILE = lib.mkOption {
+              type = with lib.types; nullOr path;
+              default = cfg.environment.N8N_RUNNERS_AUTH_TOKEN_FILE;
+              defaultText = lib.literalExpression "config.services.n8n.environment.N8N_RUNNERS_AUTH_TOKEN_FILE";
+              description = ''
+                Path to the authentication token file for the task runner.
+              '';
+            };
+            N8N_RUNNERS_TASK_BROKER_URI = lib.mkOption {
+              type = lib.types.str;
+              default = "http://${cfg.environment.N8N_RUNNERS_BROKER_LISTEN_ADDRESS}:${cfg.environment.N8N_RUNNERS_BROKER_PORT}";
+              defaultText = lib.literalExpression ''"http://''${config.services.n8n.environment.N8N_RUNNERS_BROKER_LISTEN_ADDRESS}:''${config.services.n8n.environment.N8N_RUNNERS_BROKER_PORT}"'';
+              description = ''
+                URI of the n8n task broker that the runner connects to.
+              '';
+            };
+          };
+        };
+        default = { };
+      };
+
+      runners = lib.mkOption {
+        type = lib.types.attrsOf (
+          lib.types.submodule (
+            { name, ... }:
+            {
+              options = {
+                enable = lib.mkOption {
+                  type = lib.types.bool;
+                  default = true;
+                  description = ''
+                    Whether to enable the ${name} task runner.
+                    Only takes effect when {option}`services.n8n.taskRunners.enable` is true.
+                  '';
+                };
+
+                command = lib.mkOption {
+                  type = lib.types.str;
+                  description = "Command to execute for this runner.";
+                };
+
+                healthCheckPort = lib.mkOption {
+                  type = lib.types.port;
+                  description = "Port for the runner's health check server.";
+                };
+
+                args = lib.mkOption {
+                  type = with lib.types; listOf str;
+                  default = [ ];
+                  description = "Additional command-line arguments to pass to the task runner.";
+                };
+
+                environment = lib.mkOption {
+                  type = with lib.types; attrsOf str;
+                  default = { };
+                  description = "Environment variables specific to this task runner.";
+                };
+              };
+            }
+          )
+        );
+        default = { };
+        defaultText = lib.literalExpression ''
+          {
+            javascript = {
+              enable = true;
+              command = lib.getExe' config.services.n8n.package "n8n-task-runner";
+              healthCheckPort = 5681;
+            };
+            python = {
+              enable = true;
+              command = lib.getExe' config.services.n8n.package "n8n-task-runner-python";
+              healthCheckPort = 5682;
+            };
+          }
+        '';
+        description = "Configuration for individual task runners.";
+      };
+    };
   };
 
   config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = anyRunnerEnabled -> cfg.environment.N8N_RUNNERS_AUTH_TOKEN_FILE != null;
+        message = "services.n8n.environment.N8N_RUNNERS_AUTH_TOKEN_FILE must be set when task runners are enabled.";
+      }
+    ];
+
     systemd.services.n8n = {
       description = "n8n service";
       after = [ "network.target" ];
@@ -144,15 +346,12 @@ in
         // {
           HOME = cfg.environment.N8N_USER_FOLDER;
         }
-        // lib.optionalAttrs (cfg.customNodes != [ ]) {
-          N8N_CUSTOM_EXTENSIONS = toString customNodesDir;
-        }
         // n8nEnv.fileBasedTransformed;
       serviceConfig = {
         Type = "simple";
         ExecStart = lib.getExe cfg.package;
         Restart = "on-failure";
-        StateDirectory = "n8n";
+        StateDirectory = baseNameOf cfg.environment.N8N_USER_FOLDER;
 
         LoadCredential = lib.mapAttrsToList (
           varName: secretPath: "${envVarToCredName varName}:${secretPath}"
@@ -178,6 +377,62 @@ in
       };
     };
 
+    warnings = lib.optional (runnersCfg.enable && !anyRunnerEnabled) ''
+      services.n8n.taskRunners.enable is true, but both JavaScript and Python runners are disabled.
+      Enable at least one runner or disable taskRunners.
+    '';
+
+    # We set the defaults here to ease adding attributes
+    services.n8n.taskRunners.runners = {
+      javascript = lib.mapAttrs (_: lib.mkDefault) {
+        enable = true;
+        command = lib.getExe' cfg.package "n8n-task-runner";
+        healthCheckPort = 5681;
+      };
+      python = lib.mapAttrs (_: lib.mkDefault) {
+        enable = true;
+        command = lib.getExe' cfg.package "n8n-task-runner-python";
+        healthCheckPort = 5682;
+      };
+    };
+
+    systemd.services.n8n-task-runner = lib.mkIf anyRunnerEnabled {
+      description = "n8n task runner";
+      after = [ "n8n.service" ];
+      requires = [ "n8n.service" ];
+      wantedBy = [ "multi-user.target" ];
+      environment = runnersEnv.regular // runnersEnv.fileBasedTransformed;
+      serviceConfig = {
+        Type = "simple";
+        ExecStart = "${lib.getExe runnersCfg.launcherPackage} ${lib.concatStringsSep " " runnerTypes}";
+        Restart = "on-failure";
+
+        StateDirectory = runnersStateDir;
+
+        LoadCredential = lib.mapAttrsToList (
+          varName: secretPath: "${envVarToCredName varName}:${secretPath}"
+        ) runnersEnv.fileBased;
+
+        # Hardening
+        DynamicUser = "true";
+        NoNewPrivileges = "yes";
+        PrivateTmp = "yes";
+        PrivateDevices = "yes";
+        DevicePolicy = "closed";
+        ProtectSystem = "strict";
+        ProtectHome = "read-only";
+        ProtectControlGroups = "yes";
+        ProtectKernelModules = "yes";
+        ProtectKernelTunables = "yes";
+        RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6 AF_NETLINK";
+        RestrictNamespaces = "yes";
+        RestrictRealtime = "yes";
+        RestrictSUIDSGID = "yes";
+        MemoryDenyWriteExecute = "no"; # v8 JIT requires memory segments to be Writable-Executable.
+        LockPersonality = "yes";
+      };
+    };
+
     networking.firewall = lib.mkIf cfg.openFirewall {
       allowedTCPPorts = [ (lib.toInt cfg.environment.N8N_PORT) ];
     };
diff --git a/nixos/tests/n8n.nix b/nixos/tests/n8n.nix
index d3226e2ed0f4..270f63648904 100644
--- a/nixos/tests/n8n.nix
+++ b/nixos/tests/n8n.nix
@@ -1,12 +1,18 @@
 { lib, pkgs, ... }:
 let
   port = 5678;
+  brokerPort = 5679;
   webhookUrl = "http://example.com";
   secretFile = toString (pkgs.writeText "n8n-encryption-key" "test-encryption-key-12345");
+  authTokenFile = toString (pkgs.writeText "n8n-runner-auth-token" "test-runner-auth-token-12345");
 in
 {
   name = "n8n";
-  meta.maintainers = with lib.maintainers; [ k900 ];
+  meta.maintainers = with lib.maintainers; [
+    k900
+    sweenu
+    gepbird
+  ];
 
   node.pkgsReadOnly = false;
 
@@ -20,8 +26,26 @@ in
           WEBHOOK_URL = webhookUrl;
           N8N_TEMPLATES_ENABLED = false;
           DB_PING_INTERVAL_SECONDS = 2;
-          # !!! Don't do this with real keys. The /nix store is world-readable!
+          # !!! Don't do this with real keys/tokens. The /nix store is world-readable!
           N8N_ENCRYPTION_KEY_FILE = secretFile;
+          N8N_RUNNERS_AUTH_TOKEN_FILE = authTokenFile;
+        };
+        taskRunners = {
+          enable = true;
+          environment = {
+            # Common env var for all runners
+            N8N_RUNNERS_MAX_CONCURRENCY = 10;
+          };
+          runners = {
+            javascript = {
+              args = [ "--disallow-code-generation-from-strings" ];
+              environment.NODE_FUNCTION_ALLOW_BUILTIN = "*";
+            };
+            python = {
+              args = [ "--test-arg" ];
+              environment.N8N_RUNNERS_STDLIB_ALLOW = "*";
+            };
+          };
         };
       };
     };
@@ -48,5 +72,35 @@ in
     custom_extensions_dir = machine.succeed("grep -oP 'N8N_CUSTOM_EXTENSIONS=\\K[^\"]+' /etc/systemd/system/n8n.service").strip()
     machine.succeed(f"test -L {custom_extensions_dir}/n8n-nodes-carbonejs")
     machine.succeed(f"test -f {custom_extensions_dir}/n8n-nodes-carbonejs/package.json")
+
+    # Test task runner integration on n8n service
+    machine.succeed("grep -qF 'N8N_RUNNERS_MODE=external' /etc/systemd/system/n8n.service")
+    machine.succeed("grep -qF 'N8N_RUNNERS_BROKER_PORT=${toString brokerPort}' /etc/systemd/system/n8n.service")
+    machine.succeed("grep -qF 'LoadCredential=n8n_runners_auth_token_file:${authTokenFile}' /etc/systemd/system/n8n.service")
+
+    # Test task runner service
+    machine.wait_for_unit("n8n-task-runner.service")
+    machine.succeed("systemctl is-active n8n-task-runner.service")
+
+    # Test that both runner types are enabled
+    machine.succeed("grep -qF 'javascript python' /etc/systemd/system/n8n-task-runner.service")
+
+    # Test common environment variables are passed to launcher
+    machine.succeed("grep -qF 'N8N_RUNNERS_MAX_CONCURRENCY=10' /etc/systemd/system/n8n-task-runner.service")
+    machine.succeed("grep -qF 'N8N_RUNNERS_TASK_BROKER_URI=http://127.0.0.1:${toString brokerPort}' /etc/systemd/system/n8n-task-runner.service")
+
+    # Test auth token is loaded via credentials
+    machine.succeed("grep -qF 'LoadCredential=n8n_runners_auth_token_file:${authTokenFile}' /etc/systemd/system/n8n-task-runner.service")
+
+    # Test launcher config file
+    config_path = machine.succeed("grep -oP 'N8N_RUNNERS_CONFIG_PATH=\\K[^[:space:]\"]+' /etc/systemd/system/n8n-task-runner.service").strip()
+    config = machine.succeed(f"cat {config_path}")
+    assert "NODE_FUNCTION_ALLOW_BUILTIN" in config, "JavaScript env-override not in config"
+    assert "N8N_RUNNERS_STDLIB_ALLOW" in config, "Python env-override not in config"
+    assert "N8N_RUNNERS_MAX_CONCURRENCY" in config, "Common allowed-env not in config"
+    assert "--disallow-code-generation-from-strings" in config, "JavaScript args not in config"
+    assert "--test-arg" in config, "Python args not in config"
+    assert '"health-check-server-port":"5681"' in config, "JavaScript health check port not in config"
+    assert '"health-check-server-port":"5682"' in config, "Python health check port not in config"
   '';
 }
diff --git a/pkgs/applications/audio/quodlibet/default.nix b/pkgs/applications/audio/quodlibet/default.nix
index d1740db71df6..afade20b517c 100644
--- a/pkgs/applications/audio/quodlibet/default.nix
+++ b/pkgs/applications/audio/quodlibet/default.nix
@@ -140,21 +140,6 @@ python3.pkgs.buildPythonApplication rec {
     pytest-xdist
   ]);
 
-  pytestFlags = [
-    # missing translation strings in potfiles
-    "--deselect=tests/test_po.py::TPOTFILESIN::test_missing"
-    # require networking
-    "--deselect=tests/plugin/test_covers.py::test_live_cover_download"
-    "--deselect=tests/test_browsers_iradio.py::TInternetRadio::test_click_add_station"
-    # upstream does actually not enforce source code linting
-    "--ignore=tests/quality"
-    # marked as flaky, breaks in sandbox
-    "--deselect=tests/test_library_file.py::TWatchedFileLibrary::test_watched_adding"
-  ]
-  ++ lib.optionals (withXineBackend || !withGstPlugins) [
-    "--ignore=tests/plugin/test_replaygain.py"
-  ];
-
   env.LC_ALL = "en_US.UTF-8";
 
   preCheck = ''
@@ -162,15 +147,32 @@ python3.pkgs.buildPythonApplication rec {
     export XDG_DATA_DIRS="$out/share:${gtk3}/share/gsettings-schemas/${gtk3.name}:$XDG_ICON_DIRS:$XDG_DATA_DIRS"
   '';
 
-  checkPhase = ''
-    runHook preCheck
+  checkPhase =
+    let
+      pytestFlags = [
+        # missing translation strings in potfiles
+        "--deselect=tests/test_po.py::TPOTFILESIN::test_missing"
+        # require networking
+        "--deselect=tests/plugin/test_covers.py::test_live_cover_download"
+        "--deselect=tests/test_browsers_iradio.py::TInternetRadio::test_click_add_station"
+        # upstream does actually not enforce source code linting
+        "--ignore=tests/quality"
+        # marked as flaky, breaks in sandbox
+        "--deselect=tests/test_library_file.py::TWatchedFileLibrary::test_watched_adding"
+      ]
+      ++ lib.optionals (withXineBackend || !withGstPlugins) [
+        "--ignore=tests/plugin/test_replaygain.py"
+      ];
+    in
+    ''
+      runHook preCheck
 
-    xvfb-run -s '-screen 0 1920x1080x24' \
-      dbus-run-session --config-file=${dbus}/share/dbus-1/session.conf \
-      pytest $pytestFlags
+      xvfb-run -s '-screen 0 1920x1080x24' \
+        dbus-run-session --config-file=${dbus}/share/dbus-1/session.conf \
+        pytest ${lib.concatStringsSep " " pytestFlags}
 
-    runHook postCheck
-  '';
+      runHook postCheck
+    '';
 
   preFixup = lib.optionalString (kakasi != null) ''
     gappsWrapperArgs+=(--prefix PATH : ${lib.getBin kakasi})
diff --git a/pkgs/applications/audio/zynaddsubfx/default.nix b/pkgs/applications/audio/zynaddsubfx/default.nix
index 1a76c7b2acbc..47f52d27c486 100644
--- a/pkgs/applications/audio/zynaddsubfx/default.nix
+++ b/pkgs/applications/audio/zynaddsubfx/default.nix
@@ -139,7 +139,7 @@ stdenv.mkDerivation rec {
   # Find FLTK without requiring an OpenGL library in buildInputs
   ++ lib.optional (guiModule == "fltk") "-DFLTK_SKIP_OPENGL=ON";
 
-  CXXFLAGS = [
+  env.CXXFLAGS = toString [
     # GCC 13: error: 'uint8_t' does not name a type
     "-include cstdint"
   ];
diff --git a/pkgs/applications/blockchains/zcash/default.nix b/pkgs/applications/blockchains/zcash/default.nix
index 5b019e254e7f..1dfbd0f39559 100644
--- a/pkgs/applications/blockchains/zcash/default.nix
+++ b/pkgs/applications/blockchains/zcash/default.nix
@@ -69,7 +69,7 @@ stdenv.mkDerivation rec {
     zeromq
   ];
 
-  CXXFLAGS = [
+  env.CXXFLAGS = toString [
     "-I${lib.getDev utf8cpp}/include/utf8cpp"
     "-I${lib.getDev cxx-rs}/include"
   ];
diff --git a/pkgs/applications/editors/neovim/wrapper.nix b/pkgs/applications/editors/neovim/wrapper.nix
index 6c97a6f22377..e8f04ad30fc3 100644
--- a/pkgs/applications/editors/neovim/wrapper.nix
+++ b/pkgs/applications/editors/neovim/wrapper.nix
@@ -104,16 +104,13 @@ let
         packpathDirs.myNeovimPackages = vimPackageInfo.vimPackage;
         finalPackdir = neovimUtils.packDir packpathDirs;
 
-        rcContent = lib.concatStringsSep "\n" (
-          [
-            providerLuaRc
-          ]
-          ++ lib.optional (luaRcContent != "") luaRcContent
-          ++ lib.optional (neovimRcContent' != "") ''
-            vim.cmd.source "${writeText "init.vim" neovimRcContent'}"
-          ''
-          ++ lib.optionals autoconfigure vimPackageInfo.pluginAdvisedLua
-        );
+        rcContent = ''
+          ${luaRcContent}
+        ''
+        + lib.optionalString (neovimRcContent' != "") ''
+          vim.cmd.source "${writeText "init.vim" neovimRcContent'}"
+        ''
+        + lib.optionalString autoconfigure (lib.concatStringsSep "\n" vimPackageInfo.pluginAdvisedLua);
 
         python3Env =
           lib.warnIf (attrs ? python3Env)
@@ -128,7 +125,12 @@ let
 
         wrapperArgsStr = if lib.isString wrapperArgs then wrapperArgs else lib.escapeShellArgs wrapperArgs;
 
-        generatedWrapperArgs =
+        generatedWrapperArgs = [
+          # vim accepts a limited number of commands so we join all the provider ones
+          "--add-flags"
+          ''--cmd "lua ${providerLuaRc}"''
+        ]
+        ++
           lib.optionals
             (
               finalAttrs.packpathDirs.myNeovimPackages.start != [ ]
@@ -140,17 +142,17 @@ let
               "--add-flags"
               ''--cmd "set rtp^=${finalPackdir}"''
             ]
-          ++ lib.optionals finalAttrs.withRuby [
-            "--set"
-            "GEM_HOME"
-            "${rubyEnv}/${rubyEnv.ruby.gemPath}"
-          ]
-          ++ lib.optionals (finalAttrs.runtimeDeps != [ ]) [
-            "--suffix"
-            "PATH"
-            ":"
-            (lib.makeBinPath finalAttrs.runtimeDeps)
-          ];
+        ++ lib.optionals finalAttrs.withRuby [
+          "--set"
+          "GEM_HOME"
+          "${rubyEnv}/${rubyEnv.ruby.gemPath}"
+        ]
+        ++ lib.optionals (finalAttrs.runtimeDeps != [ ]) [
+          "--suffix"
+          "PATH"
+          ":"
+          (lib.makeBinPath finalAttrs.runtimeDeps)
+        ];
 
         providerLuaRc = neovimUtils.generateProviderRc {
           inherit (finalAttrs)
@@ -179,7 +181,7 @@ let
         ++ lib.optionals finalAttrs.wrapRc [
           "--set-default"
           "VIMINIT"
-          "lua dofile('${writeText "init.lua" finalAttrs.luaRcContent}')"
+          "lua dofile('${writeText "init.lua" rcContent}')"
         ]
         ++ finalAttrs.generatedWrapperArgs;
 
diff --git a/pkgs/applications/graphics/tesseract/tesseract3.nix b/pkgs/applications/graphics/tesseract/tesseract3.nix
index 4d3a97ade7dd..ffe3cbc7039e 100644
--- a/pkgs/applications/graphics/tesseract/tesseract3.nix
+++ b/pkgs/applications/graphics/tesseract/tesseract3.nix
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
     opencl-headers
   ];
 
-  LIBLEPT_HEADERSDIR = "${leptonica}/include";
+  env.LIBLEPT_HEADERSDIR = "${leptonica}/include";
 
   meta = {
     description = "OCR engine";
diff --git a/pkgs/applications/networking/cluster/rke2/builder.nix b/pkgs/applications/networking/cluster/rke2/builder.nix
index 68fe28b50075..bb2381c8f9a0 100644
--- a/pkgs/applications/networking/cluster/rke2/builder.nix
+++ b/pkgs/applications/networking/cluster/rke2/builder.nix
@@ -75,7 +75,7 @@ buildGoModule (finalAttrs: {
   ];
 
   # Passing boringcrypto to GOEXPERIMENT variable to build with goboring library
-  GOEXPERIMENT = "boringcrypto";
+  env.GOEXPERIMENT = "boringcrypto";
 
   # https://github.com/rancher/rke2/blob/104ddbf3de65ab5490aedff36df2332d503d90fe/scripts/build-binary#L27-L39
   ldflags =
diff --git a/pkgs/applications/science/machine-learning/shogun/default.nix b/pkgs/applications/science/machine-learning/shogun/default.nix
index e1e7c4d8a0ae..fae5f8a00782 100644
--- a/pkgs/applications/science/machine-learning/shogun/default.nix
+++ b/pkgs/applications/science/machine-learning/shogun/default.nix
@@ -191,7 +191,7 @@ stdenv.mkDerivation (finalAttrs: {
       (lib.cmakeBool "USE_SVMLIGHT" withSvmLight)
     ];
 
-  CXXFLAGS = "-faligned-new";
+  env.CXXFLAGS = "-faligned-new";
 
   doCheck = true;
 
diff --git a/pkgs/applications/version-management/monotone/default.nix b/pkgs/applications/version-management/monotone/default.nix
index 7a4fdb9d0811..d72a5d37a394 100644
--- a/pkgs/applications/version-management/monotone/default.nix
+++ b/pkgs/applications/version-management/monotone/default.nix
@@ -71,7 +71,7 @@ stdenv.mkDerivation rec {
       {} +
   '';
 
-  CXXFLAGS = " --std=c++11 ";
+  env.CXXFLAGS = " --std=c++11 ";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/applications/window-managers/awesome/default.nix b/pkgs/applications/window-managers/awesome/default.nix
index 8c7ef0442848..4d9db85dbc2f 100644
--- a/pkgs/applications/window-managers/awesome/default.nix
+++ b/pkgs/applications/window-managers/awesome/default.nix
@@ -114,8 +114,6 @@ stdenv.mkDerivation rec {
     "doc"
   ];
 
-  FONTCONFIG_FILE = toString fontsConf;
-
   propagatedUserEnvPkgs = [ hicolor-icon-theme ];
   buildInputs = [
     cairo
@@ -150,11 +148,14 @@ stdenv.mkDerivation rec {
   ]
   ++ lib.optional lua.pkgs.isLuaJIT "-DLUA_LIBRARY=${lua}/lib/libluajit-5.1.so";
 
-  GI_TYPELIB_PATH = "${pango.out}/lib/girepository-1.0";
-  # LUA_CPATH and LUA_PATH are used only for *building*, see the --search flags
-  # below for how awesome finds the libraries it needs at runtime.
-  LUA_CPATH = "${luaEnv}/lib/lua/${lua.luaversion}/?.so";
-  LUA_PATH = "${luaEnv}/share/lua/${lua.luaversion}/?.lua;;";
+  env = {
+    FONTCONFIG_FILE = toString fontsConf;
+    GI_TYPELIB_PATH = "${pango.out}/lib/girepository-1.0";
+    # LUA_CPATH and LUA_PATH are used only for *building*, see the --search flags
+    # below for how awesome finds the libraries it needs at runtime.
+    LUA_CPATH = "${luaEnv}/lib/lua/${lua.luaversion}/?.so";
+    LUA_PATH = "${luaEnv}/share/lua/${lua.luaversion}/?.lua;;";
+  };
 
   postInstall = ''
     # Don't use wrapProgram or the wrapper will duplicate the --search
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 9bb07456e8f2..808fe5db2780 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -603,7 +603,7 @@ stdenvNoCC.mkDerivation {
       installPhase =
         if targetPlatform.isCygwin then
           ''
-            echo addToSearchPath "LINK_DLL_FOLDERS" "${cc_bin}/lib" >> $out
+            echo addToSearchPath "_linkDeps_inputPath" "${cc_solib}/bin" >> $out
             # Work around build failure caused by the gnulib workaround for
             # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114870. remove after
             # gnulib is updated in core packages (e.g. iconv, gnupatch, gnugrep)
diff --git a/pkgs/build-support/docker/tarsum.nix b/pkgs/build-support/docker/tarsum.nix
index 9358c571e94b..6c82fb8f4238 100644
--- a/pkgs/build-support/docker/tarsum.nix
+++ b/pkgs/build-support/docker/tarsum.nix
@@ -13,9 +13,11 @@ stdenv.mkDerivation {
 
   dontUnpack = true;
 
-  CGO_ENABLED = 0;
-  GOFLAGS = "-trimpath";
-  GO111MODULE = "off";
+  env = {
+    CGO_ENABLED = 0;
+    GOFLAGS = "-trimpath";
+    GO111MODULE = "off";
+  };
 
   buildPhase = ''
     runHook preBuild
diff --git a/pkgs/build-support/setup-hooks/cygwin-dll-link.sh b/pkgs/build-support/setup-hooks/cygwin-dll-link.sh
deleted file mode 100644
index a9309925e658..000000000000
--- a/pkgs/build-support/setup-hooks/cygwin-dll-link.sh
+++ /dev/null
@@ -1,77 +0,0 @@
-# shellcheck shell=bash
-
-addLinkDLLPaths() {
-  addToSearchPath "LINK_DLL_FOLDERS" "$1/lib"
-  addToSearchPath "LINK_DLL_FOLDERS" "$1/bin"
-}
-
-# shellcheck disable=SC2154
-addEnvHooks "$targetOffset" addLinkDLLPaths
-
-addOutputDLLPaths() {
-  for output in $(getAllOutputNames); do
-    addToSearchPath "LINK_DLL_FOLDERS" "${!output}/lib"
-    addToSearchPath "LINK_DLL_FOLDERS" "${!output}/bin"
-  done
-}
-
-postInstallHooks+=(addOutputDLLPaths)
-
-_dllDeps() {
-  "$OBJDUMP" -p "$1" \
-    | sed -n 's/.*DLL Name: \(.*\)/\1/p' \
-    | sort -u
-}
-
-_linkDeps() {
-  local target="$1" dir="$2" check="$3"
-  echo 'target:' "$target"
-  local dll
-  _dllDeps "$target" | while read -r dll; do
-    echo '  dll:' "$dll"
-    if [[ -e "$dir/$dll" ]]; then continue; fi
-    # Locate the DLL - it should be an *executable* file on $LINK_DLL_FOLDERS.
-    local dllPath
-    if ! dllPath="$(PATH="$(dirname "$target"):$LINK_DLL_FOLDERS" type -P "$dll")"; then
-      if [[ -z "$check" || -n "${allowedImpureDLLsMap[$dll]}" ]]; then
-        continue
-      fi
-      echo unable to find "$dll" in "$LINK_DLL_FOLDERS" >&2
-      exit 1
-    fi
-    echo '    linking to:' "$dllPath"
-    CYGWIN+=\ winsymlinks:nativestrict ln -sr "$dllPath" "$dir"
-    # That DLL might have its own (transitive) dependencies,
-    # so add also all DLLs from its directory to be sure.
-    _linkDeps "$dllPath" "$dir" ""
-  done
-}
-
-linkDLLs() {
-  # shellcheck disable=SC2154
-  if [ ! -d "$prefix" ]; then return; fi
-  (
-    set -e
-    shopt -s globstar nullglob
-
-    local -a allowedImpureDLLsArray
-    concatTo allowedImpureDLLsArray allowedImpureDLLs
-
-    local -A allowedImpureDLLsMap;
-
-    for dll in "${allowedImpureDLLsArray[@]}"; do
-      allowedImpureDLLsMap[$dll]=1
-    done
-
-    cd "$prefix"
-
-    # Iterate over any DLL that we depend on.
-    local target
-    for target in {bin,libexec}/**/*.{exe,dll}; do
-      [[ ! -f "$target" || ! -x "$target" ]] ||
-        _linkDeps "$target" "$(dirname "$target")" "1"
-    done
-  )
-}
-
-fixupOutputHooks+=(linkDLLs)
diff --git a/pkgs/by-name/ac/acpica-tools/package.nix b/pkgs/by-name/ac/acpica-tools/package.nix
index 2b0d3601c46b..4f3420a991d8 100644
--- a/pkgs/by-name/ac/acpica-tools/package.nix
+++ b/pkgs/by-name/ac/acpica-tools/package.nix
@@ -34,21 +34,23 @@ stdenv.mkDerivation (finalAttrs: {
     "iasl"
   ];
 
-  env.NIX_CFLAGS_COMPILE = toString [
-    "-O3"
-  ];
+  env = {
+    NIX_CFLAGS_COMPILE = toString [
+      "-O3"
+    ];
+
+    # i686 builds fail with hardening enabled (due to -Wformat-overflow). Disable
+    # -Werror altogether to make this derivation less fragile to toolchain
+    # updates.
+    NOWERROR = "TRUE";
+
+    # We can handle stripping ourselves.
+    # Unless we are on Darwin. Upstream makefiles degrade coreutils install to cp if _APPLE is detected.
+    INSTALLFLAGS = lib.optionals (!stdenv.hostPlatform.isDarwin) "-m 555";
+  };
 
   enableParallelBuilding = true;
 
-  # i686 builds fail with hardening enabled (due to -Wformat-overflow). Disable
-  # -Werror altogether to make this derivation less fragile to toolchain
-  # updates.
-  NOWERROR = "TRUE";
-
-  # We can handle stripping ourselves.
-  # Unless we are on Darwin. Upstream makefiles degrade coreutils install to cp if _APPLE is detected.
-  INSTALLFLAGS = lib.optionals (!stdenv.hostPlatform.isDarwin) "-m 555";
-
   installFlags = [ "PREFIX=${placeholder "out"}" ];
 
   passthru.updateScript = nix-update-script { };
diff --git a/pkgs/by-name/ar/ardour/package.nix b/pkgs/by-name/ar/ardour/package.nix
index 9f7f7be04f7d..1a2e14771506 100644
--- a/pkgs/by-name/ar/ardour/package.nix
+++ b/pkgs/by-name/ar/ardour/package.nix
@@ -192,14 +192,17 @@ stdenv.mkDerivation (
     ]
     ++ lib.optional optimize "--optimize";
 
-    env.NIX_CFLAGS_COMPILE = toString [
-      # 'ioprio_set' syscall support:
-      "-D_GNU_SOURCE"
-      # compiler doesn't find headers without these:
-      "-I${lib.getDev serd}/include/serd-0"
-      "-I${lib.getDev sratom}/include/sratom-0"
-      "-I${lib.getDev sord}/include/sord-0"
-    ];
+    env = {
+      NIX_CFLAGS_COMPILE = toString [
+        # 'ioprio_set' syscall support:
+        "-D_GNU_SOURCE"
+        # compiler doesn't find headers without these:
+        "-I${lib.getDev serd}/include/serd-0"
+        "-I${lib.getDev sratom}/include/sratom-0"
+        "-I${lib.getDev sord}/include/sord-0"
+      ];
+      LINKFLAGS = "-lpthread";
+    };
 
     postInstall = ''
       # wscript does not install these for some reason
@@ -227,8 +230,6 @@ stdenv.mkDerivation (
         }"
     '';
 
-    LINKFLAGS = "-lpthread";
-
     meta = {
       description = "Multi-track hard disk recording software";
       longDescription = ''
diff --git a/pkgs/by-name/au/authentik/client-go-config.patch b/pkgs/by-name/au/authentik/client-go-config.patch
new file mode 100644
index 000000000000..8398b16160c7
--- /dev/null
+++ b/pkgs/by-name/au/authentik/client-go-config.patch
@@ -0,0 +1,9 @@
+diff --git a/config.yaml b/config.yaml
+index 2f07ea7..0f90432 100644
+--- a/config.yaml
++++ b/config.yaml
+@@ -4,3 +4,4 @@ additionalProperties:
+   packageName: api
+   enumClassPrefix: true
+   useOneOfDiscriminatorLookup: true
++  disallowAdditionalPropertiesIfNotPresent: false
diff --git a/pkgs/by-name/au/authentik/ldap.nix b/pkgs/by-name/au/authentik/ldap.nix
index 5d4159ae9737..bf6b88202e11 100644
--- a/pkgs/by-name/au/authentik/ldap.nix
+++ b/pkgs/by-name/au/authentik/ldap.nix
@@ -1,6 +1,7 @@
 {
   buildGoModule,
   authentik,
+  apiGoVendorHook,
   vendorHash,
 }:
 
@@ -9,6 +10,8 @@ buildGoModule {
   inherit (authentik) version src;
   inherit vendorHash;
 
+  nativeBuildInputs = [ apiGoVendorHook ];
+
   env.CGO_ENABLED = 0;
 
   subPackages = [ "cmd/ldap" ];
diff --git a/pkgs/by-name/au/authentik/outposts.nix b/pkgs/by-name/au/authentik/outposts.nix
index 485dd81e8c20..0548c36e888d 100644
--- a/pkgs/by-name/au/authentik/outposts.nix
+++ b/pkgs/by-name/au/authentik/outposts.nix
@@ -1,10 +1,11 @@
 {
   callPackage,
   authentik,
+  apiGoVendorHook ? authentik.apiGoVendorHook,
   vendorHash ? authentik.proxy.vendorHash,
 }:
 {
-  ldap = callPackage ./ldap.nix { inherit vendorHash; };
-  proxy = callPackage ./proxy.nix { inherit vendorHash; };
-  radius = callPackage ./radius.nix { inherit vendorHash; };
+  ldap = callPackage ./ldap.nix { inherit apiGoVendorHook vendorHash; };
+  proxy = callPackage ./proxy.nix { inherit apiGoVendorHook vendorHash; };
+  radius = callPackage ./radius.nix { inherit apiGoVendorHook vendorHash; };
 }
diff --git a/pkgs/by-name/au/authentik/package.nix b/pkgs/by-name/au/authentik/package.nix
index 8a4a7c6409e3..680c719f0f06 100644
--- a/pkgs/by-name/au/authentik/package.nix
+++ b/pkgs/by-name/au/authentik/package.nix
@@ -10,18 +10,23 @@
   nodejs_24,
   python3,
   makeWrapper,
+  openapi-generator-cli,
+  go,
+  typescript,
+  makeSetupHook,
+  writeShellScript,
 }:
 
 let
   nodejs = nodejs_24;
 
-  version = "2025.10.1";
+  version = "2025.12.4";
 
   src = fetchFromGitHub {
     owner = "goauthentik";
     repo = "authentik";
     tag = "version/${version}";
-    hash = "sha256-HowB6DTGCqz770fKYbnE+rQ11XRV0WSNkLD+HSWZwz8=";
+    hash = "sha256-alTyrMBbjZbw4jhEna8saabf93sqSrZCu+Z5xH3pZ7M=";
   };
 
   meta = {
@@ -39,6 +44,90 @@ let
     ];
   };
 
+  client-go = stdenvNoCC.mkDerivation {
+    pname = "authentik-client-go";
+    version = "3.${version}";
+    inherit meta;
+
+    src = fetchFromGitHub {
+      owner = "goauthentik";
+      repo = "client-go";
+      tag = "v3.${version}";
+      hash = "sha256-+/CfOE2HkBU+ZddvdXGenB/z8xNFk8cujpZpMXyh3cY=";
+    };
+
+    patches = [
+      ./client-go-config.patch
+    ];
+
+    postPatch = ''
+      substituteInPlace ./config.yaml \
+        --replace-fail '/local' "$(pwd)"
+    '';
+
+    nativeBuildInputs = [
+      openapi-generator-cli
+      go
+    ];
+
+    buildPhase = ''
+      runHook preBuild
+
+      openapi-generator-cli generate \
+        -i ${src}/schema.yml -o $out \
+        -g go \
+        -c ./config.yaml
+
+      gofmt -w $out
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      cp go.mod go.sum $out
+
+      cd $out
+      rm -rf test
+      rm -f .travis.yml git_push.sh
+
+      runHook postInstall
+    '';
+  };
+
+  client-ts = stdenvNoCC.mkDerivation {
+    pname = "authentik-client-ts";
+    inherit version src meta;
+
+    postPatch = ''
+      substituteInPlace ./scripts/api/ts-config.yaml \
+        --replace-fail '/local' "$(pwd)"
+    '';
+
+    nativeBuildInputs = [
+      nodejs
+      openapi-generator-cli
+      typescript
+    ];
+
+    buildPhase = ''
+      runHook preBuild
+
+      openapi-generator-cli generate \
+        -i ./schema.yml -o $out \
+        -g typescript-fetch \
+        -c ./scripts/api/ts-config.yaml \
+        --additional-properties=npmVersion=${version} \
+        --git-repo-id authentik --git-user-id goauthentik
+
+      cd $out
+      npm run build
+
+      runHook postBuild
+    '';
+  };
+
   # prefetch-npm-deps does not save all dependencies even though the lockfile is fine
   website-deps = stdenvNoCC.mkDerivation {
     pname = "authentik-website-deps";
@@ -48,8 +137,8 @@ let
 
     outputHash =
       {
-        "aarch64-linux" = "sha256-aXXlzTsZp5mOrsxy9oHNzcc+1cFSnbC9RmtawBohmLI=";
-        "x86_64-linux" = "sha256-Hi0HXzwTLuer0v4IKF3aim0tVe7AVLi67DiMimrIq5s=";
+        "aarch64-linux" = "sha256-GL5FPIBnoEXYtw8DPJpRPe3tT3qioN4AdoeOmCoiYsM=";
+        "x86_64-linux" = "sha256-AnceTipq6uUvTbOAZanVshAbAJ9LS1kwImbttTOcWxc=";
       }
       .${stdenvNoCC.hostPlatform.system} or (throw "authentik-website-deps: unsupported host platform");
 
@@ -119,8 +208,8 @@ let
 
     outputHash =
       {
-        "aarch64-linux" = "sha256-t/jyzG3ibTW3fu8Gl1tWkSjMG6Lek/7JDccDrZX6sD0=";
-        "x86_64-linux" = "sha256-8I1YAKvgWjM3p9O1mCetZvhZelrfB31w0ZwkZBUEoh4=";
+        "aarch64-linux" = "sha256-eZZ5Ynj81KwFsU5emPtYZ2CxO8MFvWbJnCHs+L88KQQ=";
+        "x86_64-linux" = "sha256-yUAyyO1NFav1EptrRYGSzC8dxCxYVj0FmzHk8IckFZM=";
       }
       .${stdenvNoCC.hostPlatform.system} or (throw "authentik-webui-deps: unsupported host platform");
     outputHashMode = "recursive";
@@ -172,6 +261,10 @@ let
       find -type d -name node_modules -prune -print -exec cp -rT {} $buildRoot/{} \;
       popd
 
+      chmod -R +w node_modules/@goauthentik
+      rm -R node_modules/@goauthentik/api
+      ln -sn ${client-ts} node_modules/@goauthentik/api
+
       pushd node_modules/.bin
       patchShebangs $(readlink rollup)
       patchShebangs $(readlink wireit)
@@ -208,6 +301,21 @@ let
       # https://github.com/goauthentik/authentik/pull/16324
       django = final.django_5;
 
+      ak-guardian = final.buildPythonPackage {
+        pname = "ak-guardian";
+        inherit version src meta;
+        pyproject = true;
+
+        sourceRoot = "${src.name}/packages/ak-guardian";
+
+        build-system = with final; [ hatchling ];
+
+        propagatedBuildInputs = with final; [
+          django
+          typing-extensions
+        ];
+      };
+
       django-channels-postgres = final.buildPythonPackage {
         pname = "django-channels-postgres";
         inherit version src meta;
@@ -330,14 +438,15 @@ let
         pyproject = true;
 
         postPatch = ''
-          rm lifecycle/system_migrations/tenant_files.py
           substituteInPlace authentik/root/settings.py \
             --replace-fail 'Path(__file__).absolute().parent.parent.parent' "Path(\"$out\")"
           substituteInPlace authentik/lib/default.yml \
-            --replace-fail '/blueprints' "$out/blueprints" \
-            --replace-fail './media' '/var/lib/authentik/media'
+            --replace-fail '/blueprints' "$out/blueprints"
           substituteInPlace authentik/stages/email/utils.py \
             --replace-fail 'web/' '${webui}/'
+          # allways allow file upload if the data directoy exists
+          substituteInPlace authentik/admin/files/backends/file.py \
+            --replace-fail "and (self._base_dir.is_mount() or (self._base_dir / self.usage.value).is_mount())" ""
         '';
 
         build-system = [
@@ -351,6 +460,7 @@ let
         dependencies =
           with final;
           [
+            ak-guardian
             argon2-cffi
             cachetools
             channels
@@ -364,7 +474,6 @@ let
             django-cte
             django-dramatiq-postgres
             django-filter
-            django-guardian
             django-model-utils
             django-pglock
             django-pgtrigger
@@ -375,7 +484,6 @@ let
             django-tenants
             djangoql
             djangorestframework
-            djangorestframework-guardian
             docker
             drf-orjson-renderer
             drf-spectacular
@@ -440,6 +548,31 @@ let
 
   inherit (python.pkgs) authentik-django;
 
+  # Provide a setup-hook to configure the Go vendor directory with up-to-date API bindings.
+  # This is done to avoid the `vendorHash` depending on anything in the `client-go` build (e.g.
+  # openapi-generator-cli version updates changing the produced content) and invalidating the hash.
+  apiGoVendorHook =
+    makeSetupHook
+      {
+        name = "authentik-api-go-vendor-hook";
+      }
+      (
+        writeShellScript "authentik-api-go-vendor-hook" ''
+          authentikApiGoVendorHook() {
+            chmod -R +w vendor/goauthentik.io/api
+            rm -rf vendor/goauthentik.io/api/v3
+            cp -r ${client-go} vendor/goauthentik.io/api/v3
+
+            echo "Finished authentikApiGoVendorHook"
+          }
+
+          # don't run for FOD, e.g. the `goModules` build
+          if [ -z ''${outputHash-} ]; then
+            postConfigureHooks+=(authentikApiGoVendorHook)
+          fi
+        ''
+      );
+
   proxy = buildGoModule {
     pname = "authentik-proxy";
     inherit version src meta;
@@ -453,9 +586,14 @@ let
         --replace-fail './web' "${authentik-django}/web"
     '';
 
+    nativeBuildInputs = [ apiGoVendorHook ];
+
     env.CGO_ENABLED = 0;
 
-    vendorHash = "sha256-m2shrCwoVdbtr8B83ZcAyG+J6dEys2xdjtlfFFF4CDo=";
+    # calculate the vendorHash without other dependencies, so it is only based on the `go.sum` file
+    overrideModAttrs.postPatch = "";
+
+    vendorHash = "sha256-pdQg02f1K4nOhsnadoplQYOhEybqZxn+yDQRN5RNygM=";
 
     postInstall = ''
       mv $out/bin/server $out/bin/authentik
@@ -500,9 +638,10 @@ stdenvNoCC.mkDerivation {
   '';
 
   passthru = {
-    inherit proxy;
+    inherit proxy apiGoVendorHook;
     outposts = callPackages ./outposts.nix {
       inherit (proxy) vendorHash;
+      inherit apiGoVendorHook;
     };
   };
 
diff --git a/pkgs/by-name/au/authentik/proxy.nix b/pkgs/by-name/au/authentik/proxy.nix
index 37cb9e88dc82..f1db56006460 100644
--- a/pkgs/by-name/au/authentik/proxy.nix
+++ b/pkgs/by-name/au/authentik/proxy.nix
@@ -1,6 +1,7 @@
 {
   buildGoModule,
   authentik,
+  apiGoVendorHook,
   vendorHash,
 }:
 
@@ -9,6 +10,8 @@ buildGoModule {
   inherit (authentik) version src;
   inherit vendorHash;
 
+  nativeBuildInputs = [ apiGoVendorHook ];
+
   env.CGO_ENABLED = 0;
 
   subPackages = [ "cmd/proxy" ];
diff --git a/pkgs/by-name/au/authentik/radius.nix b/pkgs/by-name/au/authentik/radius.nix
index 4c44ecfe6d07..ba348a72515f 100644
--- a/pkgs/by-name/au/authentik/radius.nix
+++ b/pkgs/by-name/au/authentik/radius.nix
@@ -1,6 +1,7 @@
 {
   buildGoModule,
   authentik,
+  apiGoVendorHook,
   vendorHash,
 }:
 
@@ -9,6 +10,8 @@ buildGoModule {
   inherit (authentik) version src;
   inherit vendorHash;
 
+  nativeBuildInputs = [ apiGoVendorHook ];
+
   env.CGO_ENABLED = 0;
 
   subPackages = [ "cmd/radius" ];
diff --git a/pkgs/by-name/ba/bant/package.nix b/pkgs/by-name/ba/bant/package.nix
index 6b364c284223..fbf07613ed3c 100644
--- a/pkgs/by-name/ba/bant/package.nix
+++ b/pkgs/by-name/ba/bant/package.nix
@@ -33,7 +33,10 @@ buildBazelPackage rec {
     "--registry"
     "file://${registry}"
   ];
-  LIBTOOL = lib.optionalString stdenv.hostPlatform.isDarwin "${cctools}/bin/libtool";
+
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    LIBTOOL = "${cctools}/bin/libtool";
+  };
 
   postPatch = ''
     patchShebangs scripts/create-workspace-status.sh
diff --git a/pkgs/by-name/bl/bluespec/package.nix b/pkgs/by-name/bl/bluespec/package.nix
index d5d1ac88333a..53dbfc6655a6 100644
--- a/pkgs/by-name/bl/bluespec/package.nix
+++ b/pkgs/by-name/bl/bluespec/package.nix
@@ -177,12 +177,17 @@ stdenv.mkDerivation rec {
     cctools
   ];
 
-  env.NIX_CFLAGS_COMPILE = toString (
-    lib.optionals (stdenv.cc.isClang) [
-      # wide_data.cxx:1750:15: error: variable length arrays in C++ are a Clang extension [-Werror,-Wvla-cxx-extension]
-      "-Wno-error"
-    ]
-  );
+  env =
+    lib.optionalAttrs (stdenv.cc.isClang) {
+      NIX_CFLAGS_COMPILE = toString [
+        # wide_data.cxx:1750:15: error: variable length arrays in C++ are a Clang extension [-Werror,-Wvla-cxx-extension]
+        "-Wno-error"
+      ];
+    }
+    // lib.optionalAttrs (withSuiteCheck && stdenv.hostPlatform.isLinux) {
+      # bash: warning: setlocale: LC_ALL: cannot change locale (en_US.UTF-8)
+      LOCALE_ARCHIVE = "${glibcLocales}/lib/locale/locale-archive";
+    };
 
   makeFlags = [
     "NO_DEPS_CHECKS=1" # skip the subrepo check (this deriviation uses yices-src instead of the subrepo)
@@ -235,11 +240,6 @@ stdenv.mkDerivation rec {
 
   checkTarget = if withSuiteCheck then "checkparallel" else "check-smoke"; # this is the shortest check but "check-suite" tests much more
 
-  # bash: warning: setlocale: LC_ALL: cannot change locale (en_US.UTF-8)
-  LOCALE_ARCHIVE = lib.optionalString (
-    withSuiteCheck && stdenv.hostPlatform.isLinux
-  ) "${glibcLocales}/lib/locale/locale-archive";
-
   nativeCheckInputs = [
     gmp-static
     iverilog
diff --git a/pkgs/by-name/bo/botamusique/package.nix b/pkgs/by-name/bo/botamusique/package.nix
index 55b85a96111d..8d86a367d3ee 100644
--- a/pkgs/by-name/bo/botamusique/package.nix
+++ b/pkgs/by-name/bo/botamusique/package.nix
@@ -70,7 +70,7 @@ stdenv.mkDerivation rec {
       --replace "version = 'git'" "version = '${version}'"
   '';
 
-  NODE_OPTIONS = "--openssl-legacy-provider";
+  env.NODE_OPTIONS = "--openssl-legacy-provider";
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/by-name/br/browserpass/package.nix b/pkgs/by-name/br/browserpass/package.nix
index 3e7f17629ed2..24138be165e7 100644
--- a/pkgs/by-name/br/browserpass/package.nix
+++ b/pkgs/by-name/br/browserpass/package.nix
@@ -39,7 +39,7 @@ buildGoModule (finalAttrs: {
     sed -i -e 's/INSTALL =.*/INSTALL = install/' Makefile
   '';
 
-  DESTDIR = placeholder "out";
+  env.DESTDIR = placeholder "out";
 
   postConfigure = ''
     make configure
diff --git a/pkgs/by-name/br/bruno-cli/package.nix b/pkgs/by-name/br/bruno-cli/package.nix
index af0138114a91..455360f85785 100644
--- a/pkgs/by-name/br/bruno-cli/package.nix
+++ b/pkgs/by-name/br/bruno-cli/package.nix
@@ -42,7 +42,7 @@ buildNpmPackage {
     patchShebangs packages/*/node_modules
   '';
 
-  ELECTRON_SKIP_BINARY_DOWNLOAD = 1;
+  env.ELECTRON_SKIP_BINARY_DOWNLOAD = 1;
 
   buildPhase = ''
     runHook preBuild
diff --git a/pkgs/by-name/br/bruno/package.nix b/pkgs/by-name/br/bruno/package.nix
index a398b4b1ae4a..461f2882a82f 100644
--- a/pkgs/by-name/br/bruno/package.nix
+++ b/pkgs/by-name/br/bruno/package.nix
@@ -84,7 +84,7 @@ buildNpmPackage rec {
     patchShebangs packages/*/node_modules
   '';
 
-  ELECTRON_SKIP_BINARY_DOWNLOAD = 1;
+  env.ELECTRON_SKIP_BINARY_DOWNLOAD = 1;
 
   # remove giflib dependency
   npmRebuildFlags = [ "--ignore-scripts" ];
diff --git a/pkgs/by-name/bu/bupc/package.nix b/pkgs/by-name/bu/bupc/package.nix
index 0077d8ad9730..e25dbf1e111b 100644
--- a/pkgs/by-name/bu/bupc/package.nix
+++ b/pkgs/by-name/bu/bupc/package.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   # Used during the configure phase
-  ENVCMD = "${coreutils}/bin/env";
+  env.ENVCMD = "${coreutils}/bin/env";
 
   buildInputs = [ perl ];
 
diff --git a/pkgs/by-name/ca/caprine/package.nix b/pkgs/by-name/ca/caprine/package.nix
index ad6b054a84b1..18161241ebc4 100644
--- a/pkgs/by-name/ca/caprine/package.nix
+++ b/pkgs/by-name/ca/caprine/package.nix
@@ -20,7 +20,7 @@ buildNpmPackage rec {
     hash = "sha256-hBGsqOqKMHNy2SNw1kHCQq1lPDd2S36L5pdKgD2O8FA=";
   };
 
-  ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
 
   npmDepsHash = "sha256-FgOHuMMUX92VHF6hdznoi7bhO/27t6+l038kmpqjctQ=";
 
diff --git a/pkgs/by-name/ca/cargo-expand/package.nix b/pkgs/by-name/ca/cargo-expand/package.nix
index 17607da8aeb2..8e92fbdbe0f8 100644
--- a/pkgs/by-name/ca/cargo-expand/package.nix
+++ b/pkgs/by-name/ca/cargo-expand/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-expand";
-  version = "1.0.120";
+  version = "1.0.121";
 
   src = fetchFromGitHub {
     owner = "dtolnay";
     repo = "cargo-expand";
     tag = finalAttrs.version;
-    hash = "sha256-KXnAKv8202Trkkr9D9HRmxTOZ67M2Jt4dhZ9o7D86uI=";
+    hash = "sha256-Mwc1toL3kF+ZSmSwE24FRHXtIGHB0IVBiKtHGEpsn2E=";
   };
 
-  cargoHash = "sha256-eCDjGKLPy98SuknzzIE2GZEsxFjNZKuV30Y5nBQao3s=";
+  cargoHash = "sha256-F5g70cQYSiz63DD4uQTYIQ6I7Xf6fXL4ZwfDzOYpXzQ=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
diff --git a/pkgs/by-name/ca/cargo-hack/package.nix b/pkgs/by-name/ca/cargo-hack/package.nix
index 66aa21aa6bdd..2ef25d040f36 100644
--- a/pkgs/by-name/ca/cargo-hack/package.nix
+++ b/pkgs/by-name/ca/cargo-hack/package.nix
@@ -7,14 +7,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-hack";
-  version = "0.6.42";
+  version = "0.6.43";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-ebKnXTEWROIy4MREcBQ+ahbQoQZCSttiCMrgW+/buj4=";
+    hash = "sha256-5C2qqmP+k7WtvjEOPuhlcj2MbcOJJEMsAwmr928Uw4E=";
   };
 
-  cargoHash = "sha256-4Vg0JD2FeZV8SiD5Kzg1KLkPnQ20NVlkbiguwbpYip8=";
+  cargoHash = "sha256-sG+ltuEbptHeYgXAUIOlQ82f5z8MvKwHWHsU9aGC/K0=";
 
   # some necessary files are absent in the crate version
   doCheck = false;
diff --git a/pkgs/by-name/ca/cargo-llvm-cov/package.nix b/pkgs/by-name/ca/cargo-llvm-cov/package.nix
index 6c4f39d2aa91..18b8a9b3a699 100644
--- a/pkgs/by-name/ca/cargo-llvm-cov/package.nix
+++ b/pkgs/by-name/ca/cargo-llvm-cov/package.nix
@@ -57,10 +57,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     };
   };
 
-  # `cargo-llvm-cov` reads these environment variables to find these binaries,
-  # which are needed to run the tests
-  LLVM_COV = "${llvm}/bin/llvm-cov";
-  LLVM_PROFDATA = "${llvm}/bin/llvm-profdata";
+  env = {
+    # `cargo-llvm-cov` reads these environment variables to find these binaries,
+    # which are needed to run the tests
+    LLVM_COV = "${llvm}/bin/llvm-cov";
+    LLVM_PROFDATA = "${llvm}/bin/llvm-profdata";
+  };
 
   nativeCheckInputs = [
     gitMinimal
diff --git a/pkgs/by-name/cd/cdk8s-cli/package.nix b/pkgs/by-name/cd/cdk8s-cli/package.nix
index 165c044da9c7..9cec2ba1663e 100644
--- a/pkgs/by-name/cd/cdk8s-cli/package.nix
+++ b/pkgs/by-name/cd/cdk8s-cli/package.nix
@@ -12,18 +12,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cdk8s-cli";
-  version = "2.204.7";
+  version = "2.204.9";
 
   src = fetchFromGitHub {
     owner = "cdk8s-team";
     repo = "cdk8s-cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-+VY9vGGb/Fk2YhqDLDsdA/2jjKsiyGEOgaY+YNr0LCo=";
+    hash = "sha256-FV9/v8/UFrLtNPIZCh8No8A7n5oIzd9BlyjP1np8VZY=";
   };
 
   yarnOfflineCache = fetchYarnDeps {
     inherit (finalAttrs) src;
-    hash = "sha256-BFkXKEpK/iTaO7MnkqyTt0VX+yYbSy0y8eqrQb88JdM=";
+    hash = "sha256-4/1euuWSaZcRO2gwMj55g+m+K46D/bEd+yFJojGap5k=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/cd/cdktf-cli/package.nix b/pkgs/by-name/cd/cdktn-cli/package.nix
similarity index 72%
rename from pkgs/by-name/cd/cdktf-cli/package.nix
rename to pkgs/by-name/cd/cdktn-cli/package.nix
index 7d338e863da8..33b3856011d8 100644
--- a/pkgs/by-name/cd/cdktf-cli/package.nix
+++ b/pkgs/by-name/cd/cdktn-cli/package.nix
@@ -8,7 +8,7 @@
   fixup-yarn-lock,
   go,
   makeWrapper,
-  nodejs,
+  nodejs_20,
   nix-update-script,
   patchelf,
   removeReferencesTo,
@@ -18,26 +18,26 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  pname = "cdktf-cli";
-  version = "0.21.0";
+  pname = "cdktn-cli";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
-    owner = "hashicorp";
-    repo = "terraform-cdk";
+    owner = "open-constructs";
+    repo = "cdk-terrain";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-iqy8j1bqwjSRBOj8kjFtAq9dLiv6dDbJsiFGQUhGW7k=";
+    hash = "sha256-KgDRQ76ePLJEdULMCTJTouMaWu0SCeV4NwNW2WpoaNY=";
   };
 
   offlineCache = fetchYarnDeps {
     yarnLock = "${finalAttrs.src}/yarn.lock";
-    hash = "sha256-qGjzy/+u8Ui9aHK0sX3MfYbkj5Cqab4RlhOgrwbEmGs=";
+    hash = "sha256-0aOwRdfCTiQHmWzOk+ExLX+/EAryxheyILe7L7oyd4w=";
   };
 
   hcl2json-go-modules =
     (buildGoModule {
-      pname = "cdktf-hcl2json-go-modules";
+      pname = "cdktn-hcl2json-go-modules";
       inherit (finalAttrs) version src;
-      modRoot = "packages/@cdktf/hcl2json";
+      modRoot = "packages/@cdktn/hcl2json";
       vendorHash = "sha256-OiKPq0CHkOxJaFzgsaNJ02tasvHtHWylmaPRPayJob4=";
       proxyVendor = true;
       doCheck = false;
@@ -46,9 +46,9 @@ stdenv.mkDerivation (finalAttrs: {
 
   hcltools-go-modules =
     (buildGoModule {
-      pname = "cdktf-hcltools-go-modules";
+      pname = "cdktn-hcltools-go-modules";
       inherit (finalAttrs) version src;
-      modRoot = "packages/@cdktf/hcl-tools";
+      modRoot = "packages/@cdktn/hcl-tools";
       vendorHash = "sha256-orGxkYEQVtTKvXb7/FD/CLwqSINgBQFTF5arbR0xAvE=";
       proxyVendor = true;
       doCheck = false;
@@ -63,7 +63,7 @@ stdenv.mkDerivation (finalAttrs: {
     fixup-yarn-lock
     go
     makeWrapper
-    nodejs
+    nodejs_20
     patchelf
     removeReferencesTo
     yarn
@@ -71,9 +71,9 @@ stdenv.mkDerivation (finalAttrs: {
 
   postPatch = ''
     # wasm_exec has moved to lib in newer versions of Go
-    substituteInPlace packages/@cdktf/hcl-tools/prebuild.sh \
+    substituteInPlace packages/@cdktn/hcl-tools/prebuild.sh \
       --replace-fail "misc/wasm/wasm_exec.js" "lib/wasm/wasm_exec.js"
-    substituteInPlace packages/@cdktf/hcl2json/prebuild.sh \
+    substituteInPlace packages/@cdktn/hcl2json/prebuild.sh \
       --replace-fail "misc/wasm/wasm_exec.js" "lib/wasm/wasm_exec.js"
   '';
 
@@ -114,7 +114,7 @@ stdenv.mkDerivation (finalAttrs: {
     runHook preCheck
 
     # Skip tests that require terraform (unfree)
-    yarn --offline workspace cdktf-cli test -- \
+    yarn --offline workspace cdktn-cli test -- \
       --testPathIgnorePatterns \
        "src/test/cmds/(convert|init).test.ts"
 
@@ -126,11 +126,11 @@ stdenv.mkDerivation (finalAttrs: {
 
     yarn --offline --production install
 
-    mkdir -p "$out/lib/node_modules/cdktf-cli"
-    cp -rL node_modules packages/cdktf-cli/bundle packages/cdktf-cli/package.json "$out/lib/node_modules/cdktf-cli/"
+    mkdir -p "$out/lib/node_modules/cdktn-cli"
+    cp -rL node_modules packages/cdktn-cli/bundle packages/cdktn-cli/package.json "$out/lib/node_modules/cdktn-cli/"
 
-    makeWrapper "${lib.getExe nodejs}" "$out/bin/cdktf" \
-      --add-flags "$out/lib/node_modules/cdktf-cli/bundle/bin/cdktf.js"
+    makeWrapper "${lib.getExe nodejs_20}" "$out/bin/cdktn" \
+      --add-flags "$out/lib/node_modules/cdktn-cli/bundle/bin/cdktn.js"
 
     runHook postInstall
   '';
@@ -138,8 +138,8 @@ stdenv.mkDerivation (finalAttrs: {
   postInstall = ''
     # Go isn't needed at runtime, so remove these to decrease the closure size
     remove-references-to -t ${go} \
-      "$out/lib/node_modules/cdktf-cli/node_modules/@cdktf/hcl-tools/main.wasm" \
-      "$out/lib/node_modules/cdktf-cli/node_modules/@cdktf/hcl2json/main.wasm"
+      "$out/lib/node_modules/cdktn-cli/node_modules/@cdktn/hcl-tools/main.wasm" \
+      "$out/lib/node_modules/cdktn-cli/node_modules/@cdktn/hcl2json/main.wasm"
   '';
 
   nativeInstallCheckInputs = [
@@ -154,10 +154,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "CDK for Terraform CLI";
-    homepage = "https://github.com/hashicorp/terraform-cdk";
-    changelog = "https://github.com/hashicorp/terraform-cdk/releases/tag/${finalAttrs.src.tag}";
+    homepage = "https://cdktn.io";
+    changelog = "https://github.com/open-constructs/cdk-terrain/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mpl20;
-    mainProgram = "cdktf";
+    mainProgram = "cdktn";
     maintainers = with lib.maintainers; [ deejayem ];
     platforms = lib.platforms.unix;
   };
diff --git a/pkgs/by-name/ch/chatd/package.nix b/pkgs/by-name/ch/chatd/package.nix
index 70e5ba36afeb..5a7a52e44a68 100644
--- a/pkgs/by-name/ch/chatd/package.nix
+++ b/pkgs/by-name/ch/chatd/package.nix
@@ -24,7 +24,7 @@ buildNpmPackage rec {
   };
 
   makeCacheWritable = true; # sharp tries to build stuff in node_modules
-  ELECTRON_SKIP_BINARY_DOWNLOAD = true;
+  env.ELECTRON_SKIP_BINARY_DOWNLOAD = true;
 
   npmDepsHash = "sha256-jvGvhgNhY+wz/DFS7NDtmzKXbhHbNF3i0qVQoFFeB0M=";
 
diff --git a/pkgs/by-name/ch/checkov/package.nix b/pkgs/by-name/ch/checkov/package.nix
index 52351f1c8e3f..45ecb9a2fb3f 100644
--- a/pkgs/by-name/ch/checkov/package.nix
+++ b/pkgs/by-name/ch/checkov/package.nix
@@ -37,14 +37,14 @@ with py.pkgs;
 
 python3.pkgs.buildPythonApplication rec {
   pname = "checkov";
-  version = "3.2.501";
+  version = "3.2.504";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     tag = version;
-    hash = "sha256-kvUPhCuKWcklrrTnzbNWIg2Vqhv5dFP52+QkYas3kww=";
+    hash = "sha256-w6U8XW/hSPy/WJy4a6N41Hu+i9OVqiwI5buAE2uFjoI=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/by-name/ch/chipsec/package.nix b/pkgs/by-name/ch/chipsec/package.nix
index 945617e41e4b..bd9f6db867ff 100644
--- a/pkgs/by-name/ch/chipsec/package.nix
+++ b/pkgs/by-name/ch/chipsec/package.nix
@@ -25,7 +25,9 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     ./log-path.diff
   ];
 
-  KSRC = lib.optionalString withDriver "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
+  env = lib.optionalAttrs withDriver {
+    KSRC = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
+  };
 
   nativeBuildInputs = [
     nasm
diff --git a/pkgs/by-name/ch/chrysalis/package.nix b/pkgs/by-name/ch/chrysalis/package.nix
index 8b4c30b8e65e..323369883d9d 100644
--- a/pkgs/by-name/ch/chrysalis/package.nix
+++ b/pkgs/by-name/ch/chrysalis/package.nix
@@ -32,9 +32,9 @@ appimageTools.wrapType2 {
         -t $out/share/applications
     substituteInPlace \
         $out/share/applications/Chrysalis.desktop \
-        --replace-fail 'Exec=Chrysalis' 'Exec=${pname}'
+        --replace-fail 'Exec=Chrysalis' 'Exec=chrysalis'
 
-    install -Dm444 ${appimageContents}/usr/share/icons/hicolor/256x256/chrysalis.png -t $out/share/pixmaps
+    cp -r ${appimageContents}/usr/share $out/share
   '';
 
   passthru.updateScript = ./update.sh;
diff --git a/pkgs/by-name/ci/cider-2/package.nix b/pkgs/by-name/ci/cider-2/package.nix
index fef24e1b7101..88f6e1e16a4d 100644
--- a/pkgs/by-name/ci/cider-2/package.nix
+++ b/pkgs/by-name/ci/cider-2/package.nix
@@ -86,6 +86,8 @@ stdenv.mkDerivation rec {
 
     install -Dm444 $out/share/pixmaps/cider.png \
       $out/share/icons/hicolor/256x256/apps/cider.png
+
+    rm -r $out/share/pixmaps
   '';
 
   passthru.updateScript = ./updater.sh;
diff --git a/pkgs/by-name/ci/circt/package.nix b/pkgs/by-name/ci/circt/package.nix
index d28a4de75e5f..f855bf648c17 100644
--- a/pkgs/by-name/ci/circt/package.nix
+++ b/pkgs/by-name/ci/circt/package.nix
@@ -69,7 +69,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   # cannot use lib.optionalString as it creates an empty string, disabling all tests
-  LIT_FILTER_OUT =
+  env.LIT_FILTER_OUT =
     let
       lit-filters =
         # There are some tests depending on `clang-tools` to work. They are activated only when detected
diff --git a/pkgs/by-name/cl/clever-tools/package.nix b/pkgs/by-name/cl/clever-tools/package.nix
index 6e3f05f33c33..455cb1c2858d 100644
--- a/pkgs/by-name/cl/clever-tools/package.nix
+++ b/pkgs/by-name/cl/clever-tools/package.nix
@@ -11,7 +11,7 @@
 buildNpmPackage rec {
   pname = "clever-tools";
 
-  version = "4.5.3";
+  version = "4.6.0";
 
   nodejs = nodejs_22;
 
@@ -19,10 +19,10 @@ buildNpmPackage rec {
     owner = "CleverCloud";
     repo = "clever-tools";
     rev = version;
-    hash = "sha256-/PVVnTzRPy4AM3OEfTdrSrvdWfbPSrP/LoenzPA0d2Q=";
+    hash = "sha256-0c2SBArtMUffQ7hd2fH9l5DMGm+UIWNeY/aSU0cUHzg=";
   };
 
-  npmDepsHash = "sha256-i9cZI+P363EqODlnggqKT6XxoDYTNVrg5rTYNWWHm8A=";
+  npmDepsHash = "sha256-Quzpdmu9qvJ4P77nsXzqLg3k7tQvuYtvEioDuUSU0+M=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/cl/clfft/package.nix b/pkgs/by-name/cl/clfft/package.nix
index b3d55f41e5c0..be470ec69e6b 100644
--- a/pkgs/by-name/cl/clfft/package.nix
+++ b/pkgs/by-name/cl/clfft/package.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   # https://github.com/clMathLibraries/clFFT/issues/237
-  CXXFLAGS = "-std=c++98";
+  env.CXXFLAGS = "-std=c++98";
 
   meta = {
     description = "Library containing FFT functions written in OpenCL";
diff --git a/pkgs/by-name/cl/cljfmt/package.nix b/pkgs/by-name/cl/cljfmt/package.nix
index 6513a016ad04..a4f8361f2ea2 100644
--- a/pkgs/by-name/cl/cljfmt/package.nix
+++ b/pkgs/by-name/cl/cljfmt/package.nix
@@ -8,11 +8,11 @@
 
 buildGraalvmNativeImage (finalAttrs: {
   pname = "cljfmt";
-  version = "0.15.6";
+  version = "0.16.0";
 
   src = fetchurl {
     url = "https://github.com/weavejester/cljfmt/releases/download/${finalAttrs.version}/cljfmt-${finalAttrs.version}-standalone.jar";
-    hash = "sha256-/ihm/b/B9cSay2Zgshie7D0KwaKuIjiNI5FOnWOHfOw=";
+    hash = "sha256-56llKSnJJzjv9mf33ir7b3gk8Jp+jxyuax6vEXj0xDk=";
   };
 
   extraNativeImageBuildArgs = [
diff --git a/pkgs/by-name/cl/clmagma/package.nix b/pkgs/by-name/cl/clmagma/package.nix
index bfd23cb0bcb5..dbcbd91dc96f 100644
--- a/pkgs/by-name/cl/clmagma/package.nix
+++ b/pkgs/by-name/cl/clmagma/package.nix
@@ -60,12 +60,14 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  MKLROOT = "${mkl}";
-  clBLAS = "${clblas}";
+  env = {
+    MKLROOT = mkl;
+    clBLAS = clblas;
 
-  # Otherwise build looks for it in /run/opengl-driver/etc/OpenCL/vendors,
-  # which is not available.
-  OPENCL_VENDOR_PATH = "${intel-ocl}/etc/OpenCL/vendors";
+    # Otherwise build looks for it in /run/opengl-driver/etc/OpenCL/vendors,
+    # which is not available.
+    OPENCL_VENDOR_PATH = "${intel-ocl}/etc/OpenCL/vendors";
+  };
 
   preBuild = ''
     # By default it tries to use GPU, and thus fails for CPUs
diff --git a/pkgs/by-name/cl/clockify/package.nix b/pkgs/by-name/cl/clockify/package.nix
index d25c393bc3a0..133293f75f87 100644
--- a/pkgs/by-name/cl/clockify/package.nix
+++ b/pkgs/by-name/cl/clockify/package.nix
@@ -19,7 +19,7 @@ appimageTools.wrapType2 rec {
     in
     ''
       install -Dm 444 ${appimageContents}/clockify.desktop -t $out/share/applications
-      install -Dm 444 ${appimageContents}/clockify.png -t $out/share/pixmaps
+      install -Dm 444 ${appimageContents}/clockify.png -t $out/share/icons/hicolor/1024x1024/apps
 
       substituteInPlace $out/share/applications/clockify.desktop \
         --replace-fail 'Exec=AppRun' 'Exec=${pname}'
diff --git a/pkgs/by-name/co/coc-emmet/package.nix b/pkgs/by-name/co/coc-emmet/package.nix
index 7d2bd93c087d..40cac7149897 100644
--- a/pkgs/by-name/co/coc-emmet/package.nix
+++ b/pkgs/by-name/co/coc-emmet/package.nix
@@ -32,7 +32,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     nodejs
   ];
 
-  NODE_OPTIONS = "--openssl-legacy-provider";
+  env.NODE_OPTIONS = "--openssl-legacy-provider";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/co/coc-r-lsp/package.nix b/pkgs/by-name/co/coc-r-lsp/package.nix
index 5041dd5de652..da487906c18e 100644
--- a/pkgs/by-name/co/coc-r-lsp/package.nix
+++ b/pkgs/by-name/co/coc-r-lsp/package.nix
@@ -32,7 +32,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     nodejs
   ];
 
-  NODE_OPTIONS = "--openssl-legacy-provider";
+  env.NODE_OPTIONS = "--openssl-legacy-provider";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/co/coc-spell-checker/package.nix b/pkgs/by-name/co/coc-spell-checker/package.nix
index b02556e9f636..4b6be645132a 100644
--- a/pkgs/by-name/co/coc-spell-checker/package.nix
+++ b/pkgs/by-name/co/coc-spell-checker/package.nix
@@ -33,7 +33,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     nodejs
   ];
 
-  NODE_OPTIONS = "--openssl-legacy-provider";
+  env.NODE_OPTIONS = "--openssl-legacy-provider";
 
   passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
 
diff --git a/pkgs/by-name/co/coc-stylelint/package.nix b/pkgs/by-name/co/coc-stylelint/package.nix
index 40a12dbd98e4..482717d78380 100644
--- a/pkgs/by-name/co/coc-stylelint/package.nix
+++ b/pkgs/by-name/co/coc-stylelint/package.nix
@@ -38,7 +38,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     nodejs
   ];
 
-  NODE_OPTIONS = "--openssl-legacy-provider";
+  env.NODE_OPTIONS = "--openssl-legacy-provider";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/co/coc-vimlsp/package.nix b/pkgs/by-name/co/coc-vimlsp/package.nix
index 395441c17dea..f08f17be1d96 100644
--- a/pkgs/by-name/co/coc-vimlsp/package.nix
+++ b/pkgs/by-name/co/coc-vimlsp/package.nix
@@ -32,7 +32,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     nodejs
   ];
 
-  NODE_OPTIONS = "--openssl-legacy-provider";
+  env.NODE_OPTIONS = "--openssl-legacy-provider";
 
   passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
 
diff --git a/pkgs/by-name/co/coc-wxml/package.nix b/pkgs/by-name/co/coc-wxml/package.nix
index caf706f21679..5ec0005ef3df 100644
--- a/pkgs/by-name/co/coc-wxml/package.nix
+++ b/pkgs/by-name/co/coc-wxml/package.nix
@@ -38,7 +38,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     nodejs
   ];
 
-  NODE_OPTIONS = "--openssl-legacy-provider";
+  env.NODE_OPTIONS = "--openssl-legacy-provider";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/cr/cryptopp/package.nix b/pkgs/by-name/cr/cryptopp/package.nix
index a57949bea97c..bcc57aa3972a 100644
--- a/pkgs/by-name/cr/cryptopp/package.nix
+++ b/pkgs/by-name/cr/cryptopp/package.nix
@@ -42,7 +42,10 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
   hardeningDisable = [ "fortify" ];
-  CXXFLAGS = lib.optionals withOpenMP [ "-fopenmp" ];
+
+  env = lib.optionalAttrs withOpenMP {
+    CXXFLAGS = "-fopenmp";
+  };
 
   doCheck = true;
 
diff --git a/pkgs/by-name/cs/csmith/package.nix b/pkgs/by-name/cs/csmith/package.nix
index 261f5bf1bbf0..80830a36167a 100644
--- a/pkgs/by-name/cs/csmith/package.nix
+++ b/pkgs/by-name/cs/csmith/package.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     SysCPU
   ]);
 
-  CXXFLAGS = "-std=c++98";
+  env.CXXFLAGS = "-std=c++98";
 
   postInstall = ''
     substituteInPlace $out/bin/compiler_test.pl \
diff --git a/pkgs/by-name/cu/curlMinimal/package.nix b/pkgs/by-name/cu/curlMinimal/package.nix
index ca46d135e389..422f2ff3a7bf 100644
--- a/pkgs/by-name/cu/curlMinimal/package.nix
+++ b/pkgs/by-name/cu/curlMinimal/package.nix
@@ -119,7 +119,11 @@ stdenv.mkDerivation (finalAttrs: {
 
   strictDeps = true;
 
-  env = lib.optionalAttrs (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isStatic) {
+  env = {
+    CXX = "${stdenv.cc.targetPrefix}c++";
+    CXXCPP = "${stdenv.cc.targetPrefix}c++ -E";
+  }
+  // lib.optionalAttrs (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isStatic) {
     # Not having this causes curl’s `configure` script to fail with static builds on Darwin because
     # some of curl’s propagated inputs need libiconv.
     NIX_LDFLAGS = "-liconv";
@@ -209,9 +213,6 @@ stdenv.mkDerivation (finalAttrs: {
     "--with-ca-path=/etc/ssl/certs"
   ];
 
-  CXX = "${stdenv.cc.targetPrefix}c++";
-  CXXCPP = "${stdenv.cc.targetPrefix}c++ -E";
-
   # takes 14 minutes on a 24 core and because many other packages depend on curl
   # they cannot be run concurrently and are a bottleneck
   # tests are available in passthru.tests.withCheck
diff --git a/pkgs/by-name/da/darling-dmg/package.nix b/pkgs/by-name/da/darling-dmg/package.nix
index 3a71869edd4b..9f5654adea22 100644
--- a/pkgs/by-name/da/darling-dmg/package.nix
+++ b/pkgs/by-name/da/darling-dmg/package.nix
@@ -47,7 +47,7 @@ stdenv.mkDerivation {
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [ libiconv ];
 
-  CXXFLAGS = [
+  env.CXXFLAGS = toString [
     "-DCOMPILE_WITH_LZFSE=1"
     "-llzfse"
   ];
diff --git a/pkgs/by-name/di/diffuse/package.nix b/pkgs/by-name/di/diffuse/package.nix
index 8b5bf717ac97..d241ed6d1cf0 100644
--- a/pkgs/by-name/di/diffuse/package.nix
+++ b/pkgs/by-name/di/diffuse/package.nix
@@ -58,7 +58,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
   ];
 
   # to avoid running gtk-update-icon-cache, update-desktop-database and glib-compile-schemas
-  DESTDIR = "/";
+  env.DESTDIR = "/";
 
   makeWrapperArgs = [
     "--prefix XDG_DATA_DIRS : ${hicolor-icon-theme}/share"
diff --git a/pkgs/by-name/dn/dnspeep/package.nix b/pkgs/by-name/dn/dnspeep/package.nix
index bbdb1a80aecf..a7767de99e47 100644
--- a/pkgs/by-name/dn/dnspeep/package.nix
+++ b/pkgs/by-name/dn/dnspeep/package.nix
@@ -18,8 +18,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoHash = "sha256-tZlh7+END6oOy3uWOrjle+nwqFhMU6bbXmr4hdt6gqY=";
 
-  LIBPCAP_LIBDIR = lib.makeLibraryPath [ libpcap ];
-  LIBPCAP_VER = libpcap.version;
+  env = {
+    LIBPCAP_LIBDIR = lib.makeLibraryPath [ libpcap ];
+    LIBPCAP_VER = libpcap.version;
+  };
 
   meta = {
     description = "Spy on the DNS queries your computer is making";
diff --git a/pkgs/by-name/do/docbook2x/package.nix b/pkgs/by-name/do/docbook2x/package.nix
index fbbe6e3daeb2..3413918f9499 100644
--- a/pkgs/by-name/do/docbook2x/package.nix
+++ b/pkgs/by-name/do/docbook2x/package.nix
@@ -54,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
   # configure tries to find osx in PATH and hardcodes the resulting path
   # (if any) on the Perl code. this fails under strictDeps, so override
   # the autoconf test:
-  OSX = "${opensp}/bin/osx";
+  env.OSX = "${opensp}/bin/osx";
 
   postConfigure = ''
     # Broken substitution is used for `perl/config.pl', which leaves literal
diff --git a/pkgs/by-name/do/dotnet-outdated/package.nix b/pkgs/by-name/do/dotnet-outdated/package.nix
index 254f59463939..738696dbaf2b 100644
--- a/pkgs/by-name/do/dotnet-outdated/package.nix
+++ b/pkgs/by-name/do/dotnet-outdated/package.nix
@@ -6,11 +6,11 @@
 buildDotnetGlobalTool rec {
   pname = "dotnet-outdated";
   nugetName = "dotnet-outdated-tool";
-  version = "4.6.9";
+  version = "4.7.0";
 
   dotnet-sdk = dotnetCorePackages.sdk_10_0;
 
-  nugetHash = "sha256-LVe/b18hxM9A0Kni6Kl4sE38KgzIihDuc+xRw8qaKv0=";
+  nugetHash = "sha256-96tYVEN6sWw2H5xB6UaDUO7EtOn839Nfagamxf8bLvA=";
 
   meta = {
     description = ".NET Core global tool to display and update outdated NuGet packages in a project";
diff --git a/pkgs/by-name/dr/draco/package.nix b/pkgs/by-name/dr/draco/package.nix
index 24352556e86a..d17e8e471f63 100644
--- a/pkgs/by-name/dr/draco/package.nix
+++ b/pkgs/by-name/dr/draco/package.nix
@@ -61,9 +61,10 @@ stdenv.mkDerivation (finalAttrs: {
     "-DDRACO_TINYGLTF_PATH=${tinygltf}"
   ];
 
-  CXXFLAGS = [
+  env.CXXFLAGS = toString [
     # error: expected ')' before 'value' in 'explicit GltfValue(uint8_t value)'
-    "-include cstdint"
+    "-include"
+    "cstdint"
   ];
 
   passthru.updateScript = nix-update-script { };
diff --git a/pkgs/by-name/dr/drawio/package.nix b/pkgs/by-name/dr/drawio/package.nix
index f34850f7c99b..a86bddff9fff 100644
--- a/pkgs/by-name/dr/drawio/package.nix
+++ b/pkgs/by-name/dr/drawio/package.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
     darwin.autoSignDarwinBinariesHook
   ];
 
-  ELECTRON_SKIP_BINARY_DOWNLOAD = true;
+  env.ELECTRON_SKIP_BINARY_DOWNLOAD = true;
 
   configurePhase = ''
     runHook preConfigure
diff --git a/pkgs/by-name/dr/drill/package.nix b/pkgs/by-name/dr/drill/package.nix
index 1e88a744405b..2d06e6cf7905 100644
--- a/pkgs/by-name/dr/drill/package.nix
+++ b/pkgs/by-name/dr/drill/package.nix
@@ -24,8 +24,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     pkg-config
   ];
 
-  OPENSSL_LIB_DIR = "${lib.getLib openssl}/lib";
-  OPENSSL_DIR = "${lib.getDev openssl}";
+  env = {
+    OPENSSL_LIB_DIR = "${lib.getLib openssl}/lib";
+    OPENSSL_DIR = "${lib.getDev openssl}";
+  };
 
   buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
     openssl
diff --git a/pkgs/by-name/dw/dwarfs/package.nix b/pkgs/by-name/dw/dwarfs/package.nix
index 8669f2eb3dde..c0d7424775f1 100644
--- a/pkgs/by-name/dw/dwarfs/package.nix
+++ b/pkgs/by-name/dw/dwarfs/package.nix
@@ -100,7 +100,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
   # these fail inside of the sandbox due to missing access
   # to the FUSE device
-  GTEST_FILTER =
+  env.GTEST_FILTER =
     let
       disabledTests = [
         "dwarfs/tools_test.end_to_end/*"
diff --git a/pkgs/by-name/ea/eask-cli/package.nix b/pkgs/by-name/ea/eask-cli/package.nix
index d94b62a9fe4f..7b54749c6880 100644
--- a/pkgs/by-name/ea/eask-cli/package.nix
+++ b/pkgs/by-name/ea/eask-cli/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "eask-cli";
-  version = "0.12.5";
+  version = "0.12.8";
 
   src = fetchFromGitHub {
     owner = "emacs-eask";
     repo = "cli";
     rev = version;
-    hash = "sha256-GYpFbCEgS9GgZs/XC3NwA8GuCiovaUTL1bVqlsnyFKI=";
+    hash = "sha256-eH46NlHQs+OVbc3WVUKHQGgXi9rvFMTrbd3UB8WCB6k=";
   };
 
-  npmDepsHash = "sha256-712QW0tTKg7THsBzvEHcG97FBMw3ESzpoqdw0kv3mMU=";
+  npmDepsHash = "sha256-U/VKtefL31FNYUegt8+Qg2jM6fx4cX660UcNqGsWMOc=";
 
   dontBuild = true;
 
diff --git a/pkgs/by-name/ec/ecasound/package.nix b/pkgs/by-name/ec/ecasound/package.nix
index b643c8aa7fe5..395c103a6a3c 100644
--- a/pkgs/by-name/ec/ecasound/package.nix
+++ b/pkgs/by-name/ec/ecasound/package.nix
@@ -61,7 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   strictDeps = true;
 
-  CXXFLAGS = "-std=c++11";
+  env.CXXFLAGS = "-std=c++11";
   configureFlags = [
     "--enable-liblilv"
     "--with-extra-cppflags=-Dnullptr=0"
diff --git a/pkgs/by-name/ed/edk2/package.nix b/pkgs/by-name/ed/edk2/package.nix
index 19c0aabd0642..e4ded1dfd220 100644
--- a/pkgs/by-name/ed/edk2/package.nix
+++ b/pkgs/by-name/ed/edk2/package.nix
@@ -169,7 +169,7 @@ stdenv.mkDerivation (finalAttrs: {
           ++ attrs.nativeBuildInputs or [ ];
           strictDeps = true;
 
-          ${"GCC5_${targetArch}_PREFIX"} = stdenv.cc.targetPrefix;
+          env.${"GCC5_${targetArch}_PREFIX"} = stdenv.cc.targetPrefix;
 
           prePatch = ''
             rm -rf BaseTools
diff --git a/pkgs/by-name/ek/ekho/package.nix b/pkgs/by-name/ek/ekho/package.nix
index f99ac8376ef9..93a928c216ce 100644
--- a/pkgs/by-name/ek/ekho/package.nix
+++ b/pkgs/by-name/ek/ekho/package.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
     ./autogen.sh
   '';
 
-  CXXFLAGS = [
+  env.CXXFLAGS = toString [
     "-O0"
     "-I${lib.getDev utf8cpp}/include/utf8cpp"
   ];
diff --git a/pkgs/by-name/en/ente-auth/package.nix b/pkgs/by-name/en/ente-auth/package.nix
index da702d2a11eb..13a9da94e9c6 100644
--- a/pkgs/by-name/en/ente-auth/package.nix
+++ b/pkgs/by-name/en/ente-auth/package.nix
@@ -61,7 +61,7 @@ flutter332.buildFlutterApplication rec {
   ];
 
   # https://github.com/juliansteenbakker/flutter_secure_storage/issues/965
-  CXXFLAGS = [ "-Wno-deprecated-literal-operator" ];
+  env.CXXFLAGS = toString [ "-Wno-deprecated-literal-operator" ];
 
   # Based on https://github.com/ente-io/ente/blob/main/auth/linux/packaging/rpm/make_config.yaml
   # and https://github.com/ente-io/ente/blob/main/auth/linux/packaging/enteauth.appdata.xml
diff --git a/pkgs/by-name/er/ergogen/package.nix b/pkgs/by-name/er/ergogen/package.nix
index 2dfc6400de20..169ac57f788e 100644
--- a/pkgs/by-name/er/ergogen/package.nix
+++ b/pkgs/by-name/er/ergogen/package.nix
@@ -24,7 +24,8 @@ buildNpmPackage (finalAttrs: {
   makeCacheWritable = true;
   dontNpmBuild = true;
   npmPackFlags = [ "--ignore-scripts" ];
-  NODE_OPTIONS = "--openssl-legacy-provider";
+
+  env.NODE_OPTIONS = "--openssl-legacy-provider";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
diff --git a/pkgs/by-name/er/ergoscf/package.nix b/pkgs/by-name/er/ergoscf/package.nix
index 322f6915cae3..de4d74093589 100644
--- a/pkgs/by-name/er/ergoscf/package.nix
+++ b/pkgs/by-name/er/ergoscf/package.nix
@@ -35,13 +35,15 @@ stdenv.mkDerivation (finalAttrs: {
   env = {
     # Required for compilation with gcc-14
     NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
-    LDFLAGS = "-lblas -llapack";
+    LDFLAGS = toString [
+      "-lblas"
+      "-llapack"
+    ];
+    OMP_NUM_THREADS = 2; # required for check phase
   };
 
   enableParallelBuilding = true;
 
-  OMP_NUM_THREADS = 2; # required for check phase
-
   # With "fortify3", there are test failures, such as:
   # Testing cnof CAMB3LYP/6-31G using FMM
   # *** buffer overflow detected ***: terminated
diff --git a/pkgs/by-name/et/eternal-terminal/package.nix b/pkgs/by-name/et/eternal-terminal/package.nix
index 98d93face05c..cfcc629d5e26 100644
--- a/pkgs/by-name/et/eternal-terminal/package.nix
+++ b/pkgs/by-name/et/eternal-terminal/package.nix
@@ -45,9 +45,9 @@ stdenv.mkDerivation (finalAttrs: {
     "-DDISABLE_CRASH_LOG=TRUE"
   ];
 
-  CXXFLAGS = lib.optionals stdenv.cc.isClang [
-    "-std=c++17"
-  ];
+  env = lib.optionalAttrs stdenv.cc.isClang {
+    CXXFLAGS = toString [ "-std=c++17" ];
+  };
 
   doCheck = true;
 
diff --git a/pkgs/by-name/ev/evcc/package.nix b/pkgs/by-name/ev/evcc/package.nix
index 8380018141d9..b6372cd0a171 100644
--- a/pkgs/by-name/ev/evcc/package.nix
+++ b/pkgs/by-name/ev/evcc/package.nix
@@ -1,12 +1,12 @@
 {
   lib,
   stdenv,
-  buildGo125Module,
+  buildGo126Module,
   fetchFromGitHub,
   fetchNpmDeps,
   cacert,
   git,
-  go_1_25,
+  go_1_26,
   gokrazy,
   enumer,
   mockgen,
@@ -17,23 +17,23 @@
 }:
 
 let
-  version = "0.300.8";
+  version = "0.301.0";
 
   src = fetchFromGitHub {
     owner = "evcc-io";
     repo = "evcc";
     tag = version;
-    hash = "sha256-IbyE9Y9crdoaPy1/PkKaA1iOAUFOf2cYzoB9Cj3luSo=";
+    hash = "sha256-ns6Kl0sN8GeF0Br7HrRLdVmKaGMqT3Y5REuH9UJg+Yg=";
   };
 
-  vendorHash = "sha256-j+tmZeVUqUpETIg8ILlxRRdN5/OV8pYmgH2FM1uweAY=";
+  vendorHash = "sha256-LGTT7WxBlWA4pCunvFDpsqDkUhTN96PohBKTLAffr0o=";
 
   commonMeta = {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ hexa ];
   };
 
-  decorate = buildGo125Module {
+  decorate = buildGo126Module {
     pname = "evcc-decorate";
     inherit version src vendorHash;
 
@@ -46,13 +46,13 @@ let
   };
 in
 
-buildGo125Module rec {
+buildGo126Module rec {
   pname = "evcc";
   inherit version src vendorHash;
 
   npmDeps = fetchNpmDeps {
     inherit src;
-    hash = "sha256-DGDPbc/N+c3lt1rIx/nAt1i44J//egPQXGWH7tomJTw=";
+    hash = "sha256-fblf49V+fn+9iuIwwOZ/iYMxUbjtWcm3iEs9mP9l59I=";
   };
 
   nativeBuildInputs = [
@@ -64,7 +64,7 @@ buildGo125Module rec {
     nativeBuildInputs = [
       decorate
       enumer
-      go_1_25
+      go_1_26
       gokrazy
       git
       cacert
diff --git a/pkgs/by-name/ev/eventstore/package.nix b/pkgs/by-name/ev/eventstore/package.nix
index fd730c0fd77c..51452be3c28b 100644
--- a/pkgs/by-name/ev/eventstore/package.nix
+++ b/pkgs/by-name/ev/eventstore/package.nix
@@ -27,7 +27,7 @@ buildDotnetModule rec {
   };
 
   # Fixes application reporting 0.0.0.0 as its version.
-  MINVERVERSIONOVERRIDE = version;
+  env.MINVERVERSIONOVERRIDE = version;
 
   dotnet-sdk = dotnetCorePackages.sdk_8_0;
   dotnet-runtime = dotnetCorePackages.aspnetcore_8_0;
diff --git a/pkgs/by-name/fi/fig2dev/package.nix b/pkgs/by-name/fi/fig2dev/package.nix
index 73444a95bd14..a42db77a1cda 100644
--- a/pkgs/by-name/fi/fig2dev/package.nix
+++ b/pkgs/by-name/fi/fig2dev/package.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ libpng ];
 
-  GSEXE = "${ghostscript}/bin/gs";
+  env.GSEXE = "${ghostscript}/bin/gs";
 
   configureFlags = [ "--enable-transfig" ];
 
diff --git a/pkgs/by-name/fi/firefoxpwa/package.nix b/pkgs/by-name/fi/firefoxpwa/package.nix
index 57f7b0a7fc5c..3f6c43bc42e4 100644
--- a/pkgs/by-name/fi/firefoxpwa/package.nix
+++ b/pkgs/by-name/fi/firefoxpwa/package.nix
@@ -56,8 +56,10 @@ rustPlatform.buildRustPackage rec {
   ];
   buildInputs = [ openssl ];
 
-  FFPWA_EXECUTABLES = ""; # .desktop entries generated without any store path references
-  FFPWA_SYSDATA = "${placeholder "out"}/share/firefoxpwa";
+  env = {
+    FFPWA_EXECUTABLES = ""; # .desktop entries generated without any store path references
+    FFPWA_SYSDATA = "${placeholder "out"}/share/firefoxpwa";
+  };
   completions = "target/${stdenv.targetPlatform.config}/release/completions";
 
   gtk_modules = map (x: x + x.gtkModule) [ libcanberra-gtk3 ];
diff --git a/pkgs/by-name/fl/floorp-bin-unwrapped/sources.json b/pkgs/by-name/fl/floorp-bin-unwrapped/sources.json
index a29f47c045be..a3f3a55e1472 100644
--- a/pkgs/by-name/fl/floorp-bin-unwrapped/sources.json
+++ b/pkgs/by-name/fl/floorp-bin-unwrapped/sources.json
@@ -1,21 +1,21 @@
 {
-  "version": "12.10.3",
+  "version": "12.10.4",
   "sources": {
     "aarch64-linux": {
-      "url": "https://github.com/Floorp-Projects/Floorp/releases/download/v12.10.3/floorp-linux-aarch64.tar.xz",
-      "sha256": "b2f62db7941f819375a9f8627bd55442c30310e93cb270621fdf9e5c707801e3"
+      "url": "https://github.com/Floorp-Projects/Floorp/releases/download/v12.10.4/floorp-linux-aarch64.tar.xz",
+      "sha256": "6fb5030be0209744dd9aac0fa5645c45a21d135d4e487836a300359a695327e5"
     },
     "x86_64-linux": {
-      "url": "https://github.com/Floorp-Projects/Floorp/releases/download/v12.10.3/floorp-linux-x86_64.tar.xz",
-      "sha256": "fb866cd00da594c5c6435238e32ac2c13eaca40ead4936656aee88ea3446983f"
+      "url": "https://github.com/Floorp-Projects/Floorp/releases/download/v12.10.4/floorp-linux-x86_64.tar.xz",
+      "sha256": "1cc457b0b23d29d863749a9a4f000b47fa480aa0579774bb39eff5978160df21"
     },
     "aarch64-darwin": {
-      "url": "https://github.com/Floorp-Projects/Floorp/releases/download/v12.10.3/floorp-macOS-universal.dmg",
-      "sha256": "56477ebaae97aee37c0a93294f8770ae901bf2e35d2be03540daf0a779db6dae"
+      "url": "https://github.com/Floorp-Projects/Floorp/releases/download/v12.10.4/floorp-macOS-universal.dmg",
+      "sha256": "1fa4e85c9aa58d989f0aa01389c0b3a5f231ad08485606427498777daba81398"
     },
     "x86_64-darwin": {
-      "url": "https://github.com/Floorp-Projects/Floorp/releases/download/v12.10.3/floorp-macOS-universal.dmg",
-      "sha256": "56477ebaae97aee37c0a93294f8770ae901bf2e35d2be03540daf0a779db6dae"
+      "url": "https://github.com/Floorp-Projects/Floorp/releases/download/v12.10.4/floorp-macOS-universal.dmg",
+      "sha256": "1fa4e85c9aa58d989f0aa01389c0b3a5f231ad08485606427498777daba81398"
     }
   }
 }
diff --git a/pkgs/by-name/fo/fortune-kind/package.nix b/pkgs/by-name/fo/fortune-kind/package.nix
index 4b5c28281cf2..86a8b7b5508c 100644
--- a/pkgs/by-name/fo/fortune-kind/package.nix
+++ b/pkgs/by-name/fo/fortune-kind/package.nix
@@ -32,7 +32,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   buildNoDefaultFeatures = true;
 
-  MAN_OUT = "./man";
+  env.MAN_OUT = "./man";
 
   preBuild = ''
     mkdir -p "./$MAN_OUT";
diff --git a/pkgs/by-name/fr/freeswitch/package.nix b/pkgs/by-name/fr/freeswitch/package.nix
index 1b43feeca048..c80de735f401 100644
--- a/pkgs/by-name/fr/freeswitch/package.nix
+++ b/pkgs/by-name/fr/freeswitch/package.nix
@@ -159,17 +159,19 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
-  env.NIX_CFLAGS_COMPILE = toString [
-    "-Wno-error"
-    # https://github.com/signalwire/freeswitch/issues/2495
-    "-Wno-incompatible-pointer-types"
-  ];
+  env = {
+    NIX_CFLAGS_COMPILE = toString [
+      "-Wno-error"
+      # https://github.com/signalwire/freeswitch/issues/2495
+      "-Wno-incompatible-pointer-types"
+    ];
 
-  # Using c++14 because of build error
-  # gsm_at.h:94:32: error: ISO C++17 does not allow dynamic exception specifications
-  CXXFLAGS = "-std=c++14";
+    # Using c++14 because of build error
+    # gsm_at.h:94:32: error: ISO C++17 does not allow dynamic exception specifications
+    CXXFLAGS = "-std=c++14";
 
-  CFLAGS = "-D_ANSI_SOURCE";
+    CFLAGS = "-D_ANSI_SOURCE";
+  };
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/by-name/fr/frr/package.nix b/pkgs/by-name/fr/frr/package.nix
index fd0dc3eebf34..ef3a202c00c6 100644
--- a/pkgs/by-name/fr/frr/package.nix
+++ b/pkgs/by-name/fr/frr/package.nix
@@ -91,7 +91,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   # Without the std explicitly set, we may run into abseil-cpp
   # compilation errors.
-  CXXFLAGS = "-std=gnu++23";
+  env.CXXFLAGS = "-std=gnu++23";
 
   nativeBuildInputs = [
     autoreconfHook
diff --git a/pkgs/by-name/gh/ghciwatch/package.nix b/pkgs/by-name/gh/ghciwatch/package.nix
index 55c66944929a..9fe7f3455ac3 100644
--- a/pkgs/by-name/gh/ghciwatch/package.nix
+++ b/pkgs/by-name/gh/ghciwatch/package.nix
@@ -19,7 +19,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   cargoHash = "sha256-kH5YTadpaUXDma+7SfBJxrOIsd9Gm0EU3MfhFmQ3U80=";
 
   # integration tests are not run but the macros need this variable to be set
-  GHC_VERSIONS = "";
+  env.GHC_VERSIONS = "";
   checkFlags = "--test \"unit\"";
 
   meta = {
diff --git a/pkgs/by-name/gh/ghdl/package.nix b/pkgs/by-name/gh/ghdl/package.nix
index 90f62294bad8..3d9943397e0b 100644
--- a/pkgs/by-name/gh/ghdl/package.nix
+++ b/pkgs/by-name/gh/ghdl/package.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-vPeODNTptxIjN6qLoIHaKOFf3P3iAK2GloVreHPaAz8=";
   };
 
-  LIBRARY_PATH = "${stdenv.cc.libc}/lib";
+  env.LIBRARY_PATH = "${stdenv.cc.libc}/lib";
 
   nativeBuildInputs = [
     gnat
diff --git a/pkgs/by-name/gi/git-crypt/package.nix b/pkgs/by-name/gi/git-crypt/package.nix
index 46ff7e4602d2..aeb5635f37a4 100644
--- a/pkgs/by-name/gi/git-crypt/package.nix
+++ b/pkgs/by-name/gi/git-crypt/package.nix
@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   # https://github.com/AGWA/git-crypt/issues/232
-  CXXFLAGS = [
+  env.CXXFLAGS = toString [
     "-DOPENSSL_API_COMPAT=0x30000000L"
   ];
 
diff --git a/pkgs/by-name/gi/github-runner/package.nix b/pkgs/by-name/gi/github-runner/package.nix
index bba388654e88..710f952a5223 100644
--- a/pkgs/by-name/gi/github-runner/package.nix
+++ b/pkgs/by-name/gi/github-runner/package.nix
@@ -103,10 +103,12 @@ buildDotnetModule (finalAttrs: {
                      'true'
   '';
 
-  DOTNET_SYSTEM_GLOBALIZATION_INVARIANT = isNull glibcLocales;
-  LOCALE_ARCHIVE = lib.optionalString (
-    !finalAttrs.DOTNET_SYSTEM_GLOBALIZATION_INVARIANT
-  ) "${glibcLocales}/lib/locale/locale-archive";
+  env = {
+    DOTNET_SYSTEM_GLOBALIZATION_INVARIANT = isNull glibcLocales;
+  }
+  // lib.optionalAttrs (!isNull glibcLocales) {
+    LOCALE_ARCHIVE = "${glibcLocales}/lib/locale/locale-archive";
+  };
 
   postConfigure = ''
     # Generate src/Runner.Sdk/BuildConstants.cs
@@ -220,7 +222,7 @@ buildDotnetModule (finalAttrs: {
     "GitHub.Runner.Common.Tests.Worker.StepHostL0.DetermineNode20RuntimeVersionInAlpineContainerAsync"
     "GitHub.Runner.Common.Tests.Worker.StepHostL0.DetermineNode24RuntimeVersionInAlpineContainerAsync"
   ]
-  ++ lib.optionals finalAttrs.DOTNET_SYSTEM_GLOBALIZATION_INVARIANT [
+  ++ lib.optionals finalAttrs.env.DOTNET_SYSTEM_GLOBALIZATION_INVARIANT [
     "GitHub.Runner.Common.Tests.Util.StringUtilL0.FormatUsesInvariantCulture"
     "GitHub.Runner.Common.Tests.Worker.VariablesL0.Constructor_SetsOrdinalIgnoreCaseComparer"
     "GitHub.Runner.Common.Tests.Worker.WorkerL0.DispatchCancellation"
diff --git a/pkgs/by-name/gi/gitlab/package.nix b/pkgs/by-name/gi/gitlab/package.nix
index a244ea5474d0..2e0616ee636b 100644
--- a/pkgs/by-name/gi/gitlab/package.nix
+++ b/pkgs/by-name/gi/gitlab/package.nix
@@ -228,14 +228,16 @@ let
       chmod 777 ee/frontend_islands/yarn.lock
     '';
 
-    # One of the patches uses this variable - if it's unset, execution
-    # of rake tasks fails.
-    GITLAB_LOG_PATH = "log";
-    FOSS_ONLY = !gitlabEnterprise;
-    SKIP_FRONTEND_ISLANDS_BUILD = lib.optionalString (!gitlabEnterprise) "true";
+    env = {
+      # One of the patches uses this variable - if it's unset, execution
+      # of rake tasks fails.
+      GITLAB_LOG_PATH = "log";
+      FOSS_ONLY = !gitlabEnterprise;
+      SKIP_FRONTEND_ISLANDS_BUILD = lib.optionalString (!gitlabEnterprise) "true";
 
-    SKIP_YARN_INSTALL = 1;
-    NODE_OPTIONS = "--max-old-space-size=8192";
+      SKIP_YARN_INSTALL = 1;
+      NODE_OPTIONS = "--max-old-space-size=8192";
+    };
 
     postConfigure = ''
       # Some rake tasks try to run yarn automatically, which won't work
diff --git a/pkgs/by-name/gl/glib/package.nix b/pkgs/by-name/gl/glib/package.nix
index 430755541a16..c9f8ba26d34b 100644
--- a/pkgs/by-name/gl/glib/package.nix
+++ b/pkgs/by-name/gl/glib/package.nix
@@ -252,6 +252,7 @@ stdenv.mkDerivation (finalAttrs: {
       # we're using plain
       "-DG_DISABLE_CAST_CHECKS"
     ];
+    DETERMINISTIC_BUILD = 1;
   };
 
   postPatch = ''
@@ -280,8 +281,6 @@ stdenv.mkDerivation (finalAttrs: {
     patchShebangs gio/gdbus-2.0/codegen/gdbus-codegen gobject/glib-{genmarshal,mkenums}
   '';
 
-  DETERMINISTIC_BUILD = 1;
-
   postInstall = ''
     moveToOutput "share/glib-2.0" "$dev"
     moveToOutput "share/glib-2.0/gdb" "$out"
diff --git a/pkgs/by-name/gl/global-platform-pro/package.nix b/pkgs/by-name/gl/global-platform-pro/package.nix
index 1bc0cc605163..a89e1057c104 100644
--- a/pkgs/by-name/gl/global-platform-pro/package.nix
+++ b/pkgs/by-name/gl/global-platform-pro/package.nix
@@ -26,7 +26,7 @@ in
 maven.buildMavenPackage rec {
   pname = "global-platform-pro";
   version = "25.10.20";
-  GPPRO_VERSION = "v25.10.20-0-g72f85b9"; # git describe --tags --always --long --dirty
+  env.GPPRO_VERSION = "v25.10.20-0-g72f85b9"; # git describe --tags --always --long --dirty
 
   src = fetchFromGitHub {
     owner = "martinpaljak";
diff --git a/pkgs/by-name/go/golem/package.nix b/pkgs/by-name/go/golem/package.nix
index 527d1d69ea48..0ba5fff942db 100644
--- a/pkgs/by-name/go/golem/package.nix
+++ b/pkgs/by-name/go/golem/package.nix
@@ -43,12 +43,14 @@ rustPlatform.buildRustPackage rec {
     (lib.getDev openssl)
   ];
 
-  # Required for golem-wasm-rpc's build.rs to find the required protobuf files
-  # https://github.com/golemcloud/wasm-rpc/blob/v1.0.6/wasm-rpc/build.rs#L7
-  GOLEM_WASM_AST_ROOT = "../golem-wasm-ast-1.1.0";
-  # Required for golem-examples's build.rs to find the required Wasm Interface Type (WIT) files
-  # https://github.com/golemcloud/golem-examples/blob/v1.0.6/build.rs#L9
-  GOLEM_WIT_ROOT = "../golem-wit-1.1.0";
+  env = {
+    # Required for golem-wasm-rpc's build.rs to find the required protobuf files
+    # https://github.com/golemcloud/wasm-rpc/blob/v1.0.6/wasm-rpc/build.rs#L7
+    GOLEM_WASM_AST_ROOT = "../golem-wasm-ast-1.1.0";
+    # Required for golem-examples's build.rs to find the required Wasm Interface Type (WIT) files
+    # https://github.com/golemcloud/golem-examples/blob/v1.0.6/build.rs#L9
+    GOLEM_WIT_ROOT = "../golem-wit-1.1.0";
+  };
 
   cargoHash = "sha256-zf/L7aNsfQXCdGpzvBZxgoatAGB92bvIuj59jANrXIc=";
 
diff --git a/pkgs/by-name/gp/gpuvis/package.nix b/pkgs/by-name/gp/gpuvis/package.nix
index 802627e8eb6a..012ad4ad4541 100644
--- a/pkgs/by-name/gp/gpuvis/package.nix
+++ b/pkgs/by-name/gp/gpuvis/package.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
     freetype
   ];
 
-  CXXFLAGS = [
+  env.CXXFLAGS = toString [
     # GCC 13: error: 'uint32_t' has not been declared
     "-include cstdint"
   ];
diff --git a/pkgs/by-name/gr/greenmask/package.nix b/pkgs/by-name/gr/greenmask/package.nix
index df1ca94e3107..b3909b3cfa85 100644
--- a/pkgs/by-name/gr/greenmask/package.nix
+++ b/pkgs/by-name/gr/greenmask/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "greenmask";
-  version = "0.2.15";
+  version = "0.2.16";
 
   src = fetchFromGitHub {
     owner = "GreenmaskIO";
     repo = "greenmask";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/At0boolTyge4VNy1EDpK09Yo7hLAdq6SvCbyBTKGbw=";
+    hash = "sha256-0XWVYkC5ltpJZ1VLG3G1gvTwGdgqY4nzmOvDDnbz0Ss=";
   };
 
   vendorHash = "sha256-t2U65GAGBGdMRXPTkCQCuXfLuqohA6erTlvAN/xx/ek=";
diff --git a/pkgs/by-name/gv/gvm-libs/package.nix b/pkgs/by-name/gv/gvm-libs/package.nix
index 426dbb1a8eaa..18756a07c037 100644
--- a/pkgs/by-name/gv/gvm-libs/package.nix
+++ b/pkgs/by-name/gv/gvm-libs/package.nix
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gvm-libs";
-  version = "22.35.6";
+  version = "22.35.7";
 
   src = fetchFromGitHub {
     owner = "greenbone";
     repo = "gvm-libs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-oXfxgoFxInx3MyolVxzwRP3EpMsa35G5sdt1GxBUmUU=";
+    hash = "sha256-A3FO2el1ytsXUJEWA+7zthcTN2WpEnNIO2fWQI+0bjc=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/ha/hackedbox/package.nix b/pkgs/by-name/ha/hackedbox/package.nix
index a53d96c0ff3e..bce90fa612ad 100644
--- a/pkgs/by-name/ha/hackedbox/package.nix
+++ b/pkgs/by-name/ha/hackedbox/package.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
   ];
 
-  CXXFLAGS = "-std=c++98";
+  env.CXXFLAGS = "-std=c++98";
 
   buildInputs = [
     freetype
diff --git a/pkgs/by-name/he/helm/package.nix b/pkgs/by-name/he/helm/package.nix
index 96c3fa7b7457..1d71ea4ee24a 100644
--- a/pkgs/by-name/he/helm/package.nix
+++ b/pkgs/by-name/he/helm/package.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
   nativeBuildInputs = [ pkg-config ];
 
-  CXXFLAGS = [
+  env.CXXFLAGS = toString [
     "-DHAVE_LROUND"
     "-fpermissive"
   ];
diff --git a/pkgs/by-name/he/hentai-at-home/package.nix b/pkgs/by-name/he/hentai-at-home/package.nix
index 9d819530488c..b94b3f0eeba5 100644
--- a/pkgs/by-name/he/hentai-at-home/package.nix
+++ b/pkgs/by-name/he/hentai-at-home/package.nix
@@ -22,10 +22,12 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     makeWrapper
   ];
 
-  LANG = "en_US.UTF-8";
-  LOCALE_ARCHIVE = lib.optionalString (
-    stdenvNoCC.buildPlatform.libc == "glibc"
-  ) "${buildPackages.glibcLocales}/lib/locale/locale-archive";
+  env = {
+    LANG = "en_US.UTF-8";
+  }
+  // lib.optionalAttrs (stdenvNoCC.buildPlatform.libc == "glibc") {
+    LOCALE_ARCHIVE = "${buildPackages.glibcLocales}/lib/locale/locale-archive";
+  };
 
   makeFlags = [ "all" ];
   enableParallelBuilding = false;
diff --git a/pkgs/by-name/ho/honeycomb-refinery/package.nix b/pkgs/by-name/ho/honeycomb-refinery/package.nix
index f64c596e492f..142581a155cf 100644
--- a/pkgs/by-name/ho/honeycomb-refinery/package.nix
+++ b/pkgs/by-name/ho/honeycomb-refinery/package.nix
@@ -17,7 +17,7 @@ buildGoModule (finalAttrs: {
     hash = "sha256-JHjjaK5WFRzDYuVkenfYowFsPnrF+Wjo85gQAbaVxO8=";
   };
 
-  NO_REDIS_TEST = true;
+  env.NO_REDIS_TEST = true;
 
   patches = [
     # Allows turning off the one test requiring a Redis service during build.
diff --git a/pkgs/by-name/hy/hyperrogue/package.nix b/pkgs/by-name/hy/hyperrogue/package.nix
index e6b287554de2..cd0492506027 100644
--- a/pkgs/by-name/hy/hyperrogue/package.nix
+++ b/pkgs/by-name/hy/hyperrogue/package.nix
@@ -32,13 +32,13 @@ stdenv.mkDerivation (finalAttrs: {
     HYPERROGUE_USE_GLEW = 1;
     HYPERROGUE_USE_PNG = 1;
     HYPERROGUE_USE_ROGUEVIZ = 1;
-  };
 
-  CXXFLAGS = [
-    "-I${lib.getDev SDL}/include/SDL"
-    "-DHYPERPATH='\"${placeholder "out"}/share/hyperrogue/\"'"
-    "-DRESOURCEDESTDIR=HYPERPATH"
-  ];
+    CXXFLAGS = toString [
+      "-I${lib.getDev SDL}/include/SDL"
+      "-DHYPERPATH='\"${placeholder "out"}/share/hyperrogue/\"'"
+      "-DRESOURCEDESTDIR=HYPERPATH"
+    ];
+  };
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/ig/igprof/package.nix b/pkgs/by-name/ig/igprof/package.nix
index 3cb0885b43f7..a0fc1c0a5e58 100644
--- a/pkgs/by-name/ig/igprof/package.nix
+++ b/pkgs/by-name/ig/igprof/package.nix
@@ -32,7 +32,8 @@ stdenv.mkDerivation (finalAttrs: {
     pcre
   ];
   nativeBuildInputs = [ cmake ];
-  CXXFLAGS = [
+
+  env.CXXFLAGS = toString [
     "-fPIC"
     "-O2"
     "-w"
diff --git a/pkgs/by-name/in/infnoise/package.nix b/pkgs/by-name/in/infnoise/package.nix
index f5c6f3855403..762f9a629e81 100644
--- a/pkgs/by-name/in/infnoise/package.nix
+++ b/pkgs/by-name/in/infnoise/package.nix
@@ -27,9 +27,11 @@ stdenv.mkDerivation (finalAttrs: {
     })
   ];
 
-  GIT_COMMIT = finalAttrs.src.rev;
-  GIT_VERSION = finalAttrs.version;
-  GIT_DATE = "2023-02-14";
+  env = {
+    GIT_COMMIT = finalAttrs.src.rev;
+    GIT_VERSION = finalAttrs.version;
+    GIT_DATE = "2023-02-14";
+  };
 
   buildInputs = [ libftdi ];
 
diff --git a/pkgs/by-name/in/intel-vaapi-driver/package.nix b/pkgs/by-name/in/intel-vaapi-driver/package.nix
index b461933e2d85..33f06004ae1b 100644
--- a/pkgs/by-name/in/intel-vaapi-driver/package.nix
+++ b/pkgs/by-name/in/intel-vaapi-driver/package.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation {
   };
 
   # Set the correct install path:
-  LIBVA_DRIVERS_PATH = "${placeholder "out"}/lib/dri";
+  env.LIBVA_DRIVERS_PATH = "${placeholder "out"}/lib/dri";
 
   postInstall = lib.optionalString enableHybridCodec ''
     ln -s ${vaapi-intel-hybrid}/lib/dri/* $out/lib/dri/
diff --git a/pkgs/by-name/is/isso/package.nix b/pkgs/by-name/is/isso/package.nix
index 2b1959ae6203..cd8486a3de53 100644
--- a/pkgs/by-name/is/isso/package.nix
+++ b/pkgs/by-name/is/isso/package.nix
@@ -54,7 +54,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     npmHooks.npmConfigHook
   ];
 
-  NODE_PATH = "$npmDeps";
+  env.NODE_PATH = "$npmDeps";
 
   preBuild = ''
     ln -s ${finalAttrs.npmDeps}/node_modules ./node_modules
diff --git a/pkgs/applications/video/jellyfin-desktop/non-fatal-unique-app.patch b/pkgs/by-name/je/jellyfin-desktop/non-fatal-unique-app.patch
similarity index 100%
rename from pkgs/applications/video/jellyfin-desktop/non-fatal-unique-app.patch
rename to pkgs/by-name/je/jellyfin-desktop/non-fatal-unique-app.patch
diff --git a/pkgs/applications/video/jellyfin-desktop/default.nix b/pkgs/by-name/je/jellyfin-desktop/package.nix
similarity index 86%
rename from pkgs/applications/video/jellyfin-desktop/default.nix
rename to pkgs/by-name/je/jellyfin-desktop/package.nix
index 12ac1682972f..0c62dc24ed2d 100644
--- a/pkgs/applications/video/jellyfin-desktop/default.nix
+++ b/pkgs/by-name/je/jellyfin-desktop/package.nix
@@ -5,27 +5,22 @@
   cmake,
   ninja,
   python3,
-  wrapQtAppsHook,
-  qtbase,
-  qtdeclarative,
-  qtwebchannel,
-  qtwebengine,
+  kdePackages,
   mpv-unwrapped,
-  mpvqt,
   libcec,
   SDL2,
   libxrandr,
   cacert,
   nix-update-script,
 }:
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "jellyfin-desktop";
   version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "jellyfin";
     repo = "jellyfin-desktop";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-ITlYOrMS6COx9kDRSBi4wM6mzL/Q2G5X9GbABwDIOe4=";
     fetchSubmodules = true;
   };
@@ -36,15 +31,15 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     cmake
     ninja
-    wrapQtAppsHook
+    kdePackages.wrapQtAppsHook
   ]
   ++ lib.optional stdenv.hostPlatform.isDarwin python3;
 
   buildInputs = [
-    qtbase
-    qtdeclarative
-    qtwebchannel
-    qtwebengine
+    kdePackages.qtbase
+    kdePackages.qtdeclarative
+    kdePackages.qtwebchannel
+    kdePackages.qtwebengine
     mpv-unwrapped
 
     # input sources
@@ -55,7 +50,7 @@ stdenv.mkDerivation rec {
     libxrandr
     cacert
   ]
-  ++ lib.optional (!stdenv.hostPlatform.isDarwin) mpvqt;
+  ++ lib.optional (!stdenv.hostPlatform.isDarwin) kdePackages.mpvqt;
 
   cmakeFlags = [
     "-DCHECK_FOR_UPDATES=OFF"
@@ -97,4 +92,4 @@ stdenv.mkDerivation rec {
     ];
     mainProgram = "jellyfin-desktop";
   };
-}
+})
diff --git a/pkgs/by-name/ka/kanban/package.nix b/pkgs/by-name/ka/kanban/package.nix
index f63dfdfe46c5..f0b5c5169f94 100644
--- a/pkgs/by-name/ka/kanban/package.nix
+++ b/pkgs/by-name/ka/kanban/package.nix
@@ -16,7 +16,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-w1NoWgaUBny//3t1S5z/juPOYFomwJKtTq/M4qKoNv0=";
   };
 
-  GIT_COMMIT_HASH = finalAttrs.src.rev;
+  env.GIT_COMMIT_HASH = finalAttrs.src.rev;
 
   cargoHash = "sha256-N+c2jnJ7a+Nh2UibkaOByh4tKDX52VovYIpeHTpawXo=";
 
diff --git a/pkgs/by-name/ka/kaufkauflist/package.nix b/pkgs/by-name/ka/kaufkauflist/package.nix
index 8e4ad879104a..9ba0a388d6a9 100644
--- a/pkgs/by-name/ka/kaufkauflist/package.nix
+++ b/pkgs/by-name/ka/kaufkauflist/package.nix
@@ -39,7 +39,7 @@ buildNpmPackage rec {
 
   npmDepsHash = "sha256-HDv6sW6FmKZpUjymrUjz/WG9XrKgLmM6qHMAxP6gBtU=";
 
-  ESBUILD_BINARY_PATH = lib.getExe esbuild';
+  env.ESBUILD_BINARY_PATH = lib.getExe esbuild';
 
   postInstall = ''
     mkdir -p $out/share/kaufkauflist $out/share/pocketbase
diff --git a/pkgs/by-name/ki/kinect-audio-setup/package.nix b/pkgs/by-name/ki/kinect-audio-setup/package.nix
index 76cd1370d66b..16c26dfd17a8 100644
--- a/pkgs/by-name/ki/kinect-audio-setup/package.nix
+++ b/pkgs/by-name/ki/kinect-audio-setup/package.nix
@@ -17,7 +17,7 @@ let
   # redirects to the following url:
   licenseUrl = "https://www.microsoft.com/en-us/legal/terms-of-use";
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "kinect-audio-setup";
 
   # On update: Make sure that the `firmwareURL` is still in sync with upstream.
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   version = "0.5";
 
   # This is an MSI or CAB file
-  FIRMWARE = requireFile {
+  env.FIRMWARE = requireFile {
     name = "UACFirmware";
     sha256 = "08a2vpgd061cmc6h3h8i6qj3sjvjr1fwcnwccwywqypz3icn8xw1";
     message = ''
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
 
   src = fetchgit {
     url = "git://git.ao2.it/kinect-audio-setup.git";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-bFwmWh822KvFwP/0Gu097nF5K2uCwCLMB1RtP7k+Zt0=";
   };
 
@@ -77,7 +77,7 @@ stdenv.mkDerivation rec {
     install -Dm755 kinect_upload_fw/kinect_upload_fw $out/libexec/
 
     # 7z extract "assume yes on all queries" "only extract/keep files/directories matching UACFIRMWARE.* recursively"
-    7z e -y -r "${FIRMWARE}" "UACFirmware.*" >/dev/null
+    7z e -y -r "${finalAttrs.env.FIRMWARE}" "UACFirmware.*" >/dev/null
     # The filename is bound to change with the Firmware SDK
     mv UACFirmware.* $out/lib/firmware/UACFirmware
 
@@ -93,4 +93,4 @@ stdenv.mkDerivation rec {
     platforms = lib.platforms.linux;
     license = lib.licenses.unfree;
   };
-}
+})
diff --git a/pkgs/by-name/ki/kitty/package.nix b/pkgs/by-name/ki/kitty/package.nix
index 9cd9d0ed1757..06df3c4cd49f 100644
--- a/pkgs/by-name/ki/kitty/package.nix
+++ b/pkgs/by-name/ki/kitty/package.nix
@@ -150,8 +150,10 @@ buildPythonApplication rec {
     "fortify3"
   ];
 
-  env.CGO_ENABLED = 0;
-  GOFLAGS = "-trimpath";
+  env = {
+    CGO_ENABLED = 0;
+    GOFLAGS = "-trimpath";
+  };
 
   configurePhase = ''
     export GOCACHE=$TMPDIR/go-cache
diff --git a/pkgs/by-name/lc/lc3tools/package.nix b/pkgs/by-name/lc/lc3tools/package.nix
index c9ef1484bb24..461a85ea2aea 100644
--- a/pkgs/by-name/lc/lc3tools/package.nix
+++ b/pkgs/by-name/lc/lc3tools/package.nix
@@ -41,10 +41,12 @@ stdenv.mkDerivation {
     readline
   ];
 
-  # lumetta published this a while ago but handrolled his configure
-  # jank in the original packaging makes this necessary:
-  LIBS = "${flex}/lib:${ncurses}/lib:${readline}/lib";
-  INCLUDES = "${flex}/include:${ncurses}/include:${readline}/include";
+  env = {
+    # lumetta published this a while ago but handrolled his configure
+    # jank in the original packaging makes this necessary:
+    LIBS = "${flex}/lib:${ncurses}/lib:${readline}/lib";
+    INCLUDES = "${flex}/include:${ncurses}/include:${readline}/include";
+  };
 
   # it doesn't take `--prefix`
   prefixKey = "--installdir ";
diff --git a/pkgs/by-name/li/libe57format/package.nix b/pkgs/by-name/li/libe57format/package.nix
index fe9d3bc5cbb2..892083d77d6a 100644
--- a/pkgs/by-name/li/libe57format/package.nix
+++ b/pkgs/by-name/li/libe57format/package.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-JARpxp6Z2VioBfY0pZSyQU2mG/EllbaF3qteSFM9u8o=";
   };
 
-  CXXFLAGS = [
+  env.CXXFLAGS = toString [
     # GCC 13: error: 'int16_t' has not been declared in 'std'
     "-include cstdint"
   ];
diff --git a/pkgs/by-name/li/libfolia/package.nix b/pkgs/by-name/li/libfolia/package.nix
index 75612f075e9f..5269e5c5a101 100644
--- a/pkgs/by-name/li/libfolia/package.nix
+++ b/pkgs/by-name/li/libfolia/package.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   # compat with icu61+ https://github.com/unicode-org/icu/blob/release-64-2/icu4c/readme.html#L554
-  CXXFLAGS = [ "-DU_USING_ICU_NAMESPACE=1" ];
+  env.CXXFLAGS = toString [ "-DU_USING_ICU_NAMESPACE=1" ];
 
   passthru = {
     updateScript = gitUpdater { rev-prefix = "v"; };
diff --git a/pkgs/by-name/li/libpar2/package.nix b/pkgs/by-name/li/libpar2/package.nix
index 2b1a3b69ebcf..2d29d4d81eb7 100644
--- a/pkgs/by-name/li/libpar2/package.nix
+++ b/pkgs/by-name/li/libpar2/package.nix
@@ -20,7 +20,9 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [ ./libpar2-0.4-external-verification.patch ];
 
-  CXXFLAGS = lib.optionalString stdenv.cc.isClang "-std=c++11";
+  env = lib.optionalAttrs stdenv.cc.isClang {
+    CXXFLAGS = "-std=c++11";
+  };
 
   meta = {
     homepage = "https://parchive.sourceforge.net/";
diff --git a/pkgs/by-name/li/libphonenumber/package.nix b/pkgs/by-name/li/libphonenumber/package.nix
index 5b4ecd3e530d..4b2d500c76d1 100644
--- a/pkgs/by-name/li/libphonenumber/package.nix
+++ b/pkgs/by-name/li/libphonenumber/package.nix
@@ -8,7 +8,8 @@
   gtest,
   jre,
   pkg-config,
-  boost,
+  # complains about missing boost.system on 1.89
+  boost188,
   icu,
   protobuf,
 }:
@@ -52,7 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   propagatedBuildInputs = lib.optionals enableTests [
-    boost
+    boost188
   ];
 
   cmakeDir = "../cpp";
diff --git a/pkgs/by-name/li/libretrack/package.nix b/pkgs/by-name/li/libretrack/package.nix
index 22e4c7198518..28a007312faa 100644
--- a/pkgs/by-name/li/libretrack/package.nix
+++ b/pkgs/by-name/li/libretrack/package.nix
@@ -32,7 +32,7 @@ flutter329.buildFlutterApplication rec {
   ];
 
   # https://github.com/juliansteenbakker/flutter_secure_storage/issues/965
-  CXXFLAGS = [ "-Wno-deprecated-literal-operator" ];
+  env.CXXFLAGS = toString [ "-Wno-deprecated-literal-operator" ];
 
   postInstall = ''
     substituteInPlace snap/gui/org.proninyaroslav.libretrack.desktop \
diff --git a/pkgs/by-name/li/libthreadar/package.nix b/pkgs/by-name/li/libthreadar/package.nix
index 60b786662501..60d35b030630 100644
--- a/pkgs/by-name/li/libthreadar/package.nix
+++ b/pkgs/by-name/li/libthreadar/package.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [ gcc-unwrapped ];
 
-  CXXFLAGS = [ "-std=c++14" ];
+  env.CXXFLAGS = toString [ "-std=c++14" ];
 
   configureFlags = [
     "--disable-build-html"
diff --git a/pkgs/by-name/li/linuxdoc-tools/package.nix b/pkgs/by-name/li/linuxdoc-tools/package.nix
index 7d3feb00d414..45cd774c6d00 100644
--- a/pkgs/by-name/li/linuxdoc-tools/package.nix
+++ b/pkgs/by-name/li/linuxdoc-tools/package.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
     ("--enable-docs=txt info lyx html rtf" + lib.optionalString withLatex " pdf")
   ];
 
-  LEX = "flex";
+  env.LEX = "flex";
 
   postInstall = ''
     wrapProgram $out/bin/linuxdoc \
diff --git a/pkgs/by-name/li/lirc/package.nix b/pkgs/by-name/li/lirc/package.nix
index ed1e36cafe29..730b003723a3 100644
--- a/pkgs/by-name/li/lirc/package.nix
+++ b/pkgs/by-name/li/lirc/package.nix
@@ -95,7 +95,7 @@ stdenv.mkDerivation (finalAttrs: {
     libx11
   ];
 
-  DEVINPUT_HEADER = "${linuxHeaders}/include/linux/input-event-codes.h";
+  env.DEVINPUT_HEADER = "${linuxHeaders}/include/linux/input-event-codes.h";
 
   configureFlags = [
     "--sysconfdir=/etc"
diff --git a/pkgs/by-name/lo/log4shib/package.nix b/pkgs/by-name/lo/log4shib/package.nix
index ef90d78fecbd..3b421146e8cb 100644
--- a/pkgs/by-name/lo/log4shib/package.nix
+++ b/pkgs/by-name/lo/log4shib/package.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ autoreconfHook ];
 
-  CXXFLAGS = "-std=c++11";
+  env.CXXFLAGS = "-std=c++11";
 
   meta = {
     description = "Forked version of log4cpp that has been created for the Shibboleth project";
diff --git a/pkgs/by-name/ls/lsof/package.nix b/pkgs/by-name/ls/lsof/package.nix
index f438a33b5465..8976e83d5069 100644
--- a/pkgs/by-name/ls/lsof/package.nix
+++ b/pkgs/by-name/ls/lsof/package.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ ncurses ];
 
   # Stop build scripts from searching global include paths
-  LSOF_INCLUDE = "${lib.getDev stdenv.cc.libc}/include";
+  env.LSOF_INCLUDE = "${lib.getDev stdenv.cc.libc}/include";
   configurePhase =
     let
       genericFlags = "LSOF_CC=$CC LSOF_AR=\"$AR cr\" LSOF_RANLIB=$RANLIB";
diff --git a/pkgs/by-name/ma/maestral-gui/package.nix b/pkgs/by-name/ma/maestral-gui/package.nix
index ba047ae40420..0d2ecbeee604 100644
--- a/pkgs/by-name/ma/maestral-gui/package.nix
+++ b/pkgs/by-name/ma/maestral-gui/package.nix
@@ -6,7 +6,7 @@
   nixosTests,
 }:
 
-python3.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "maestral-qt";
   version = "1.9.5";
   pyproject = true;
@@ -14,7 +14,7 @@ python3.pkgs.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "SamSchott";
     repo = "maestral-qt";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-FCn9ELbodk+zCJNmlOVoxE/KSSqbxy5HTB1vpiu7AJA=";
   };
 
@@ -39,14 +39,22 @@ python3.pkgs.buildPythonApplication rec {
   dontWrapQtApps = true;
 
   makeWrapperArgs = with python3.pkgs; [
-    # Firstly, add all necessary QT variables
-    "\${qtWrapperArgs[@]}"
-
     # Add the installed directories to the python path so the daemon can find them
-    "--prefix PYTHONPATH : ${makePythonPath (requiredPythonModules maestral.propagatedBuildInputs)}"
-    "--prefix PYTHONPATH : ${makePythonPath [ maestral ]}"
+    "--prefix"
+    "PYTHONPATH"
+    ":"
+    (makePythonPath (requiredPythonModules maestral.propagatedBuildInputs))
+    "--prefix"
+    "PYTHONPATH"
+    ":"
+    (makePythonPath [ maestral ])
   ];
 
+  preFixup = ''
+    # Add all necessary QT variables
+    makeWrapperArgs+=("''${qtWrapperArgs[@]}")
+  '';
+
   postInstall = ''
     install -Dm444 -t $out/share/icons/hicolor/512x512/apps src/maestral_qt/resources/maestral.png
   '';
@@ -58,10 +66,12 @@ python3.pkgs.buildPythonApplication rec {
 
   passthru.tests.maestral = nixosTests.maestral;
 
+  __structuredAttrs = true;
+
   meta = {
     description = "GUI front-end for maestral (an open-source Dropbox client) for Linux";
     homepage = "https://maestral.app";
-    changelog = "https://github.com/samschott/maestral/releases/tag/v${version}";
+    changelog = "https://github.com/samschott/maestral/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       peterhoeg
@@ -70,4 +80,4 @@ python3.pkgs.buildPythonApplication rec {
     platforms = lib.platforms.linux;
     mainProgram = "maestral_qt";
   };
-}
+})
diff --git a/pkgs/by-name/ma/mainsail/package.nix b/pkgs/by-name/ma/mainsail/package.nix
index b9d6961fc1f9..2118f7775d5a 100644
--- a/pkgs/by-name/ma/mainsail/package.nix
+++ b/pkgs/by-name/ma/mainsail/package.nix
@@ -21,7 +21,7 @@ buildNpmPackage rec {
   nodejs = nodejs_20;
 
   # Prevent Cypress binary download.
-  CYPRESS_INSTALL_BINARY = 0;
+  env.CYPRESS_INSTALL_BINARY = 0;
 
   preConfigure = ''
     # Make the build.zip target do nothing, since we will just copy these files later.
diff --git a/pkgs/by-name/ma/materialize/package.nix b/pkgs/by-name/ma/materialize/package.nix
index b684305768a5..196f6769ed02 100644
--- a/pkgs/by-name/ma/materialize/package.nix
+++ b/pkgs/by-name/ma/materialize/package.nix
@@ -92,7 +92,6 @@ in
 rustPlatform.buildRustPackage rec {
   pname = "materialize";
   version = "0.87.2";
-  MZ_DEV_BUILD_SHA = "000000000000000000000000000000000000000000000000000";
 
   src = fetchFromGitHub {
     owner = "MaterializeInc";
@@ -112,6 +111,7 @@ rustPlatform.buildRustPackage rec {
   '';
 
   env = {
+    MZ_DEV_BUILD_SHA = "000000000000000000000000000000000000000000000000000";
     # needed for internal protobuf c wrapper library
     PROTOC = lib.getExe protobuf;
     PROTOC_INCLUDE = "${protobuf}/include";
diff --git a/pkgs/by-name/mh/mhabit/package.nix b/pkgs/by-name/mh/mhabit/package.nix
index 82aec6204858..4d7552d03a40 100644
--- a/pkgs/by-name/mh/mhabit/package.nix
+++ b/pkgs/by-name/mh/mhabit/package.nix
@@ -35,7 +35,7 @@ flutter338.buildFlutterApplication {
   ];
 
   # https://github.com/juliansteenbakker/flutter_secure_storage/issues/965
-  CXXFLAGS = [ "-Wno-deprecated-literal-operator" ];
+  env.CXXFLAGS = toString [ "-Wno-deprecated-literal-operator" ];
 
   postInstall = ''
     install -Dm644 flatpak/io.github.friesi23.mhabit.desktop --target-directory=$out/share/applications
diff --git a/pkgs/by-name/mi/mirakurun/package.nix b/pkgs/by-name/mi/mirakurun/package.nix
index 825ff812f01c..4317d296276b 100644
--- a/pkgs/by-name/mi/mirakurun/package.nix
+++ b/pkgs/by-name/mi/mirakurun/package.nix
@@ -37,7 +37,7 @@ buildNpmPackage rec {
   ];
 
   # workaround for https://github.com/webpack/webpack/issues/14532
-  NODE_OPTIONS = "--openssl-legacy-provider";
+  env.NODE_OPTIONS = "--openssl-legacy-provider";
 
   postInstall =
     let
diff --git a/pkgs/by-name/mk/mktemp/package.nix b/pkgs/by-name/mk/mktemp/package.nix
index e0b6f1e88470..56d24f7ede8a 100644
--- a/pkgs/by-name/mk/mktemp/package.nix
+++ b/pkgs/by-name/mk/mktemp/package.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation (finalAttrs: {
   version = "1.7";
 
   # Have `configure' avoid `/usr/bin/nroff' in non-chroot builds.
-  NROFF = "${groff}/bin/nroff";
+  env.NROFF = "${groff}/bin/nroff";
 
   patches = [
     # Pull upstream fix for parallel install failures.
diff --git a/pkgs/by-name/mm/mmtc/package.nix b/pkgs/by-name/mm/mmtc/package.nix
index 623b9e3ed060..15057ca33a36 100644
--- a/pkgs/by-name/mm/mmtc/package.nix
+++ b/pkgs/by-name/mm/mmtc/package.nix
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     installShellCompletion artifacts/mmtc.{bash,fish} --zsh artifacts/_mmtc
   '';
 
-  GEN_ARTIFACTS = "artifacts";
+  env.GEN_ARTIFACTS = "artifacts";
 
   meta = {
     description = "Minimal mpd terminal client that aims to be simple yet highly configurable";
diff --git a/pkgs/by-name/mo/modelscan/package.nix b/pkgs/by-name/mo/modelscan/package.nix
index a3b180618484..d506e3d3211d 100644
--- a/pkgs/by-name/mo/modelscan/package.nix
+++ b/pkgs/by-name/mo/modelscan/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "modelscan";
-  version = "0.8.5";
+  version = "0.8.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "protectai";
     repo = "modelscan";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8VupkPiHebVtOqMdtkBflAI1zPRdDSvHCEq3ghjASaE=";
+    hash = "sha256-mN2X6Zbai7xm8bdr2hi9fwzIsfQtukeGcOIS32G4hA0=";
   };
 
   pythonRelaxDeps = [ "rich" ];
diff --git a/pkgs/by-name/mo/morse-linux/package.nix b/pkgs/by-name/mo/morse-linux/package.nix
new file mode 100644
index 000000000000..7d0a5be31e4f
--- /dev/null
+++ b/pkgs/by-name/mo/morse-linux/package.nix
@@ -0,0 +1,60 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  alsa-lib,
+  pulseaudio,
+  pkg-config,
+  xmlto,
+  docbook_xsl,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "morse";
+  version = "2.6";
+
+  src = fetchFromGitLab {
+    owner = "esr";
+    repo = "morse-classic";
+    tag = finalAttrs.version;
+    hash = "sha256-wk/Jcp2YWUlecV3OMELD6IWrlj3IC8kh0U4geMxG4fw=";
+  };
+
+  buildInputs = [
+    alsa-lib
+    pulseaudio
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+    xmlto
+    docbook_xsl
+  ];
+
+  postPatch = ''
+    substituteInPlace Makefile --replace-fail "xmlto" "xmlto --skip-validation"
+  '';
+
+  env.NIX_CFLAGS_COMPILE = "-std=gnu99";
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 morse -t "$out/bin/"
+    install -Dm755 QSO -t "$out/bin/"
+    install -Dm644 morse.1 -t "$out/share/man/man1/"
+    install -Dm644 QSO.1 -t "$out/share/man/man1/"
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Training program about morse-code for aspiring radio hams";
+    homepage = "https://gitlab.com/esr/morse-classic";
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [
+      matthewcroughan
+      sarcasticadmin
+    ];
+    platforms = lib.platforms.linux;
+    mainProgram = "morse";
+  };
+})
diff --git a/pkgs/by-name/mo/movit/package.nix b/pkgs/by-name/mo/movit/package.nix
index 12e8be4d619f..a36ebab3f3db 100644
--- a/pkgs/by-name/mo/movit/package.nix
+++ b/pkgs/by-name/mo/movit/package.nix
@@ -26,8 +26,6 @@ stdenv.mkDerivation rec {
     "dev"
   ];
 
-  GTEST_DIR = "${gtest.src}/googletest";
-
   nativeBuildInputs = [
     pkg-config
   ];
@@ -45,13 +43,15 @@ stdenv.mkDerivation rec {
     libepoxy
   ];
 
-  env =
-    lib.optionalAttrs stdenv.cc.isGNU {
-      NIX_CFLAGS_COMPILE = "-std=c++17"; # needed for latest gtest
-    }
-    // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-      NIX_LDFLAGS = "-framework OpenGL";
-    };
+  env = {
+    GTEST_DIR = "${gtest.src}/googletest";
+  }
+  // lib.optionalAttrs stdenv.cc.isGNU {
+    NIX_CFLAGS_COMPILE = "-std=c++17"; # needed for latest gtest
+  }
+  // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    NIX_LDFLAGS = "-framework OpenGL";
+  };
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/by-name/mp/mpd/package.nix b/pkgs/by-name/mp/mpd/package.nix
index 850a8880a5d9..51df5dbb4064 100644
--- a/pkgs/by-name/mp/mpd/package.nix
+++ b/pkgs/by-name/mp/mpd/package.nix
@@ -257,9 +257,11 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optional (builtins.elem "documentation" features_) "man";
 
-  CXXFLAGS = lib.optionals stdenv.hostPlatform.isDarwin [
-    "-D__ASSERT_MACROS_DEFINE_VERSIONS_WITHOUT_UNDERSCORES=0"
-  ];
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    CXXFLAGS = toString [
+      "-D__ASSERT_MACROS_DEFINE_VERSIONS_WITHOUT_UNDERSCORES=0"
+    ];
+  };
 
   mesonFlags = [
     (lib.mesonBool "test" true)
diff --git a/pkgs/by-name/ms/msbuild/package.nix b/pkgs/by-name/ms/msbuild/package.nix
index 6d8010e4e0cb..ce9f87d20088 100644
--- a/pkgs/by-name/ms/msbuild/package.nix
+++ b/pkgs/by-name/ms/msbuild/package.nix
@@ -55,9 +55,11 @@ mkPackage rec {
     glibcLocales
   ];
 
-  # https://github.com/NixOS/nixpkgs/issues/38991
-  # bash: warning: setlocale: LC_ALL: cannot change locale (en_US.UTF-8)
-  LOCALE_ARCHIVE = lib.optionalString stdenv.hostPlatform.isLinux "${glibcLocales}/lib/locale/locale-archive";
+  env = lib.optionalAttrs stdenv.hostPlatform.isLinux {
+    # https://github.com/NixOS/nixpkgs/issues/38991
+    # bash: warning: setlocale: LC_ALL: cannot change locale (en_US.UTF-8)
+    LOCALE_ARCHIVE = "${glibcLocales}/lib/locale/locale-archive";
+  };
 
   postPatch = ''
     # not patchShebangs, there is /bin/bash in the body of the script as well
diff --git a/pkgs/by-name/ms/msieve/package.nix b/pkgs/by-name/ms/msieve/package.nix
index 3370bc459f32..c80468d07815 100644
--- a/pkgs/by-name/ms/msieve/package.nix
+++ b/pkgs/by-name/ms/msieve/package.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
     ecm
   ];
 
-  ECM = if ecm == null then "0" else "1";
+  env.ECM = if ecm == null then "0" else "1";
 
   # Doesn't hurt Linux but lets clang-based platforms like Darwin work fine too
   makeFlags = [
diff --git a/pkgs/by-name/ne/netcdffortran/package.nix b/pkgs/by-name/ne/netcdffortran/package.nix
index 50c745633639..0891559c5b78 100644
--- a/pkgs/by-name/ne/netcdffortran/package.nix
+++ b/pkgs/by-name/ne/netcdffortran/package.nix
@@ -27,8 +27,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   doCheck = true;
 
-  FFLAGS = [ "-std=legacy" ];
-  FCFLAGS = [ "-std=legacy" ];
+  env = {
+    FFLAGS = toString [ "-std=legacy" ];
+    FCFLAGS = toString [ "-std=legacy" ];
+  };
 
   meta = {
     description = "Fortran API to manipulate netcdf files";
diff --git a/pkgs/by-name/ne/netop/package.nix b/pkgs/by-name/ne/netop/package.nix
index e303475d1804..103fa61fd84a 100644
--- a/pkgs/by-name/ne/netop/package.nix
+++ b/pkgs/by-name/ne/netop/package.nix
@@ -16,8 +16,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-Rnp2VNAi8BNbKqkGFoYUb4C5db5BS1P1cqpWlroTmdQ=";
   };
 
-  LIBPCAP_LIBDIR = lib.makeLibraryPath [ libpcap ];
-  LIBPCAP_VER = libpcap.version;
+  env = {
+    LIBPCAP_LIBDIR = lib.makeLibraryPath [ libpcap ];
+    LIBPCAP_VER = libpcap.version;
+  };
 
   cargoHash = "sha256-WGwtRMARwRvcUflN3JYL32aib+IG1Q0j0D9BEfaiME4=";
 
diff --git a/pkgs/by-name/ne/newsboat/package.nix b/pkgs/by-name/ne/newsboat/package.nix
index a2e87e041013..bd821281dcfe 100644
--- a/pkgs/by-name/ne/newsboat/package.nix
+++ b/pkgs/by-name/ne/newsboat/package.nix
@@ -66,12 +66,14 @@ stdenv.mkDerivation (finalAttrs: {
     gettext
   ];
 
-  # https://github.com/NixOS/nixpkgs/pull/98471#issuecomment-703100014 . We set
-  # these for all platforms, since upstream's gettext crate behavior might
-  # change in the future.
-  GETTEXT_LIB_DIR = "${lib.getLib gettext}/lib";
-  GETTEXT_INCLUDE_DIR = "${lib.getDev gettext}/include";
-  GETTEXT_BIN_DIR = "${lib.getBin gettext}/bin";
+  env = {
+    # https://github.com/NixOS/nixpkgs/pull/98471#issuecomment-703100014 . We set
+    # these for all platforms, since upstream's gettext crate behavior might
+    # change in the future.
+    GETTEXT_LIB_DIR = "${lib.getLib gettext}/lib";
+    GETTEXT_INCLUDE_DIR = "${lib.getDev gettext}/include";
+    GETTEXT_BIN_DIR = "${lib.getBin gettext}/bin";
+  };
 
   makeFlags = [ "prefix=$(out)" ];
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/ni/nirius/package.nix b/pkgs/by-name/ni/nirius/package.nix
index 30fc65aa9a72..d55ec4204e99 100644
--- a/pkgs/by-name/ni/nirius/package.nix
+++ b/pkgs/by-name/ni/nirius/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "nirius";
-  version = "0.6.1";
+  version = "0.7.0";
 
   src = fetchFromSourcehut {
     owner = "~tsdh";
     repo = "nirius";
     rev = "nirius-${finalAttrs.version}";
-    hash = "sha256-KAh45AcNB9Y4ahxamtI6/z3l1xg6yf17h4rnZl3w89I=";
+    hash = "sha256-e/3FOlA29u214gs8Y4Tvk+XJUhT5Bn4GLrptbqrDRw8=";
   };
 
-  cargoHash = "sha256-p123QvlB/j0b5kFjICcTI/5ZKL8pzGfIvH80doAhqFA=";
+  cargoHash = "sha256-4tdPm4+ykEjGeYpQxR3M8Zh84VMDkkQXAaWlehunZ8c=";
 
   meta = {
     description = "Utility commands for the niri wayland compositor";
diff --git a/pkgs/by-name/ni/nix-heuristic-gc/package.nix b/pkgs/by-name/ni/nix-heuristic-gc/package.nix
index 07a43fa9a1d7..4158c0d01421 100644
--- a/pkgs/by-name/ni/nix-heuristic-gc/package.nix
+++ b/pkgs/by-name/ni/nix-heuristic-gc/package.nix
@@ -20,7 +20,7 @@ python3Packages.buildPythonPackage rec {
 
   # NIX_SYSTEM suggested at
   # https://github.com/NixOS/nixpkgs/issues/386184#issuecomment-2692433531
-  NIX_SYSTEM = nixVersions.nixComponents_2_30.nix-store.stdenv.hostPlatform.system;
+  env.NIX_SYSTEM = nixVersions.nixComponents_2_30.nix-store.stdenv.hostPlatform.system;
 
   buildInputs = [
     boost
diff --git a/pkgs/by-name/ni/nix-weather/package.nix b/pkgs/by-name/ni/nix-weather/package.nix
index 3f6aa492a66b..00f904a9144d 100644
--- a/pkgs/by-name/ni/nix-weather/package.nix
+++ b/pkgs/by-name/ni/nix-weather/package.nix
@@ -41,7 +41,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   ];
 
   # This is where `build.rs` puts manpages
-  MAN_OUT = "./man";
+  env.MAN_OUT = "./man";
 
   postInstall = ''
     cd crates/nix-weather
diff --git a/pkgs/by-name/ni/nix-web/package.nix b/pkgs/by-name/ni/nix-web/package.nix
index 95bebd4c0e40..339a85f4789c 100644
--- a/pkgs/by-name/ni/nix-web/package.nix
+++ b/pkgs/by-name/ni/nix-web/package.nix
@@ -42,7 +42,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   cargoBuildFlags = cargoFlags;
   cargoTestFlags = cargoFlags;
 
-  NIX_WEB_BUILD_NIX_CLI_PATH = "${nixPackage}/bin/nix";
+  env.NIX_WEB_BUILD_NIX_CLI_PATH = "${nixPackage}/bin/nix";
 
   meta = {
     description = "Web interface for the Nix store";
diff --git a/pkgs/by-name/no/nostui/package.nix b/pkgs/by-name/no/nostui/package.nix
index ee987669e91e..d7a113a01d9b 100644
--- a/pkgs/by-name/no/nostui/package.nix
+++ b/pkgs/by-name/no/nostui/package.nix
@@ -15,7 +15,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-7i76JPg6MAk4/sO8/JI4ody4iYFJPeLkD2SWncFhT4o=";
   };
 
-  GIT_HASH = "000000000000000000000000000000000000000000000000000";
+  env.GIT_HASH = "000000000000000000000000000000000000000000000000000";
 
   checkFlags = [
     # skip failing test due to nix build timestamps
diff --git a/pkgs/by-name/ns/ns-3/package.nix b/pkgs/by-name/ns/ns-3/package.nix
index ffeac414ee46..64f4beb62aa4 100644
--- a/pkgs/by-name/ns/ns-3/package.nix
+++ b/pkgs/by-name/ns/ns-3/package.nix
@@ -133,7 +133,7 @@ stdenv.mkDerivation (finalAttrs: {
     "build" + lib.optionalString enableDoxygen " doxygen" + lib.optionalString withManual "sphinx";
 
   # to prevent fatal error: 'backward_warning.h' file not found
-  CXXFLAGS = "-D_GLIBCXX_PERMIT_BACKWARD_HASH";
+  env.CXXFLAGS = "-D_GLIBCXX_PERMIT_BACKWARD_HASH";
 
   # Make generated python bindings discoverable in customized python environment
   passthru = {
diff --git a/pkgs/by-name/ns/nsis/package.nix b/pkgs/by-name/ns/nsis/package.nix
index 172d5d0459a5..05e25a5ed97d 100644
--- a/pkgs/by-name/ns/nsis/package.nix
+++ b/pkgs/by-name/ns/nsis/package.nix
@@ -32,14 +32,16 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [ scons ];
   buildInputs = [ zlib ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ libiconv ];
 
-  CPPPATH = symlinkJoin {
-    name = "nsis-includes";
-    paths = [ zlib.dev ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ libiconv ];
-  };
+  env = {
+    CPPPATH = symlinkJoin {
+      name = "nsis-includes";
+      paths = [ zlib.dev ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ libiconv ];
+    };
 
-  LIBPATH = symlinkJoin {
-    name = "nsis-libs";
-    paths = [ zlib ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ libiconv ];
+    LIBPATH = symlinkJoin {
+      name = "nsis-libs";
+      paths = [ zlib ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ libiconv ];
+    };
   };
 
   sconsFlags = [
diff --git a/pkgs/by-name/nu/nushell-plugin-bson/package.nix b/pkgs/by-name/nu/nushell-plugin-bson/package.nix
index d0208edde789..df0ab8b9d969 100644
--- a/pkgs/by-name/nu/nushell-plugin-bson/package.nix
+++ b/pkgs/by-name/nu/nushell-plugin-bson/package.nix
@@ -23,7 +23,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     llvmPackages.libclang
   ];
 
-  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
+  env.LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
 
   passthru.update-script = nix-update-script { };
   meta = {
diff --git a/pkgs/by-name/op/opentabletdriver/package.nix b/pkgs/by-name/op/opentabletdriver/package.nix
index f3b81bd51a94..ea6735f171dc 100644
--- a/pkgs/by-name/op/opentabletdriver/package.nix
+++ b/pkgs/by-name/op/opentabletdriver/package.nix
@@ -67,7 +67,7 @@ buildDotnetModule (finalAttrs: {
 
   buildInputs = finalAttrs.runtimeDeps;
 
-  OTD_CONFIGURATIONS = "${finalAttrs.src}/OpenTabletDriver.Configurations/Configurations";
+  env.OTD_CONFIGURATIONS = "${finalAttrs.src}/OpenTabletDriver.Configurations/Configurations";
 
   doCheck = true;
   testProjectFile = "OpenTabletDriver.Tests/OpenTabletDriver.Tests.csproj";
diff --git a/pkgs/by-name/op/openzwave/package.nix b/pkgs/by-name/op/openzwave/package.nix
index 1d27e9bf8640..a593b6c93ed4 100644
--- a/pkgs/by-name/op/openzwave/package.nix
+++ b/pkgs/by-name/op/openzwave/package.nix
@@ -46,8 +46,10 @@ stdenv.mkDerivation {
     "PREFIX=${placeholder "out"}"
   ];
 
-  FONTCONFIG_FILE = "${fontconfig.out}/etc/fonts/fonts.conf";
-  FONTCONFIG_PATH = "${fontconfig.out}/etc/fonts/";
+  env = {
+    FONTCONFIG_FILE = "${fontconfig.out}/etc/fonts/fonts.conf";
+    FONTCONFIG_PATH = "${fontconfig.out}/etc/fonts/";
+  };
 
   postPatch = ''
     substituteInPlace cpp/src/Options.cpp \
diff --git a/pkgs/by-name/pa/pacu/package.nix b/pkgs/by-name/pa/pacu/package.nix
index f9a9f1d4914e..64b5a12279f0 100644
--- a/pkgs/by-name/pa/pacu/package.nix
+++ b/pkgs/by-name/pa/pacu/package.nix
@@ -13,14 +13,14 @@ let
 in
 python.pkgs.buildPythonApplication (finalAttrs: {
   pname = "pacu";
-  version = "1.6.1";
+  version = "1.6.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "RhinoSecurityLabs";
     repo = "pacu";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Td5H4O6/7Gh/rvP191xjCJmIbyc4ezZC5Fh4FZ39ZUM=";
+    hash = "sha256-Hrks6mvvmmdCMxprB/SPlkfcSu6uyoEVtb0eUD3CALo=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/by-name/pa/parseable/package.nix b/pkgs/by-name/pa/parseable/package.nix
index b9ad8934f384..e69eb7bdd8e1 100644
--- a/pkgs/by-name/pa/parseable/package.nix
+++ b/pkgs/by-name/pa/parseable/package.nix
@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-Asb6064TqvL9kNkWBMj4Z+1j1yIM+iBWsN+R5EuMOVA=";
   };
 
-  LOCAL_ASSETS_PATH = fetchzip {
+  env.LOCAL_ASSETS_PATH = fetchzip {
     url = "https://parseable-prism-build.s3.us-east-2.amazonaws.com/v${finalAttrs.version}/build.zip";
     hash = "sha256-gWzfucetsJJSSjI9nGm7I8xLo0t1VKb4AertiEGuLWA=";
   };
diff --git a/pkgs/by-name/pd/pdfslicer/package.nix b/pkgs/by-name/pd/pdfslicer/package.nix
index b2834f28cdcf..de9635d0b3bb 100644
--- a/pkgs/by-name/pd/pdfslicer/package.nix
+++ b/pkgs/by-name/pd/pdfslicer/package.nix
@@ -56,9 +56,10 @@ stdenv.mkDerivation (finalAttrs: {
     qpdf
   ];
 
-  CXXFLAGS =
+  env = lib.optionalAttrs (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "13") {
     # Pending upstream compatibility with GCC 13
-    lib.optional (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "13") "-Wno-changes-meaning";
+    CXXFLAGS = "-Wno-changes-meaning";
+  };
 
   meta = {
     description = "Simple application to extract, merge, rotate and reorder pages of PDF documents";
diff --git a/pkgs/by-name/pi/pixieditor/deps.json b/pkgs/by-name/pi/pixieditor/deps.json
index e9fa64d94cb5..24900dfa0d0f 100644
--- a/pkgs/by-name/pi/pixieditor/deps.json
+++ b/pkgs/by-name/pi/pixieditor/deps.json
@@ -249,6 +249,11 @@
     "version": "6.9.0",
     "hash": "sha256-MwPAPFD/gs9WZ8gB5BQMEwYswd3EEIpLlvMN5vmz1Wc="
   },
+  {
+    "pname": "DeviceId.Mac",
+    "version": "6.9.0",
+    "hash": "sha256-bQ59eaeDGRgk4ow7bk7U9yEnJgiV2Ok9U3fbBIOdRVw="
+  },
   {
     "pname": "DiscordRichPresence",
     "version": "1.3.0.28",
diff --git a/pkgs/by-name/pi/pixieditor/package.nix b/pkgs/by-name/pi/pixieditor/package.nix
index 7221d9d3564d..ffd013ab9fb1 100644
--- a/pkgs/by-name/pi/pixieditor/package.nix
+++ b/pkgs/by-name/pi/pixieditor/package.nix
@@ -23,6 +23,7 @@
 
   makeDesktopItem,
   copyDesktopItems,
+  desktopToDarwinBundle,
 
   nix-update-script,
 }:
@@ -70,6 +71,9 @@ buildDotnetModule (finalAttrs: {
 
   nativeBuildInputs = [
     copyDesktopItems
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    desktopToDarwinBundle
   ];
 
   buildInputs = [
@@ -85,15 +89,20 @@ buildDotnetModule (finalAttrs: {
 
   dotnet-sdk = dotnetCorePackages.sdk_8_0;
   dotnet-runtime = dotnetCorePackages.runtime_8_0;
-  dotnetFlags =
-    lib.optionals stdenv.hostPlatform.isx86_64 [ "-p:Runtimeidentifier=linux-x64" ]
-    ++ lib.optionals stdenv.hostPlatform.isAarch64 [ "-p:Runtimeidentifier=linux-arm64" ];
+  dotnetFlags = [
+    "-p:RuntimeIdentifier=${dotnetCorePackages.systemToDotnetRid stdenv.hostPlatform.system}"
+  ];
 
   buildType = "ReleaseNoUpdate";
   projectFile = [
     "src/PixiEditor.Desktop/PixiEditor.Desktop.csproj"
     "src/PixiEditor/PixiEditor.csproj"
-    "src/PixiEditor.Linux/PixiEditor.Linux.csproj"
+    (
+      if stdenv.hostPlatform.isLinux then
+        "src/PixiEditor.Linux/PixiEditor.Linux.csproj"
+      else
+        "src/PixiEditor.MacOs/PixiEditor.MacOs.csproj"
+    )
     "src/PixiEditor.Platform.Standalone/PixiEditor.Platform.Standalone.csproj"
   ];
   executables = [ "PixiEditor.Desktop" ];
@@ -183,6 +192,8 @@ buildDotnetModule (finalAttrs: {
     platforms = [
       "x86_64-linux"
       "aarch64-linux"
+      "x86_64-darwin"
+      "aarch64-darwin"
     ];
   };
 })
diff --git a/pkgs/by-name/pm/pmacct/package.nix b/pkgs/by-name/pm/pmacct/package.nix
index 491735246210..e58d1558dd26 100644
--- a/pkgs/by-name/pm/pmacct/package.nix
+++ b/pkgs/by-name/pm/pmacct/package.nix
@@ -68,7 +68,7 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optional gnutlsSupport gnutls;
 
-  MYSQL_CONFIG = lib.optionalString withMysql "${lib.getDev libmysqlclient}/bin/mysql_config";
+  env.MYSQL_CONFIG = lib.optionalString withMysql "${lib.getDev libmysqlclient}/bin/mysql_config";
 
   configureFlags = [
     "--with-pcap-includes=${libpcap}/include"
diff --git a/pkgs/by-name/po/poco/package.nix b/pkgs/by-name/po/poco/package.nix
index 3d6dd586095f..fd6eb26914f9 100644
--- a/pkgs/by-name/po/poco/package.nix
+++ b/pkgs/by-name/po/poco/package.nix
@@ -52,8 +52,10 @@ stdenv.mkDerivation rec {
     "dev"
   ];
 
-  MYSQL_DIR = libmysqlclient;
-  MYSQL_INCLUDE_DIR = "${MYSQL_DIR}/include/mysql";
+  env = {
+    MYSQL_DIR = libmysqlclient;
+    MYSQL_INCLUDE_DIR = "${env.MYSQL_DIR}/include/mysql";
+  };
 
   cmakeFlags =
     let
diff --git a/pkgs/by-name/po/podman-desktop/package.nix b/pkgs/by-name/po/podman-desktop/package.nix
index 2786cd00360b..3ff7d7425ec6 100644
--- a/pkgs/by-name/po/podman-desktop/package.nix
+++ b/pkgs/by-name/po/podman-desktop/package.nix
@@ -75,7 +75,7 @@ stdenv.mkDerivation (finalAttrs: {
     ./system-defaults-dir.patch
   ];
 
-  ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
 
   nativeBuildInputs = [
     makeBinaryWrapper
diff --git a/pkgs/by-name/pr/prisma-engines_7/package.nix b/pkgs/by-name/pr/prisma-engines_7/package.nix
index 39b5444528b9..9bcc16bc61bd 100644
--- a/pkgs/by-name/pr/prisma-engines_7/package.nix
+++ b/pkgs/by-name/pr/prisma-engines_7/package.nix
@@ -23,7 +23,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   cargoHash = "sha256-U5d/HkuWnD/XSrAJr5AYh+WPVGDOcK/e4sC0udPZoyU=";
 
   # Use system openssl.
-  OPENSSL_NO_VENDOR = 1;
+  env.OPENSSL_NO_VENDOR = 1;
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/pr/proj/package.nix b/pkgs/by-name/pr/proj/package.nix
index 610fcb26d9bf..7c2529f008fe 100644
--- a/pkgs/by-name/pr/proj/package.nix
+++ b/pkgs/by-name/pr/proj/package.nix
@@ -59,9 +59,11 @@ stdenv.mkDerivation (finalAttrs: {
     "-DNLOHMANN_JSON_ORIGIN=external"
     "-DEXE_SQLITE3=${buildPackages.sqlite}/bin/sqlite3"
   ];
-  CXXFLAGS = [
+
+  env.CXXFLAGS = toString [
     # GCC 13: error: 'int64_t' in namespace 'std' does not name a type
-    "-include cstdint"
+    "-include"
+    "cstdint"
   ];
 
   preCheck =
diff --git a/pkgs/by-name/pr/protoc-gen-js/package.nix b/pkgs/by-name/pr/protoc-gen-js/package.nix
index 57ede878199f..324ad5d431b2 100644
--- a/pkgs/by-name/pr/protoc-gen-js/package.nix
+++ b/pkgs/by-name/pr/protoc-gen-js/package.nix
@@ -40,7 +40,9 @@ buildBazelPackage' rec {
   removeRulesCC = false;
   removeLocalConfigCC = false;
 
-  LIBTOOL = lib.optionalString stdenv.hostPlatform.isDarwin "${cctools}/bin/libtool";
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    LIBTOOL = "${cctools}/bin/libtool";
+  };
 
   fetchAttrs = {
     preInstall = ''
diff --git a/pkgs/by-name/pr/proxysql/package.nix b/pkgs/by-name/pr/proxysql/package.nix
index 885bf4d5de3d..373a1bab4b58 100644
--- a/pkgs/by-name/pr/proxysql/package.nix
+++ b/pkgs/by-name/pr/proxysql/package.nix
@@ -77,7 +77,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
-  GIT_VERSION = finalAttrs.version;
+  env.GIT_VERSION = finalAttrs.version;
 
   dontConfigure = true;
 
diff --git a/pkgs/by-name/ps/pspp/package.nix b/pkgs/by-name/ps/pspp/package.nix
index 3ef4dbbe2423..bb720dc07489 100644
--- a/pkgs/by-name/ps/pspp/package.nix
+++ b/pkgs/by-name/ps/pspp/package.nix
@@ -55,9 +55,11 @@ stdenv.mkDerivation rec {
     iconv
   ];
 
-  C_INCLUDE_PATH =
-    "${libxml2.dev}/include/libxml2/:" + lib.makeSearchPathOutput "dev" "include" buildInputs;
-  LIBRARY_PATH = lib.makeLibraryPath buildInputs;
+  env = {
+    C_INCLUDE_PATH =
+      "${libxml2.dev}/include/libxml2/:" + lib.makeSearchPathOutput "dev" "include" buildInputs;
+    LIBRARY_PATH = lib.makeLibraryPath buildInputs;
+  };
 
   doCheck = false;
 
diff --git a/pkgs/by-name/qc/qcdnum/package.nix b/pkgs/by-name/qc/qcdnum/package.nix
index 0b147eddce75..96887b55ff2c 100644
--- a/pkgs/by-name/qc/qcdnum/package.nix
+++ b/pkgs/by-name/qc/qcdnum/package.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [ gfortran ];
   buildInputs = [ zlib ];
 
-  FFLAGS = [
+  env.FFLAGS = toString [
     "-std=legacy" # fix build with gfortran 10
   ];
 
diff --git a/pkgs/by-name/ra/rapidfuzz-cpp/package.nix b/pkgs/by-name/ra/rapidfuzz-cpp/package.nix
index 3df57342a13e..348a309d47a3 100644
--- a/pkgs/by-name/ra/rapidfuzz-cpp/package.nix
+++ b/pkgs/by-name/ra/rapidfuzz-cpp/package.nix
@@ -26,10 +26,13 @@ stdenv.mkDerivation (finalAttrs: {
     "-DRAPIDFUZZ_BUILD_TESTING=ON"
   ];
 
-  CXXFLAGS = lib.optionals stdenv.cc.isClang [
-    # error: no member named 'fill' in namespace 'std'
-    "-include algorithm"
-  ];
+  env = lib.optionalAttrs stdenv.cc.isClang {
+    CXXFLAGS = toString [
+      # error: no member named 'fill' in namespace 'std'
+      "-include"
+      "algorithm"
+    ];
+  };
 
   nativeCheckInputs = [
     catch2_3
diff --git a/pkgs/by-name/rc/rcs/package.nix b/pkgs/by-name/rc/rcs/package.nix
index 839c47a30bbe..73fec8b194e5 100644
--- a/pkgs/by-name/rc/rcs/package.nix
+++ b/pkgs/by-name/rc/rcs/package.nix
@@ -17,16 +17,17 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-Q93+EHJKi4XiRo9kA7YABzcYbwHmDgvWL95p2EIjTMU=";
   };
 
-  ac_cv_path_ED = "${ed}/bin/ed";
-  DIFF = "${diffutils}/bin/diff";
-  DIFF3 = "${diffutils}/bin/diff3";
-
   disallowedReferences = lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     buildPackages.diffutils
     buildPackages.ed
   ];
 
-  env.NIX_CFLAGS_COMPILE = "-std=c99";
+  env = {
+    NIX_CFLAGS_COMPILE = "-std=c99";
+    ac_cv_path_ED = "${ed}/bin/ed";
+    DIFF = "${diffutils}/bin/diff";
+    DIFF3 = "${diffutils}/bin/diff3";
+  };
 
   hardeningDisable = lib.optional stdenv.cc.isClang "format";
 
diff --git a/pkgs/by-name/re/readeck/package.nix b/pkgs/by-name/re/readeck/package.nix
index 55ff948ef227..80d53127f561 100644
--- a/pkgs/by-name/re/readeck/package.nix
+++ b/pkgs/by-name/re/readeck/package.nix
@@ -27,7 +27,7 @@ buildGoModule (finalAttrs: {
 
   npmRoot = "web";
 
-  NODE_PATH = "$npmDeps";
+  env.NODE_PATH = "$npmDeps";
 
   preBuild = ''
     make generate
diff --git a/pkgs/by-name/re/renode-bin/package.nix b/pkgs/by-name/re/renode-bin/package.nix
index edf34d337346..d8314e908541 100644
--- a/pkgs/by-name/re/renode-bin/package.nix
+++ b/pkgs/by-name/re/renode-bin/package.nix
@@ -51,11 +51,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "renode";
-  version = "1.16.0";
+  version = "1.16.1";
 
   src = fetchurl {
     url = "https://github.com/renode/renode/releases/download/v${finalAttrs.version}/renode-${finalAttrs.version}.linux-dotnet.tar.gz";
-    hash = "sha256-oNlTz5LBggPkjKM4TJO2UDKQdt2Ga7rBTdgyGjN8/zA=";
+    hash = "sha256-YmKcqjMe1L1Ot6vhPuLkg0+8qnDeSS2zll+vpO3FaU8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sa/sagoin/package.nix b/pkgs/by-name/sa/sagoin/package.nix
index 1b75e28938fd..73452dc2f3bf 100644
--- a/pkgs/by-name/sa/sagoin/package.nix
+++ b/pkgs/by-name/sa/sagoin/package.nix
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     installShellCompletion artifacts/sagoin.{bash,fish} --zsh artifacts/_sagoin
   '';
 
-  GEN_ARTIFACTS = "artifacts";
+  env.GEN_ARTIFACTS = "artifacts";
 
   meta = {
     description = "Command-line submission tool for the UMD CS Submit Server";
diff --git a/pkgs/by-name/sc/scite/package.nix b/pkgs/by-name/sc/scite/package.nix
index 94865c79ca06..c73a7f6b132e 100644
--- a/pkgs/by-name/sc/scite/package.nix
+++ b/pkgs/by-name/sc/scite/package.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
     "prefix=${placeholder "out"}"
   ];
 
-  CXXFLAGS = [
+  env.CXXFLAGS = toString [
     # GCC 13: error: 'intptr_t' does not name a type
     "-include cstdint"
     "-include system_error"
diff --git a/pkgs/by-name/se/search-vulns/package.nix b/pkgs/by-name/se/search-vulns/package.nix
index e419934a7a78..b669d34839ac 100644
--- a/pkgs/by-name/se/search-vulns/package.nix
+++ b/pkgs/by-name/se/search-vulns/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "search-vulns";
-  version = "1.0.2";
+  version = "1.0.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ra1nb0rn";
     repo = "search_vulns";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xdZq4Er+0CT59Iv0mEcmkZcUM+xbBi/x+TtBNCiyhbY=";
+    hash = "sha256-lQyd5FmiBlno+BEXou70XOAv1hkwxIs0BCoNESYjjZM=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/se/send/package.nix b/pkgs/by-name/se/send/package.nix
index 9c6ebdbb96b7..51486020a37c 100644
--- a/pkgs/by-name/se/send/package.nix
+++ b/pkgs/by-name/se/send/package.nix
@@ -28,14 +28,14 @@ buildNpmPackage rec {
 
   env = {
     PUPPETEER_SKIP_CHROMIUM_DOWNLOAD = "true";
+
+    NODE_OPTIONS = "--openssl-legacy-provider";
   };
 
   makeCacheWritable = true;
 
   npmPackFlags = [ "--ignore-scripts" ];
 
-  NODE_OPTIONS = "--openssl-legacy-provider";
-
   postInstall = ''
     cp -r dist $out/lib/node_modules/send/
     ln -s $out/lib/node_modules/send/dist/version.json $out/lib/node_modules/send/version.json
diff --git a/pkgs/by-name/se/server-box/package.nix b/pkgs/by-name/se/server-box/package.nix
index 3057a4975dee..e32c77a8af7b 100644
--- a/pkgs/by-name/se/server-box/package.nix
+++ b/pkgs/by-name/se/server-box/package.nix
@@ -36,7 +36,7 @@ flutter338.buildFlutterApplication {
   ];
 
   # https://github.com/juliansteenbakker/flutter_secure_storage/issues/965
-  CXXFLAGS = [ "-Wno-deprecated-literal-operator" ];
+  env.CXXFLAGS = toString [ "-Wno-deprecated-literal-operator" ];
 
   desktopItems = [
     (makeDesktopItem {
diff --git a/pkgs/by-name/sh/sharing/package.nix b/pkgs/by-name/sh/sharing/package.nix
index dcad6dd71b16..185080b2c5da 100644
--- a/pkgs/by-name/sh/sharing/package.nix
+++ b/pkgs/by-name/sh/sharing/package.nix
@@ -22,7 +22,7 @@ buildNpmPackage rec {
   # The prepack script runs the build script, which we'd rather do in the build phase.
   npmPackFlags = [ "--ignore-scripts" ];
 
-  NODE_OPTIONS = "--openssl-legacy-provider";
+  env.NODE_OPTIONS = "--openssl-legacy-provider";
 
   meta = {
     description = "Command-line tool to share directories and files to mobile devices";
diff --git a/pkgs/by-name/si/sirius/package.nix b/pkgs/by-name/si/sirius/package.nix
index d352d6d571fd..102acd62b3ff 100644
--- a/pkgs/by-name/si/sirius/package.nix
+++ b/pkgs/by-name/si/sirius/package.nix
@@ -133,7 +133,7 @@ stdenv.mkDerivation (finalAttrs: {
     ]
   );
 
-  CXXFLAGS = [
+  env.CXXFLAGS = toString [
     # GCC 13: error: 'uintptr_t' in namespace 'std' does not name a type
     "-include cstdint"
   ];
diff --git a/pkgs/by-name/sm/smlpkg/package.nix b/pkgs/by-name/sm/smlpkg/package.nix
index 5f9123f7a528..b5d66880f220 100644
--- a/pkgs/by-name/sm/smlpkg/package.nix
+++ b/pkgs/by-name/sm/smlpkg/package.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [ mlton ];
 
   # Set as an environment variable in all the phase scripts.
-  MLCOMP = "mlton";
+  env.MLCOMP = "mlton";
 
   buildFlags = [ "all" ];
   installFlags = [ "prefix=$(out)" ];
diff --git a/pkgs/by-name/sp/spdx-license-list-data/package.nix b/pkgs/by-name/sp/spdx-license-list-data/package.nix
index d6dba6e518dc..de5505415de6 100644
--- a/pkgs/by-name/sp/spdx-license-list-data/package.nix
+++ b/pkgs/by-name/sp/spdx-license-list-data/package.nix
@@ -3,18 +3,7 @@
   lib,
   fetchFromGitHub,
 }:
-
-stdenvNoCC.mkDerivation rec {
-  pname = "spdx-license-list-data";
-  version = "3.27.0";
-
-  src = fetchFromGitHub {
-    owner = "spdx";
-    repo = "license-list-data";
-    rev = "v${version}";
-    hash = "sha256-TRrsxk+gtxI9KqJvFzD0Cfy1h5cZAJ2kT9KUARjlXcY=";
-  };
-
+let
   # List of file formats to package.
   _types = [
     "html"
@@ -27,6 +16,17 @@ stdenvNoCC.mkDerivation rec {
     "template"
     "text"
   ];
+in
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "spdx-license-list-data";
+  version = "3.27.0";
+
+  src = fetchFromGitHub {
+    owner = "spdx";
+    repo = "license-list-data";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-TRrsxk+gtxI9KqJvFzD0Cfy1h5cZAJ2kT9KUARjlXcY=";
+  };
 
   outputs = [ "out" ] ++ _types;
 
@@ -38,7 +38,7 @@ stdenvNoCC.mkDerivation rec {
     runHook preInstall
 
     mkdir -pv $out
-    for t in $_types
+    for t in ${lib.concatStringsSep " " _types}
     do
       _outpath=''${!t}
       mkdir -pv $_outpath
@@ -60,4 +60,4 @@ stdenvNoCC.mkDerivation rec {
     ];
     platforms = lib.platforms.all;
   };
-}
+})
diff --git a/pkgs/by-name/sp/sphinxsearch/package.nix b/pkgs/by-name/sp/sphinxsearch/package.nix
index 8be034f42a33..87cd529882aa 100644
--- a/pkgs/by-name/sp/sphinxsearch/package.nix
+++ b/pkgs/by-name/sp/sphinxsearch/package.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
       expat
     ];
 
-  CXXFLAGS = "-std=c++98";
+  env.CXXFLAGS = "-std=c++98";
 
   meta = {
     description = "Open source full text search server";
diff --git a/pkgs/by-name/sq/sql-formatter/package.nix b/pkgs/by-name/sq/sql-formatter/package.nix
index 4671dd6f57e8..56514cdba7fb 100644
--- a/pkgs/by-name/sq/sql-formatter/package.nix
+++ b/pkgs/by-name/sq/sql-formatter/package.nix
@@ -11,13 +11,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "sql-formatter";
-  version = "15.7.0";
+  version = "15.7.2";
 
   src = fetchFromGitHub {
     owner = "sql-formatter-org";
     repo = "sql-formatter";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-k105xoppmxW1jSbkzbqHF7bg/IbY1P9kZVwa3pdKF7k=";
+    hash = "sha256-0EV35Hz+xyNfKEYMAMIkYNjE3erN1G6db+A9i4hNrJY=";
   };
 
   yarnOfflineCache = fetchYarnDeps {
diff --git a/pkgs/by-name/sq/squeezelite/package.nix b/pkgs/by-name/sq/squeezelite/package.nix
index 46a973d744d3..38d6f1cd6c56 100644
--- a/pkgs/by-name/sq/squeezelite/package.nix
+++ b/pkgs/by-name/sq/squeezelite/package.nix
@@ -72,23 +72,31 @@ stdenv.mkDerivation {
       --replace "<opusfile.h>" "<opus/opusfile.h>"
   '';
 
-  EXECUTABLE = binName;
+  env = {
+    EXECUTABLE = binName;
 
-  OPTS = [
-    "-DLINKALL"
-    "-DGPIO"
-  ]
-  ++ optional dsdSupport "-DDSD"
-  ++ optional (!faad2Support) "-DNO_FAAD"
-  ++ optional ffmpegSupport "-DFFMPEG"
-  ++ optional opusSupport "-DOPUS"
-  ++ optional portaudioSupport "-DPORTAUDIO"
-  ++ optional pulseSupport "-DPULSEAUDIO"
-  ++ optional resampleSupport "-DRESAMPLE"
-  ++ optional sslSupport "-DUSE_SSL"
-  ++ optional (stdenv.hostPlatform.isAarch32 or stdenv.hostPlatform.isAarch64) "-DRPI";
-
-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin { LDADD = "-lportaudio -lpthread"; };
+    OPTS = toString (
+      [
+        "-DLINKALL"
+        "-DGPIO"
+      ]
+      ++ optional dsdSupport "-DDSD"
+      ++ optional (!faad2Support) "-DNO_FAAD"
+      ++ optional ffmpegSupport "-DFFMPEG"
+      ++ optional opusSupport "-DOPUS"
+      ++ optional portaudioSupport "-DPORTAUDIO"
+      ++ optional pulseSupport "-DPULSEAUDIO"
+      ++ optional resampleSupport "-DRESAMPLE"
+      ++ optional sslSupport "-DUSE_SSL"
+      ++ optional (stdenv.hostPlatform.isAarch32 or stdenv.hostPlatform.isAarch64) "-DRPI"
+    );
+  }
+  // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    LDADD = toString [
+      "-lportaudio"
+      "-lpthread"
+    ];
+  };
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/by-name/st/stalwart/webadmin.nix b/pkgs/by-name/st/stalwart/webadmin.nix
index d62ee5258c28..323a4833303a 100644
--- a/pkgs/by-name/st/stalwart/webadmin.nix
+++ b/pkgs/by-name/st/stalwart/webadmin.nix
@@ -51,7 +51,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     zip
   ];
 
-  NODE_PATH = "$npmDeps";
+  env.NODE_PATH = "$npmDeps";
 
   buildPhase = ''
     trunk build --offline --frozen --release
diff --git a/pkgs/by-name/su/superTuxKart/package.nix b/pkgs/by-name/su/superTuxKart/package.nix
index 8ece4444bad2..b6fae7be863e 100644
--- a/pkgs/by-name/su/superTuxKart/package.nix
+++ b/pkgs/by-name/su/superTuxKart/package.nix
@@ -125,7 +125,7 @@ stdenv.mkDerivation (finalAttrs: {
     "-DOpenGL_GL_PREFERENCE=GLVND"
   ];
 
-  CXXFLAGS = [
+  env.CXXFLAGS = toString [
     # GCC 13: error: 'snprintf' was not declared in this scope
     "-include cstdio"
     # GCC 13: error: 'runtime_error' is not a member of 'std'
diff --git a/pkgs/by-name/sw/swagger-typescript-api/missing-hashes.json b/pkgs/by-name/sw/swagger-typescript-api/missing-hashes.json
deleted file mode 100644
index e69a0ea7abd4..000000000000
--- a/pkgs/by-name/sw/swagger-typescript-api/missing-hashes.json
+++ /dev/null
@@ -1,72 +0,0 @@
-{
-  "@biomejs/cli-darwin-arm64@npm:2.2.6": "38ade81bfc2cf3c981fc6c06f15d41faefec1eed3be7a9c856304db9d0010700769479e2df16f7f421bf335a910b72fa1bf5185f30dd8372d416972a623c7841",
-  "@biomejs/cli-darwin-x64@npm:2.2.6": "42d5a3ca874969d3e1d72a7151f1ef3a40cb887f8c6c315a1898cf53f8a825eeb1419fbc691adf1551ec06355cf4c11f5400ecb42720e63a44c5c5b0db6f1cbc",
-  "@biomejs/cli-linux-arm64-musl@npm:2.2.6": "866839019a2a5ad2e731a4f04c1effdeb41a2559e04639ecc33bbc119c0d217175dd8e972ec54d34f84edea8db00ee75fda7bca44bbdcba5495ebffbaf3dc709",
-  "@biomejs/cli-linux-arm64@npm:2.2.6": "18db4d7c04347b2095584b9ed851234aeb31599a112176418d8b29d3dcc73f6e2b4a759e3c20b3a0440d57b6656056c418f8b9f52aad5e1bbb02385f97792bee",
-  "@biomejs/cli-linux-x64-musl@npm:2.2.6": "b43573c8cda9b9026d911931b8fd517a0e1f661ff6529ad718852cc8716a68632361d06f1c14bcc73fd600c69aeb7542680ac66a46a2461f6a4a645e7cef1d9b",
-  "@biomejs/cli-linux-x64@npm:2.2.6": "06f32d1d001eb09d9783587318f94fa52c3055826c0b835f48c18fc480aecfd311bcc0ddac678c709949f3b99b1283450cb073bbcc8b1631c39877d7264ac62e",
-  "@biomejs/cli-win32-arm64@npm:2.2.6": "fbdbb024198c027edc2043e1f6416592263624a4534768a98a46b359bfa813e9b919e2bb89f10114b7bfd7e78d29b298773262a255c924555096b39df9d35323",
-  "@biomejs/cli-win32-x64@npm:2.2.6": "7ceac86065c5e7c765993d4b300fd29c710678d2c65ea4394ed68ccf6ae1fa5133730829a7db8915dfb2877792093b8d5fe6eaea3ed727826ee5e2ac11530274",
-  "@esbuild/aix-ppc64@npm:0.25.11": "46c2697b0e5bf6a1d1d57e80358ee04fcb0d59a1c6648759ec94e12a83af50d35ecf2469cf7c5643f85a9b2c5b2f91173bc6485ebec9bb9add4a6b30b5dab95c",
-  "@esbuild/android-arm64@npm:0.25.11": "cc45d931e813767a15ad6e7fd6071c97865a2e9aaa0d3a78374da452d303dbea71a4f13c63426b01f71ce3c10dd208f9382e6387505111adaf631e39749aa404",
-  "@esbuild/android-arm@npm:0.25.11": "b8ee90079d3d6c02b732529b04d2e6c017d12b2c401f2f8d6e60ec5fb1060d819edde5429acfbc7471b2224b4457de8cb99b97bea4164e94a3da2cbf121e60a4",
-  "@esbuild/android-x64@npm:0.25.11": "c03182ed17c50ab29973b19814cbdee85ff67ba00e13f001fafabcf7538d061fd737a783fc4131f96e22b2e7bed26936e5e730b717bb88ffb0b8c429fadd6536",
-  "@esbuild/darwin-arm64@npm:0.25.11": "67114421780e01c947d3a646d9737d5965e2bf39ea75a2440d614971b7b2565a8cc91c39780f5b86adc25cdc466bbf1ade79a05cef71827e3f3a2be00435d868",
-  "@esbuild/darwin-x64@npm:0.25.11": "da5612584d5fc2e714efc0876826fa45a48fa3b881be4a728516f2394c6aeb72f6ca8ce08272106c24ea6a9b040513afd847b4ea9bfcc5a6637e427a1634acd7",
-  "@esbuild/freebsd-arm64@npm:0.25.11": "8ad357e0b7605a320d428b10ab704a2f34383786bb43e663ebb62ded22297343c72149ab126257629308195cd18b4828f9b90579b224c26d2ca56f416dcb3e48",
-  "@esbuild/freebsd-x64@npm:0.25.11": "a42ea4c6801eb2ff09b0f1e67a04b2d4a00da9dc08233a8dc227b25468efa954ea13478bd2f2dad46bf78e8d1ec3cf11b1edbc1b50af7e61da05e715f0ea0fc7",
-  "@esbuild/linux-arm64@npm:0.25.11": "c8f87df1d15ff5c835d782e26213bb28653eed9388351e42c073431ffa8e3606fa8e0670ccb0df325f56a9695782b34c98af2fe30756953a883f9da63d1eb42a",
-  "@esbuild/linux-arm@npm:0.25.11": "122d069ed8332d3eb6e3f0d99c7f25d8920d6aff3655013d6bc2f3666fcba85ae074402b54f3a2ca9a3a3a9cd54350fac1f56252d84d466daefca7a8dc82975b",
-  "@esbuild/linux-ia32@npm:0.25.11": "dbd90c3efbbb33b920abb3f3def4a61fcff258b8a60289c61c0ba6d5210fae8fd569af991ff9aaebe03b3c24a0c67a5fd74d8e32e8fd7c5a0dbf1898aeeb2bf3",
-  "@esbuild/linux-loong64@npm:0.25.11": "c58d14d84cf4f024f5cc585efd759b161ec4122767d94500578cf32f9649542ab7e7b5e2b88389d774d4544d50a39ba1e0d791793170643645ec6a2eb8836ffe",
-  "@esbuild/linux-mips64el@npm:0.25.11": "5a3f4ccefe0d8ed30806a6984b7b6cee17e2f2a14d3f6d64c37f05f78f6dddd04821fd5ff4d61044ce23c0206a8fd4f1535a90d534e26cb5e90c8c04d1203a0a",
-  "@esbuild/linux-ppc64@npm:0.25.11": "e35d0a4e54f7d48aa931abe6211b7fc374291b26cd59849fff938499114b5b34e3da15b71e67b76f83c1d712d6f78a50255d8b96bacaad8df233771126544ebe",
-  "@esbuild/linux-riscv64@npm:0.25.11": "4e932cf5950d97aec76aa5c52d7d15e7135f2b865414c97cd4410adc3f8b26e1588cda7a09222b92f54fff8c888180219e822b9a633c833098bb876b1e66ac02",
-  "@esbuild/linux-s390x@npm:0.25.11": "af2b8a5c0a6147985b1d194a7c1323b4693b72ad5884de1292f045882b41436cf4e64828c18cdbf7b85763060404279cc070fbf74c00f9f82d8f35469b8c0073",
-  "@esbuild/linux-x64@npm:0.25.11": "1e1fe2d9c8ae8ed76f3090ff2e4d3d084d581cc9298e349daf8addd398ae9b466a1817d9640202956d72479a82e602979ca364035d10e8cb6e2c2baf6e850081",
-  "@esbuild/netbsd-arm64@npm:0.25.11": "03e86862f25a9d3ed05383031ab3430ba73b80e5a1617cf0b9f91ce2a4d5700125398722a4a6145299d6f3626caca556d30604bd24f88af1a289794822322814",
-  "@esbuild/netbsd-x64@npm:0.25.11": "af848a8e720c5ba4fb63a748c657e366770e4f00a249dd4a0eb996bdafa0fcad7f04c88df3ed29cb1b488f76c4f7c3355e192ff71392c81d641dd52bc453355c",
-  "@esbuild/openbsd-arm64@npm:0.25.11": "40d46a15da7643aa57ba7a61aa8174cc7ead37f67b3438eaeb407f6527712b848327a025484a57ce936debced507a2d405614e790491aa181f8178c09b8f2ad2",
-  "@esbuild/openbsd-x64@npm:0.25.11": "8ee73b8cfe0b5d24433400bddcb20c3ceb2cab3d11112ba01c5ee799e3629d24267f6dcfcb2f3aef89726ddc5d10592e35ec46b9725cc9e297af3d8d35a3122b",
-  "@esbuild/openharmony-arm64@npm:0.25.11": "bf2fa9985a1aaba0a4376657e72e73c7d5368d0a1972e12788ec276384e6a20637904c5d07b52a9f10306735898730dbebd55a6234cc0cd30962ee130c7b9a8b",
-  "@esbuild/sunos-x64@npm:0.25.11": "7ac357650fadc4ad44a0615a184920734ab5f4432ddd913bef2cf4e4ef7855f7ffd1995cfabb323c10cb9b876f252cf3f7938b4450cfa9ce3b1488e47d91b6cf",
-  "@esbuild/win32-arm64@npm:0.25.11": "01a7db317fecb784cd273ddfb0f3eb35871709904cc879adfbeca139cb33fbe8db6d33ee53ae4eb3b4185ef9fb6d6f140d9ac0fcbbe61518cf546487d7430dcb",
-  "@esbuild/win32-ia32@npm:0.25.11": "cdb90fcd780022685374b762b2f6fdd19501ff43c4b4b63b9b875cdb56d4c79b4747f36f4893ce57d3f0c520aaf30b0f31309e606bae14738300b22bbb30b1df",
-  "@esbuild/win32-x64@npm:0.25.11": "a7b6080abc4d575c0572e880cefcb24faf89f7e48057652d6ab11e2e5b3fbd4555d27246ee281d5a1ac1f744a29ff90573e7075310e171ade9e2838665caefce",
-  "@rolldown/binding-android-arm64@npm:1.0.0-beta.44": "3584478753a119db5c345c314b7a80a122fe1f4aa868773d5103942f62e81493f922f440c040af86902296b8343a418f8ff325f0336ca477c58a3f00a5fe92cd",
-  "@rolldown/binding-darwin-arm64@npm:1.0.0-beta.44": "b3ffe5e3e54d7db2aa77ea24399016c934b68e3c4e7d5124ea90e85a7814e74ef933e07fd640ca0608fbf4a46f6db21087fa301ebf209883db8d0f43b97b5081",
-  "@rolldown/binding-darwin-x64@npm:1.0.0-beta.44": "ecad93425fde8cbc0ab451592887f068fbd3b2e6e7c6a54c12e4f02dceb499ec584a5ebd854b94691e78ad1a097846e0328485adc7c8f69a66531001dfd3afa0",
-  "@rolldown/binding-freebsd-x64@npm:1.0.0-beta.44": "4b397b3e5bf3ba2b3f4af648921bd027fbaf9859041b92aa36c9a60d4e25eb7f67da8812d61b80078957ffd2836d3a9618dfa6c4d1141e2c4eb1dd6d4b7a051c",
-  "@rolldown/binding-linux-arm-gnueabihf@npm:1.0.0-beta.44": "0d2be4daa7358490a081769efc6bf5a7ef8007706bf8a54d354950214b4eff91b367f21f4cb4d05d0e0a3dc759528bf8d7eab7e482754c74321d66d612997f43",
-  "@rolldown/binding-linux-arm64-gnu@npm:1.0.0-beta.44": "4a0d9d0e06fae39dcd984e5dcb858aa38d34d412e8472290593f3b907aac6e8c1e60b7659020b71063d469faa904dee78fb6678979292ddc7060e765cf0258a7",
-  "@rolldown/binding-linux-arm64-musl@npm:1.0.0-beta.44": "3dfb95b4663bc950d1ed5f93162ed1b7a2cb02281f1ee82901844a9e22e34369dece54d5a9bbf9d3d2381407ca363b8536d236421a793dbd72350dc65d7bfc46",
-  "@rolldown/binding-linux-x64-gnu@npm:1.0.0-beta.44": "d6329c568d9ccd363b215ebffff7b86df0a102d0dcf2b56e32a81e2d1961d052691d8a90e9df5dff3c819a0965635b3b5beb71e125fb7f385aebdf458b3f53a8",
-  "@rolldown/binding-linux-x64-musl@npm:1.0.0-beta.44": "b0fd15a216b02ff03cb927e84802bc9d8454d5cafcc3561cb9f642997fd5869c6611bdbb5e3391d9d6866ea8b764876db8dcbab6a52017025f4f349c83c6a51f",
-  "@rolldown/binding-openharmony-arm64@npm:1.0.0-beta.44": "e367f21610a6daf111f337824334474213172f4050d67bf4c7a29f69ba43e35733911cf4c44906b3170cdcaf9fb96ba6386eff29e02650109e11130da46dc53a",
-  "@rolldown/binding-wasm32-wasi@npm:1.0.0-beta.44": "a53092c1338dfc25fc0447a223748ef5048058ee420fefda15e846131b31c3c8fc6d3f2e975467190905f91abccf8de570653aed77a147513d3dae7ff0004931",
-  "@rolldown/binding-win32-arm64-msvc@npm:1.0.0-beta.44": "d985908536816c176699b21626ad57106af36a99d665437cf58f827f54491200763f2b47870c218ac3022d4a43c6ff5bb38438f81a18a1fc88fc837d9e53a459",
-  "@rolldown/binding-win32-ia32-msvc@npm:1.0.0-beta.44": "f247d3a00caa1238fed18d6d7f884d02291e3fd570d987f50bf77b0886e767529dae2586093bfd820320eb0548cbdba6784f5b49afd49032a883bfc3f1ea19b4",
-  "@rolldown/binding-win32-x64-msvc@npm:1.0.0-beta.44": "9f13f6cd9f6ba17c79a7c398c1931cd2e8321703d30aea0de56e5c6175e4979d96988ca941576d0d424e928e873625c5802d081498e8111e52382ada737656f2",
-  "@rollup/rollup-android-arm-eabi@npm:4.52.5": "62451748fde2f4a8e8423b2e7f83fd0342e57433fa0f71d378ea38ed3f85dc6a0706ef9feae21d79428f4e274da45c07bc49eb1b3a82c08f6b98d8cf20de83f7",
-  "@rollup/rollup-android-arm64@npm:4.52.5": "d050880ec4e14c0d1ab7e32e6a843c3f39b4161ddd574532482807e6e559e34dee8bfe3862bf06a62e79e46a410afaa3dafedc5e0db41db5cf39c10bbcf32330",
-  "@rollup/rollup-darwin-arm64@npm:4.52.5": "4c7a2994ec5bb915b5b455a507b296c892c914ed0c0c3e8e1958d7e021dc47627a27c756f1628aca2e2ace8487dc93dd801483f0ec40f92603b6a788322e66ed",
-  "@rollup/rollup-darwin-x64@npm:4.52.5": "fcdc3b7954afea6dc191a6244e793a32e8373e1798020d1cfcaf5da48bd23c533b661763d2dbfb87412bf5b1a59377ec06560f64da869126ab8c995391de9047",
-  "@rollup/rollup-freebsd-arm64@npm:4.52.5": "f52788b616f5bc4c5edbc41ca2ac4fde7fbed678a0d2c3249111f4322a76550e682037563d07a0f07eb21f82289e9c5616c41797f3d9caa6d5b4261b8e1ce642",
-  "@rollup/rollup-freebsd-x64@npm:4.52.5": "8fcb45fd9b7ec02848230cefac866bca73f38071e2e85e1217627007df211e814743e3e2525b236dc410acea7f7c4484050e2338391bda509bac34e7e0bc9ca4",
-  "@rollup/rollup-linux-arm-gnueabihf@npm:4.52.5": "ff055f9efd2f8d1e1ced74a0defa0d089b54789f2b3d3d8f9261180059d6cd45fb895399c938c87467419ce1b37f7c50eaec333d5f140e7d8b53874cfba7bad9",
-  "@rollup/rollup-linux-arm-musleabihf@npm:4.52.5": "2932799d8e79831d1f79032d2bced666503466a5d3b87e98a12f577400bad80dfb5ce2883318059c038d061319ed51ed58213bc9b253b3c60a1ac5ca3807ba46",
-  "@rollup/rollup-linux-arm64-gnu@npm:4.52.5": "f2bf47b114856efd75e23baa3c3954fc2a8b864d678610fec5c2ecdab5736d1068fe3c813d29592a9de3f54c0de4055190670ef842333f5bc9e34e1221fb403e",
-  "@rollup/rollup-linux-arm64-musl@npm:4.52.5": "26c8ded405da1a31c414677de84c261d1139cd7bf568e979036d39c613a2783bff559ba9cd4ebeda06c517d709050fea97ed65ca482316322984a1bad51ccc05",
-  "@rollup/rollup-linux-loong64-gnu@npm:4.52.5": "3fec9dbb69d304495c40c26d49e736ae98ac173368ed0f0115fdf90b464e8bdd716b5a10f0458438a8ee31d5b13cb219ceff2ea0773537a87b597a3aaf6c0fbd",
-  "@rollup/rollup-linux-ppc64-gnu@npm:4.52.5": "542b1171f910f3298a1f326ca6dfb41463ac8a9291f21502830a75217d91c38a0701517c4424c1d114b7fcba06b5fdc1ac95b9814ff542fc1c5741c965a12fc0",
-  "@rollup/rollup-linux-riscv64-gnu@npm:4.52.5": "3f8a728b372d5cd2964281bdfe6184cd6dcff579681ea3a9bcb240d2fdaa0181a763f6f34930eae206d00c687cbecfa3d3b18b49bfdef0b772809fac80e007d8",
-  "@rollup/rollup-linux-riscv64-musl@npm:4.52.5": "26b5a6d0983aeea544421d697787a540de653a84f948389280cfde0add366fa0fb7af4a5e67ca490a63a8fabca801f04b23a70bb948cbe06d48aa0ab0b3fff73",
-  "@rollup/rollup-linux-s390x-gnu@npm:4.52.5": "6f4b1605d9cb191ec404ad2418f5fbc43d5585a83eeb33f8a8de6d2393e4ec85fb42a4e55da7d100bdd708e830e89b815d4e444f34b3002096370b1e1e80bee7",
-  "@rollup/rollup-linux-x64-gnu@npm:4.52.5": "70fdee240db9c56c9a2a202450f4fb2b8cad059bb001c10cfc37b8ba1a333f1ad61b4a9bc01df005d9d0eb9c7ae57103c70c4ba58ef89942e11b0eb449cb3fd8",
-  "@rollup/rollup-linux-x64-musl@npm:4.52.5": "871865574e0a5f79af49151685b1e243d43f0eb11100cffb9d835c4aa3423a471dfbb56ba7d16928eb11df7956e307c74d0b5cd872db711cd382bc36e487be9a",
-  "@rollup/rollup-openharmony-arm64@npm:4.52.5": "15150989aa46138a5675962f1bfb01640a212e26976e799be4b0029c2e6f0e7a21b32754457b13dac05d02aa04814b6d0a6ee43dbf3473dc9fce00c7d8c0155f",
-  "@rollup/rollup-win32-arm64-msvc@npm:4.52.5": "6433d349de33e71bb1cd11192ac58827630ef1b4eef79af40708cd7a8375922bfdcde69ed9e31309ae9b9224e3d9237ac00191a1c8406c7e3bbfa99d57baae00",
-  "@rollup/rollup-win32-ia32-msvc@npm:4.52.5": "0da2d66ad1bc046a601b9de5a1266ba61a08e211df670d056451a58ee92a1a1de3739cfae853bf133c4204802ec7c72d2fae607f7ef31789e6124c23441f3f07",
-  "@rollup/rollup-win32-x64-gnu@npm:4.52.5": "a7d3489e79f1cd8e4d34e784f3e32e9681170e4fc7d568cf43b31511c6b9c0e03db722c76baa595799c85ebd96a7e6ce66670ec00ed253e674d7e732a244c554",
-  "@rollup/rollup-win32-x64-msvc@npm:4.52.5": "eb1c823b1e13f27b49321ae56f4c35710194d674034820f6c0b66a2309cbefaff7bc4a58e6c3fbb2453f8913f4aa1cc173cf9f6e9085df47f1922626630260da"
-}
diff --git a/pkgs/by-name/sw/swagger-typescript-api/package.nix b/pkgs/by-name/sw/swagger-typescript-api/package.nix
index b54a6c588812..0134079d766c 100644
--- a/pkgs/by-name/sw/swagger-typescript-api/package.nix
+++ b/pkgs/by-name/sw/swagger-typescript-api/package.nix
@@ -1,15 +1,19 @@
 {
   lib,
   fetchFromGitHub,
-  yarn-berry_4,
   stdenv,
+  makeBinaryWrapper,
+  writableTmpDirAsHomeHook,
   nodejs,
-  makeWrapper,
+  bun,
 }:
 let
   pname = "swagger-typescript-api";
-  version = "13.2.16";
-  yarn-berry = yarn-berry_4;
+  version = "13.2.18";
+
+  node-modules-hash = {
+    "x86_64-linux" = "sha256-IkJk9g5FdvNaBsXaazNg0YX5f2jb/KxHU7BSm0/u4cs=";
+  };
 in
 stdenv.mkDerivation (finalAttrs: {
   inherit pname version;
@@ -17,27 +21,59 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "acacode";
     repo = "swagger-typescript-api";
-    rev = version;
-    hash = "sha256-SPvOCoxtf7x8MLPV8kylyaNXHaNtsHvs6liagd7iyF8=";
+    rev = "v${version}";
+    hash = "sha256-2EC3bLP57qOMXATXVQzlFSUs/KCm8L24saJq0HMgHaY=";
+  };
+
+  node_modules = stdenv.mkDerivation {
+    inherit (finalAttrs) src version;
+    pname = "${pname}-node_modules";
+
+    nativeBuildInputs = [
+      bun
+      writableTmpDirAsHomeHook
+    ];
+
+    dontConfigure = true;
+
+    buildPhase = ''
+      runHook preBuild
+
+      export BUN_INSTALL_CACHE_DIR=$(mktemp -d)
+      bun install --no-progress --frozen-lockfile --no-cache
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/node_modules
+      cp -R ./node_modules $out
+
+      runHook postInstall
+    '';
+
+    outputHash =
+      node-modules-hash.${stdenv.hostPlatform.system}
+        or (throw "${finalAttrs.pname}: Platform ${stdenv.hostPlatform.system} is not packaged yet. Supported platforms: x86_64-linux.");
+    outputHashAlgo = "sha256";
+    outputHashMode = "recursive";
   };
 
   nativeBuildInputs = [
-    makeWrapper
-    yarn-berry.yarnBerryConfigHook
-    yarn-berry
+    makeBinaryWrapper
     nodejs
+    bun
   ];
 
-  missingHashes = ./missing-hashes.json;
-  offlineCache = yarn-berry.fetchYarnBerryDeps {
-    inherit (finalAttrs) src missingHashes;
-    hash = "sha256-ZIF+sA/Wp2Rbu9CeERZo1X1oC00SjE64Mk5verb8IxU=";
-  };
-
   buildPhase = ''
     runHook preBuild
 
-    yarn run build
+    cp -R ${finalAttrs.node_modules}/node_modules .
+    patchShebangs node_modules
+
+    bun run build
 
     runHook postBuild
   '';
@@ -48,8 +84,8 @@ stdenv.mkDerivation (finalAttrs: {
     mkdir -p $out/lib
     cp -r {dist,templates,node_modules} $out/lib
 
-    makeWrapper ${nodejs}/bin/node $out/bin/${pname} \
-      --add-flags $out/lib/dist/cli.js \
+    makeBinaryWrapper ${nodejs}/bin/node $out/bin/${pname} \
+      --add-flags $out/lib/dist/cli.cjs \
       --set NODE_ENV production \
       --set NODE_PATH "$out/lib/node_modules"
 
@@ -60,9 +96,9 @@ stdenv.mkDerivation (finalAttrs: {
     mainProgram = "swagger-typescript-api";
     description = "Generate TypeScript API client and definitions for fetch or axios from an OpenAPI specification";
     homepage = "https://github.com/acacode/swagger-typescript-api";
-    changelog = "https://github.com/acacode/swagger-typescript-api/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/acacode/swagger-typescript-api/blob/v${version}/CHANGELOG.md";
     license = lib.licenses.mit;
-    platforms = lib.platforms.all;
+    platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [ angelodlfrtr ];
   };
 })
diff --git a/pkgs/by-name/sy/system76-scheduler/package.nix b/pkgs/by-name/sy/system76-scheduler/package.nix
index e37b663187fb..c92b38081820 100644
--- a/pkgs/by-name/sy/system76-scheduler/package.nix
+++ b/pkgs/by-name/sy/system76-scheduler/package.nix
@@ -32,7 +32,7 @@ rustPlatform.buildRustPackage {
     pipewire
   ];
 
-  EXECSNOOP_PATH = "${bcc}/bin/execsnoop";
+  env.EXECSNOOP_PATH = "${bcc}/bin/execsnoop";
 
   # tests don't build
   doCheck = false;
diff --git a/pkgs/by-name/te/termcolor/package.nix b/pkgs/by-name/te/termcolor/package.nix
index f2474f74b3a7..49e3f5d0cecf 100644
--- a/pkgs/by-name/te/termcolor/package.nix
+++ b/pkgs/by-name/te/termcolor/package.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [ cmake ];
 
   cmakeFlags = [ "-DTERMCOLOR_TESTS=ON" ];
-  CXXFLAGS = [
+  env.CXXFLAGS = toString [
     # GCC 13: error: 'uint8_t' has not been declared
     "-include cstdint"
   ];
diff --git a/pkgs/by-name/th/thc-hydra/package.nix b/pkgs/by-name/th/thc-hydra/package.nix
index b27d967fabb5..db87bf2d2597 100644
--- a/pkgs/by-name/th/thc-hydra/package.nix
+++ b/pkgs/by-name/th/thc-hydra/package.nix
@@ -63,7 +63,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  DATADIR = "/share/${pname}";
+  env.DATADIR = "/share/${pname}";
 
   postInstall = lib.optionalString withGUI ''
     wrapProgram $out/bin/xhydra \
diff --git a/pkgs/by-name/th/thunar-shares-plugin/package.nix b/pkgs/by-name/th/thunar-shares-plugin/package.nix
new file mode 100644
index 000000000000..23b448124205
--- /dev/null
+++ b/pkgs/by-name/th/thunar-shares-plugin/package.nix
@@ -0,0 +1,54 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitLab,
+  gettext,
+  glib,
+  gtk3,
+  meson,
+  ninja,
+  pkg-config,
+  thunar,
+  xfconf,
+  gitUpdater,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "thunar-shares-plugin";
+  version = "0.5.0";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.xfce.org";
+    owner = "thunar-plugins";
+    repo = "thunar-shares-plugin";
+    tag = "thunar-shares-plugin-${finalAttrs.version}";
+    hash = "sha256-sWLFagoLy1lbAsPYKm8GWwCH+Aa++cDXbRDwkNh6bKk=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    gettext
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    glib
+    gtk3
+    thunar
+    xfconf
+  ];
+
+  passthru.updateScript = gitUpdater { rev-prefix = "thunar-shares-plugin-"; };
+
+  meta = {
+    description = "Thunar plugin providing quick folder sharing using Samba without requiring root access";
+    homepage = "https://gitlab.xfce.org/thunar-plugins/thunar-shares-plugin";
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ fgaz ];
+    platforms = lib.platforms.linux;
+    teams = [ lib.teams.xfce ];
+  };
+})
diff --git a/pkgs/by-name/ti/timekpr/package.nix b/pkgs/by-name/ti/timekpr/package.nix
index e56b2aefc406..5248b0546b4f 100644
--- a/pkgs/by-name/ti/timekpr/package.nix
+++ b/pkgs/by-name/ti/timekpr/package.nix
@@ -9,6 +9,7 @@
   sound-theme-freedesktop,
   stdenv,
   wrapGAppsHook4,
+  writeText,
 }:
 python3Packages.buildPythonApplication rec {
   pname = "timekpr";
@@ -42,49 +43,51 @@ python3Packages.buildPythonApplication rec {
     psutil
   ];
 
-  # Generate setup.py because the upstream repository does not include it
-  SETUP_PY = ''
-    from setuptools import setup, find_namespace_packages
+  postPatch =
+    let
+      # Generate setup.py because the upstream repository does not include it
+      setup-py = writeText "setup.py" ''
+        from setuptools import setup, find_namespace_packages
 
-    package_dir={"timekpr": "."}
-    setup(
-      name="timekpr-next",
-      version="${version}",
-      package_dir=package_dir,
-      packages=[
-        f"{package_prefix}.{package_suffix}"
-        for package_prefix, where in package_dir.items()
-        for package_suffix in find_namespace_packages(where=where)
-      ],
-      install_requires=[
-        ${lib.concatMapStringsSep ", " (dependency: "'${dependency.pname}'") dependencies}
-      ],
-    )
-  '';
+        package_dir={"timekpr": "."}
+        setup(
+          name="timekpr-next",
+          version="${version}",
+          package_dir=package_dir,
+          packages=[
+            f"{package_prefix}.{package_suffix}"
+            for package_prefix, where in package_dir.items()
+            for package_suffix in find_namespace_packages(where=where)
+          ],
+          install_requires=[
+            ${lib.concatMapStringsSep ", " (dependency: "'${dependency.pname}'") dependencies}
+          ],
+        )
+      '';
+    in
+    ''
+      shopt -s globstar extglob nullglob
 
-  postPatch = ''
-    shopt -s globstar extglob nullglob
+      substituteInPlace bin/* **/*.py resource/server/systemd/timekpr.service \
+        --replace-quiet /usr/lib/python3/dist-packages "$out"/${lib.escapeShellArg python3Packages.python.sitePackages}
 
-    substituteInPlace bin/* **/*.py resource/server/systemd/timekpr.service \
-      --replace-quiet /usr/lib/python3/dist-packages "$out"/${lib.escapeShellArg python3Packages.python.sitePackages}
+      substituteInPlace **/*.desktop **/*.policy **/*.service \
+        --replace-fail /usr/bin/timekpr "$out"/bin/timekpr
 
-    substituteInPlace **/*.desktop **/*.policy **/*.service \
-      --replace-fail /usr/bin/timekpr "$out"/bin/timekpr
+      substituteInPlace common/constants/constants.py \
+        --replace-fail /usr/share/sounds/freedesktop ${lib.escapeShellArg sound-theme-freedesktop}/share/sounds/freedesktop \
+        --replace-fail /usr/share/timekpr "$out"/share/timekpr \
+        --replace-fail /usr/share/locale "$out"/share/locale
 
-    substituteInPlace common/constants/constants.py \
-      --replace-fail /usr/share/sounds/freedesktop ${lib.escapeShellArg sound-theme-freedesktop}/share/sounds/freedesktop \
-      --replace-fail /usr/share/timekpr "$out"/share/timekpr \
-      --replace-fail /usr/share/locale "$out"/share/locale
+      substituteInPlace resource/server/timekpr.conf \
+        --replace-fail /usr/share/timekpr "$out"/share/timekpr \
 
-    substituteInPlace resource/server/timekpr.conf \
-      --replace-fail /usr/share/timekpr "$out"/share/timekpr \
+      # The original file name `timekpra` is renamed to `..timekpra-wrapped-wrapped` because `makeCWrapper` was used multiple times.
+      substituteInPlace client/admin/adminprocessor.py \
+        --replace-fail '"/timekpra" in ' '"/..timekpra-wrapped-wrapped" in '
 
-    # The original file name `timekpra` is renamed to `..timekpra-wrapped-wrapped` because `makeCWrapper` was used multiple times.
-    substituteInPlace client/admin/adminprocessor.py \
-      --replace-fail '"/timekpra" in ' '"/..timekpra-wrapped-wrapped" in '
-
-    printf %s "$SETUP_PY" > setup.py
-  '';
+      ln -s ${setup-py} setup.py
+    '';
 
   # We need to manually inject $PYTHONPATH here, because `buildPythonApplication` does not recognize timekpr's executables as Python scripts, and therefore it does not automatically inject $PYTHONPATH into them.
   postFixup = ''
diff --git a/pkgs/by-name/tr/trackma/package.nix b/pkgs/by-name/tr/trackma/package.nix
index a9f97259e755..87417d91dd16 100644
--- a/pkgs/by-name/tr/trackma/package.nix
+++ b/pkgs/by-name/tr/trackma/package.nix
@@ -10,6 +10,7 @@
   qt5,
   makeDesktopItem,
   copyDesktopItems,
+  imagemagick,
   withCurses ? false,
   withGTK ? false,
   withQT ? false,
@@ -46,6 +47,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
   nativeBuildInputs = [
     copyDesktopItems
     python3.pkgs.poetry-core
+    imagemagick
   ]
   ++ lib.optionals withGTK [
     wrapGAppsHook3
@@ -94,7 +96,8 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     );
 
   postInstall = ''
-    install -Dvm444 $src/trackma/data/icon.png $out/share/pixmaps/trackma.png
+    mkdir -p $out/share/icons/hicolor/64x64/apps
+    magick $src/trackma/data/icon.png -resize 64x64! $out/share/icons/hicolor/64x64/apps/trackma.png
   '';
 
   doCheck = false;
diff --git a/pkgs/by-name/tu/tutanota-desktop/package.nix b/pkgs/by-name/tu/tutanota-desktop/package.nix
index ad3159c5b747..7c445f261307 100644
--- a/pkgs/by-name/tu/tutanota-desktop/package.nix
+++ b/pkgs/by-name/tu/tutanota-desktop/package.nix
@@ -25,7 +25,6 @@ appimageTools.wrapType2 rec {
     in
     ''
       install -Dm 444 ${appimageContents}/tutanota-desktop.desktop -t $out/share/applications
-      install -Dm 444 ${appimageContents}/tutanota-desktop.png -t $out/share/pixmaps
       cp -r ${appimageContents}/usr/share/icons/. $out/share/icons
 
       substituteInPlace $out/share/applications/tutanota-desktop.desktop \
diff --git a/pkgs/by-name/tu/tuxpaint/package.nix b/pkgs/by-name/tu/tuxpaint/package.nix
index 27146a18264b..3152be909715 100644
--- a/pkgs/by-name/tu/tuxpaint/package.nix
+++ b/pkgs/by-name/tu/tuxpaint/package.nix
@@ -91,7 +91,6 @@ stdenv.mkDerivation (finalAttrs: {
   postInstall = ''
     # Install desktop file
     mkdir -p $out/share/applications
-    cp hildon/tuxpaint.xpm $out/share/pixmaps
     sed -e "s+Exec=tuxpaint+Exec=$out/bin/tuxpaint+" < src/tuxpaint.desktop > $out/share/applications/tuxpaint.desktop
 
     # Install stamps
@@ -99,6 +98,10 @@ stdenv.mkDerivation (finalAttrs: {
     cd tuxpaint-stamps-*
     make install-all PREFIX=$out
 
+    mkdir -p $out/share/icons/hicolor/32x32/apps
+    magick $out/share/pixmaps/tuxpaint.png -resize 32x32 $out/share/icons/hicolor/32x32/apps/tuxpaint.png
+    rm -r $out/share/pixmaps
+
     # Requirements for tuxpaint-import
     wrapProgram $out/bin/tuxpaint-import \
       --prefix PATH : ${lib.makeBinPath [ netpbm ]}
diff --git a/pkgs/by-name/uc/ucommon/package.nix b/pkgs/by-name/uc/ucommon/package.nix
index a4e623a24d81..1e5830224512 100644
--- a/pkgs/by-name/uc/ucommon/package.nix
+++ b/pkgs/by-name/uc/ucommon/package.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [ pkg-config ];
 
   # use C++14 Standard until error handling code gets updated upstream
-  CXXFLAGS = [ "-std=c++14" ];
+  env.CXXFLAGS = toString [ "-std=c++14" ];
 
   # disable flaky networking test
   postPatch = ''
diff --git a/pkgs/by-name/up/upscayl/linux.nix b/pkgs/by-name/up/upscayl/linux.nix
index 0eba61244f05..1833aa9b7f9b 100644
--- a/pkgs/by-name/up/upscayl/linux.nix
+++ b/pkgs/by-name/up/upscayl/linux.nix
@@ -31,10 +31,8 @@ appimageTools.wrapType2 {
   ];
 
   extraInstallCommands = ''
-    mkdir -p $out/share/{applications,pixmaps}
-
-    cp ${appimageContents}/upscayl.desktop $out/share/applications/upscayl.desktop
-    cp ${appimageContents}/upscayl.png $out/share/pixmaps/upscayl.png
+    install -D ${appimageContents}/upscayl.desktop -t $out/share/applications
+    install -D ${appimageContents}/upscayl.png -t $out/share/icons/hicolor/512x512/apps
 
     substituteInPlace $out/share/applications/upscayl.desktop \
       --replace-fail 'Exec=AppRun --no-sandbox %U' 'Exec=upscayl'
diff --git a/pkgs/by-name/ur/urh/package.nix b/pkgs/by-name/ur/urh/package.nix
index d71ce5ee0bd5..7beff4db9e02 100644
--- a/pkgs/by-name/ur/urh/package.nix
+++ b/pkgs/by-name/ur/urh/package.nix
@@ -85,7 +85,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
   ];
 
   postInstall = ''
-    install -Dm644 data/icons/appicon.png $out/share/pixmaps/urh.png
+    install -Dm644 data/icons/appicon.png $out/share/icons/hicolor/512x512/apps/urh.png
   '';
 
   meta = {
diff --git a/pkgs/by-name/ve/verible/package.nix b/pkgs/by-name/ve/verible/package.nix
index ae5a1c37bec8..067d8d8336e6 100644
--- a/pkgs/by-name/ve/verible/package.nix
+++ b/pkgs/by-name/ve/verible/package.nix
@@ -19,15 +19,21 @@ let
     rev = "3f863a3f35f31b61982d813835d8637b3d93d87a";
     hash = "sha256-BsxP3GrS98ubIAkFx/c4pB1i97ZZL2TijS+2ORnooww=";
   };
-in
-buildBazelPackage rec {
-  pname = "verible";
-
-  # These environment variables are read in bazel/build-version.py to create
-  # a build string shown in the tools --version output.
-  # If env variables not set, it would attempt to extract it from .git/.
   GIT_DATE = "2025-08-29";
   GIT_VERSION = "v0.0-4023-gc1271a00";
+in
+buildBazelPackage {
+  pname = "verible";
+
+  env = {
+    # These environment variables are read in bazel/build-version.py to create
+    # a build string shown in the tools --version output.
+    # If env variables not set, it would attempt to extract it from .git/.
+    inherit GIT_DATE GIT_VERSION;
+  }
+  // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    LIBTOOL = "${cctools}/bin/libtool";
+  };
 
   # Derive nix package version from GIT_VERSION: "v1.2-345-abcde" -> "1.2.345"
   version = builtins.concatStringsSep "." (
@@ -64,7 +70,6 @@ buildBazelPackage rec {
     flex # .. to compile with newer glibc
     python3
   ];
-  LIBTOOL = lib.optionalString stdenv.hostPlatform.isDarwin "${cctools}/bin/libtool";
 
   postPatch = ''
     patchShebangs \
diff --git a/pkgs/by-name/vi/vice/package.nix b/pkgs/by-name/vi/vice/package.nix
index 634b05fddb05..ac958fb50f26 100644
--- a/pkgs/by-name/vi/vice/package.nix
+++ b/pkgs/by-name/vi/vice/package.nix
@@ -72,7 +72,7 @@ stdenv.mkDerivation (finalAttrs: {
     "--with-gif"
   ];
 
-  LIBS = "-lGL";
+  env.LIBS = "-lGL";
 
   preBuild = ''
     sed -i -e 's|#!/usr/bin/env bash|${runtimeShell}/bin/bash|' src/arch/gtk3/novte/box_drawing_generate.sh
diff --git a/pkgs/by-name/vi/vintagestory/package.nix b/pkgs/by-name/vi/vintagestory/package.nix
index 333a51bf753f..60f5ba20d977 100644
--- a/pkgs/by-name/vi/vintagestory/package.nix
+++ b/pkgs/by-name/vi/vintagestory/package.nix
@@ -23,6 +23,7 @@
   waylandSupport ? false,
   wayland ? null,
   libxkbcommon ? null,
+  imagemagick,
 }:
 
 assert x11Support || waylandSupport;
@@ -41,6 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     makeWrapper
     copyDesktopItems
+    imagemagick
   ];
 
   runtimeLibs = [
@@ -89,9 +91,9 @@ stdenv.mkDerivation (finalAttrs: {
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out/share/vintagestory $out/bin $out/share/pixmaps $out/share/fonts/truetype
+    mkdir -p $out/share/vintagestory $out/bin $out/share/icons/hicolor/512x512/apps $out/share/fonts/truetype
     cp -r * $out/share/vintagestory
-    cp $out/share/vintagestory/assets/gameicon.xpm $out/share/pixmaps/vintagestory.xpm
+    magick $out/share/vintagestory/assets/gameicon.xpm $out/share/icons/hicolor/512x512/apps/vintagestory.png
     cp $out/share/vintagestory/assets/game/fonts/*.ttf $out/share/fonts/truetype
 
     runHook postInstall
diff --git a/pkgs/by-name/vi/virtiofsd/package.nix b/pkgs/by-name/vi/virtiofsd/package.nix
index 19b607a1aab7..1b3ef67272c8 100644
--- a/pkgs/by-name/vi/virtiofsd/package.nix
+++ b/pkgs/by-name/vi/virtiofsd/package.nix
@@ -23,8 +23,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoHash = "sha256-AOWHlvFvKj05f4/KE1F37qkRstW5gUlRH0HZVZrg7Dg=";
 
-  LIBCAPNG_LIB_PATH = "${lib.getLib libcap_ng}/lib";
-  LIBCAPNG_LINK_TYPE = if stdenv.hostPlatform.isStatic then "static" else "dylib";
+  env = {
+    LIBCAPNG_LIB_PATH = "${lib.getLib libcap_ng}/lib";
+    LIBCAPNG_LINK_TYPE = if stdenv.hostPlatform.isStatic then "static" else "dylib";
+  };
 
   buildInputs = [
     libcap_ng
diff --git a/pkgs/by-name/wa/waypipe/package.nix b/pkgs/by-name/wa/waypipe/package.nix
index b32e73714ff1..eacc5b6cbdc4 100644
--- a/pkgs/by-name/wa/waypipe/package.nix
+++ b/pkgs/by-name/wa/waypipe/package.nix
@@ -38,7 +38,7 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
   };
 
   strictDeps = true;
-  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
+  env.LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
   depsBuildBuild = [ pkg-config ];
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/we/weblate/package.nix b/pkgs/by-name/we/weblate/package.nix
index 2fc9c6dbe630..213dcf3935c1 100644
--- a/pkgs/by-name/we/weblate/package.nix
+++ b/pkgs/by-name/we/weblate/package.nix
@@ -35,6 +35,15 @@ let
       django = prev.django_5;
     };
   };
+
+  GI_TYPELIB_PATH = lib.makeSearchPathOutput "out" "lib/girepository-1.0" [
+    pango
+    harfbuzz
+    librsvg
+    gdk-pixbuf
+    glib
+    gobject-introspection
+  ];
 in
 python.pkgs.buildPythonApplication rec {
   pname = "weblate";
@@ -197,14 +206,10 @@ python.pkgs.buildPythonApplication rec {
   };
 
   # We don't just use wrapGAppsNoGuiHook because we need to expose GI_TYPELIB_PATH
-  GI_TYPELIB_PATH = lib.makeSearchPathOutput "out" "lib/girepository-1.0" [
-    pango
-    harfbuzz
-    librsvg
-    gdk-pixbuf
-    glib
-    gobject-introspection
-  ];
+  env = {
+    inherit GI_TYPELIB_PATH;
+  };
+
   makeWrapperArgs = [ "--set GI_TYPELIB_PATH \"$GI_TYPELIB_PATH\"" ];
 
   nativeCheckInputs =
diff --git a/pkgs/by-name/xg/xgboost/package.nix b/pkgs/by-name/xg/xgboost/package.nix
index 486801e20524..134da018efd4 100644
--- a/pkgs/by-name/xg/xgboost/package.nix
+++ b/pkgs/by-name/xg/xgboost/package.nix
@@ -90,9 +90,6 @@ effectiveStdenv.mkDerivation rec {
     ++ lib.optionals ncclSupport [ "-DUSE_NCCL=ON" ]
     ++ lib.optionals rLibrary [ "-DR_LIB=ON" ];
 
-  # on Darwin, cmake uses find_library to locate R instead of using the PATH
-  env.NIX_LDFLAGS = "-L${R}/lib/R/lib";
-
   preConfigure = lib.optionals rLibrary ''
     substituteInPlace cmake/RPackageInstall.cmake.in --replace "CMD INSTALL" "CMD INSTALL -l $out/library"
     export R_LIBS_SITE="$R_LIBS_SITE''${R_LIBS_SITE:+:}$out/library"
@@ -106,70 +103,75 @@ effectiveStdenv.mkDerivation rec {
     ctest --force-new-ctest-process ${lib.optionalString cudaSupport "-E TestXGBoostLib"}
   '';
 
-  # Disable finicky tests from dmlc core that fail in Hydra. XGboost team
-  # confirmed xgboost itself does not use this part of the dmlc code.
-  GTEST_FILTER =
-    let
-      # Upstream Issue: https://github.com/xtensor-stack/xsimd/issues/456
-      xsimdTests = lib.optionals effectiveStdenv.hostPlatform.isDarwin [
-        "ThreadGroup.TimerThread"
-        "ThreadGroup.TimerThreadSimple"
-      ];
-      networkingTest = [
-        "AllgatherTest.Basic"
-        "AllgatherTest.VAlgo"
-        "AllgatherTest.VBasic"
-        "AllgatherTest.VRing"
-        "AllreduceGlobal.Basic"
-        "AllreduceGlobal.Small"
-        "AllreduceTest.Basic"
-        "AllreduceTest.BitOr"
-        "AllreduceTest.Restricted"
-        "AllreduceTest.Sum"
-        "Approx.PartitionerColumnSplit"
-        "BroadcastTest.Basic"
-        "CPUHistogram.BuildHistColSplit"
-        "CPUHistogram.BuildHistColumnSplit"
-        "CPUPredictor.CategoricalPredictLeafColumnSplit"
-        "CPUPredictor.CategoricalPredictionColumnSplit"
-        "ColumnSplit/ColumnSplitTrainingTest*"
-        "ColumnSplit/TestApproxColumnSplit*"
-        "ColumnSplit/TestHistColumnSplit*"
-        "ColumnSplitObjective/TestColumnSplit*"
-        "Cpu/ColumnSplitTrainingTest*"
-        "CommGroupTest.Basic"
-        "CommTest.Channel"
-        "CpuPredictor.BasicColumnSplit"
-        "CpuPredictor.IterationRangeColmnSplit"
-        "CpuPredictor.LesserFeaturesColumnSplit"
-        "CpuPredictor.SparseColumnSplit"
-        "DistributedMetric/TestDistributedMetric.BinaryAUCRowSplit/Dist_*"
-        "InitEstimation.FitStumpColumnSplit"
-        "MetaInfo.GetSetFeatureColumnSplit"
-        "Quantile.ColumnSplit"
-        "Quantile.ColumnSplitBasic"
-        "Quantile.ColumnSplitSorted"
-        "Quantile.ColumnSplitSortedBasic"
-        "Quantile.Distributed"
-        "Quantile.DistributedBasic"
-        "Quantile.SameOnAllWorkers"
-        "Quantile.SortedDistributed"
-        "Quantile.SortedDistributedBasic"
-        "QuantileHist.MultiPartitionerColumnSplit"
-        "QuantileHist.PartitionerColumnSplit"
-        "Stats.SampleMean"
-        "Stats.WeightedSampleMean"
-        "SimpleDMatrix.ColumnSplit"
-        "TrackerAPITest.CAPI"
-        "TrackerTest.AfterShutdown"
-        "TrackerTest.Bootstrap"
-        "TrackerTest.GetHostAddress"
-        "TrackerTest.Print"
-        "VectorAllgatherV.Basic"
-      ];
-      excludedTests = xsimdTests ++ networkingTest;
-    in
-    "-${builtins.concatStringsSep ":" excludedTests}";
+  env = {
+    # on Darwin, cmake uses find_library to locate R instead of using the PATH
+    NIX_LDFLAGS = "-L${R}/lib/R/lib";
+
+    # Disable finicky tests from dmlc core that fail in Hydra. XGboost team
+    # confirmed xgboost itself does not use this part of the dmlc code.
+    GTEST_FILTER =
+      let
+        # Upstream Issue: https://github.com/xtensor-stack/xsimd/issues/456
+        xsimdTests = lib.optionals effectiveStdenv.hostPlatform.isDarwin [
+          "ThreadGroup.TimerThread"
+          "ThreadGroup.TimerThreadSimple"
+        ];
+        networkingTest = [
+          "AllgatherTest.Basic"
+          "AllgatherTest.VAlgo"
+          "AllgatherTest.VBasic"
+          "AllgatherTest.VRing"
+          "AllreduceGlobal.Basic"
+          "AllreduceGlobal.Small"
+          "AllreduceTest.Basic"
+          "AllreduceTest.BitOr"
+          "AllreduceTest.Restricted"
+          "AllreduceTest.Sum"
+          "Approx.PartitionerColumnSplit"
+          "BroadcastTest.Basic"
+          "CPUHistogram.BuildHistColSplit"
+          "CPUHistogram.BuildHistColumnSplit"
+          "CPUPredictor.CategoricalPredictLeafColumnSplit"
+          "CPUPredictor.CategoricalPredictionColumnSplit"
+          "ColumnSplit/ColumnSplitTrainingTest*"
+          "ColumnSplit/TestApproxColumnSplit*"
+          "ColumnSplit/TestHistColumnSplit*"
+          "ColumnSplitObjective/TestColumnSplit*"
+          "Cpu/ColumnSplitTrainingTest*"
+          "CommGroupTest.Basic"
+          "CommTest.Channel"
+          "CpuPredictor.BasicColumnSplit"
+          "CpuPredictor.IterationRangeColmnSplit"
+          "CpuPredictor.LesserFeaturesColumnSplit"
+          "CpuPredictor.SparseColumnSplit"
+          "DistributedMetric/TestDistributedMetric.BinaryAUCRowSplit/Dist_*"
+          "InitEstimation.FitStumpColumnSplit"
+          "MetaInfo.GetSetFeatureColumnSplit"
+          "Quantile.ColumnSplit"
+          "Quantile.ColumnSplitBasic"
+          "Quantile.ColumnSplitSorted"
+          "Quantile.ColumnSplitSortedBasic"
+          "Quantile.Distributed"
+          "Quantile.DistributedBasic"
+          "Quantile.SameOnAllWorkers"
+          "Quantile.SortedDistributed"
+          "Quantile.SortedDistributedBasic"
+          "QuantileHist.MultiPartitionerColumnSplit"
+          "QuantileHist.PartitionerColumnSplit"
+          "Stats.SampleMean"
+          "Stats.WeightedSampleMean"
+          "SimpleDMatrix.ColumnSplit"
+          "TrackerAPITest.CAPI"
+          "TrackerTest.AfterShutdown"
+          "TrackerTest.Bootstrap"
+          "TrackerTest.GetHostAddress"
+          "TrackerTest.Print"
+          "VectorAllgatherV.Basic"
+        ];
+        excludedTests = xsimdTests ++ networkingTest;
+      in
+      "-${builtins.concatStringsSep ":" excludedTests}";
+  };
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/by-name/yt/ytdownloader/package.nix b/pkgs/by-name/yt/ytdownloader/package.nix
index 47aff6b74a2d..341edc43421e 100644
--- a/pkgs/by-name/yt/ytdownloader/package.nix
+++ b/pkgs/by-name/yt/ytdownloader/package.nix
@@ -45,7 +45,7 @@ buildNpmPackage rec {
     })
   ];
 
-  ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/by-name/zp/zpaq/package.nix b/pkgs/by-name/zp/zpaq/package.nix
index ee9ebd2a53e2..38c1bebead71 100644
--- a/pkgs/by-name/zp/zpaq/package.nix
+++ b/pkgs/by-name/zp/zpaq/package.nix
@@ -20,14 +20,20 @@ stdenv.mkDerivation (finalAttrs: {
     perl # for pod2man
   ];
 
-  CPPFLAGS = [
-    "-Dunix"
-  ]
-  ++ lib.optional (!stdenv.hostPlatform.isi686 && !stdenv.hostPlatform.isx86_64) "-DNOJIT";
-  CXXFLAGS = [
-    "-O3"
-    "-DNDEBUG"
-  ];
+  env = {
+    CPPFLAGS = toString (
+      [
+        "-Dunix"
+      ]
+      ++ lib.optionals (!stdenv.hostPlatform.isi686 && !stdenv.hostPlatform.isx86_64) [
+        "-DNOJIT"
+      ]
+    );
+    CXXFLAGS = toString [
+      "-O3"
+      "-DNDEBUG"
+    ];
+  };
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/by-name/zw/zwave-js-ui/package.nix b/pkgs/by-name/zw/zwave-js-ui/package.nix
index 4534be6b4677..cdab52b5909b 100644
--- a/pkgs/by-name/zw/zwave-js-ui/package.nix
+++ b/pkgs/by-name/zw/zwave-js-ui/package.nix
@@ -7,15 +7,15 @@
 
 buildNpmPackage rec {
   pname = "zwave-js-ui";
-  version = "11.11.0";
+  version = "11.12.0";
 
   src = fetchFromGitHub {
     owner = "zwave-js";
     repo = "zwave-js-ui";
     tag = "v${version}";
-    hash = "sha256-pxLpHeFBdmbuw4VtVgrOMfE8uPft2AyYcwdIyXpUz2s=";
+    hash = "sha256-ewJJCeGR2jmw0CeEB4Ip4wkQ0V+NDwkqOAr/1wGiULI=";
   };
-  npmDepsHash = "sha256-BZnHHIjRbhMCq8miK4lPkhIfE13sEv4q0Ting/mmavQ=";
+  npmDepsHash = "sha256-IKZTmA410mFLZuf2AgPI8P8csBNI+Nx1+P8WGqk3fQ8=";
 
   passthru.tests.zwave-js-ui = nixosTests.zwave-js-ui;
 
diff --git a/pkgs/development/beam-modules/livebook/default.nix b/pkgs/development/beam-modules/livebook/default.nix
index ab484ea47cac..81adf8d0e35a 100644
--- a/pkgs/development/beam-modules/livebook/default.nix
+++ b/pkgs/development/beam-modules/livebook/default.nix
@@ -9,7 +9,7 @@
 
 beamPackages.mixRelease rec {
   pname = "livebook";
-  version = "0.18.5";
+  version = "0.18.6";
 
   inherit (beamPackages) elixir;
 
@@ -21,7 +21,7 @@ beamPackages.mixRelease rec {
     owner = "livebook-dev";
     repo = "livebook";
     tag = "v${version}";
-    hash = "sha256-yClo+PkEDuRHzVm/XPGxq896MwuM2305Tu7/B5M900A=";
+    hash = "sha256-8pFvY86ht2NMUtknjt5M7QasOKnoHvQdYJrOlgTyueU=";
   };
 
   mixFodDeps = beamPackages.fetchMixDeps {
diff --git a/pkgs/development/compilers/chicken/4/eggDerivation.nix b/pkgs/development/compilers/chicken/4/eggDerivation.nix
index 7e334782fe78..a4eb19b8a927 100644
--- a/pkgs/development/compilers/chicken/4/eggDerivation.nix
+++ b/pkgs/development/compilers/chicken/4/eggDerivation.nix
@@ -26,10 +26,13 @@ stdenv.mkDerivation (
     nativeBuildInputs = [ makeWrapper ];
     buildInputs = [ chicken ];
 
-    CSC_OPTIONS = lib.concatStringsSep " " cscOptions;
+    env = {
+      CSC_OPTIONS = lib.concatStringsSep " " cscOptions;
 
-    CHICKEN_REPOSITORY = libPath;
-    CHICKEN_INSTALL_PREFIX = "$out";
+      CHICKEN_REPOSITORY = libPath;
+      CHICKEN_INSTALL_PREFIX = "$out";
+    }
+    // (args.env or { });
 
     installPhase = ''
       runHook preInstall
diff --git a/pkgs/development/compilers/chicken/5/eggDerivation.nix b/pkgs/development/compilers/chicken/5/eggDerivation.nix
index 6629a30ad973..dcb8e8dbd6f4 100644
--- a/pkgs/development/compilers/chicken/5/eggDerivation.nix
+++ b/pkgs/development/compilers/chicken/5/eggDerivation.nix
@@ -41,7 +41,10 @@ in
 
     strictDeps = true;
 
-    CSC_OPTIONS = lib.concatStringsSep " " cscOptions;
+    env = {
+      CSC_OPTIONS = lib.concatStringsSep " " cscOptions;
+    }
+    // (args.env or { });
 
     buildPhase = ''
       runHook preBuild
diff --git a/pkgs/development/compilers/chicken/5/overrides.nix b/pkgs/development/compilers/chicken/5/overrides.nix
index ef48b8c0232c..1c3d7776ed94 100644
--- a/pkgs/development/compilers/chicken/5/overrides.nix
+++ b/pkgs/development/compilers/chicken/5/overrides.nix
@@ -24,7 +24,7 @@ let
   broken = addMetaAttrs { broken = true; };
   brokenOnDarwin = addMetaAttrs { broken = stdenv.hostPlatform.isDarwin; };
   addToCscOptions = opt: old: {
-    CSC_OPTIONS = lib.concatStringsSep " " ([ old.CSC_OPTIONS or "" ] ++ lib.toList opt);
+    env.CSC_OPTIONS = lib.concatStringsSep " " ([ old.env.CSC_OPTIONS or "" ] ++ lib.toList opt);
   };
 in
 {
diff --git a/pkgs/development/compilers/gcc/common/builder.nix b/pkgs/development/compilers/gcc/common/builder.nix
index b1b5daeb00f1..1e90828a6643 100644
--- a/pkgs/development/compilers/gcc/common/builder.nix
+++ b/pkgs/development/compilers/gcc/common/builder.nix
@@ -363,6 +363,13 @@ originalAttrs:
           fi
       done
     ''
+    + lib.optionalString stdenv.targetPlatform.isCygwin ''
+      targetBinDir="''${targetConfig+$targetConfig/}bin"
+      for i in "''${!outputBin}/$targetLibDir"/cyg*.dll; do
+        mkdir -p "''${!outputLib}/$targetBinDir"
+        mv "$i" "''${!outputLib}/$targetBinDir"/
+      done
+    ''
     # if cross-compiling, link from $lib/lib to $lib/${targetConfig}.
     # since native-compiles have $lib/lib as a directory (not a
     # symlink), this ensures that in every case we can assume that
diff --git a/pkgs/development/coq-modules/mathcomp-bigenough/default.nix b/pkgs/development/coq-modules/mathcomp-bigenough/default.nix
index 0d890af79364..15bf8d24756d 100644
--- a/pkgs/development/coq-modules/mathcomp-bigenough/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-bigenough/default.nix
@@ -6,37 +6,47 @@
   version ? null,
 }:
 
-mkCoqDerivation {
+let
+  derivation = mkCoqDerivation {
 
-  namePrefix = [
-    "coq"
-    "mathcomp"
-  ];
-  pname = "bigenough";
-  owner = "math-comp";
+    namePrefix = [
+      "coq"
+      "mathcomp"
+    ];
+    pname = "bigenough";
+    owner = "math-comp";
 
-  release = {
-    "1.0.0".sha256 = "10g0gp3hk7wri7lijkrqna263346wwf6a3hbd4qr9gn8hmsx70wg";
-    "1.0.1".sha256 = "sha256:02f4dv4rz72liciwxb2k7acwx6lgqz4381mqyq5854p3nbyn06aw";
-    "1.0.2".sha256 = "sha256-fJ/5xr91VtvpIoaFwb3PlnKl6UHG6GEeBRVGZrVLMU0=";
-    "1.0.3".sha256 = "sha256-9ObUoaavnninL72r5iqkLz7lJBpcKXXi8LXKGhgx/N4=";
+    release = {
+      "1.0.0".sha256 = "10g0gp3hk7wri7lijkrqna263346wwf6a3hbd4qr9gn8hmsx70wg";
+      "1.0.1".sha256 = "sha256:02f4dv4rz72liciwxb2k7acwx6lgqz4381mqyq5854p3nbyn06aw";
+      "1.0.2".sha256 = "sha256-fJ/5xr91VtvpIoaFwb3PlnKl6UHG6GEeBRVGZrVLMU0=";
+      "1.0.3".sha256 = "sha256-9ObUoaavnninL72r5iqkLz7lJBpcKXXi8LXKGhgx/N4=";
+    };
+    inherit version;
+    defaultVersion =
+      let
+        case = case: out: { inherit case out; };
+      in
+      with lib.versions;
+      lib.switch coq.coq-version [
+        (case (range "8.10" "9.1") "1.0.3")
+        (case (range "8.10" "9.1") "1.0.2")
+        (case (range "8.5" "8.14") "1.0.0")
+      ] null;
+
+    propagatedBuildInputs = [ mathcomp-boot ];
+
+    meta = {
+      description = "Small library to do epsilon - N reasonning";
+      license = lib.licenses.cecill-b;
+    };
   };
-  inherit version;
-  defaultVersion =
-    let
-      case = case: out: { inherit case out; };
-    in
-    with lib.versions;
-    lib.switch coq.coq-version [
-      (case (range "8.10" "9.1") "1.0.3")
-      (case (range "8.10" "9.1") "1.0.2")
-      (case (range "8.5" "8.14") "1.0.0")
-    ] null;
-
-  propagatedBuildInputs = [ mathcomp-boot ];
-
-  meta = {
-    description = "Small library to do epsilon - N reasonning";
-    license = lib.licenses.cecill-b;
-  };
-}
+in
+# this is just a wrapper for rocqPackages.mathcomp-bigenough for Rocq >= 9.0
+if coq.rocqPackages ? mathcomp-bigenough then
+  coq.rocqPackages.mathcomp-bigenough.override {
+    inherit version mathcomp-boot;
+    inherit (coq.rocqPackages) rocq-core;
+  }
+else
+  derivation
diff --git a/pkgs/development/coq-modules/mathcomp-finmap/default.nix b/pkgs/development/coq-modules/mathcomp-finmap/default.nix
index 3aab002a5897..9c6b4b2bd49f 100644
--- a/pkgs/development/coq-modules/mathcomp-finmap/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-finmap/default.nix
@@ -6,64 +6,74 @@
   version ? null,
 }:
 
-mkCoqDerivation {
+let
+  derivation = mkCoqDerivation {
 
-  namePrefix = [
-    "coq"
-    "mathcomp"
-  ];
-  pname = "finmap";
-  owner = "math-comp";
-  inherit version;
-  defaultVersion =
-    let
-      case = coq: mc: out: {
-        cases = [
-          coq
-          mc
-        ];
-        inherit out;
-      };
-    in
-    with lib.versions;
-    lib.switch
-      [ coq.coq-version mathcomp-boot.version ]
-      [
-        (case (range "8.20" "9.1") (range "2.3" "2.5") "2.2.2")
-        (case (range "8.20" "9.1") (range "2.3" "2.4") "2.2.0")
-        (case (range "8.16" "9.0") (range "2.0" "2.3") "2.1.0")
-        (case (range "8.16" "8.18") (range "2.0" "2.1") "2.0.0")
-        (case (range "8.13" "8.20") (range "1.12" "1.19") "1.5.2")
-        (case (isGe "8.10") (range "1.11" "1.17") "1.5.1")
-        (case (range "8.7" "8.11") "1.11.0" "1.5.0")
-        (case (isEq "8.11") (range "1.8" "1.10") "1.4.0+coq-8.11")
-        (case (range "8.7" "8.11.0") (range "1.8" "1.10") "1.4.0")
-        (case (range "8.7" "8.11.0") (range "1.8" "1.10") "1.3.4")
-        (case (range "8.7" "8.9") "1.7.0" "1.1.0")
-        (case (range "8.6" "8.7") (range "1.6.1" "1.7") "1.0.0")
-      ]
-      null;
-  release = {
-    "2.2.2".sha256 = "sha256-G5fSdx4MhOXtQ2H8lpyK5FuIbWAZNc7vRL3hcYmGA2o=";
-    "2.2.0".sha256 = "sha256-oDQEZOutrJxmN8FvzovUIhqw0mwc8Ej7thrieJrW8BY=";
-    "2.1.0".sha256 = "sha256-gh0cnhdVDyo+D5zdtxLc10kGKQLQ3ITzHnMC45mCtpY=";
-    "2.0.0".sha256 = "sha256-0Wr1ZUYVuZH74vawO4EZlZ+K3kq+s1xEz/BfzyKj+wk=";
-    "1.5.2".sha256 = "sha256-0KmmSjc2AlUo6BKr9RZ4FjL9wlGISlTGU0X1Eu7l4sw=";
-    "1.5.1".sha256 = "0ryfml4pf1dfya16d8ma80favasmrygvspvb923n06kfw9v986j7";
-    "1.5.0".sha256 = "0vx9n1fi23592b3hv5p5ycy7mxc8qh1y5q05aksfwbzkk5zjkwnq";
-    "1.4.1".sha256 = "0kx4nx24dml1igk0w0qijmw221r5bgxhwhl5qicnxp7ab3c35s8p";
-    "1.4.0+coq-8.11".sha256 = "1fd00ihyx0kzq5fblh9vr8s5mr1kg7p6pk11c4gr8svl1n69ppmb";
-    "1.4.0".sha256 = "0mp82mcmrs424ff1vj3cvd8353r9vcap027h3p0iprr1vkkwjbzd";
-    "1.3.4".sha256 = "0f5a62ljhixy5d7gsnwd66gf054l26k3m79fb8nz40i2mgp6l9ii";
-    "1.2.1".sha256 = "0jryb5dq8js3imbmwrxignlk5zh8gwfb1wr4b1s7jbwz410vp7zf";
-    "1.1.0".sha256 = "05df59v3na8jhpsfp7hq3niam6asgcaipg2wngnzxzqnl86srp2a";
-    "1.0.0".sha256 = "0sah7k9qm8sw17cgd02f0x84hki8vj8kdz7h15i7rmz08rj0whpa";
+    namePrefix = [
+      "coq"
+      "mathcomp"
+    ];
+    pname = "finmap";
+    owner = "math-comp";
+    inherit version;
+    defaultVersion =
+      let
+        case = coq: mc: out: {
+          cases = [
+            coq
+            mc
+          ];
+          inherit out;
+        };
+      in
+      with lib.versions;
+      lib.switch
+        [ coq.coq-version mathcomp-boot.version ]
+        [
+          (case (range "8.20" "9.1") (range "2.3" "2.5") "2.2.2")
+          (case (range "8.20" "9.1") (range "2.3" "2.4") "2.2.0")
+          (case (range "8.16" "9.0") (range "2.0" "2.3") "2.1.0")
+          (case (range "8.16" "8.18") (range "2.0" "2.1") "2.0.0")
+          (case (range "8.13" "8.20") (range "1.12" "1.19") "1.5.2")
+          (case (isGe "8.10") (range "1.11" "1.17") "1.5.1")
+          (case (range "8.7" "8.11") "1.11.0" "1.5.0")
+          (case (isEq "8.11") (range "1.8" "1.10") "1.4.0+coq-8.11")
+          (case (range "8.7" "8.11.0") (range "1.8" "1.10") "1.4.0")
+          (case (range "8.7" "8.11.0") (range "1.8" "1.10") "1.3.4")
+          (case (range "8.7" "8.9") "1.7.0" "1.1.0")
+          (case (range "8.6" "8.7") (range "1.6.1" "1.7") "1.0.0")
+        ]
+        null;
+    release = {
+      "2.2.2".sha256 = "sha256-G5fSdx4MhOXtQ2H8lpyK5FuIbWAZNc7vRL3hcYmGA2o=";
+      "2.2.0".sha256 = "sha256-oDQEZOutrJxmN8FvzovUIhqw0mwc8Ej7thrieJrW8BY=";
+      "2.1.0".sha256 = "sha256-gh0cnhdVDyo+D5zdtxLc10kGKQLQ3ITzHnMC45mCtpY=";
+      "2.0.0".sha256 = "sha256-0Wr1ZUYVuZH74vawO4EZlZ+K3kq+s1xEz/BfzyKj+wk=";
+      "1.5.2".sha256 = "sha256-0KmmSjc2AlUo6BKr9RZ4FjL9wlGISlTGU0X1Eu7l4sw=";
+      "1.5.1".sha256 = "0ryfml4pf1dfya16d8ma80favasmrygvspvb923n06kfw9v986j7";
+      "1.5.0".sha256 = "0vx9n1fi23592b3hv5p5ycy7mxc8qh1y5q05aksfwbzkk5zjkwnq";
+      "1.4.1".sha256 = "0kx4nx24dml1igk0w0qijmw221r5bgxhwhl5qicnxp7ab3c35s8p";
+      "1.4.0+coq-8.11".sha256 = "1fd00ihyx0kzq5fblh9vr8s5mr1kg7p6pk11c4gr8svl1n69ppmb";
+      "1.4.0".sha256 = "0mp82mcmrs424ff1vj3cvd8353r9vcap027h3p0iprr1vkkwjbzd";
+      "1.3.4".sha256 = "0f5a62ljhixy5d7gsnwd66gf054l26k3m79fb8nz40i2mgp6l9ii";
+      "1.2.1".sha256 = "0jryb5dq8js3imbmwrxignlk5zh8gwfb1wr4b1s7jbwz410vp7zf";
+      "1.1.0".sha256 = "05df59v3na8jhpsfp7hq3niam6asgcaipg2wngnzxzqnl86srp2a";
+      "1.0.0".sha256 = "0sah7k9qm8sw17cgd02f0x84hki8vj8kdz7h15i7rmz08rj0whpa";
+    };
+
+    propagatedBuildInputs = [ mathcomp-boot ];
+
+    meta = {
+      description = "Finset and finmap library";
+      license = lib.licenses.cecill-b;
+    };
   };
-
-  propagatedBuildInputs = [ mathcomp-boot ];
-
-  meta = {
-    description = "Finset and finmap library";
-    license = lib.licenses.cecill-b;
-  };
-}
+in
+# this is just a wrapper for rocqPackages.mathcomp-finmap for Rocq >= 9.0
+if coq.rocqPackages ? mathcomp-finmap then
+  coq.rocqPackages.mathcomp-finmap.override {
+    inherit version mathcomp-boot;
+    inherit (coq.rocqPackages) rocq-core;
+  }
+else
+  derivation
diff --git a/pkgs/development/libraries/librsb/default.nix b/pkgs/development/libraries/librsb/default.nix
index e878e84e8d18..83caf9d4ac24 100644
--- a/pkgs/development/libraries/librsb/default.nix
+++ b/pkgs/development/libraries/librsb/default.nix
@@ -45,14 +45,16 @@ stdenv.mkDerivation rec {
   ];
 
   # Ensure C/Fortran code is position-independent.
-  env.NIX_CFLAGS_COMPILE = toString [
-    "-fPIC"
-    "-Ofast"
-  ];
-  FCFLAGS = [
-    "-fPIC"
-    "-Ofast"
-  ];
+  env = {
+    NIX_CFLAGS_COMPILE = toString [
+      "-fPIC"
+      "-Ofast"
+    ];
+    FCFLAGS = toString [
+      "-fPIC"
+      "-Ofast"
+    ];
+  };
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/opencolorio/default.nix b/pkgs/development/libraries/opencolorio/default.nix
index 5ffa44c14037..64c6ef1defee 100644
--- a/pkgs/development/libraries/opencolorio/default.nix
+++ b/pkgs/development/libraries/opencolorio/default.nix
@@ -68,7 +68,7 @@ stdenv.mkDerivation rec {
 
   # Gcc blindly tries to optimize all float operations instead of just marked ones.
   # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=122304
-  CXXFLAGS = "-ffp-contract=on";
+  env.CXXFLAGS = "-ffp-contract=on";
   cmakeFlags = [
     "-DOCIO_INSTALL_EXT_PACKAGES=NONE"
     "-DOCIO_USE_SSE2NEON=OFF"
diff --git a/pkgs/development/libraries/wayland/default.nix b/pkgs/development/libraries/wayland/default.nix
index eec81c239e59..ca472fb06234 100644
--- a/pkgs/development/libraries/wayland/default.nix
+++ b/pkgs/development/libraries/wayland/default.nix
@@ -108,6 +108,11 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://wayland.freedesktop.org/";
     license = lib.licenses.mit; # Expat version
     platforms = lib.platforms.unix;
+    # Builds with a large downstream patch, but breaks at least the
+    # `qt6Packages.qtbase` build. Please audit Wayland availability
+    # checks throughout the tree before enabling (and work with
+    # upstream if you want sustainable Wayland support on macOS).
+    badPlatforms = lib.platforms.darwin;
     maintainers = with lib.maintainers; [
       codyopel
       qyliss
diff --git a/pkgs/development/php-packages/phan/default.nix b/pkgs/development/php-packages/phan/default.nix
index 18e33ed93875..3cf0ec59b8b2 100644
--- a/pkgs/development/php-packages/phan/default.nix
+++ b/pkgs/development/php-packages/phan/default.nix
@@ -8,16 +8,16 @@
 (php.withExtensions ({ enabled, all }: enabled ++ (with all; [ ast ]))).buildComposerProject2
   (finalAttrs: {
     pname = "phan";
-    version = "6.0.0";
+    version = "6.0.1";
 
     src = fetchFromGitHub {
       owner = "phan";
       repo = "phan";
       tag = finalAttrs.version;
-      hash = "sha256-1qRGNDptiAdcGc1x+iLrxe9TjLGaL8EM8xuTOUNB+Ww=";
+      hash = "sha256-B6n4hGsUFwFsTLUMhtmElgF0xNqfol9RQ83aP9Zs/AI=";
     };
 
-    vendorHash = "sha256-Ro5/lA72xVIkZyuRNix77Cpeyyj1GbW5J4DzjQMq0Rc=";
+    vendorHash = "sha256-8m0aoK6P6HUhNLh4avMm9C0qBKVfsK9zQ+iJVWVhWm4=";
 
     composerStrictValidation = false;
     doInstallCheck = true;
diff --git a/pkgs/development/python-modules/emborg/default.nix b/pkgs/development/python-modules/emborg/default.nix
index b45a6e5c1a9e..223613f55988 100644
--- a/pkgs/development/python-modules/emborg/default.nix
+++ b/pkgs/development/python-modules/emborg/default.nix
@@ -50,7 +50,7 @@ buildPythonPackage rec {
   ];
 
   # this disables testing fuse mounts
-  MISSING_DEPENDENCIES = "fuse";
+  env.MISSING_DEPENDENCIES = "fuse";
 
   postPatch = ''
     patchShebangs .
diff --git a/pkgs/development/python-modules/geniushub-client/default.nix b/pkgs/development/python-modules/geniushub-client/default.nix
index 6eceb28fd3f6..cdb5f955f682 100644
--- a/pkgs/development/python-modules/geniushub-client/default.nix
+++ b/pkgs/development/python-modules/geniushub-client/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "geniushub-client";
-  version = "0.7.2";
+  version = "0.7.3";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "manzanotti";
     repo = "geniushub-client";
     tag = "v${version}";
-    hash = "sha256-RBXqSpumJMLZIT+nQr/BUE315krjRy/Qk9OlX9Ukn3Y=";
+    hash = "sha256-9/LOybFJdVxImr/i/RIbrYSPZ7vA5ffdSBxzg51UM8s=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index 19f83ae76045..6f41f95fdb7e 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202602181";
+  version = "0.1.202602191";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6HLwpTFTqS3T6VQ9jwr7+wVv8ARLDbh9a/68txWMvJU=";
+    hash = "sha256-yvfJith7JfwO6lO57K3y98vqGHkEiEzmfM0WAktufck=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/maestral/default.nix b/pkgs/development/python-modules/maestral/default.nix
index 116a94520802..bb7e36e65961 100644
--- a/pkgs/development/python-modules/maestral/default.nix
+++ b/pkgs/development/python-modules/maestral/default.nix
@@ -28,7 +28,7 @@
   nixosTests,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "maestral";
   version = "1.9.6";
   pyproject = true;
@@ -36,7 +36,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "SamSchott";
     repo = "maestral";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-mYFiQL4FumJWP2y1u5tIo1CZL027J8/EIYqJQde7G/c=";
   };
 
@@ -65,8 +65,14 @@ buildPythonPackage rec {
 
   makeWrapperArgs = [
     # Add the installed directories to the python path so the daemon can find them
-    "--prefix PYTHONPATH : ${makePythonPath dependencies}"
-    "--prefix PYTHONPATH : $out/${python.sitePackages}"
+    "--prefix"
+    "PYTHONPATH"
+    ":"
+    (makePythonPath finalAttrs.finalPackage.dependencies)
+    "--prefix"
+    "PYTHONPATH"
+    ":"
+    "$out/${python.sitePackages}"
   ];
 
   nativeCheckInputs = [ pytestCheckHook ];
@@ -117,7 +123,7 @@ buildPythonPackage rec {
     description = "Open-source Dropbox client for macOS and Linux";
     mainProgram = "maestral";
     homepage = "https://maestral.app";
-    changelog = "https://github.com/samschott/maestral/releases/tag/v${version}";
+    changelog = "https://github.com/samschott/maestral/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       natsukium
@@ -125,4 +131,4 @@ buildPythonPackage rec {
       sfrijters
     ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/nix-prefetch-github/default.nix b/pkgs/development/python-modules/nix-prefetch-github/default.nix
index ae1d3c35eac2..d4aed2d8de0d 100644
--- a/pkgs/development/python-modules/nix-prefetch-github/default.nix
+++ b/pkgs/development/python-modules/nix-prefetch-github/default.nix
@@ -47,7 +47,7 @@ buildPythonPackage rec {
   sphinxRoot = "docs";
 
   # ignore tests which are impure
-  DISABLED_TESTS = "network requires_nix_build";
+  env.DISABLED_TESTS = "network requires_nix_build";
 
   meta = {
     description = "Prefetch sources from github";
diff --git a/pkgs/development/python-modules/playwright-stealth/default.nix b/pkgs/development/python-modules/playwright-stealth/default.nix
index e6b716e9b2e2..18032f8b0b0e 100644
--- a/pkgs/development/python-modules/playwright-stealth/default.nix
+++ b/pkgs/development/python-modules/playwright-stealth/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "playwright-stealth";
-  version = "2.0.1";
+  version = "2.0.2";
   pyproject = true;
 
   src = fetchPypi {
     pname = "playwright_stealth";
     inherit (finalAttrs) version;
-    hash = "sha256-o29zXWFGnBK9oXm1jV/EIou+5hyc9bE0OxSXpf1R7Bo=";
+    hash = "sha256-rFflGHMZDaXmU+A3IOlIyPCj0GsJjx1WdjED0j7kgUM=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/py-cid/default.nix b/pkgs/development/python-modules/py-cid/default.nix
index 2f75be74fc96..f60f46f4c2f6 100644
--- a/pkgs/development/python-modules/py-cid/default.nix
+++ b/pkgs/development/python-modules/py-cid/default.nix
@@ -9,12 +9,14 @@
   morphys,
   py-multihash,
   hypothesis,
+  pytest-cov-stub,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "py-cid";
   version = "0.4.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ipld";
@@ -23,14 +25,11 @@ buildPythonPackage rec {
     hash = "sha256-IYjk7sajHFWgsOMxwk1tWvKtTfPN8vHoNeENQed7MiU=";
   };
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "base58>=1.0.2,<2.0" "base58>=1.0.2" \
-      --replace "py-multihash>=0.2.0,<1.0.0" "py-multihash>=0.2.0" \
-      --replace "'pytest-runner'," ""
-  '';
+  pythonRelaxDeps = [ "base58" ];
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     base58
     py-multibase
     py-multicodec
@@ -40,6 +39,7 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytestCheckHook
+    pytest-cov-stub
     hypothesis
   ];
 
@@ -48,6 +48,7 @@ buildPythonPackage rec {
   meta = {
     description = "Self-describing content-addressed identifiers for distributed systems implementation in Python";
     homepage = "https://github.com/ipld/py-cid";
+    changelog = "https://github.com/ipld/py-cid/blob/${src.tag}/HISTORY.rst";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ Luflosi ];
   };
diff --git a/pkgs/development/python-modules/py-multiaddr/default.nix b/pkgs/development/python-modules/py-multiaddr/default.nix
index b2ad11184d14..9b002fd4058e 100644
--- a/pkgs/development/python-modules/py-multiaddr/default.nix
+++ b/pkgs/development/python-modules/py-multiaddr/default.nix
@@ -1,38 +1,45 @@
 {
   lib,
+  base58,
   buildPythonPackage,
   fetchFromGitHub,
-  varint,
-  base58,
-  netaddr,
   idna,
+  netaddr,
   py-cid,
   py-multicodec,
+  trio,
   pytestCheckHook,
+  setuptools,
+  psutil,
+  varint,
+  dnspython,
+  trio-typing,
 }:
 
 buildPythonPackage rec {
   pname = "py-multiaddr";
-  version = "0.0.10";
-  format = "setuptools";
+  version = "0.0.11";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "multiformats";
     repo = "py-multiaddr";
     tag = "v${version}";
-    hash = "sha256-N46D2H3RG6rtdBrSyDjh8UxD+Ph/FXEa4FcEI2uz4y8=";
+    hash = "sha256-mlHcuLVtczp3APXJFkWbjeY7xU39eFERa8hhiOEwBSU=";
   };
 
-  postPatch = ''
-    substituteInPlace setup.py --replace "'pytest-runner'," ""
-  '';
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     varint
     base58
     netaddr
+    dnspython
+    trio-typing
+    trio
     idna
     py-cid
+    psutil
     py-multicodec
   ];
 
@@ -40,9 +47,22 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "multiaddr" ];
 
+  disabledTests = [
+    # Test is outdated
+    "test_resolve_cancellation_with_error"
+    # AssertionError
+    "test_ipv4_wildcard"
+  ];
+
+  disabledTestPaths = [
+    # Tests require network access
+    "tests/test_resolvers.py"
+  ];
+
   meta = {
     description = "Composable and future-proof network addresses";
     homepage = "https://github.com/multiformats/py-multiaddr";
+    changelog = "https://github.com/multiformats/py-multiaddr/releases/tag/${src.tag}";
     license = with lib.licenses; [
       mit
       asl20
diff --git a/pkgs/development/python-modules/python-kadmin-rs/default.nix b/pkgs/development/python-modules/python-kadmin-rs/default.nix
index 7694ed48dc34..35ccf09e80dc 100644
--- a/pkgs/development/python-modules/python-kadmin-rs/default.nix
+++ b/pkgs/development/python-modules/python-kadmin-rs/default.nix
@@ -5,56 +5,69 @@
   rustPlatform,
   pythonImportsCheckHook,
   buildPythonPackage,
-
-  cargo,
-  rustc,
   pkg-config,
-  sccache,
-  setuptools,
-  setuptools-rust,
-  setuptools-scm,
+  heimdal,
 }:
-
 buildPythonPackage rec {
   pname = "python-kadmin-rs";
-  version = "0.6.3";
+  version = "0.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "authentik-community";
     repo = "kadmin-rs";
     rev = "kadmin/version/${version}";
-    hash = "sha256-ofoxgaTflem/QG/aQc6M5oxrUl/YoLHzDWlNyeVr0H8=";
+    hash = "sha256-7aRbpQblRFoCmuZJgm2mrGoUNL0BBcIpzlKblCnHVPc=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit src;
-    hash = "sha256-mSwuR8TCljPYgVhguZiu2fXprCl+IEyZxE7ML+FBI98=";
+    hash = "sha256-dzTcB5GfeUbgikznq4YFEzZ75z0zvz4I1/+5UCQ0e2o=";
   };
 
+  # The include directories of krb5 and heimdal contain overlapping paths.
+  # Only add one and set the other required paths via environment variables.
   buildInputs = [
     pkgs.krb5
   ];
 
+  env = {
+    KADMIN_MIT_CLIENT_INCLUDES = "${pkgs.krb5.dev}/include";
+    KADMIN_MIT_SERVER_INCLUDES = "${pkgs.krb5.dev}/include";
+    KADMIN_HEIMDAL_CLIENT_INCLUDES = "${heimdal.dev}/include";
+    KADMIN_HEIMDAL_SERVER_INCLUDES = "${heimdal.dev}/include";
+    KADMIN_MIT_CLIENT_KRB5_CONFIG = "${pkgs.krb5.dev}/bin/krb5-config";
+    KADMIN_MIT_SERVER_KRB5_CONFIG = "${pkgs.krb5.dev}/bin/krb5-config";
+    KADMIN_HEIMDAL_CLIENT_KRB5_CONFIG = "${heimdal.dev}/bin/krb5-config";
+    KADMIN_HEIMDAL_SERVER_KRB5_CONFIG = "${heimdal.dev}/bin/krb5-config";
+
+    K5TEST_MIT_KDB5_UTIL = "${pkgs.krb5}/bin/kdb5_util";
+    K5TEST_MIT_KRB5KDC = "${pkgs.krb5}/bin/krb5kdc";
+    K5TEST_MIT_KADMIN = "${pkgs.krb5}/bin/kadmin";
+    K5TEST_MIT_KADMIN_LOCAL = "${pkgs.krb5}/bin/kadmin.local";
+    K5TEST_MIT_KADMIND = "${pkgs.krb5}/bin/kadmind";
+    K5TEST_MIT_KPROP = "${pkgs.krb5}/bin/kprop";
+    K5TEST_MIT_KINIT = "${pkgs.krb5}/bin/kinit";
+    K5TEST_MIT_KLIST = "${pkgs.krb5}/bin/klist";
+
+    K5TEST_HEIMDAL_KDC = "${heimdal}/libexec/kdc";
+    K5TEST_HEIMDAL_KADMIN = "${heimdal}/bin/kadmin";
+    K5TEST_HEIMDAL_KADMIND = "${heimdal}/libexec/kadmind";
+    K5TEST_HEIMDAL_KINIT = "${heimdal}/bin/kinit";
+    K5TEST_HEIMDAL_KLIST = "${heimdal}/bin/klist";
+    K5TEST_HEIMDAL_KTUTIL = "${heimdal}/bin/ktutil";
+  };
+
   nativeBuildInputs = [
-    sccache
     pkg-config
     pythonImportsCheckHook
     rustPlatform.bindgenHook
     rustPlatform.cargoSetupHook
-    cargo
-    rustc
-  ];
-
-  build-system = [
-    setuptools
-    setuptools-rust
-    setuptools-scm
+    rustPlatform.maturinBuildHook
   ];
 
   pythonImportsCheck = [
     "kadmin"
-    "kadmin_local"
   ];
 
   meta = {
diff --git a/pkgs/development/python-modules/sacremoses/default.nix b/pkgs/development/python-modules/sacremoses/default.nix
index 9bcfb97d989b..98b49fa4cac0 100644
--- a/pkgs/development/python-modules/sacremoses/default.nix
+++ b/pkgs/development/python-modules/sacremoses/default.nix
@@ -1,38 +1,44 @@
 {
-  buildPythonPackage,
   lib,
+  buildPythonPackage,
   fetchFromGitHub,
+  # build-system
+  setuptools,
+  # dependencies
   click,
-  six,
-  tqdm,
   joblib,
-  pytest,
+  regex,
+  tqdm,
+  # tests
+  pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "sacremoses";
-  version = "0.0.35";
-  format = "setuptools";
+  version = "0.1.1";
+  pyproject = true;
 
   src = fetchFromGitHub {
-    owner = "alvations";
+    owner = "hplt-project";
     repo = "sacremoses";
-    rev = version;
-    sha256 = "1gzr56w8yx82mn08wax5m0xyg15ym4ri5l80gmagp8r53443j770";
+    tag = finalAttrs.version;
+    sha256 = "sha256-ked6/8oaGJwVW1jvpjrWtJYfr0GKUHdJyaEuzid/S3M=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     click
-    six
-    tqdm
     joblib
+    regex
+    tqdm
   ];
 
-  nativeCheckInputs = [ pytest ];
+  nativeCheckInputs = [ pytestCheckHook ];
   # ignore tests which call to remote host
-  checkPhase = ''
-    pytest -k 'not truecase'
-  '';
+  disabledTestPaths = [
+    "sacremoses/test/test_truecaser.py::TestTruecaser"
+  ];
 
   meta = {
     homepage = "https://github.com/alvations/sacremoses";
@@ -42,4 +48,4 @@ buildPythonPackage rec {
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ pashashocky ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/scikit-build-core/default.nix b/pkgs/development/python-modules/scikit-build-core/default.nix
index a436bb78aa32..b4f68998eb7f 100644
--- a/pkgs/development/python-modules/scikit-build-core/default.nix
+++ b/pkgs/development/python-modules/scikit-build-core/default.nix
@@ -1,7 +1,9 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch,
 
   # build-system
   hatch-vcs,
@@ -25,7 +27,7 @@
   wheel,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "scikit-build-core";
   version = "0.11.6";
   pyproject = true;
@@ -33,10 +35,20 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "scikit-build";
     repo = "scikit-build-core";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-zBTDacTkeclz+/X0SUl1xkxLz4zsfeLOD4Ew0V1Y1iU=";
   };
 
+  # TODO: Rebuild avoidance; clean up on `staging`.
+  ${if stdenv.hostPlatform.isDarwin then "patches" else null} = [
+    # Backport an upstream commit to fix the tests on Darwin.
+    (fetchpatch {
+      url = "https://github.com/scikit-build/scikit-build-core/commit/c30f52a3b2bd01dc05f23d3b89332c213006afe0.patch";
+      excludes = [ ".github/workflows/ci.yml" ];
+      hash = "sha256-5E9QfF5UcSNY1wzHzieEEHEPYzPjUTb66CKCodYb9vo=";
+    })
+  ];
+
   postPatch = "";
 
   build-system = [
@@ -84,8 +96,8 @@ buildPythonPackage rec {
   meta = {
     description = "Next generation Python CMake adaptor and Python API for plugins";
     homepage = "https://github.com/scikit-build/scikit-build-core";
-    changelog = "https://github.com/scikit-build/scikit-build-core/blob/${src.tag}/docs/about/changelog.md";
+    changelog = "https://github.com/scikit-build/scikit-build-core/blob/${finalAttrs.src.tag}/docs/about/changelog.md";
     license = with lib.licenses; [ asl20 ];
     maintainers = with lib.maintainers; [ veprbl ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/signxml/default.nix b/pkgs/development/python-modules/signxml/default.nix
index fa4ae55d6465..e1f33a11763e 100644
--- a/pkgs/development/python-modules/signxml/default.nix
+++ b/pkgs/development/python-modules/signxml/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "signxml";
-  version = "4.2.2";
+  version = "4.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "XML-Security";
     repo = "signxml";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-IZa62HIsCsNiIlHhLgy0GRIq+E3HBnYSdy/LtDvPa/E=";
+    hash = "sha256-yAqew1y9LBCKGSc4B9r/c/2XtQzQur4lvVQJUExk95E=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/tensorflow/default.nix b/pkgs/development/python-modules/tensorflow/default.nix
index 75cd0d771d71..22f2220d30c2 100644
--- a/pkgs/development/python-modules/tensorflow/default.nix
+++ b/pkgs/development/python-modules/tensorflow/default.nix
@@ -344,84 +344,89 @@ let
     ++ lib.optionals mklSupport [ mkl ]
     ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [ nsync ];
 
-    # arbitrarily set to the current latest bazel version, overly careful
-    TF_IGNORE_MAX_BAZEL_VERSION = true;
+    env = {
+      # arbitrarily set to the current latest bazel version, overly careful
+      TF_IGNORE_MAX_BAZEL_VERSION = true;
 
-    LIBTOOL = lib.optionalString stdenv.hostPlatform.isDarwin "${cctools}/bin/libtool";
+      LIBTOOL = lib.optionalString stdenv.hostPlatform.isDarwin "${cctools}/bin/libtool";
 
-    # Take as many libraries from the system as possible. Keep in sync with
-    # list of valid syslibs in
-    # https://github.com/tensorflow/tensorflow/blob/master/third_party/systemlibs/syslibs_configure.bzl
-    TF_SYSTEM_LIBS = lib.concatStringsSep "," (
-      [
-        "absl_py"
-        "astor_archive"
-        "astunparse_archive"
-        "boringssl"
-        "com_google_absl"
-        # Not packaged in nixpkgs
-        # "com_github_googleapis_googleapis"
-        # "com_github_googlecloudplatform_google_cloud_cpp"
-        "com_github_grpc_grpc"
-        "com_google_protobuf"
-        # Fails with the error: external/org_tensorflow/tensorflow/core/profiler/utils/tf_op_utils.cc:46:49: error: no matching function for call to 're2::RE2::FullMatch(absl::lts_2020_02_25::string_view&, re2::RE2&)'
-        # "com_googlesource_code_re2"
-        "curl"
-        "cython"
-        "dill_archive"
-        "double_conversion"
-        "flatbuffers"
-        "functools32_archive"
-        "gast_archive"
-        "gif"
-        "hwloc"
-        "icu"
-        "jsoncpp_git"
-        "libjpeg_turbo"
-        "nasm"
-        "opt_einsum_archive"
-        "org_sqlite"
-        "pasta"
-        "png"
-        "pybind11"
-        "six_archive"
-        "snappy"
-        "tblib_archive"
-        "termcolor_archive"
-        "typing_extensions_archive"
-        "wrapt"
-        "zlib"
-      ]
-      ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
-        "nsync" # fails to build on darwin
-      ]
-    );
+      # Take as many libraries from the system as possible. Keep in sync with
+      # list of valid syslibs in
+      # https://github.com/tensorflow/tensorflow/blob/master/third_party/systemlibs/syslibs_configure.bzl
+      TF_SYSTEM_LIBS = lib.concatStringsSep "," (
+        [
+          "absl_py"
+          "astor_archive"
+          "astunparse_archive"
+          "boringssl"
+          "com_google_absl"
+          # Not packaged in nixpkgs
+          # "com_github_googleapis_googleapis"
+          # "com_github_googlecloudplatform_google_cloud_cpp"
+          "com_github_grpc_grpc"
+          "com_google_protobuf"
+          # Fails with the error: external/org_tensorflow/tensorflow/core/profiler/utils/tf_op_utils.cc:46:49: error: no matching function for call to 're2::RE2::FullMatch(absl::lts_2020_02_25::string_view&, re2::RE2&)'
+          # "com_googlesource_code_re2"
+          "curl"
+          "cython"
+          "dill_archive"
+          "double_conversion"
+          "flatbuffers"
+          "functools32_archive"
+          "gast_archive"
+          "gif"
+          "hwloc"
+          "icu"
+          "jsoncpp_git"
+          "libjpeg_turbo"
+          "nasm"
+          "opt_einsum_archive"
+          "org_sqlite"
+          "pasta"
+          "png"
+          "pybind11"
+          "six_archive"
+          "snappy"
+          "tblib_archive"
+          "termcolor_archive"
+          "typing_extensions_archive"
+          "wrapt"
+          "zlib"
+        ]
+        ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
+          "nsync" # fails to build on darwin
+        ]
+      );
 
-    INCLUDEDIR = "${includes_joined}/include";
+      INCLUDEDIR = "${includes_joined}/include";
 
-    # This is needed for the Nix-provided protobuf dependency to work,
-    # as otherwise the rule `link_proto_files` tries to create the links
-    # to `/usr/include/...` which results in build failures.
-    PROTOBUF_INCLUDE_PATH = "${protobuf-core}/include";
+      # This is needed for the Nix-provided protobuf dependency to work,
+      # as otherwise the rule `link_proto_files` tries to create the links
+      # to `/usr/include/...` which results in build failures.
+      PROTOBUF_INCLUDE_PATH = "${protobuf-core}/include";
 
-    PYTHON_BIN_PATH = pythonEnv.interpreter;
+      PYTHON_BIN_PATH = pythonEnv.interpreter;
 
-    TF_NEED_GCP = true;
-    TF_NEED_HDFS = true;
-    TF_ENABLE_XLA = tfFeature xlaSupport;
+      TF_NEED_GCP = true;
+      TF_NEED_HDFS = true;
+      TF_ENABLE_XLA = tfFeature xlaSupport;
 
-    CC_OPT_FLAGS = " ";
+      CC_OPT_FLAGS = " ";
 
-    # https://github.com/tensorflow/tensorflow/issues/14454
-    TF_NEED_MPI = tfFeature cudaSupport;
+      # https://github.com/tensorflow/tensorflow/issues/14454
+      TF_NEED_MPI = tfFeature cudaSupport;
 
-    TF_NEED_CUDA = tfFeature cudaSupport;
-    TF_CUDA_PATHS = lib.optionalString cudaSupport "${cudatoolkitDevMerged},${cudnnMerged},${lib.getLib nccl}";
-    TF_CUDA_COMPUTE_CAPABILITIES = lib.concatStringsSep "," cudaCapabilities;
+      TF_NEED_CUDA = tfFeature cudaSupport;
+      TF_CUDA_PATHS = lib.optionalString cudaSupport "${cudatoolkitDevMerged},${cudnnMerged},${lib.getLib nccl}";
+      TF_CUDA_COMPUTE_CAPABILITIES = lib.concatStringsSep "," cudaCapabilities;
 
-    # Needed even when we override stdenv: e.g. for ar
-    GCC_HOST_COMPILER_PREFIX = lib.optionalString cudaSupport "${cudatoolkit_cc_joined}/bin";
-    GCC_HOST_COMPILER_PATH = lib.optionalString cudaSupport "${cudatoolkit_cc_joined}/bin/cc";
+      # Needed even when we override stdenv: e.g. for ar
+      GCC_HOST_COMPILER_PREFIX = lib.optionalString cudaSupport "${cudatoolkit_cc_joined}/bin";
+      GCC_HOST_COMPILER_PATH = lib.optionalString cudaSupport "${cudatoolkit_cc_joined}/bin/cc";
+
+      # https://github.com/tensorflow/tensorflow/pull/39470
+      NIX_CFLAGS_COMPILE = toString [ "-Wno-stringop-truncation" ];
+    };
 
     patches = [
       "${gentoo-patches}/0002-systemlib-Latest-absl-LTS-has-split-cord-libs.patch"
@@ -453,9 +458,6 @@ let
       sed -i '/tensorboard ~=/d' tensorflow/tools/pip_package/setup.py
     '';
 
-    # https://github.com/tensorflow/tensorflow/pull/39470
-    env.NIX_CFLAGS_COMPILE = toString [ "-Wno-stringop-truncation" ];
-
     preConfigure =
       let
         opt_flags =
diff --git a/pkgs/development/python-modules/zammad-py/default.nix b/pkgs/development/python-modules/zammad-py/default.nix
index 656c153ac682..b7249c9b4416 100644
--- a/pkgs/development/python-modules/zammad-py/default.nix
+++ b/pkgs/development/python-modules/zammad-py/default.nix
@@ -7,16 +7,16 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "zammad-py";
-  version = "3.2.0";
+  version = "3.2.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "joeirimpan";
     repo = "zammad_py";
-    tag = "v${version}";
-    hash = "sha256-gU5OA5m8X03GM7ImXZZVLkEyoAXRCoFskfop8oXJFH0=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-idPT3H2mlHoC8gHAQHOAcQJKciPZyagVEmojcKbj8ls=";
   };
 
   build-system = [
@@ -37,6 +37,9 @@ buildPythonPackage rec {
     "test_tickets"
     "test_groups"
     "test_pagination"
+    "test_knowledge_bases"
+    "test_knowledge_bases_answers"
+    "test_knowledge_bases_categories"
   ];
 
   pythonImportsCheck = [
@@ -44,10 +47,10 @@ buildPythonPackage rec {
   ];
 
   meta = {
-    changelog = "https://github.com/joeirimpan/zammad_py/blob/${src.tag}/HISTORY.rst";
+    changelog = "https://github.com/joeirimpan/zammad_py/blob/${finalAttrs.src.tag}/HISTORY.md";
     description = "Python API client for accessing zammad REST API";
     homepage = "https://github.com/joeirimpan/zammad_py";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ hexa ];
   };
-}
+})
diff --git a/pkgs/development/rocq-modules/mathcomp-bigenough/default.nix b/pkgs/development/rocq-modules/mathcomp-bigenough/default.nix
new file mode 100644
index 000000000000..2643fdda7456
--- /dev/null
+++ b/pkgs/development/rocq-modules/mathcomp-bigenough/default.nix
@@ -0,0 +1,37 @@
+{
+  rocq-core,
+  mkRocqDerivation,
+  mathcomp-boot,
+  lib,
+  version ? null,
+}:
+
+mkRocqDerivation {
+
+  namePrefix = [
+    "rocq-core"
+    "mathcomp"
+  ];
+  pname = "bigenough";
+  owner = "math-comp";
+
+  release = {
+    "1.0.4".sha256 = "sha256-cwfDCEFSXWnqV5aIrhTviUti0CXNwmFe6zVbqlD2iZw=";
+  };
+  inherit version;
+  defaultVersion =
+    let
+      case = case: out: { inherit case out; };
+    in
+    with lib.versions;
+    lib.switch rocq-core.rocq-version [
+      (case (range "9.0" "9.1") "1.0.4")
+    ] null;
+
+  propagatedBuildInputs = [ mathcomp-boot ];
+
+  meta = {
+    description = "Small library to do epsilon - N reasonning";
+    license = lib.licenses.cecill-b;
+  };
+}
diff --git a/pkgs/development/rocq-modules/mathcomp-finmap/default.nix b/pkgs/development/rocq-modules/mathcomp-finmap/default.nix
new file mode 100644
index 000000000000..5fd9b61f82e4
--- /dev/null
+++ b/pkgs/development/rocq-modules/mathcomp-finmap/default.nix
@@ -0,0 +1,45 @@
+{
+  rocq-core,
+  mkRocqDerivation,
+  mathcomp-boot,
+  lib,
+  version ? null,
+}:
+
+mkRocqDerivation {
+
+  namePrefix = [
+    "rocq-core"
+    "mathcomp"
+  ];
+  pname = "finmap";
+  owner = "math-comp";
+  inherit version;
+  defaultVersion =
+    let
+      case = rocq: mc: out: {
+        cases = [
+          rocq
+          mc
+        ];
+        inherit out;
+      };
+    in
+    with lib.versions;
+    lib.switch
+      [ rocq-core.rocq-version mathcomp-boot.version ]
+      [
+        (case (range "9.0" "9.1") (range "2.3" "2.5") "2.2.2")
+      ]
+      null;
+  release = {
+    "2.2.2".sha256 = "sha256-G5fSdx4MhOXtQ2H8lpyK5FuIbWAZNc7vRL3hcYmGA2o=";
+  };
+
+  propagatedBuildInputs = [ mathcomp-boot ];
+
+  meta = {
+    description = "Finset and finmap library";
+    license = lib.licenses.cecill-b;
+  };
+}
diff --git a/pkgs/development/tools/godot/4.6/default.nix b/pkgs/development/tools/godot/4.6/default.nix
index 39613ff06e5b..a0ac2cbb947a 100644
--- a/pkgs/development/tools/godot/4.6/default.nix
+++ b/pkgs/development/tools/godot/4.6/default.nix
@@ -1,11 +1,11 @@
 {
-  version = "4.6-stable";
-  hash = "sha256-lK9KQsmrNZLx7yP3PwbN93otwkWq2H+nWt85WH/u8oI=";
+  version = "4.6.1-stable";
+  hash = "sha256-C3AX+Gl6a3nX/k0TP6FYjYCK9AbKmtku+1ilYBu0R74=";
   default = {
-    exportTemplatesHash = "sha256-OzCsjBdy8l9d+l9lkiyrCpDnuWAXaJEjfFdyUV68zEY=";
+    exportTemplatesHash = "sha256-5tNyr9T9+q6VceteNWivzZbObbmlaSRANBVPrwrGmHU=";
   };
   mono = {
-    exportTemplatesHash = "sha256-RgVug5TNHx+FzPqr3f/Bpn9ZW/2Z+9ps1ir6dR2/xRk=";
+    exportTemplatesHash = "sha256-V5JmHtCJVQNX4OEJVK9pWEa+CjLtdJT6QKAAnjtaPqk=";
     nugetDeps = ./deps.json;
   };
 }
diff --git a/pkgs/development/tools/godot/common.nix b/pkgs/development/tools/godot/common.nix
index 48eeca61fa6a..6e8f5b668890 100644
--- a/pkgs/development/tools/godot/common.nix
+++ b/pkgs/development/tools/godot/common.nix
@@ -461,35 +461,36 @@ let
           (allow file-read* (subpath "/System/Library/CoreServices/SystemAppearance.bundle"))
         '';
 
-        patches = [
-          ./Linux-fix-missing-library-with-builtin_glslang-false.patch
-        ]
-        ++ lib.optionals (lib.versionAtLeast version "4.6") [
-          # https://github.com/godotengine/godot/pull/115450
-          (fetchpatch {
-            name = "fix-tls-handshake-fail-preventing-assetlib-use.patch";
-            url = "https://github.com/godotengine/godot/commit/29acd734c71f06268d6ef4715d7df70b14731f48.patch";
-            hash = "sha256-wxkr6jPtutUTG+mYrXoxcDcWIIZghlSJ79XqhFh/0P4=";
-          })
-        ]
-        ++ lib.optionals (lib.versionOlder version "4.4") [
-          (fetchpatch {
-            name = "wayland-header-fix.patch";
-            url = "https://github.com/godotengine/godot/commit/6ce71f0fb0a091cffb6adb4af8ab3f716ad8930b.patch";
-            hash = "sha256-hgAtAtCghF5InyGLdE9M+9PjPS1BWXWGKgIAyeuqkoU=";
-          })
-          (fetchpatch {
-            name = "thorvg-header-fix.patch";
-            url = "https://github.com/godotengine/godot/commit/1823460787a6c1bb8e4eaf21ac2a3f90d24d5ee0.patch";
-            hash = "sha256-PcHEMXd0v2c3j6Eitxt5uWi6cD+OmsBAn3TNMNRNPog=";
-          })
-          # Fix a crash in the mono test project build. It no longer seems to
-          # happen in 4.4, but an existing fix couldn't be identified.
-          ./CSharpLanguage-fix-crash-in-reload_assemblies-after-.patch
-        ]
-        ++ lib.optional (
-          stdenv.hostPlatform.isDarwin && lib.versionAtLeast version "4.4"
-        ) ./fix-moltenvk-detection.patch;
+        patches =
+          lib.optionals (lib.versionOlder version "4.6") [
+            ./Linux-fix-missing-library-with-builtin_glslang-false.patch
+          ]
+          ++ lib.optionals (lib.versionAtLeast version "4.6") [
+            # https://github.com/godotengine/godot/pull/115450
+            (fetchpatch {
+              name = "fix-tls-handshake-fail-preventing-assetlib-use.patch";
+              url = "https://github.com/godotengine/godot/commit/29acd734c71f06268d6ef4715d7df70b14731f48.patch";
+              hash = "sha256-wxkr6jPtutUTG+mYrXoxcDcWIIZghlSJ79XqhFh/0P4=";
+            })
+          ]
+          ++ lib.optionals (lib.versionOlder version "4.4") [
+            (fetchpatch {
+              name = "wayland-header-fix.patch";
+              url = "https://github.com/godotengine/godot/commit/6ce71f0fb0a091cffb6adb4af8ab3f716ad8930b.patch";
+              hash = "sha256-hgAtAtCghF5InyGLdE9M+9PjPS1BWXWGKgIAyeuqkoU=";
+            })
+            (fetchpatch {
+              name = "thorvg-header-fix.patch";
+              url = "https://github.com/godotengine/godot/commit/1823460787a6c1bb8e4eaf21ac2a3f90d24d5ee0.patch";
+              hash = "sha256-PcHEMXd0v2c3j6Eitxt5uWi6cD+OmsBAn3TNMNRNPog=";
+            })
+            # Fix a crash in the mono test project build. It no longer seems to
+            # happen in 4.4, but an existing fix couldn't be identified.
+            ./CSharpLanguage-fix-crash-in-reload_assemblies-after-.patch
+          ]
+          ++ lib.optional (
+            stdenv.hostPlatform.isDarwin && lib.versionAtLeast version "4.4"
+          ) ./fix-moltenvk-detection.patch;
 
         postPatch = ''
           # this stops scons from hiding e.g. NIX_CFLAGS_COMPILE
diff --git a/pkgs/development/tools/misc/libtool/libtool2.nix b/pkgs/development/tools/misc/libtool/libtool2.nix
index 059fbf70e4d0..f087e49b13a8 100644
--- a/pkgs/development/tools/misc/libtool/libtool2.nix
+++ b/pkgs/development/tools/misc/libtool/libtool2.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
 
   # FILECMD was added in libtool 2.4.7; previous versions hardwired `/usr/bin/file`
   #   https://lists.gnu.org/archive/html/autotools-announce/2022-03/msg00000.html
-  FILECMD = "${file}/bin/file";
+  env.FILECMD = "${file}/bin/file";
 
   postPatch =
     # libtool commit da2e352735722917bf0786284411262195a6a3f6 changed
diff --git a/pkgs/development/tools/parsing/antlr/2.7.7.nix b/pkgs/development/tools/parsing/antlr/2.7.7.nix
index dc476806e1bb..cee3ff1b2e32 100644
--- a/pkgs/development/tools/parsing/antlr/2.7.7.nix
+++ b/pkgs/development/tools/parsing/antlr/2.7.7.nix
@@ -15,7 +15,9 @@ stdenv.mkDerivation rec {
   patches = [ ./2.7.7-fixes.patch ];
   buildInputs = [ jdk ];
 
-  CXXFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-D_LIBCPP_ENABLE_CXX17_REMOVED_UNARY_BINARY_FUNCTION";
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    CXXFLAGS = "-D_LIBCPP_ENABLE_CXX17_REMOVED_UNARY_BINARY_FUNCTION";
+  };
 
   meta = {
     description = "Powerful parser generator";
diff --git a/pkgs/misc/uboot/default.nix b/pkgs/misc/uboot/default.nix
index 1c4fab7c75ab..78abd41049ac 100644
--- a/pkgs/misc/uboot/default.nix
+++ b/pkgs/misc/uboot/default.nix
@@ -261,8 +261,10 @@ in
   ubootBananaPim64 = buildUBoot {
     defconfig = "bananapi_m64_defconfig";
     extraMeta.platforms = [ "aarch64-linux" ];
-    BL31 = "${armTrustedFirmwareAllwinner}/bl31.bin";
-    SCP = "/dev/null";
+    env = {
+      BL31 = "${armTrustedFirmwareAllwinner}/bl31.bin";
+      SCP = "/dev/null";
+    };
     filesToInstall = [ "u-boot-sunxi-with-spl.bin" ];
   };
 
@@ -276,8 +278,10 @@ in
   ubootCM3588NAS = buildUBoot {
     defconfig = "cm3588-nas-rk3588_defconfig";
     extraMeta.platforms = [ "aarch64-linux" ];
-    BL31 = "${armTrustedFirmwareRK3588}/bl31.elf";
-    ROCKCHIP_TPL = rkbin.TPL_RK3588;
+    env = {
+      BL31 = "${armTrustedFirmwareRK3588}/bl31.elf";
+      ROCKCHIP_TPL = rkbin.TPL_RK3588;
+    };
     filesToInstall = [
       "u-boot.itb"
       "idbloader.img"
@@ -377,7 +381,7 @@ in
       platforms = [ "aarch64-linux" ];
       license = lib.licenses.unfreeRedistributableFirmware;
     };
-    BL31 = "${armTrustedFirmwareRK3399}/bl31.elf";
+    env.BL31 = "${armTrustedFirmwareRK3399}/bl31.elf";
     filesToInstall = [
       "u-boot.itb"
       "idbloader.img"
@@ -391,8 +395,10 @@ in
   ubootNanoPCT6 = buildUBoot {
     defconfig = "nanopc-t6-rk3588_defconfig";
     extraMeta.platforms = [ "aarch64-linux" ];
-    BL31 = "${armTrustedFirmwareRK3588}/bl31.elf";
-    ROCKCHIP_TPL = rkbin.TPL_RK3588;
+    env = {
+      BL31 = "${armTrustedFirmwareRK3588}/bl31.elf";
+      ROCKCHIP_TPL = rkbin.TPL_RK3588;
+    };
     filesToInstall = [
       "u-boot.itb"
       "idbloader.img"
@@ -404,8 +410,10 @@ in
   ubootNanoPiR5S = buildUBoot {
     defconfig = "nanopi-r5s-rk3568_defconfig";
     extraMeta.platforms = [ "aarch64-linux" ];
-    BL31 = rkbin.BL31_RK3568;
-    ROCKCHIP_TPL = rkbin.TPL_RK3568;
+    env = {
+      BL31 = rkbin.BL31_RK3568;
+      ROCKCHIP_TPL = rkbin.TPL_RK3568;
+    };
     filesToInstall = [
       "idbloader.img"
       "u-boot.itb"
@@ -490,25 +498,31 @@ in
   ubootOlimexA64Olinuxino = buildUBoot {
     defconfig = "a64-olinuxino-emmc_defconfig";
     extraMeta.platforms = [ "aarch64-linux" ];
-    BL31 = "${armTrustedFirmwareAllwinner}/bl31.bin";
-    SCP = "/dev/null";
+    env = {
+      BL31 = "${armTrustedFirmwareAllwinner}/bl31.bin";
+      SCP = "/dev/null";
+    };
     filesToInstall = [ "u-boot-sunxi-with-spl.bin" ];
   };
 
   ubootOlimexA64Teres1 = buildUBoot {
     defconfig = "teres_i_defconfig";
     extraMeta.platforms = [ "aarch64-linux" ];
-    BL31 = "${armTrustedFirmwareAllwinner}/bl31.bin";
-    # Using /dev/null here is upstream-specified way that disables the inclusion of crust-firmware as it's not yet packaged and without which the build will fail -- https://docs.u-boot.org/en/latest/board/allwinner/sunxi.html#building-the-crust-management-processor-firmware
-    SCP = "/dev/null";
+    env = {
+      BL31 = "${armTrustedFirmwareAllwinner}/bl31.bin";
+      # Using /dev/null here is upstream-specified way that disables the inclusion of crust-firmware as it's not yet packaged and without which the build will fail -- https://docs.u-boot.org/en/latest/board/allwinner/sunxi.html#building-the-crust-management-processor-firmware
+      SCP = "/dev/null";
+    };
     filesToInstall = [ "u-boot-sunxi-with-spl.bin" ];
   };
 
   ubootOrangePi5 = buildUBoot {
     defconfig = "orangepi-5-rk3588s_defconfig";
     extraMeta.platforms = [ "aarch64-linux" ];
-    BL31 = "${armTrustedFirmwareRK3588}/bl31.elf";
-    ROCKCHIP_TPL = rkbin.TPL_RK3588;
+    env = {
+      BL31 = "${armTrustedFirmwareRK3588}/bl31.elf";
+      ROCKCHIP_TPL = rkbin.TPL_RK3588;
+    };
     filesToInstall = [
       "u-boot.itb"
       "idbloader.img"
@@ -520,8 +534,10 @@ in
   ubootOrangePi5Max = buildUBoot {
     defconfig = "orangepi-5-max-rk3588_defconfig";
     extraMeta.platforms = [ "aarch64-linux" ];
-    BL31 = "${armTrustedFirmwareRK3588}/bl31.elf";
-    ROCKCHIP_TPL = rkbin.TPL_RK3588;
+    env = {
+      BL31 = "${armTrustedFirmwareRK3588}/bl31.elf";
+      ROCKCHIP_TPL = rkbin.TPL_RK3588;
+    };
     filesToInstall = [
       "u-boot.itb"
       "idbloader.img"
@@ -533,8 +549,10 @@ in
   ubootOrangePi5Plus = buildUBoot {
     defconfig = "orangepi-5-plus-rk3588_defconfig";
     extraMeta.platforms = [ "aarch64-linux" ];
-    BL31 = "${armTrustedFirmwareRK3588}/bl31.elf";
-    ROCKCHIP_TPL = rkbin.TPL_RK3588;
+    env = {
+      BL31 = "${armTrustedFirmwareRK3588}/bl31.elf";
+      ROCKCHIP_TPL = rkbin.TPL_RK3588;
+    };
     filesToInstall = [
       "u-boot.itb"
       "idbloader.img"
@@ -552,8 +570,10 @@ in
   ubootOrangePiZeroPlus2H5 = buildUBoot {
     defconfig = "orangepi_zero_plus2_defconfig";
     extraMeta.platforms = [ "aarch64-linux" ];
-    BL31 = "${armTrustedFirmwareAllwinner}/bl31.bin";
-    SCP = "/dev/null";
+    env = {
+      BL31 = "${armTrustedFirmwareAllwinner}/bl31.bin";
+      SCP = "/dev/null";
+    };
     filesToInstall = [ "u-boot-sunxi-with-spl.bin" ];
   };
 
@@ -566,7 +586,7 @@ in
   ubootOrangePiZero2 = buildUBoot {
     defconfig = "orangepi_zero2_defconfig";
     extraMeta.platforms = [ "aarch64-linux" ];
-    BL31 = "${armTrustedFirmwareAllwinnerH616}/bl31.bin";
+    env.BL31 = "${armTrustedFirmwareAllwinnerH616}/bl31.bin";
     filesToInstall = [ "u-boot-sunxi-with-spl.bin" ];
   };
 
@@ -576,23 +596,27 @@ in
     # According to https://linux-sunxi.org/H616 the H618 "is a minor update with a larger (1MB) L2 cache" (compared to the H616)
     # but "does require extra support in U-Boot, TF-A and sunxi-fel. Support for that has been merged in mainline releases."
     # But no extra support seems to be in TF-A.
-    BL31 = "${armTrustedFirmwareAllwinnerH616}/bl31.bin";
+    env.BL31 = "${armTrustedFirmwareAllwinnerH616}/bl31.bin";
     filesToInstall = [ "u-boot-sunxi-with-spl.bin" ];
   };
 
   ubootOrangePi3 = buildUBoot {
     defconfig = "orangepi_3_defconfig";
     extraMeta.platforms = [ "aarch64-linux" ];
-    BL31 = "${armTrustedFirmwareAllwinnerH6}/bl31.bin";
-    SCP = "/dev/null";
+    env = {
+      BL31 = "${armTrustedFirmwareAllwinnerH6}/bl31.bin";
+      SCP = "/dev/null";
+    };
     filesToInstall = [ "u-boot-sunxi-with-spl.bin" ];
   };
 
   ubootOrangePi3B = buildUBoot {
     defconfig = "orangepi-3b-rk3566_defconfig";
     extraMeta.platforms = [ "aarch64-linux" ];
-    ROCKCHIP_TPL = rkbin.TPL_RK3568;
-    BL31 = rkbin.BL31_RK3568;
+    env = {
+      ROCKCHIP_TPL = rkbin.TPL_RK3568;
+      BL31 = rkbin.BL31_RK3568;
+    };
     filesToInstall = [
       "u-boot.itb"
       "idbloader.img"
@@ -610,31 +634,37 @@ in
   ubootPine64 = buildUBoot {
     defconfig = "pine64_plus_defconfig";
     extraMeta.platforms = [ "aarch64-linux" ];
-    BL31 = "${armTrustedFirmwareAllwinner}/bl31.bin";
-    SCP = "/dev/null";
+    env = {
+      BL31 = "${armTrustedFirmwareAllwinner}/bl31.bin";
+      SCP = "/dev/null";
+    };
     filesToInstall = [ "u-boot-sunxi-with-spl.bin" ];
   };
 
   ubootPine64LTS = buildUBoot {
     defconfig = "pine64-lts_defconfig";
     extraMeta.platforms = [ "aarch64-linux" ];
-    BL31 = "${armTrustedFirmwareAllwinner}/bl31.bin";
-    SCP = "/dev/null";
+    env = {
+      BL31 = "${armTrustedFirmwareAllwinner}/bl31.bin";
+      SCP = "/dev/null";
+    };
     filesToInstall = [ "u-boot-sunxi-with-spl.bin" ];
   };
 
   ubootPinebook = buildUBoot {
     defconfig = "pinebook_defconfig";
     extraMeta.platforms = [ "aarch64-linux" ];
-    BL31 = "${armTrustedFirmwareAllwinner}/bl31.bin";
-    SCP = "/dev/null";
+    env = {
+      BL31 = "${armTrustedFirmwareAllwinner}/bl31.bin";
+      SCP = "/dev/null";
+    };
     filesToInstall = [ "u-boot-sunxi-with-spl.bin" ];
   };
 
   ubootPinebookPro = buildUBoot {
     defconfig = "pinebook-pro-rk3399_defconfig";
     extraMeta.platforms = [ "aarch64-linux" ];
-    BL31 = "${armTrustedFirmwareRK3399}/bl31.elf";
+    env.BL31 = "${armTrustedFirmwareRK3399}/bl31.elf";
     filesToInstall = [
       "u-boot.itb"
       "idbloader.img"
@@ -689,8 +719,10 @@ in
   ubootQuartz64B = buildUBoot {
     defconfig = "quartz64-b-rk3566_defconfig";
     extraMeta.platforms = [ "aarch64-linux" ];
-    BL31 = "${armTrustedFirmwareRK3568}/bl31.elf";
-    ROCKCHIP_TPL = rkbin.TPL_RK3566;
+    env = {
+      BL31 = "${armTrustedFirmwareRK3568}/bl31.elf";
+      ROCKCHIP_TPL = rkbin.TPL_RK3566;
+    };
     filesToInstall = [
       "idbloader.img"
       "idbloader-spi.img"
@@ -703,8 +735,10 @@ in
   ubootRadxaZero3W = buildUBoot {
     defconfig = "radxa-zero-3-rk3566_defconfig";
     extraMeta.platforms = [ "aarch64-linux" ];
-    BL31 = "${armTrustedFirmwareRK3568}/bl31.elf";
-    ROCKCHIP_TPL = rkbin.TPL_RK3566;
+    env = {
+      BL31 = "${armTrustedFirmwareRK3568}/bl31.elf";
+      ROCKCHIP_TPL = rkbin.TPL_RK3566;
+    };
     filesToInstall = [
       "idbloader.img"
       "u-boot.itb"
@@ -757,7 +791,7 @@ in
   ubootRock4CPlus = buildUBoot {
     defconfig = "rock-4c-plus-rk3399_defconfig";
     extraMeta.platforms = [ "aarch64-linux" ];
-    BL31 = "${armTrustedFirmwareRK3399}/bl31.elf";
+    env.BL31 = "${armTrustedFirmwareRK3399}/bl31.elf";
     filesToInstall = [
       "u-boot.itb"
       "idbloader.img"
@@ -767,8 +801,10 @@ in
   ubootRock5ModelB = buildUBoot {
     defconfig = "rock5b-rk3588_defconfig";
     extraMeta.platforms = [ "aarch64-linux" ];
-    BL31 = "${armTrustedFirmwareRK3588}/bl31.elf";
-    ROCKCHIP_TPL = rkbin.TPL_RK3588;
+    env = {
+      BL31 = "${armTrustedFirmwareRK3588}/bl31.elf";
+      ROCKCHIP_TPL = rkbin.TPL_RK3588;
+    };
     filesToInstall = [
       "u-boot.itb"
       "idbloader.img"
@@ -780,7 +816,7 @@ in
   ubootRock64 = buildUBoot {
     defconfig = "rock64-rk3328_defconfig";
     extraMeta.platforms = [ "aarch64-linux" ];
-    BL31 = "${armTrustedFirmwareRK3328}/bl31.elf";
+    env.BL31 = "${armTrustedFirmwareRK3328}/bl31.elf";
     filesToInstall = [
       "u-boot.itb"
       "idbloader.img"
@@ -805,7 +841,7 @@ in
     '';
     defconfig = "rock64-rk3328_defconfig";
     extraMeta.platforms = [ "aarch64-linux" ];
-    BL31 = "${armTrustedFirmwareRK3328}/bl31.elf";
+    env.BL31 = "${armTrustedFirmwareRK3328}/bl31.elf";
     filesToInstall = [
       "u-boot.itb"
       "idbloader.img"
@@ -816,7 +852,7 @@ in
   ubootRockPiE = buildUBoot {
     defconfig = "rock-pi-e-rk3328_defconfig";
     extraMeta.platforms = [ "aarch64-linux" ];
-    BL31 = "${armTrustedFirmwareRK3328}/bl31.elf";
+    env.BL31 = "${armTrustedFirmwareRK3328}/bl31.elf";
     filesToInstall = [
       "u-boot.itb"
       "idbloader.img"
@@ -827,7 +863,7 @@ in
   ubootRockPro64 = buildUBoot {
     defconfig = "rockpro64-rk3399_defconfig";
     extraMeta.platforms = [ "aarch64-linux" ];
-    BL31 = "${armTrustedFirmwareRK3399}/bl31.elf";
+    env.BL31 = "${armTrustedFirmwareRK3399}/bl31.elf";
     filesToInstall = [
       "u-boot.itb"
       "idbloader.img"
@@ -842,7 +878,7 @@ in
       "u-boot.itb"
       "idbloader.img"
     ];
-    BL31 = "${armTrustedFirmwareRK3399}/bl31.elf";
+    env.BL31 = "${armTrustedFirmwareRK3399}/bl31.elf";
   };
 
   ubootSheevaplug = buildUBoot {
@@ -857,16 +893,20 @@ in
   ubootSopine = buildUBoot {
     defconfig = "sopine_baseboard_defconfig";
     extraMeta.platforms = [ "aarch64-linux" ];
-    BL31 = "${armTrustedFirmwareAllwinner}/bl31.bin";
-    SCP = "/dev/null";
+    env = {
+      BL31 = "${armTrustedFirmwareAllwinner}/bl31.bin";
+      SCP = "/dev/null";
+    };
     filesToInstall = [ "u-boot-sunxi-with-spl.bin" ];
   };
 
   ubootTuringRK1 = buildUBoot {
     defconfig = "turing-rk1-rk3588_defconfig";
     extraMeta.platforms = [ "aarch64-linux" ];
-    BL31 = "${armTrustedFirmwareRK3588}/bl31.elf";
-    ROCKCHIP_TPL = rkbin.TPL_RK3588;
+    env = {
+      BL31 = "${armTrustedFirmwareRK3588}/bl31.elf";
+      ROCKCHIP_TPL = rkbin.TPL_RK3588;
+    };
     filesToInstall = [
       "u-boot.itb"
       "idbloader.img"
@@ -896,7 +936,7 @@ in
   ubootVisionFive2 = buildUBoot {
     defconfig = "starfive_visionfive2_defconfig";
     extraMeta.platforms = [ "riscv64-linux" ];
-    OPENSBI = "${opensbi}/share/opensbi/lp64/generic/firmware/fw_dynamic.bin";
+    env.OPENSBI = "${opensbi}/share/opensbi/lp64/generic/firmware/fw_dynamic.bin";
     filesToInstall = [
       "spl/u-boot-spl.bin.normal.out"
       "u-boot.itb"
@@ -915,7 +955,7 @@ in
   ubootRockPi4 = buildUBoot {
     defconfig = "rock-pi-4-rk3399_defconfig";
     extraMeta.platforms = [ "aarch64-linux" ];
-    BL31 = "${armTrustedFirmwareRK3399}/bl31.elf";
+    env.BL31 = "${armTrustedFirmwareRK3399}/bl31.elf";
     filesToInstall = [
       "u-boot.itb"
       "idbloader.img"
diff --git a/pkgs/os-specific/cygwin/cygwin-dll-link-hook/cygwin-dll-link.sh b/pkgs/os-specific/cygwin/cygwin-dll-link-hook/cygwin-dll-link.sh
new file mode 100644
index 000000000000..95e63b5458ab
--- /dev/null
+++ b/pkgs/os-specific/cygwin/cygwin-dll-link-hook/cygwin-dll-link.sh
@@ -0,0 +1,142 @@
+# shellcheck shell=bash
+
+_moveDLLsToLib() {
+  if [[ "${dontMoveDLLsToLib-}" ]]; then return; fi
+  # shellcheck disable=SC2154
+  moveToOutput "bin/*.dll" "${!outputLib}"
+}
+
+preFixupHooks+=(_moveDLLsToLib)
+
+declare _linkDeps_inputPath _linkDeps_outputPath
+
+_addOutputDLLPaths() {
+  for output in $(getAllOutputNames); do
+    addToSearchPath _linkDeps_outputPath "${!output}/bin"
+  done
+}
+
+preFixupHooks+=(_addOutputDLLPaths)
+
+_dllDeps() {
+  @objdump@ -p "$1" \
+    | sed -n 's/.*DLL Name: \(.*\)/\1/p' \
+    | sort -u
+}
+
+declare -Ag _linkDeps_visited
+
+_linkDeps() {
+  local target="$1" dir="$2"
+
+  # canonicalise these for the dictionary
+  target=$(realpath -s "$target")
+  dir=$(realpath -s "$dir")
+
+  if [[ -v _linkDeps_visited[$target] ]]; then
+    echo "_linkDeps: $target was already linked." 1>&2
+    return
+  fi
+  if [[ ! -f $target || ! -x $target ]]; then
+    echo "_linkDeps: $target is not an executable file, skipping." 1>&2
+    return
+  fi
+
+  local output inOutput
+  for output in $outputs ; do
+    if [[ $target == "${!output}"* && ! -L $target ]]; then
+      echo "_linkDeps: $target is in $output (${!output})." 1>&2
+      inOutput=1
+      break
+    fi
+  done
+
+  echo 'target:' "$target"
+  local dll
+  while read -r dll; do
+    echo '  dll:' "$dll"
+    local dllPath=$dir/$dll
+    if [[ -v _linkDeps_visited[$dllPath] ]]; then
+      echo "_linkDeps: $dll was already linked into $dir." 1>&2
+      continue
+    fi
+    if [[ -L $dllPath ]]; then
+      echo '    already linked'
+      dllPath=$(realpath -s "$(readlink "$dllPath")")
+      _linkDeps "$dllPath" "$dir"
+    elif [[ -e $dllPath ]]; then
+      echo '    already exits'
+      _linkDeps "$dllPath" "$dir"
+    else
+      if [[ $dll = cygwin1.dll ]]; then
+        dllPath=/bin/cygwin1.dll
+      else
+        # This intentionally doesn't use $dir because we want to prefer
+        # dependencies that are already linked next to the target.
+        local searchPath realTarget
+        searchPath=$_linkDeps_outputPath:$_linkDeps_inputPath:$HOST_PATH
+        if [[ -L $target ]]; then
+          searchPath=$searchPath:$(dirname "$(readlink "$target")")
+        fi
+        searchPath=$(dirname "$target"):$searchPath
+        if ! dllPath=$(PATH="$searchPath" type -P "$dll"); then
+          if [[ -z $inOutput || -n ${allowedImpureDLLsMap[$dll]} ]]; then
+            continue
+          fi
+          echo unable to find "$dll" in "$searchPath" >&2
+          exit 1
+        fi
+      fi
+      echo '    linking to:' "$dllPath"
+      CYGWIN+=' winsymlinks:nativestrict' ln -sr "$dllPath" "$dir"
+      _linkDeps "$dllPath" "$dir"
+    fi
+    _linkDeps_visited[$dir/$dll]=1
+  done < <(_dllDeps "$target")
+  wait $!
+}
+
+# linkDLLsDir can be used to override the destination path for links.  This is
+# useful if you're trying to link dependencies of libraries into the directory
+# containing an executable.
+#
+# Arguments can be a file or directory path. Directories are searched
+# recursively.
+linkDLLs() {
+  # shellcheck disable=SC2154
+  (
+    set -e
+    shopt -s globstar nullglob dotglob
+
+    local -a allowedImpureDLLsArray
+    concatTo allowedImpureDLLsArray allowedImpureDLLs
+
+    local -A allowedImpureDLLsMap;
+
+    for dll in "${allowedImpureDLLsArray[@]}"; do
+      allowedImpureDLLsMap[$dll]=1
+    done
+
+    local target file
+    for target in "$@"; do
+      # Iterate over any DLL that we depend on.
+      if [[ -f "$target" ]]; then
+        _linkDeps "$target" "${linkDLLsDir-$(dirname "$target")}"
+      elif [[ -d "$target" ]]; then
+        for file in "${target%/}"/**/*.{exe,dll}; do
+          _linkDeps "$file" "${linkDLLsDir-$(dirname "$file")}"
+        done
+      else
+        echo "linkDLLs: $target is not a file or directory, skipping." 1>&2
+      fi
+    done
+  )
+}
+
+_linkDLLs() {
+  # shellcheck disable=SC2154
+  if [[ ! -d $prefix || ${dontLinkDLLs-} ]]; then return; fi
+  linkDLLs "$prefix"/{bin,lib,libexec}/
+}
+
+fixupOutputHooks+=(_linkDLLs)
diff --git a/pkgs/os-specific/cygwin/cygwin-dll-link-hook/default.nix b/pkgs/os-specific/cygwin/cygwin-dll-link-hook/default.nix
new file mode 100644
index 000000000000..ff9eed6bdeef
--- /dev/null
+++ b/pkgs/os-specific/cygwin/cygwin-dll-link-hook/default.nix
@@ -0,0 +1,15 @@
+{
+  lib,
+  makeSetupHook,
+  binutils-unwrapped,
+  stdenv,
+  callPackage,
+}:
+makeSetupHook {
+  name = "cygwin-dll-link-hook";
+  substitutions = {
+    objdump = "${lib.getBin binutils-unwrapped}/${stdenv.targetPlatform.config}/bin/objdump";
+  };
+
+  passthru.tests = callPackage ./tests { };
+} ./cygwin-dll-link.sh
diff --git a/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/default.nix b/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/default.nix
new file mode 100644
index 000000000000..a8744001dc2d
--- /dev/null
+++ b/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/default.nix
@@ -0,0 +1,130 @@
+{
+  dieHook,
+  lib,
+  stdenv,
+  testers,
+  runCommand,
+}:
+
+rec {
+  dll = stdenv.mkDerivation {
+    name = "dll";
+    src = ./dll;
+    outputs = [
+      "out"
+      "dev"
+    ];
+    buildInputs = [ dll2 ];
+    strictDeps = true;
+  };
+
+  dll2 = stdenv.mkDerivation {
+    name = "dll2";
+    src = ./dll2;
+    outputs = [
+      "out"
+      "dev"
+    ];
+  };
+
+  exe = stdenv.mkDerivation {
+    name = "exe";
+    src = ./exe;
+    buildInputs = [ dll ];
+    nativeBuildInputs = [ dieHook ];
+    strictDeps = true;
+    doCheck = true;
+    postFixup = ''[[ -e "$out"/bin/cyghello2.dll ]] || die missing indirect dependency'';
+  };
+
+  link-dll = exe.overrideAttrs {
+    name = "link-dll";
+    preFixup = ''
+      ln -s ${lib.getLib dll}/bin/cyghello.dll "$out"/bin/
+    '';
+  };
+
+  user32 = stdenv.mkDerivation {
+    name = "user32";
+    src = ./user32;
+    allowedImpureDLLs = [ "USER32.dll" ];
+  };
+
+  impure-dll = testers.testBuildFailure (
+    user32.overrideAttrs {
+      name = "impure-dll";
+      allowedImpureDLLs = [ ];
+    }
+  );
+
+  user32-dll = stdenv.mkDerivation {
+    name = "user32-dll";
+    src = ./user32-dll;
+    outputs = [
+      "out"
+      "dev"
+    ];
+    allowedImpureDLLs = [ "USER32.dll" ];
+  };
+
+  user32-exe = stdenv.mkDerivation {
+    name = "user32-exe";
+    src = ./user32-exe;
+    buildInputs = [ user32-dll ];
+    strictDeps = true;
+    doCheck = true;
+  };
+
+  link-dir-dll = exe.overrideAttrs {
+    name = "link-dir-dll";
+    preFixup = ''
+      mkdir "$out"/libexec
+      ln -s ${lib.getLib user32-dll}/bin/cygpeek.dll "$out"/libexec/
+      linkDLLsDir="$out"/bin linkDLLs "$out"/libexec/cygpeek.dll
+    '';
+  };
+
+  link-dir-exe = exe.overrideAttrs {
+    name = "link-dir-exe";
+    preFixup = ''
+      mkdir "$out"/libexec
+      ln -s ${lib.getLib user32-exe}/bin/{peek.exe,cygpeek.dll} "$out"/libexec/
+      linkDLLsDir="$out"/bin linkDLLs "$out"/libexec/peek.exe
+    '';
+  };
+
+  link-user32-dll = exe.overrideAttrs {
+    name = "link-user32-dll";
+    preFixup = ''
+      ln -s ${lib.getLib user32-dll}/bin/cygpeek.dll "$out"/bin/
+    '';
+  };
+
+  copy-dll-impure = testers.testBuildFailure (
+    user32-exe.overrideAttrs {
+      name = "copy-dll-impure";
+      preFixup = ''
+        cp ${lib.getLib user32-dll}/bin/cygpeek.dll "$out"/bin/
+      '';
+    }
+  );
+
+  copy-dll = user32-exe.overrideAttrs {
+    name = "copy-dll";
+    preFixup = ''
+      cp ${lib.getLib user32-dll}/bin/cygpeek.dll "$out"/bin/
+      linkDLLs "$out"/bin/cygpeek.dll
+    '';
+    allowedImpureDLLs = [ "USER32.dll" ];
+  };
+
+  double-link = user32-exe.overrideAttrs {
+    name = "double-link";
+    preFixup = ''linkDLLs "$out"'';
+  };
+
+  utf8-glob = runCommand "utf8-glob" { } ''
+    touch NetLock_Arany_=Class_Gold=_Főtanstvny:49412ce40010.crt
+    ls -l NetLock* > "$out"
+  '';
+}
diff --git a/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/dll/Makefile b/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/dll/Makefile
new file mode 100644
index 000000000000..25e1e53c38e4
--- /dev/null
+++ b/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/dll/Makefile
@@ -0,0 +1,16 @@
+.PHONY: all install
+all: cyghello.dll
+
+install: $(out)/bin/cyghello.dll $(out)/lib/libhello.dll.a $(out)/include/hello.h
+
+cyghello.dll libhello.dll.a: hello.c
+	$(CC) -o $@ $^ -shared -Wl,--out-implib,libhello.dll.a -Wl,--export-all-symbols -lhello2
+
+$(out)/bin/cyghello.dll: cyghello.dll
+	install -m755 -D $< $@
+
+$(out)/lib/libhello.dll.a: libhello.dll.a
+	install -m644 -D $< $@
+
+$(out)/include/hello.h: hello.h
+	install -m644 -D $< $@
diff --git a/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/dll/hello.c b/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/dll/hello.c
new file mode 100644
index 000000000000..db1a301c91a4
--- /dev/null
+++ b/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/dll/hello.c
@@ -0,0 +1,7 @@
+#include "hello.h"
+#include <stdio.h>
+#include <hello2.h>
+
+void hello() {
+				hello2();
+}
diff --git a/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/dll/hello.h b/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/dll/hello.h
new file mode 100644
index 000000000000..a4a0b54c6052
--- /dev/null
+++ b/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/dll/hello.h
@@ -0,0 +1,2 @@
+#pragma once
+void hello();
diff --git a/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/dll2/Makefile b/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/dll2/Makefile
new file mode 100644
index 000000000000..87c5c1a9b9cc
--- /dev/null
+++ b/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/dll2/Makefile
@@ -0,0 +1,16 @@
+.PHONY: all install
+all: cyghello2.dll
+
+install: $(out)/bin/cyghello2.dll $(out)/lib/libhello2.dll.a $(out)/include/hello2.h
+
+cyghello2.dll libhello2.dll.a: hello2.c
+	$(CC) -o $@ $^ -shared -Wl,--out-implib,libhello2.dll.a -Wl,--export-all-symbols
+
+$(out)/bin/cyghello2.dll: cyghello2.dll
+	install -m755 -D $< $@
+
+$(out)/lib/libhello2.dll.a: libhello2.dll.a
+	install -m644 -D $< $@
+
+$(out)/include/hello2.h: hello2.h
+	install -m644 -D $< $@
diff --git a/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/dll2/hello2.c b/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/dll2/hello2.c
new file mode 100644
index 000000000000..d23050fbb776
--- /dev/null
+++ b/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/dll2/hello2.c
@@ -0,0 +1,6 @@
+#include <stdio.h>
+#include "hello2.h"
+
+void hello2() {
+				printf("Hello, World!\n");
+}
diff --git a/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/dll2/hello2.h b/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/dll2/hello2.h
new file mode 100644
index 000000000000..34e200a07e95
--- /dev/null
+++ b/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/dll2/hello2.h
@@ -0,0 +1,2 @@
+#pragma once
+void hello2();
diff --git a/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/exe/Makefile b/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/exe/Makefile
new file mode 100644
index 000000000000..da16b5d08c79
--- /dev/null
+++ b/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/exe/Makefile
@@ -0,0 +1,13 @@
+.PHONY: all check install
+all: hello.exe
+
+install: $(out)/bin/hello.exe
+
+hello.exe: main.c
+	$(CC) -o $@ $^ -lhello
+
+check: hello.exe
+	./hello.exe
+
+$(out)/bin/hello.exe: hello.exe
+	install -m755 -D $< $@
diff --git a/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/exe/main.c b/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/exe/main.c
new file mode 100644
index 000000000000..9dbc882ea430
--- /dev/null
+++ b/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/exe/main.c
@@ -0,0 +1,6 @@
+#include <hello.h>
+
+int main() {
+				hello();
+				return 0;
+}
diff --git a/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/user32-dll/Makefile b/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/user32-dll/Makefile
new file mode 100644
index 000000000000..483ad8854a06
--- /dev/null
+++ b/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/user32-dll/Makefile
@@ -0,0 +1,16 @@
+.PHONY: all install
+all: cygpeek.dll
+
+install: $(out)/bin/cygpeek.dll $(out)/lib/libpeek.dll.a $(out)/include/peek.h
+
+cygpeek.dll libpeek.dll.a: peek.c
+	$(CC) -o $@ $^ -shared -Wl,--out-implib,libpeek.dll.a -Wl,--export-all-symbols
+
+$(out)/bin/cygpeek.dll: cygpeek.dll
+	install -m755 -D $< $@
+
+$(out)/lib/libpeek.dll.a: libpeek.dll.a
+	install -m644 -D $< $@
+
+$(out)/include/peek.h: peek.h
+	install -m644 -D $< $@
diff --git a/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/user32-dll/peek.c b/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/user32-dll/peek.c
new file mode 100644
index 000000000000..715adb003c15
--- /dev/null
+++ b/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/user32-dll/peek.c
@@ -0,0 +1,7 @@
+#include <windows.h>
+
+int peek()
+{
+				MSG msg;
+				PeekMessage(&msg, NULL, 0, 0, PM_NOREMOVE);
+}
diff --git a/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/user32-dll/peek.h b/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/user32-dll/peek.h
new file mode 100644
index 000000000000..800f23f77da5
--- /dev/null
+++ b/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/user32-dll/peek.h
@@ -0,0 +1,2 @@
+#pragma once
+void peek();
diff --git a/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/user32-exe/Makefile b/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/user32-exe/Makefile
new file mode 100644
index 000000000000..231601818914
--- /dev/null
+++ b/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/user32-exe/Makefile
@@ -0,0 +1,13 @@
+.PHONY: all check install
+all: peek.exe
+
+install: $(out)/bin/peek.exe
+
+peek.exe: main.c
+	$(CC) -o $@ $^ -lpeek
+
+check: peek.exe
+	./peek.exe
+
+$(out)/bin/peek.exe: peek.exe
+	install -m755 -D $< $@
diff --git a/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/user32-exe/main.c b/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/user32-exe/main.c
new file mode 100644
index 000000000000..cddc78c91cab
--- /dev/null
+++ b/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/user32-exe/main.c
@@ -0,0 +1,6 @@
+#include <peek.h>
+
+int main() {
+				peek();
+				return 0;
+}
diff --git a/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/user32/Makefile b/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/user32/Makefile
new file mode 100644
index 000000000000..6c696a2e8cd0
--- /dev/null
+++ b/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/user32/Makefile
@@ -0,0 +1,13 @@
+.PHONY: all check install
+all: hello.exe
+
+install: $(out)/bin/hello.exe
+
+hello.exe: main.c
+	$(CC) -o $@ $^
+
+check: hello.exe
+	./hello.exe
+
+$(out)/bin/hello.exe: hello.exe
+	install -m755 -D $< $@
diff --git a/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/user32/main.c b/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/user32/main.c
new file mode 100644
index 000000000000..9cc135770d21
--- /dev/null
+++ b/pkgs/os-specific/cygwin/cygwin-dll-link-hook/tests/user32/main.c
@@ -0,0 +1,7 @@
+#include <windows.h>
+
+int main()
+{
+				MSG msg;
+				PeekMessage(&msg, NULL, 0, 0, PM_NOREMOVE);
+}
diff --git a/pkgs/os-specific/cygwin/default.nix b/pkgs/os-specific/cygwin/default.nix
index 09f69ff9f9b2..d1217f7880c1 100644
--- a/pkgs/os-specific/cygwin/default.nix
+++ b/pkgs/os-specific/cygwin/default.nix
@@ -21,5 +21,7 @@ makeScopeWithSplicing' {
       # this is here to avoid symlinks being made to cygwin1.dll in /nix/store
       newlib-cygwin-nobin = callPackage ./newlib-cygwin/nobin.nix { };
       newlib-cygwin-headers = callPackage ./newlib-cygwin { headersOnly = true; };
+
+      cygwinDllLinkHook = callPackage ./cygwin-dll-link-hook { };
     };
 }
diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index 00c749585e6d..67297d1aabbb 100644
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -15,14 +15,14 @@ let
   variants = {
     # ./update-xanmod.sh lts
     lts = {
-      version = "6.12.70";
-      hash = "sha256-Azhv4au48TQbhGsngPvY8Uue71K9KQuJyqcYrM655xM=";
+      version = "6.12.73";
+      hash = "sha256-kmfxbFQduQ+ZLlvJ6M+ZvcEvDza12040SuQjIvHme+o=";
       isLTS = true;
     };
     # ./update-xanmod.sh main
     main = {
-      version = "6.18.10";
-      hash = "sha256-bYKYx9ctHuWG+WS/Wtt4p2uW6vy2g5ikLqSPWeNeSn0=";
+      version = "6.18.12";
+      hash = "sha256-MU0Xc+UZSleOv0GIkil7RnoaCmMBxv5Zzz6Ng1NNDy8=";
     };
   };
 
diff --git a/pkgs/os-specific/linux/trace-cmd/default.nix b/pkgs/os-specific/linux/trace-cmd/default.nix
index 4a71afc5b9b9..8095c5cbece6 100644
--- a/pkgs/os-specific/linux/trace-cmd/default.nix
+++ b/pkgs/os-specific/linux/trace-cmd/default.nix
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
     "devman"
   ];
 
-  MANPAGE_DOCBOOK_XSL = "${docbook_xsl}/xml/xsl/docbook/manpages/docbook.xsl";
+  env.MANPAGE_DOCBOOK_XSL = "${docbook_xsl}/xml/xsl/docbook/manpages/docbook.xsl";
 
   dontConfigure = true;
 
diff --git a/pkgs/servers/samba/4.x.nix b/pkgs/servers/samba/4.x.nix
index 1560e32c89b5..8828a1ec1bfb 100644
--- a/pkgs/servers/samba/4.x.nix
+++ b/pkgs/servers/samba/4.x.nix
@@ -212,9 +212,17 @@ stdenv.mkDerivation (finalAttrs: {
     chmod +w answers
   '';
 
-  env.NIX_LDFLAGS = lib.optionalString (
-    stdenv.cc.bintools.isLLVM && lib.versionAtLeast stdenv.cc.bintools.version "17"
-  ) "--undefined-version";
+  env = {
+    # python-config from build Python gives incorrect values when cross-compiling.
+    # If python-config is not found, the build falls back to using the sysconfig
+    # module, which works correctly in all cases.
+    PYTHON_CONFIG = "/invalid";
+  }
+  //
+    lib.optionalAttrs (stdenv.cc.bintools.isLLVM && lib.versionAtLeast stdenv.cc.bintools.version "17")
+      {
+        NIX_LDFLAGS = "--undefined-version";
+      };
 
   wafConfigureFlags = [
     "--with-static-modules=NONE"
@@ -261,11 +269,6 @@ stdenv.mkDerivation (finalAttrs: {
     "--jobs 1"
   ];
 
-  # python-config from build Python gives incorrect values when cross-compiling.
-  # If python-config is not found, the build falls back to using the sysconfig
-  # module, which works correctly in all cases.
-  PYTHON_CONFIG = "/invalid";
-
   pythonPath = [
     python3Packages.dnspython
     python3Packages.markdown
diff --git a/pkgs/servers/sql/mariadb/default.nix b/pkgs/servers/sql/mariadb/default.nix
index 294876c28d17..ecb8349406a8 100644
--- a/pkgs/servers/sql/mariadb/default.nix
+++ b/pkgs/servers/sql/mariadb/default.nix
@@ -365,7 +365,9 @@ let
             rm -r "$out"/OFF
           '';
 
-        CXXFLAGS = lib.optionalString stdenv.hostPlatform.isi686 "-fpermissive";
+        env = lib.optionalAttrs stdenv.hostPlatform.isi686 {
+          CXXFLAGS = "-fpermissive";
+        };
 
         passthru = {
           inherit client;
diff --git a/pkgs/stdenv/cross/default.nix b/pkgs/stdenv/cross/default.nix
index cc53957eee0d..b194c780a319 100644
--- a/pkgs/stdenv/cross/default.nix
+++ b/pkgs/stdenv/cross/default.nix
@@ -83,7 +83,10 @@ lib.init bootStages
                   || p.isGenode;
               in
               f hostPlatform && !(f buildPlatform)
-            ) buildPackages.updateAutotoolsGnuConfigScriptsHook;
+            ) buildPackages.updateAutotoolsGnuConfigScriptsHook
+            ++ lib.optional (
+              hostPlatform.isCygwin && !buildPlatform.isCygwin
+            ) buildPackages.cygwin.cygwinDllLinkHook;
         })
       );
     in
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 0a512f703b49..5177b2245f1b 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -476,7 +476,6 @@ let
           nativeBuildInputs
           ++ optional separateDebugInfo' ../../build-support/setup-hooks/separate-debug-info.sh
           ++ optional isWindows ../../build-support/setup-hooks/win-dll-link.sh
-          ++ optional isCygwin ../../build-support/setup-hooks/cygwin-dll-link.sh
           ++ optionals doCheck nativeCheckInputs
           ++ optionals doInstallCheck nativeInstallCheckInputs;
 
@@ -706,7 +705,6 @@ let
               allowedImpureDLLs
               ++ lib.optionals isCygwin [
                 "KERNEL32.dll"
-                "cygwin1.dll"
               ];
           }
           // (
diff --git a/pkgs/tools/archivers/gnutar/default.nix b/pkgs/tools/archivers/gnutar/default.nix
index 1ddcfb22f04b..c7e65d9ce7f9 100644
--- a/pkgs/tools/archivers/gnutar/default.nix
+++ b/pkgs/tools/archivers/gnutar/default.nix
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
 
   # May have some issues with root compilation because the bootstrap tool
   # cannot be used as a login shell for now.
-  FORCE_UNSAFE_CONFIGURE = lib.optionalString (
+  env.FORCE_UNSAFE_CONFIGURE = lib.optionalString (
     stdenv.hostPlatform.system == "armv7l-linux" || stdenv.hostPlatform.isSunOS
   ) "1";
 
diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index 0cc7d5e91b07..c09bc4ff35d0 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -193,23 +193,26 @@ stdenv.mkDerivation (finalAttrs: {
     && (stdenv.hostPlatform.libc == "glibc" || stdenv.hostPlatform.libc == "musl")
     && !stdenv.hostPlatform.isAarch32;
 
-  # Prevents attempts of running 'help2man' on cross-built binaries.
-  PERL = if isCross then "missing" else null;
-
   enableParallelBuilding = true;
 
-  NIX_LDFLAGS = optionalString selinuxSupport "-lsepol";
-  FORCE_UNSAFE_CONFIGURE = optionalString stdenv.hostPlatform.isSunOS "1";
-  env.NIX_CFLAGS_COMPILE = toString (
-    [ ]
-    # Work around a bogus warning in conjunction with musl.
-    ++ optional stdenv.hostPlatform.isMusl "-Wno-error"
-    ++ optional stdenv.hostPlatform.isAndroid "-D__USE_FORTIFY_LEVEL=0"
-    # gnulib does not consider Clang-specific warnings to be bugs:
-    # https://lists.gnu.org/r/bug-gnulib/2025-06/msg00325.html
-    # TODO: find out why these are happening on cygwin, which is gcc
-    ++ optional (stdenv.cc.isClang || stdenv.hostPlatform.isCygwin) "-Wno-error=format-security"
-  );
+  env = {
+    NIX_LDFLAGS = optionalString selinuxSupport "-lsepol";
+    FORCE_UNSAFE_CONFIGURE = optionalString stdenv.hostPlatform.isSunOS "1";
+    NIX_CFLAGS_COMPILE = toString (
+      [ ]
+      # Work around a bogus warning in conjunction with musl.
+      ++ optional stdenv.hostPlatform.isMusl "-Wno-error"
+      ++ optional stdenv.hostPlatform.isAndroid "-D__USE_FORTIFY_LEVEL=0"
+      # gnulib does not consider Clang-specific warnings to be bugs:
+      # https://lists.gnu.org/r/bug-gnulib/2025-06/msg00325.html
+      # TODO: find out why these are happening on cygwin, which is gcc
+      ++ optional (stdenv.cc.isClang || stdenv.hostPlatform.isCygwin) "-Wno-error=format-security"
+    );
+  }
+  // optionalAttrs isCross {
+    # Prevents attempts of running 'help2man' on cross-built binaries.
+    PERL = "missing";
+  };
 
   # Works around a bug with 8.26:
   # Makefile:3440: *** Recursive variable 'INSTALL' references itself (eventually).  Stop.
diff --git a/pkgs/tools/system/rsyslog/default.nix b/pkgs/tools/system/rsyslog/default.nix
index f9e2b7668110..4bcd050f7cbf 100644
--- a/pkgs/tools/system/rsyslog/default.nix
+++ b/pkgs/tools/system/rsyslog/default.nix
@@ -180,6 +180,8 @@ stdenv.mkDerivation rec {
     (lib.enableFeature true "generate-man-pages")
   ];
 
+  NIX_CFLAGS_LINK = "-lz";
+
   passthru.tests = {
     nixos-rsyslogd = nixosTests.rsyslogd;
   };
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 3672a47eac6e..3dd997ad269b 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -426,6 +426,7 @@ mapAliases {
   cataract-unstable = throw "'cataract-unstable' has been removed due to a lack of maintenace"; # Added 2025-08-25
   catch = throw "catch has been removed. Please upgrade to catch2 or catch2_3"; # Added 2025-08-21
   catnip-gtk4 = throw "'catnip-gtk4' has been removed, as it has been unmaintained upstream since June 2023, use cavasik or cavalier instead"; # Added 2026-01-01
+  cdktf-cli = warnAlias "'cdktf-cli' has been renamed to/replaced by 'cdktn-cli'" cdktn-cli; # Added 2026-02-18
   cdparanoiaIII = cdparanoia-iii; # Added 2026-02-08
   cdwe = throw "'cdwe' has been removed, as it has been unmaintained upstream since June 2023"; # Added 2026-01-01
   cedille = throw "'cedille' has been removed due to being broken for more than a year; see RFC 180"; # Added 2026-02-05
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3c70361588d3..d9acd2783756 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1791,8 +1791,6 @@ with pkgs;
 
   intensity-normalization = with python3Packages; toPythonApplication intensity-normalization;
 
-  jellyfin-desktop = kdePackages.callPackage ../applications/video/jellyfin-desktop { };
-
   jellyfin-mpv-shim = python3Packages.callPackage ../applications/video/jellyfin-mpv-shim { };
 
   klaus = with python3Packages; toPythonApplication klaus;
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 716a769990a7..73ccd177f969 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -548,7 +548,7 @@ with self;
 
     installPhase = "./Build install --prefix $out";
 
-    SDL_INST_DIR = lib.getDev pkgs.SDL;
+    env.SDL_INST_DIR = lib.getDev pkgs.SDL;
     buildInputs = [
       pkgs.SDL
       ArchiveExtract
@@ -579,7 +579,7 @@ with self;
     };
 
     buildInputs = [ ArchiveExtract ];
-    TIDYP_DIR = pkgs.tidyp;
+    env.TIDYP_DIR = pkgs.tidyp;
     propagatedBuildInputs = [ FileShareDir ];
     meta = {
       description = "Building, finding and using tidyp library";
@@ -1893,7 +1893,7 @@ with self;
       TestWarn
     ];
     env.NIX_CFLAGS_COMPILE = "-I${pkgs.zlib.dev}/include";
-    NIX_CFLAGS_LINK = "-L${pkgs.zlib.out}/lib -lz";
+    env.NIX_CFLAGS_LINK = "-L${pkgs.zlib.out}/lib -lz";
     meta = {
       description = "Fast C metadata and tag reader for all common audio file formats, slimserver fork";
       homepage = "https://github.com/Logitech/slimserver-vendor";
@@ -2436,7 +2436,7 @@ with self;
       hash = "sha256-o/LKnSuu/BqqQJCLL5y5KS/aPn15fji7146rudna62s=";
     };
     env.NIX_CFLAGS_COMPILE = "-I${pkgs.db4.dev}/include";
-    NIX_CFLAGS_LINK = "-L${pkgs.db4.out}/lib -ldb";
+    env.NIX_CFLAGS_LINK = "-L${pkgs.db4.out}/lib -ldb";
     buildInputs = [ pkgs.db4 ];
     propagatedBuildInputs = [ commonsense ];
     meta = {
@@ -4706,7 +4706,7 @@ with self;
     postPatch = ''
       substituteInPlace Makefile.PL --replace pkg-config $PKG_CONFIG
     '';
-    NIX_CFLAGS_LINK = "-L${lib.getLib pkgs.pcsclite}/lib -lpcsclite";
+    env.NIX_CFLAGS_LINK = "-L${lib.getLib pkgs.pcsclite}/lib -lpcsclite";
     # tests fail; look unfinished
     doCheck = false;
     meta = {
@@ -5779,9 +5779,9 @@ with self;
     };
 
     # Don't build a private copy of bzip2.
-    BUILD_BZIP2 = false;
-    BZIP2_LIB = "${pkgs.bzip2.out}/lib";
-    BZIP2_INCLUDE = "${pkgs.bzip2.dev}/include";
+    env.BUILD_BZIP2 = false;
+    env.BZIP2_LIB = "${pkgs.bzip2.out}/lib";
+    env.BZIP2_INCLUDE = "${pkgs.bzip2.dev}/include";
 
     meta = {
       description = "Low-Level Interface to bzip2 compression library";
@@ -6995,7 +6995,7 @@ with self;
       TestRequires
     ];
     env.NIX_CFLAGS_COMPILE = "-I${pkgs.gmp.dev}/include";
-    NIX_CFLAGS_LINK = "-L${pkgs.gmp.out}/lib -lgmp";
+    env.NIX_CFLAGS_LINK = "-L${pkgs.gmp.out}/lib -lgmp";
     meta = {
       description = "Crypt::DH Using GMP Directly";
       license = with lib.licenses; [
@@ -7483,7 +7483,7 @@ with self;
       hash = "sha256-kHxzoQVs6gV9qYGa6kipKreG5qqq858c3ZZHsj8RbHg=";
     };
     env.NIX_CFLAGS_COMPILE = "-I${pkgs.libsodium.dev}/include";
-    NIX_CFLAGS_LINK = "-L${pkgs.libsodium.out}/lib -lsodium";
+    env.NIX_CFLAGS_LINK = "-L${pkgs.libsodium.out}/lib -lsodium";
     meta = {
       description = "Perl bindings for libsodium (NaCL)";
       homepage = "https://metacpan.org/release/Crypt-Sodium";
@@ -7580,7 +7580,7 @@ with self;
       pkgs.openssl
     ];
     env.NIX_CFLAGS_COMPILE = "-I${pkgs.openssl.dev}/include";
-    NIX_CFLAGS_LINK = "-L${lib.getLib pkgs.openssl}/lib -lcrypto";
+    env.NIX_CFLAGS_LINK = "-L${lib.getLib pkgs.openssl}/lib -lcrypto";
     meta = {
       description = "Perl wrapper around OpenSSL's AES library";
       license = with lib.licenses; [
@@ -7598,7 +7598,7 @@ with self;
       hash = "sha256-I05y+4OW1FUn5v1F5DdZxcPzogjPjynmoiFhqZb9Qtw=";
     };
     env.NIX_CFLAGS_COMPILE = "-I${pkgs.openssl.dev}/include";
-    NIX_CFLAGS_LINK = "-L${lib.getLib pkgs.openssl}/lib -lcrypto";
+    env.NIX_CFLAGS_LINK = "-L${lib.getLib pkgs.openssl}/lib -lcrypto";
     meta = {
       description = "OpenSSL's multiprecision integer arithmetic";
       license = with lib.licenses; [
@@ -7633,8 +7633,8 @@ with self;
       hash = "sha256-8IdvqhujER45uGqnMMYDIR7/KQXkYMcqV7YejPR1zvQ=";
     };
     env.NIX_CFLAGS_COMPILE = "-I${pkgs.openssl.dev}/include";
-    NIX_CFLAGS_LINK = "-L${lib.getLib pkgs.openssl}/lib -lcrypto";
-    OPENSSL_PREFIX = pkgs.openssl;
+    env.NIX_CFLAGS_LINK = "-L${lib.getLib pkgs.openssl}/lib -lcrypto";
+    env.OPENSSL_PREFIX = pkgs.openssl;
     buildInputs = [ CryptOpenSSLGuess ];
     meta = {
       description = "OpenSSL/LibreSSL pseudo-random number generator access";
@@ -7654,8 +7654,8 @@ with self;
     };
     propagatedBuildInputs = [ CryptOpenSSLRandom ];
     env.NIX_CFLAGS_COMPILE = "-I${pkgs.openssl.dev}/include";
-    NIX_CFLAGS_LINK = "-L${lib.getLib pkgs.openssl}/lib -lcrypto";
-    OPENSSL_PREFIX = pkgs.openssl;
+    env.NIX_CFLAGS_LINK = "-L${lib.getLib pkgs.openssl}/lib -lcrypto";
+    env.OPENSSL_PREFIX = pkgs.openssl;
     buildInputs = [ CryptOpenSSLGuess ];
     meta = {
       description = "RSA encoding and decoding, using the openSSL libraries";
@@ -7674,8 +7674,8 @@ with self;
       hash = "sha256-xNvBbE/CloV4I3v8MkWH/9eSSacQFQJlLbnjjUSJUX8=";
     };
     env.NIX_CFLAGS_COMPILE = "-I${pkgs.openssl.dev}/include";
-    NIX_CFLAGS_LINK = "-L${lib.getLib pkgs.openssl}/lib -lcrypto";
-    OPENSSL_PREFIX = pkgs.openssl;
+    env.NIX_CFLAGS_LINK = "-L${lib.getLib pkgs.openssl}/lib -lcrypto";
+    env.OPENSSL_PREFIX = pkgs.openssl;
     buildInputs = [ CryptOpenSSLGuess ];
     propagatedBuildInputs = [ ConvertASN1 ];
     meta = {
@@ -7883,7 +7883,7 @@ with self;
         --replace '#! /usr/bin/perl' '#!${perl}/bin/perl'
     '';
     propagatedBuildInputs = [ pkgs.ncurses ];
-    NIX_CFLAGS_LINK = "-L${pkgs.ncurses.out}/lib -lncurses";
+    env.NIX_CFLAGS_LINK = "-L${pkgs.ncurses.out}/lib -lncurses";
     meta = {
       description = "Perl bindings to ncurses";
       license = with lib.licenses; [ artistic1 ];
@@ -9853,7 +9853,7 @@ with self;
       hash = "sha256-Uf6cFYlV/aDKkXqAaGPwvFEGi1M/u8dCOzzErVle0VM=";
     };
 
-    ORACLE_HOME = "${pkgs.oracle-instantclient.lib}/lib";
+    env.ORACLE_HOME = "${pkgs.oracle-instantclient.lib}/lib";
 
     buildInputs = [
       pkgs.oracle-instantclient
@@ -9920,7 +9920,7 @@ with self;
       hash = "sha256-B1e6aqyaKaLcOFmV1myPQSqIlo/SNsDYu0ZZAo5OmWU=";
     };
 
-    SYBASE = pkgs.freetds;
+    env.SYBASE = pkgs.freetds;
 
     buildInputs = [ pkgs.freetds ];
     propagatedBuildInputs = [ DBI ];
@@ -15261,8 +15261,8 @@ with self;
     ];
 
     # needed for fontconfig tests
-    HOME = "/build";
-    FONTCONFIG_PATH = "${lib.getOutput "out" pkgs.fontconfig}/etc/fonts";
+    env.HOME = "/build";
+    env.FONTCONFIG_PATH = "${lib.getOutput "out" pkgs.fontconfig}/etc/fonts";
 
     meta = {
       description = "Perl interface to the GraphViz graphing tool";
@@ -19024,7 +19024,7 @@ with self;
       hash = "sha256-MSlAwfYPR8T8k/oKnSpiZCX6qDcEDIwvGtWO4J9i83E=";
     };
     buildInputs = [ pkgs.acl ];
-    NIX_CFLAGS_LINK = "-L${pkgs.acl.out}/lib -lacl";
+    env.NIX_CFLAGS_LINK = "-L${pkgs.acl.out}/lib -lacl";
     meta = {
       description = "Perl extension for reading and setting Access Control Lists for files by libacl linux library";
       license = with lib.licenses; [
@@ -19276,7 +19276,7 @@ with self;
       url = "mirror://cpan/authors/id/P/PV/PVANDRY/gettext-1.07.tar.gz";
       hash = "sha256-kJ1HlUaX58BCGPlykVt4e9EkTXXjvQFiC8Fn1bvEnBU=";
     };
-    LANG = "C";
+    env.LANG = "C";
     meta = {
       description = "Perl extension for emulating gettext-related API";
       license = with lib.licenses; [
@@ -20707,7 +20707,7 @@ with self;
     buildInputs = [ pkgs.gmp ];
     doCheck = false;
     env.NIX_CFLAGS_COMPILE = "-I${pkgs.gmp.dev}/include";
-    NIX_CFLAGS_LINK = "-L${pkgs.gmp.out}/lib -lgmp";
+    env.NIX_CFLAGS_LINK = "-L${pkgs.gmp.out}/lib -lgmp";
     propagatedBuildInputs = [ MathBigInt ];
     meta = {
       description = "Backend library for Math::BigInt etc. based on GMP";
@@ -20800,7 +20800,7 @@ with self;
       AlienGMP
     ];
     env.NIX_CFLAGS_COMPILE = "-I${pkgs.gmp.dev}/include";
-    NIX_CFLAGS_LINK = "-L${pkgs.gmp.out}/lib -lgmp";
+    env.NIX_CFLAGS_LINK = "-L${pkgs.gmp.out}/lib -lgmp";
     meta = {
       description = "High speed arbitrary size integer math";
       license = with lib.licenses; [ lgpl21Plus ];
@@ -20818,7 +20818,7 @@ with self;
       TestWarn
       pkgs.gmp
     ];
-    NIX_CFLAGS_LINK = "-L${pkgs.gmp.out}/lib -lgmp";
+    env.NIX_CFLAGS_LINK = "-L${pkgs.gmp.out}/lib -lgmp";
     meta = {
       description = "Perl interface to the GMP integer functions";
       homepage = "https://github.com/sisyphus/math-gmpz";
@@ -20967,7 +20967,7 @@ with self;
     };
     buildInputs = [ pkgs.gmp ];
     env.NIX_CFLAGS_COMPILE = "-I${pkgs.gmp.dev}/include";
-    NIX_CFLAGS_LINK = "-L${pkgs.gmp.out}/lib -lgmp";
+    env.NIX_CFLAGS_LINK = "-L${pkgs.gmp.out}/lib -lgmp";
     meta = {
       description = "Utilities related to prime numbers, using GMP";
       homepage = "https://github.com/danaj/Math-Prime-Util-GMP";
@@ -25343,7 +25343,7 @@ with self;
       pkgs.cups
       pkgs.libcupsfilters
     ];
-    NIX_CFLAGS_LINK = "-L${lib.getLib pkgs.cups}/lib -lcups";
+    env.NIX_CFLAGS_LINK = "-L${lib.getLib pkgs.cups}/lib -lcups";
     meta = {
       description = "Common Unix Printing System Interface";
       homepage = "https://github.com/niner/perl-Net-CUPS";
@@ -26817,7 +26817,7 @@ with self;
     hardeningDisable = [ "format" ];
     # Make the async API accessible
     env.NIX_CFLAGS_COMPILE = "-DTHREADED";
-    NIX_CFLAGS_LINK = "-L${pkgs.zookeeper_mt.out}/lib -lzookeeper_mt";
+    env.NIX_CFLAGS_LINK = "-L${pkgs.zookeeper_mt.out}/lib -lzookeeper_mt";
     # Most tests are skipped as no server is available in the sandbox.
     # `t/35_log.t` seems to suffer from a race condition; remove it.  See
     # https://github.com/NixOS/nixpkgs/pull/104889#issuecomment-737144513
@@ -27953,7 +27953,7 @@ with self;
       hash = "sha256-SEhnmj8gHj87DF9vlSbmAq9Skj/6RxoqNlfbeGvTvcU=";
     };
     buildInputs = [ pkgs.zlib ];
-    NIX_CFLAGS_LINK = "-L${pkgs.zlib.out}/lib -lz";
+    env.NIX_CFLAGS_LINK = "-L${pkgs.zlib.out}/lib -lz";
     meta = {
       description = "Perl extension to provide a PerlIO layer to gzip/gunzip";
       license = with lib.licenses; [
@@ -33082,7 +33082,7 @@ with self;
       pkgs.readline
       pkgs.ncurses
     ];
-    NIX_CFLAGS_LINK = "-lreadline -lncursesw";
+    env.NIX_CFLAGS_LINK = "-lreadline -lncursesw";
 
     # For some crazy reason Makefile.PL doesn't generate a Makefile if
     # AUTOMATED_TESTING is set.
@@ -35770,9 +35770,9 @@ with self;
       hash = "sha256-K+oyCfGOJzsZPjF1pC0mk5GRnkmrEGtuJSOV0nIYL2U=";
     };
     propagatedBuildInputs = [ pkgs.aspell ];
-    ASPELL_CONF = "dict-dir ${pkgs.aspellDicts.en}/lib/aspell";
+    env.ASPELL_CONF = "dict-dir ${pkgs.aspellDicts.en}/lib/aspell";
     env.NIX_CFLAGS_COMPILE = "-I${pkgs.aspell}/include";
-    NIX_CFLAGS_LINK = "-L${pkgs.aspell}/lib -laspell";
+    env.NIX_CFLAGS_LINK = "-L${pkgs.aspell}/lib -laspell";
     meta = {
       description = "Perl interface to the GNU Aspell library";
       license = with lib.licenses; [
@@ -38384,7 +38384,7 @@ with self;
       pkgs.libxt
       pkgs.libxtst
     ];
-    NIX_CFLAGS_LINK = "-lX11";
+    env.NIX_CFLAGS_LINK = "-lX11";
     doCheck = false; # requires an X server
     meta = {
       description = "Provides GUI testing/interaction routines";
@@ -38427,7 +38427,7 @@ with self;
       XMLSimple
       XSObjectMagic
     ];
-    NIX_CFLAGS_LINK = "-lxcb -lxcb-util -lxcb-xinerama -lxcb-icccm -lxcb-randr -lxcb-xkb";
+    env.NIX_CFLAGS_LINK = "-lxcb -lxcb-util -lxcb-xinerama -lxcb-icccm -lxcb-randr -lxcb-xkb";
     doCheck = false; # requires an X server
     meta = {
       description = "Perl bindings for libxcb";
@@ -38670,7 +38670,7 @@ with self;
       url = "mirror://cpan/authors/id/S/SH/SHLOMIF/XML-LibXML-2.0210.tar.gz";
       hash = "sha256-opvz8Aq5ye4EIYFU4K/I95m/I2dOuZwantTeH0BZpI0=";
     };
-    SKIP_SAX_INSTALL = 1;
+    env.SKIP_SAX_INSTALL = 1;
     buildInputs = [
       AlienBuild
       AlienLibxml2
@@ -39523,7 +39523,7 @@ with self;
       hash = "sha256-BpsWQRcpX6gtJSlAocqLMIrYsfPocjvk6CaqqX9wbWw=";
     };
     env.NIX_CFLAGS_COMPILE = "-I${pkgs.openssl.dev}/include -I${pkgs.libidn2}.dev}/include";
-    NIX_CFLAGS_LINK = "-L${lib.getLib pkgs.openssl}/lib -L${lib.getLib pkgs.libidn2}/lib -lcrypto -lidn2";
+    env.NIX_CFLAGS_LINK = "-L${lib.getLib pkgs.openssl}/lib -L${lib.getLib pkgs.libidn2}/lib -lcrypto -lidn2";
 
     makeMakerFlags = [ "--prefix-openssl=${pkgs.openssl.dev}" ];
 
diff --git a/pkgs/top-level/rocq-packages.nix b/pkgs/top-level/rocq-packages.nix
index 0ce9d5f897de..53f5720c53d9 100644
--- a/pkgs/top-level/rocq-packages.nix
+++ b/pkgs/top-level/rocq-packages.nix
@@ -46,6 +46,8 @@ let
       mathcomp-solvable = self.mathcomp.solvable;
       mathcomp-field = self.mathcomp.field;
       mathcomp-character = self.mathcomp.character;
+      mathcomp-bigenough = callPackage ../development/rocq-modules/mathcomp-bigenough { };
+      mathcomp-finmap = callPackage ../development/rocq-modules/mathcomp-finmap { };
       parseque = callPackage ../development/rocq-modules/parseque { };
       relation-algebra = callPackage ../development/rocq-modules/relation-algebra { };
       rocq-elpi = callPackage ../development/rocq-modules/rocq-elpi { };