diff --git a/nixos/modules/services/ttys/getty.nix b/nixos/modules/services/ttys/getty.nix
index 01d2858602b6..f33a4edd2d66 100644
--- a/nixos/modules/services/ttys/getty.nix
+++ b/nixos/modules/services/ttys/getty.nix
@@ -163,6 +163,9 @@ in
       ];
       environment.TTY = "%I";
       restartIfChanged = false;
+      # logind hardcodes spawning autovt@ttyN.service on VT switch. Upstream
+      # declares this alias via [Install] Alias=, which NixOS does not process.
+      aliases = [ "autovt@.service" ];
     };
 
     systemd.services."serial-getty@" = {
@@ -173,14 +176,6 @@ in
       restartIfChanged = false;
     };
 
-    systemd.services."autovt@" = {
-      serviceConfig.ExecStart = [
-        "" # override upstream default with an empty ExecStart
-        (gettyCmd "--noclear %I $TERM")
-      ];
-      restartIfChanged = false;
-    };
-
     systemd.services."container-getty@" = {
       serviceConfig.ExecStart = [
         "" # override upstream default with an empty ExecStart
diff --git a/nixos/modules/services/ttys/kmscon.nix b/nixos/modules/services/ttys/kmscon.nix
index a7fdb726dd03..63bf9432c501 100644
--- a/nixos/modules/services/ttys/kmscon.nix
+++ b/nixos/modules/services/ttys/kmscon.nix
@@ -172,10 +172,15 @@ in
       ];
 
       restartIfChanged = false;
+      # logind spawns autovt@ttyN.service on VT switch; point it at kmscon
       aliases = [ "autovt@.service" ];
     };
 
-    systemd.suppressedSystemUnits = [ "autovt@.service" ];
+    # tty1 is special: logind does not spawn autovt@tty1, it expects a static
+    # pull-in via getty.target. With getty@ suppressed, we must replace it.
+    systemd.services."kmsconvt@tty1".wantedBy = [ "getty.target" ];
+
+    systemd.suppressedSystemUnits = [ "getty@.service" ];
 
     services.kmscon.extraConfig =
       let
diff --git a/nixos/modules/system/boot/networkd.nix b/nixos/modules/system/boot/networkd.nix
index 413429f582de..e4bbd2d36802 100644
--- a/nixos/modules/system/boot/networkd.nix
+++ b/nixos/modules/system/boot/networkd.nix
@@ -3405,8 +3405,11 @@ let
           "systemd-networkd.service"
           "systemd-networkd.socket"
           "systemd-networkd-persistent-storage.service"
+          "systemd-networkd-varlink-metrics.socket"
         ];
 
+        systemd.sockets.systemd-networkd-varlink-metrics.wantedBy = [ "sockets.target" ];
+
         environment.etc."systemd/networkd.conf" = renderConfig cfg.config;
 
         systemd.services.systemd-networkd =
diff --git a/nixos/modules/system/boot/systemd/journald.nix b/nixos/modules/system/boot/systemd/journald.nix
index 279da8f47c0b..52b0bcf95b6b 100644
--- a/nixos/modules/system/boot/systemd/journald.nix
+++ b/nixos/modules/system/boot/systemd/journald.nix
@@ -130,6 +130,8 @@ in
       "systemd-journald-sync@.service"
       "systemd-journald-audit.socket"
       "systemd-journald-dev-log.socket"
+      "systemd-journalctl.socket"
+      "systemd-journalctl@.service"
       "syslog.socket"
     ];
 
diff --git a/nixos/modules/system/boot/systemd/logind.nix b/nixos/modules/system/boot/systemd/logind.nix
index 22d9195536b3..221f9555929f 100644
--- a/nixos/modules/system/boot/systemd/logind.nix
+++ b/nixos/modules/system/boot/systemd/logind.nix
@@ -43,7 +43,6 @@
   config = {
     systemd.additionalUpstreamSystemUnits = [
       "systemd-logind.service"
-      "autovt@.service"
       "systemd-user-sessions.service"
     ]
     ++ lib.optionals config.systemd.package.withImportd [
diff --git a/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch b/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
index 9e6f0ba7be7b..138b8c92dba2 100644
--- a/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
+++ b/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
@@ -27,7 +27,7 @@ index 25e229bf3e..b9af1c3b13 100644
                          "/etc"))
                  return true;
 diff --git a/src/shutdown/umount.c b/src/shutdown/umount.c
-index 46f208824a..3a625ad2a6 100644
+index 7729a1d415..744abeee23 100644
 --- a/src/shutdown/umount.c
 +++ b/src/shutdown/umount.c
 @@ -178,8 +178,10 @@ int mount_points_list_get(FILE *f, MountPoint **head) {
diff --git a/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch b/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
index e7861c684d84..fc80edc766cf 100644
--- a/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
+++ b/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
@@ -10,10 +10,10 @@ container, so checking early whether it exists will fail.
  1 file changed, 2 insertions(+)
 
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index 95626a7012..764e82df8b 100644
+index 84e94e845a..a0052c1c88 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -6233,6 +6233,7 @@ static int run(int argc, char *argv[]) {
+@@ -6368,6 +6368,7 @@ static int run(int argc, char *argv[]) {
                                  goto finish;
                          }
                  } else {
@@ -21,11 +21,11 @@ index 95626a7012..764e82df8b 100644
                          _cleanup_free_ char *p = NULL;
  
                          if (arg_pivot_root_new)
-@@ -6252,6 +6253,7 @@ static int run(int argc, char *argv[]) {
+@@ -6387,6 +6388,7 @@ static int run(int argc, char *argv[]) {
                                  log_error_errno(r, "Unable to determine if %s looks like it has an OS tree (i.e. whether /usr/ exists): %m", arg_directory);
                                  goto finish;
                          }
 +#endif
                  }
  
-                 if (arg_userns_mode == USER_NAMESPACE_MANAGED) {
+                 if (userns_fd >= 0) {
diff --git a/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch b/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch
index 0c9f1d206d6b..6ba6bcffd76c 100644
--- a/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch
+++ b/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch
@@ -46,10 +46,10 @@ index 862d57dcb6..8ba0ca4486 100644
  
  systemd_sleep_dir=${prefix}/lib/systemd/system-sleep
 diff --git a/src/libsystemd/sd-path/path-lookup.c b/src/libsystemd/sd-path/path-lookup.c
-index 389d7e2ad9..0819689ffa 100644
+index 32c14fb14a..7f0bf62844 100644
 --- a/src/libsystemd/sd-path/path-lookup.c
 +++ b/src/libsystemd/sd-path/path-lookup.c
-@@ -86,11 +86,7 @@ int runtime_directory(RuntimeScope scope, const char *fallback_suffix, char **re
+@@ -102,11 +102,7 @@ int runtime_directory(RuntimeScope scope, const char *fallback_suffix, char **re
  }
  
  static const char* const user_data_unit_paths[] = {
@@ -61,7 +61,7 @@ index 389d7e2ad9..0819689ffa 100644
          NULL
  };
  
-@@ -498,16 +494,13 @@ int lookup_paths_init(
+@@ -519,16 +515,13 @@ int lookup_paths_init(
                                         persistent_config,
                                         SYSTEM_CONFIG_UNIT_DIR,
                                         "/etc/systemd/system",
@@ -79,7 +79,7 @@ index 389d7e2ad9..0819689ffa 100644
                                         STRV_IFNOTNULL(generator_late));
                          break;
  
-@@ -525,13 +518,10 @@ int lookup_paths_init(
+@@ -546,13 +539,10 @@ int lookup_paths_init(
                          add = strv_new(persistent_config,
                                         USER_CONFIG_UNIT_DIR,
                                         "/etc/systemd/user",
@@ -95,7 +95,7 @@ index 389d7e2ad9..0819689ffa 100644
                          break;
  
                  case RUNTIME_SCOPE_USER:
-@@ -670,7 +660,6 @@ void lookup_paths_log(LookupPaths *lp) {
+@@ -692,7 +682,6 @@ void lookup_paths_log(LookupPaths *lp) {
  static const char* const system_generator_paths[] = {
          "/run/systemd/system-generators",
          "/etc/systemd/system-generators",
@@ -103,7 +103,7 @@ index 389d7e2ad9..0819689ffa 100644
          SYSTEM_GENERATOR_DIR,
          NULL,
  };
-@@ -678,7 +667,6 @@ static const char* const system_generator_paths[] = {
+@@ -700,7 +689,6 @@ static const char* const system_generator_paths[] = {
  static const char* const user_generator_paths[] = {
          "/run/systemd/user-generators",
          "/etc/systemd/user-generators",
@@ -111,7 +111,7 @@ index 389d7e2ad9..0819689ffa 100644
          USER_GENERATOR_DIR,
          NULL,
  };
-@@ -686,7 +674,6 @@ static const char* const user_generator_paths[] = {
+@@ -708,7 +696,6 @@ static const char* const user_generator_paths[] = {
  static const char* const system_env_generator_paths[] = {
          "/run/systemd/system-environment-generators",
          "/etc/systemd/system-environment-generators",
@@ -119,7 +119,7 @@ index 389d7e2ad9..0819689ffa 100644
          SYSTEM_ENV_GENERATOR_DIR,
          NULL,
  };
-@@ -694,7 +681,6 @@ static const char* const system_env_generator_paths[] = {
+@@ -716,7 +703,6 @@ static const char* const system_env_generator_paths[] = {
  static const char* const user_env_generator_paths[] = {
          "/run/systemd/user-environment-generators",
          "/etc/systemd/user-environment-generators",
diff --git a/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch b/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch
index bee57fa30b55..112f3f509f54 100644
--- a/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch
+++ b/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch
@@ -13,10 +13,10 @@ in containers.
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index a5a51023c5..22cc7bd789 100644
+index 79fa19d976..2115d74595 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -1578,7 +1578,8 @@ static unsigned manager_dispatch_stop_when_bound_queue(Manager *m) {
+@@ -1579,7 +1579,8 @@ static unsigned manager_dispatch_stop_when_bound_queue(Manager *m) {
                  if (!unit_is_bound_by_inactive(u, &culprit))
                          continue;
  
diff --git a/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch b/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch
index 82f9198d7d4e..2abe659a42bf 100644
--- a/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch
+++ b/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch
@@ -11,10 +11,10 @@ Subject: [PATCH] hostnamed, localed, timedated: disable methods that change
  3 files changed, 25 insertions(+)
 
 diff --git a/src/hostname/hostnamed.c b/src/hostname/hostnamed.c
-index fbe1b2fa7a..30e7c75279 100644
+index 04c72e8137..1f9f296d56 100644
 --- a/src/hostname/hostnamed.c
 +++ b/src/hostname/hostnamed.c
-@@ -1388,6 +1388,9 @@ static int method_set_static_hostname(sd_bus_message *m, void *userdata, sd_bus_
+@@ -1421,6 +1421,9 @@ static int method_set_static_hostname(sd_bus_message *m, void *userdata, sd_bus_
          if (r < 0)
                  return r;
  
@@ -24,7 +24,7 @@ index fbe1b2fa7a..30e7c75279 100644
          name = empty_to_null(name);
  
          context_read_etc_hostname(c);
-@@ -1454,6 +1457,9 @@ static int set_machine_info(Context *c, sd_bus_message *m, int prop, sd_bus_mess
+@@ -1487,6 +1490,9 @@ static int set_machine_info(Context *c, sd_bus_message *m, int prop, sd_bus_mess
          if (r < 0)
                  return r;
  
@@ -69,10 +69,10 @@ index 041ba29cd8..02fbe3e278 100644
  
          r = x11_context_verify_and_warn(&in, LOG_ERR, error);
 diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
-index d1ef772b56..9b1fe439f1 100644
+index 43cf3fddb9..1455830cba 100644
 --- a/src/timedate/timedated.c
 +++ b/src/timedate/timedated.c
-@@ -678,6 +678,10 @@ static int method_set_timezone(sd_bus_message *m, void *userdata, sd_bus_error *
+@@ -680,6 +680,10 @@ static int method_set_timezone(sd_bus_message *m, void *userdata, sd_bus_error *
          if (r < 0)
                  return r;
  
@@ -83,7 +83,7 @@ index d1ef772b56..9b1fe439f1 100644
          if (!timezone_is_valid(z, LOG_DEBUG))
                  return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid or not installed time zone '%s'", z);
  
-@@ -756,6 +760,9 @@ static int method_set_local_rtc(sd_bus_message *m, void *userdata, sd_bus_error
+@@ -758,6 +762,9 @@ static int method_set_local_rtc(sd_bus_message *m, void *userdata, sd_bus_error
          if (r < 0)
                  return r;
  
@@ -93,7 +93,7 @@ index d1ef772b56..9b1fe439f1 100644
          if (lrtc == c->local_rtc && !fix_system)
                  return sd_bus_reply_method_return(m, NULL);
  
-@@ -954,6 +961,9 @@ static int method_set_ntp(sd_bus_message *m, void *userdata, sd_bus_error *error
+@@ -956,6 +963,9 @@ static int method_set_ntp(sd_bus_message *m, void *userdata, sd_bus_error *error
          if (r < 0)
                  return r;
  
diff --git a/pkgs/os-specific/linux/systemd/0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch b/pkgs/os-specific/linux/systemd/0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
index 34cd1047f908..dafea66ecf0d 100644
--- a/pkgs/os-specific/linux/systemd/0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
+++ b/pkgs/os-specific/linux/systemd/0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
@@ -75,10 +75,10 @@ index 5dd00af952..e682337ef0 100644
                  return -EINVAL;
          if (!timezone_is_valid(e, LOG_DEBUG))
 diff --git a/src/firstboot/firstboot.c b/src/firstboot/firstboot.c
-index 38e3adaed6..953ad05fb5 100644
+index ae1899593c..20d3071114 100644
 --- a/src/firstboot/firstboot.c
 +++ b/src/firstboot/firstboot.c
-@@ -576,7 +576,7 @@ static int prompt_timezone(int rfd, sd_varlink **mute_console_link) {
+@@ -584,7 +584,7 @@ static int prompt_timezone(int rfd, sd_varlink **mute_console_link) {
  
  static int process_timezone(int rfd, sd_varlink **mute_console_link) {
          _cleanup_close_ int pfd = -EBADF;
@@ -87,7 +87,7 @@ index 38e3adaed6..953ad05fb5 100644
          const char *e;
          int r;
  
-@@ -622,12 +622,9 @@ static int process_timezone(int rfd, sd_varlink **mute_console_link) {
+@@ -630,12 +630,9 @@ static int process_timezone(int rfd, sd_varlink **mute_console_link) {
          if (isempty(arg_timezone))
                  return 0;
  
@@ -103,10 +103,10 @@ index 38e3adaed6..953ad05fb5 100644
                  return log_error_errno(r, "Failed to create /etc/localtime symlink: %m");
  
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index 764e82df8b..5dc706be4f 100644
+index a0052c1c88..39f2b1f1e5 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -1820,8 +1820,8 @@ int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid
+@@ -1856,8 +1856,8 @@ int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid
  static const char *timezone_from_path(const char *path) {
          return PATH_STARTSWITH_SET(
                          path,
@@ -118,10 +118,10 @@ index 764e82df8b..5dc706be4f 100644
  
  static bool etc_writable(void) {
 diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
-index 9b1fe439f1..916886aeff 100644
+index 1455830cba..532fe3684b 100644
 --- a/src/timedate/timedated.c
 +++ b/src/timedate/timedated.c
-@@ -266,7 +266,7 @@ static int context_read_data(Context *c) {
+@@ -268,7 +268,7 @@ static int context_read_data(Context *c) {
  
          r = get_timezone(&t);
          if (r == -EINVAL)
@@ -130,7 +130,7 @@ index 9b1fe439f1..916886aeff 100644
          else if (r < 0)
                  log_warning_errno(r, "Failed to get target of /etc/localtime: %m");
  
-@@ -290,7 +290,7 @@ static int context_write_data_timezone(Context *c) {
+@@ -292,7 +292,7 @@ static int context_write_data_timezone(Context *c) {
  
          if (isempty(c->zone) || streq(c->zone, "UTC")) {
  
@@ -139,7 +139,7 @@ index 9b1fe439f1..916886aeff 100644
  
                          if (unlink(etc_localtime()) < 0 && errno != ENOENT)
                                  return -errno;
-@@ -298,9 +298,9 @@ static int context_write_data_timezone(Context *c) {
+@@ -300,9 +300,9 @@ static int context_write_data_timezone(Context *c) {
                          return 0;
                  }
  
diff --git a/pkgs/os-specific/linux/systemd/0009-add-rootprefix-to-lookup-dir-paths.patch b/pkgs/os-specific/linux/systemd/0009-add-rootprefix-to-lookup-dir-paths.patch
index 6b02907d6d60..813a6317dfd5 100644
--- a/pkgs/os-specific/linux/systemd/0009-add-rootprefix-to-lookup-dir-paths.patch
+++ b/pkgs/os-specific/linux/systemd/0009-add-rootprefix-to-lookup-dir-paths.patch
@@ -12,7 +12,7 @@ files that I might have missed.
  1 file changed, 4 insertions(+), 2 deletions(-)
 
 diff --git a/src/basic/constants.h b/src/basic/constants.h
-index a26cff4062..3800c37e1b 100644
+index 3dbffdee26..d3c3a1b067 100644
 --- a/src/basic/constants.h
 +++ b/src/basic/constants.h
 @@ -40,13 +40,15 @@
diff --git a/pkgs/os-specific/linux/systemd/0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch b/pkgs/os-specific/linux/systemd/0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
index 37b56151b0b2..5de6a93cd7f9 100644
--- a/pkgs/os-specific/linux/systemd/0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
+++ b/pkgs/os-specific/linux/systemd/0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
@@ -10,10 +10,10 @@ This is needed for NixOS to use such scripts as systemd directory is immutable.
  1 file changed, 1 insertion(+)
 
 diff --git a/src/shutdown/shutdown.c b/src/shutdown/shutdown.c
-index ff68f9e272..53f2ba1eee 100644
+index fc6df238be..cb8b45a41b 100644
 --- a/src/shutdown/shutdown.c
 +++ b/src/shutdown/shutdown.c
-@@ -329,6 +329,7 @@ static void notify_supervisor(void) {
+@@ -330,6 +330,7 @@ static void notify_supervisor(void) {
  int main(int argc, char *argv[]) {
          static const char* const dirs[] = {
                  SYSTEM_SHUTDOWN_PATH,
diff --git a/pkgs/os-specific/linux/systemd/0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch b/pkgs/os-specific/linux/systemd/0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
index e39b77a9f86c..5da56ce4be17 100644
--- a/pkgs/os-specific/linux/systemd/0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
+++ b/pkgs/os-specific/linux/systemd/0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
@@ -9,7 +9,7 @@ This is needed for NixOS to use such scripts as systemd directory is immutable.
  1 file changed, 1 insertion(+)
 
 diff --git a/src/sleep/sleep.c b/src/sleep/sleep.c
-index 0d128053ba..4deec9f72d 100644
+index 43aaede5b0..a8e5a75e39 100644
 --- a/src/sleep/sleep.c
 +++ b/src/sleep/sleep.c
 @@ -248,6 +248,7 @@ static int execute(
diff --git a/pkgs/os-specific/linux/systemd/0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch b/pkgs/os-specific/linux/systemd/0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
index 9b2955528b8d..b0b2c5384b9b 100644
--- a/pkgs/os-specific/linux/systemd/0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
+++ b/pkgs/os-specific/linux/systemd/0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
@@ -10,7 +10,7 @@ systemd itself uses extensively.
  1 file changed, 4 insertions(+), 4 deletions(-)
 
 diff --git a/src/basic/path-util.h b/src/basic/path-util.h
-index 5b2baef4e1..7f366e4544 100644
+index e2e80ae91f..9f856490a3 100644
 --- a/src/basic/path-util.h
 +++ b/src/basic/path-util.h
 @@ -9,11 +9,11 @@
diff --git a/pkgs/os-specific/linux/systemd/0013-inherit-systemd-environment-when-calling-generators.patch b/pkgs/os-specific/linux/systemd/0013-inherit-systemd-environment-when-calling-generators.patch
index 5f2663d71425..4645b2f6d269 100644
--- a/pkgs/os-specific/linux/systemd/0013-inherit-systemd-environment-when-calling-generators.patch
+++ b/pkgs/os-specific/linux/systemd/0013-inherit-systemd-environment-when-calling-generators.patch
@@ -16,10 +16,10 @@ executables that are being called from managers.
  1 file changed, 8 insertions(+)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index 22cc7bd789..0a56da1307 100644
+index 2115d74595..86f697313b 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -3996,9 +3996,17 @@ static int build_generator_environment(Manager *m, char ***ret) {
+@@ -3999,9 +3999,17 @@ static int build_generator_environment(Manager *m, char ***ret) {
           * adjust generated units to that. Let's pass down some bits of information that are easy for us to
           * determine (but a bit harder for generator scripts to determine), as environment variables. */
  
diff --git a/pkgs/os-specific/linux/systemd/0015-tpm2_context_init-fix-driver-name-checking.patch b/pkgs/os-specific/linux/systemd/0015-tpm2_context_init-fix-driver-name-checking.patch
index 8cb7a24ec123..2cf174823605 100644
--- a/pkgs/os-specific/linux/systemd/0015-tpm2_context_init-fix-driver-name-checking.patch
+++ b/pkgs/os-specific/linux/systemd/0015-tpm2_context_init-fix-driver-name-checking.patch
@@ -27,11 +27,11 @@ filename_is_valid with path_is_valid.
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/shared/tpm2-util.c b/src/shared/tpm2-util.c
-index 76951ccfd4..0a1ed3d6a5 100644
+index 9e05c847ed..c0dd773eee 100644
 --- a/src/shared/tpm2-util.c
 +++ b/src/shared/tpm2-util.c
-@@ -741,7 +741,7 @@ int tpm2_context_new(const char *device, Tpm2Context **ret_context) {
-                 fn = strjoina("libtss2-tcti-", driver, ".so.0");
+@@ -918,7 +918,7 @@ int tpm2_context_new(const char *device, Tpm2Context **ret_context) {
+                         return log_oom_debug();
  
                  /* Better safe than sorry, let's refuse strings that cannot possibly be valid driver early, before going to disk. */
 -                if (!filename_is_valid(fn))
diff --git a/pkgs/os-specific/linux/systemd/0018-meson-Don-t-link-ssh-dropins.patch b/pkgs/os-specific/linux/systemd/0017-meson-Don-t-link-ssh-dropins.patch
similarity index 91%
rename from pkgs/os-specific/linux/systemd/0018-meson-Don-t-link-ssh-dropins.patch
rename to pkgs/os-specific/linux/systemd/0017-meson-Don-t-link-ssh-dropins.patch
index 94e93ae2c69f..ffc324be19df 100644
--- a/pkgs/os-specific/linux/systemd/0018-meson-Don-t-link-ssh-dropins.patch
+++ b/pkgs/os-specific/linux/systemd/0017-meson-Don-t-link-ssh-dropins.patch
@@ -8,10 +8,10 @@ Subject: [PATCH] meson: Don't link ssh dropins
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/meson.build b/meson.build
-index 765c1802a2..96013f0327 100644
+index 3672005d75..406be24b45 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -214,13 +214,13 @@ sshconfdir = get_option('sshconfdir')
+@@ -210,13 +210,13 @@ sshconfdir = get_option('sshconfdir')
  if sshconfdir == ''
          sshconfdir = sysconfdir / 'ssh/ssh_config.d'
  endif
diff --git a/pkgs/os-specific/linux/systemd/0017-meson.build-do-not-create-systemdstatedir.patch b/pkgs/os-specific/linux/systemd/0017-meson.build-do-not-create-systemdstatedir.patch
deleted file mode 100644
index c209affe2df8..000000000000
--- a/pkgs/os-specific/linux/systemd/0017-meson.build-do-not-create-systemdstatedir.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: nikstur <nikstur@outlook.com>
-Date: Mon, 6 Nov 2023 22:51:38 +0100
-Subject: [PATCH] meson.build: do not create systemdstatedir
-
----
- meson.build | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/meson.build b/meson.build
-index 08f4f99f51..765c1802a2 100644
---- a/meson.build
-+++ b/meson.build
-@@ -2858,7 +2858,6 @@ install_data('LICENSE.GPL2',
- install_subdir('LICENSES',
-                install_dir : docdir)
- 
--install_emptydir(systemdstatedir)
- 
- #####################################################################
- 
diff --git a/pkgs/os-specific/linux/systemd/0019-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch b/pkgs/os-specific/linux/systemd/0018-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
similarity index 100%
rename from pkgs/os-specific/linux/systemd/0019-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
rename to pkgs/os-specific/linux/systemd/0018-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 04df6c8445c8..0b221cac145a 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -202,17 +202,17 @@ let
   # command:
   #  $ curl -s https://api.github.com/repos/systemd/systemd/releases/latest | \
   #     jq '.created_at|strptime("%Y-%m-%dT%H:%M:%SZ")|mktime'
-  releaseTimestamp = "1766012573";
+  releaseTimestamp = "1773777352";
 in
 stdenv.mkDerivation (finalAttrs: {
   inherit pname;
-  version = "259.5";
+  version = "260.1";
 
   src = fetchFromGitHub {
     owner = "systemd";
     repo = "systemd";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-4w5tszZd6pBJLVGop3kBy3A9DI3YeQCvIuand7oLiL0=";
+    hash = "sha256-FUKj3lvjz8TIsyu8NyJYtiNele+1BhdJPdw7r7nW6as=";
   };
 
   # On major changes, or when otherwise required, you *must* :
@@ -240,15 +240,14 @@ stdenv.mkDerivation (finalAttrs: {
     ./0014-core-don-t-taint-on-unmerged-usr.patch
     ./0015-tpm2_context_init-fix-driver-name-checking.patch
     ./0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
-    ./0017-meson.build-do-not-create-systemdstatedir.patch
 
     # systemd tries to link the systemd-ssh-proxy ssh config snippet with tmpfiles
     # if the install prefix is not /usr, but that does not work for us
     # because we include the config snippet manually
-    ./0018-meson-Don-t-link-ssh-dropins.patch
+    ./0017-meson-Don-t-link-ssh-dropins.patch
   ]
   ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isGnu) [
-    ./0019-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
+    ./0018-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
   ];
 
   postPatch = ''
@@ -432,10 +431,6 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonOption "system-uid-max" "999")
     (lib.mesonOption "system-gid-max" "999")
 
-    # SysVinit
-    (lib.mesonOption "sysvinit-path" "")
-    (lib.mesonOption "sysvrcnd-path" "")
-
     # Login
     (lib.mesonOption "sulogin-path" "${lib.getOutput "login" util-linux}/bin/sulogin")
     (lib.mesonOption "nologin-path" "${lib.getOutput "login" util-linux}/bin/nologin")
@@ -503,7 +498,6 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonEnable "polkit" withPolkit)
     (lib.mesonEnable "elfutils" withCoredump)
     (lib.mesonEnable "libcurl" wantCurl)
-    (lib.mesonEnable "libidn" false)
     (lib.mesonEnable "libidn2" withLibidn2)
     (lib.mesonEnable "repart" withRepart)
     (lib.mesonEnable "sysupdate" withSysupdate)
@@ -598,7 +592,6 @@ stdenv.mkDerivation (finalAttrs: {
             "man/systemd-run.xml"
             "src/analyze/test-verify.c"
             "src/test/test-env-file.c"
-            "src/test/test-fileio.c"
             "src/test/test-load-fragment.c"
           ];
         }
@@ -607,7 +600,6 @@ stdenv.mkDerivation (finalAttrs: {
           replacement = "${coreutils}/bin/cat";
           where = [
             "test/test-execute/exec-noexecpaths-simple.service"
-            "src/journal/cat.c"
           ];
         }
         {
@@ -616,16 +608,6 @@ stdenv.mkDerivation (finalAttrs: {
           where = [ "man/systemd-fsck@.service.xml" ];
         }
       ]
-      ++ lib.optionals withNspawn [
-        {
-          # we only need to patch getent when nspawn will actually be built/installed
-          # as of systemd 257.x, nspawn will not be installed on systemdLibs, so we don't need to patch it
-          # patching getent unconditionally here introduces infinite recursion on musl
-          search = "/usr/bin/getent";
-          replacement = "${getent}/bin/getent";
-          where = [ "src/nspawn/nspawn-setuid.c" ];
-        }
-      ]
       ++ lib.optionals withImportd [
         {
           search = "\"gpg\"";
@@ -637,7 +619,6 @@ stdenv.mkDerivation (finalAttrs: {
           replacement = "\\\"${gnutar}/bin/tar\\\"";
           where = [
             "src/import/export-tar.c"
-            "src/import/import-common.c"
             "src/import/import-tar.c"
           ];
           ignore = [
@@ -648,8 +629,10 @@ stdenv.mkDerivation (finalAttrs: {
             "src/import/export.c"
             "src/import/import.c"
             "src/import/importd.c"
-            # runs `tar` but also also creates a temporary directory with the string
+            # runs `tar` but also creates a temporary directory with the string
             "src/import/pull-tar.c"
+            # pull-oci.c has tar references handled in postPatch
+            "src/import/pull-oci.c"
             # tar referenced as file suffix
             "src/shared/import-util.c"
           ];
@@ -657,8 +640,8 @@ stdenv.mkDerivation (finalAttrs: {
       ]
       ++ lib.optionals withKmod [
         {
-          search = "/sbin/modprobe";
-          replacement = "${lib.getBin kmod}/sbin/modprobe";
+          search = "ExecStart=-modprobe";
+          replacement = "ExecStart=-${lib.getBin kmod}/bin/modprobe";
           where = [ "units/modprobe@.service" ];
         }
       ];
@@ -709,7 +692,7 @@ stdenv.mkDerivation (finalAttrs: {
       substituteInPlace src/libsystemd/sd-journal/catalog.c \
         --replace /usr/lib/systemd/catalog/ $out/lib/systemd/catalog/
 
-      substituteInPlace src/import/pull-tar.c \
+      substituteInPlace src/import/pull-tar.c src/import/pull-oci.c \
         --replace 'wait_for_terminate_and_check("tar"' 'wait_for_terminate_and_check("${gnutar}/bin/tar"'
     '';
 
@@ -717,23 +700,10 @@ stdenv.mkDerivation (finalAttrs: {
   # warning messages
   postConfigure = ''
     substituteInPlace config.h \
-      --replace "POLKIT_AGENT_BINARY_PATH" "_POLKIT_AGENT_BINARY_PATH" \
-      --replace "SYSTEMD_BINARY_PATH" "_SYSTEMD_BINARY_PATH" \
-      --replace "SYSTEMD_CGROUP_AGENTS_PATH" "_SYSTEMD_CGROUP_AGENT_PATH"
+      --replace-fail "SYSTEMD_BINARY_PATH" "_SYSTEMD_BINARY_PATH"
   '';
 
   env.NIX_CFLAGS_COMPILE = toString [
-    # Can't say ${polkit.bin}/bin/pkttyagent here because that would
-    # lead to a cyclic dependency.
-    "-UPOLKIT_AGENT_BINARY_PATH"
-    "-DPOLKIT_AGENT_BINARY_PATH=\"/run/current-system/sw/bin/pkttyagent\""
-
-    # Set the release_agent on /sys/fs/cgroup/systemd to the
-    # currently running systemd (/run/current-system/systemd) so
-    # that we don't use an obsolete/garbage-collected release agent.
-    "-USYSTEMD_CGROUP_AGENTS_PATH"
-    "-DSYSTEMD_CGROUP_AGENTS_PATH=\"/run/current-system/systemd/lib/systemd/systemd-cgroups-agent\""
-
     "-USYSTEMD_BINARY_PATH"
     "-DSYSTEMD_BINARY_PATH=\"/run/current-system/systemd/lib/systemd/systemd\""
   ];