diff --git a/ci/eval/compare/maintainers.nix b/ci/eval/compare/maintainers.nix
index b3ebf6aee569..854c1f730bda 100644
--- a/ci/eval/compare/maintainers.nix
+++ b/ci/eval/compare/maintainers.nix
@@ -72,7 +72,8 @@ let
           (lib.unsafeGetAttrPos "src" drv)
           (lib.unsafeGetAttrPos "pname" drv)
           (lib.unsafeGetAttrPos "version" drv)
-
+        ]
+        ++ lib.optionals (drv.meta.position or null != null) [
           # Use ".meta.position" for cases when most of the package is
           # defined in a "common" section and the only place where
           # reference to the file with a derivation the "pos"
@@ -82,7 +83,7 @@ let
           #   "pkgs/tools/package-management/nix/default.nix:155"
           # We transform it to the following:
           #   { file = "pkgs/tools/package-management/nix/default.nix"; }
-          { file = lib.head (lib.splitString ":" (drv.meta.position or "")); }
+          { file = lib.head (lib.splitString ":" drv.meta.position); }
         ]
       )
     ));
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index dd06cef1f75a..0948524fc6a4 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -2489,6 +2489,7 @@
     github = "auscyber";
     name = "Ivy Pierlot";
     githubId = 12080502;
+    matrix = "@ivy:faggot.sh";
   };
   austin-artificial = {
     email = "austin.platt@artificial.io";
diff --git a/pkgs/applications/version-management/qgit/default.nix b/pkgs/applications/version-management/qgit/default.nix
index 444adfbdab90..cc946a3e78d1 100644
--- a/pkgs/applications/version-management/qgit/default.nix
+++ b/pkgs/applications/version-management/qgit/default.nix
@@ -1,35 +1,43 @@
 {
-  mkDerivation,
+  stdenv,
   lib,
   fetchFromGitHub,
   cmake,
   qtbase,
+  qt5compat,
+  wrapQtAppsHook,
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "qgit";
-  version = "2.11";
+  version = "2.12";
 
   src = fetchFromGitHub {
     owner = "tibirna";
     repo = "qgit";
-    rev = "${pname}-${version}";
-    sha256 = "sha256-DmwxOy71mIklLQ7V/qMzi8qCMtKa9nWHlkjEr/9HJIU=";
+    rev = "qgit-${finalAttrs.version}";
+    hash = "sha256-q81nY9D/8riMTFP8gDRbY2PjVo+NwRu/XEN1Yn0P/pk=";
   };
 
-  buildInputs = [ qtbase ];
+  nativeBuildInputs = [
+    cmake
+    wrapQtAppsHook
+  ];
 
-  nativeBuildInputs = [ cmake ];
+  buildInputs = [
+    qtbase
+    qt5compat
+  ];
 
-  meta = with lib; {
-    license = licenses.gpl2Only;
+  meta = {
+    license = lib.licenses.gpl2Only;
     homepage = "https://github.com/tibirna/qgit";
     description = "Graphical front-end to Git";
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
       peterhoeg
       markuskowa
     ];
     inherit (qtbase.meta) platforms;
     mainProgram = "qgit";
   };
-}
+})
diff --git a/pkgs/build-support/fetchgitlab/default.nix b/pkgs/build-support/fetchgitlab/default.nix
index 822c3991fa29..8a2b0ffa31d6 100644
--- a/pkgs/build-support/fetchgitlab/default.nix
+++ b/pkgs/build-support/fetchgitlab/default.nix
@@ -21,6 +21,8 @@ lib.makeOverridable (
     deepClone ? false,
     forceFetchGit ? false,
     sparseCheckout ? [ ],
+    private ? false,
+    varPrefix ? null,
     ... # For hash agility
   }@args:
 
@@ -51,14 +53,57 @@ lib.makeOverridable (
       "tag"
       "fetchSubmodules"
       "forceFetchGit"
+      "private"
+      "varPrefix"
       "leaveDotGit"
       "deepClone"
     ];
 
+    varBase = "NIX${lib.optionalString (varPrefix != null) "_${varPrefix}"}_GITLAB_PRIVATE_";
     useFetchGit =
       fetchSubmodules || leaveDotGit || deepClone || forceFetchGit || (sparseCheckout != [ ]);
     fetcher = if useFetchGit then fetchgit else fetchzip;
 
+    privateAttrs = lib.optionalAttrs private (
+      lib.throwIfNot (protocol == "https") "private token login is only supported for https" {
+        netrcPhase = ''
+          if [ -z "''$${varBase}USERNAME" -o -z "''$${varBase}PASSWORD" ]; then
+            echo "Error: Private fetchFromGitLab requires the nix building process (nix-daemon in multi user mode) to have the ${varBase}USERNAME and ${varBase}PASSWORD env vars set." >&2
+            exit 1
+          fi
+        ''
+        + (
+          if useFetchGit then
+            # GitLab supports HTTP Basic Authentication only when Git is used:
+            # https://docs.gitlab.com/ee/user/project/settings/project_access_tokens.html#project-access-tokens
+            ''
+              cat > netrc <<EOF
+              machine ${domain}
+                      login ''$${varBase}USERNAME
+                      password ''$${varBase}PASSWORD
+              EOF
+            ''
+          else
+            # Access via the GitLab API requires a custom header and does not work
+            # with HTTP Basic Authentication:
+            # https://docs.gitlab.com/ee/api/#personalprojectgroup-access-tokens
+            ''
+              # needed because fetchurl always sets --netrc-file if a netrcPhase is present
+              touch netrc
+
+              cat > private-token <<EOF
+              PRIVATE-TOKEN: ''$${varBase}PASSWORD
+              EOF
+              curlOpts="$curlOpts --header @./private-token"
+            ''
+        );
+        netrcImpureEnvVars = [
+          "${varBase}USERNAME"
+          "${varBase}PASSWORD"
+        ];
+      }
+    );
+
     gitRepoUrl = "${protocol}://${domain}/${slug}.git";
 
     fetcherArgs =
@@ -84,6 +129,7 @@ lib.makeOverridable (
             };
           }
       )
+      // privateAttrs
       // passthruAttrs
       // {
         inherit name;
diff --git a/pkgs/by-name/pl/plantuml/package.nix b/pkgs/by-name/pl/plantuml/package.nix
index f7ac77e03407..129f45843867 100644
--- a/pkgs/by-name/pl/plantuml/package.nix
+++ b/pkgs/by-name/pl/plantuml/package.nix
@@ -11,11 +11,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "plantuml";
-  version = "1.2025.8";
+  version = "1.2025.9";
 
   src = fetchurl {
     url = "https://github.com/plantuml/plantuml/releases/download/v${finalAttrs.version}/plantuml-pdf-${finalAttrs.version}.jar";
-    hash = "sha256-KYOy8hJ62IBrLx78S2JLAMR2wuL18Ww+afVgPeKgWgQ=";
+    hash = "sha256-sQeOboLmTsHeT5Gk/hSBs9IsMMqiYrjThv7OSAIvyNg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/tp/tpnote/package.nix b/pkgs/by-name/tp/tpnote/package.nix
index 5dc592333593..06f44f3036fc 100644
--- a/pkgs/by-name/tp/tpnote/package.nix
+++ b/pkgs/by-name/tp/tpnote/package.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tpnote";
-  version = "1.25.15";
+  version = "1.25.16";
 
   src = fetchFromGitHub {
     owner = "getreu";
     repo = "tp-note";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vmHRpY2KvG6vxVQ6OVi/u6wpD8oqQFXn2IJOT0Nh/V0=";
+    hash = "sha256-gltzK1C+4qddJ49vv+OZ8AVuMeBWArwOZkL+v7cxFzw=";
   };
 
-  cargoHash = "sha256-dltBOA6pxy2gLemVoX8l0Z+xkiJvhGWSmediWWnN1bc=";
+  cargoHash = "sha256-OH3aSQdcAGNRJWGmgQ4LNnD89hqCIEh+ieHosjFhAbk=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/development/interpreters/python/python-packages-base.nix b/pkgs/development/interpreters/python/python-packages-base.nix
index 67600fe972f5..121e4ead8987 100644
--- a/pkgs/development/interpreters/python/python-packages-base.nix
+++ b/pkgs/development/interpreters/python/python-packages-base.nix
@@ -38,7 +38,12 @@ let
         }
       else
         result
-    );
+    )
+    // lib.optionalAttrs (f ? override) {
+      # Support overriding `f` itself, e.g. `buildPythonPackage.override { }`.
+      # Ensure `makeOverridablePythonPackage` is applied to the result.
+      override = lib.mirrorFunctionArgs f.override (fdrv: makeOverridablePythonPackage (f.override fdrv));
+    };
 
   mkPythonDerivation =
     if python.isPy3k then ./mk-python-derivation.nix else ./python2/mk-python-derivation.nix;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index cff1a56fb94e..9b11818e8562 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1259,7 +1259,7 @@ with pkgs;
     python3Packages.callPackage ../applications/version-management/pass-git-helper
       { };
 
-  qgit = qt5.callPackage ../applications/version-management/qgit { };
+  qgit = qt6Packages.callPackage ../applications/version-management/qgit { };
 
   silver-platter = python3Packages.callPackage ../applications/version-management/silver-platter { };