diff --git a/.git-blame-ignore-revs b/.git-blame-ignore-revs
index 05ce9aec0135..86415c860b42 100644
--- a/.git-blame-ignore-revs
+++ b/.git-blame-ignore-revs
@@ -204,5 +204,8 @@ ce21e97a1f20dee15da85c084f9d1148d84f853b
 # sqlc: format with nixfmt
 2bdec131b2bb2c8563f4556d741d34ccb77409e2
 
+# ant: format with nixfmt-rfc-style
+2538d58436b8d0b56d29780aeebf4bf720ddb9ea
+
 # treewide: migrate packages to pkgs/by-name, take 1
 571c71e6f73af34a229414f51585738894211408
diff --git a/.github/labeler.yml b/.github/labeler.yml
index 73d0223ee71e..4c8a048c763b 100644
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@@ -194,7 +194,7 @@
         - pkgs/by-name/ma/maven/**/*
         - doc/languages-frameworks/maven.section.md
         # Ant
-        - pkgs/by-name/ap/apacheAnt/**/*
+        - pkgs/by-name/an/ant/**/*
         # javaPackages attrset
         - pkgs/development/java-modules/**/*
         - pkgs/top-level/java-packages.nix
diff --git a/doc/doc-support/package.nix b/doc/doc-support/package.nix
index f1d9996120ce..c2bbdf09e533 100644
--- a/doc/doc-support/package.nix
+++ b/doc/doc-support/package.nix
@@ -9,6 +9,8 @@
   mkShellNoCC,
   documentation-highlighter,
   nixos-render-docs,
+  nixos-render-docs-redirects,
+  writeShellScriptBin,
   nixpkgs ? { },
 }:
 
@@ -105,8 +107,14 @@ stdenvNoCC.mkDerivation (
             buildArgs = "./.";
             open = "/share/doc/nixpkgs/manual.html";
           };
+          nixos-render-docs-redirects' = writeShellScriptBin "redirects" "${lib.getExe nixos-render-docs-redirects} --file ${toString ../redirects.json} $@";
         in
-        mkShellNoCC { packages = [ devmode' ]; };
+        mkShellNoCC {
+          packages = [
+            devmode'
+            nixos-render-docs-redirects'
+          ];
+        };
 
       tests.manpage-urls = callPackage ../tests/manpage-urls.nix { };
     };
diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md
index ed4e49e876f5..d3947c7737da 100644
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@@ -915,7 +915,7 @@
 
 - `freecad` now supports addons and custom configuration in nix-way, which can be used by calling `freecad.customize`.
 
-## Detailed migration information {#sec-release-24.11-migration}
+## Detailed Migration Information {#sec-release-24.11-migration}
 
 ### `sound` options removal {#sec-release-24.11-migration-sound}
 
diff --git a/nixos/doc/manual/shell.nix b/nixos/doc/manual/shell.nix
index aeec93118fc0..4f6ab400f22c 100644
--- a/nixos/doc/manual/shell.nix
+++ b/nixos/doc/manual/shell.nix
@@ -10,7 +10,11 @@ let
     buildArgs = "../../release.nix -A manualHTML.${builtins.currentSystem}";
     open = "/${outputPath}/${indexPath}";
   };
+  nixos-render-docs-redirects = pkgs.writeShellScriptBin "redirects" "${pkgs.lib.getExe pkgs.nixos-render-docs-redirects} --file ${toString ./redirects.json} $@";
 in
 pkgs.mkShellNoCC {
-  packages = [ devmode ];
+  packages = [
+    devmode
+    nixos-render-docs-redirects
+  ];
 }
diff --git a/nixos/modules/i18n/input-method/hime.nix b/nixos/modules/i18n/input-method/hime.nix
index baf455bd2366..b3f49c0e3057 100644
--- a/nixos/modules/i18n/input-method/hime.nix
+++ b/nixos/modules/i18n/input-method/hime.nix
@@ -1,12 +1,9 @@
 { config, pkgs, lib, ... }:
-
-with lib;
-
 let
   imcfg = config.i18n.inputMethod;
 in
 {
-  config = mkIf (imcfg.enable && imcfg.type == "hime") {
+  config = lib.mkIf (imcfg.enable && imcfg.type == "hime") {
     i18n.inputMethod.package = pkgs.hime;
     environment.variables = {
       GTK_IM_MODULE = "hime";
diff --git a/nixos/modules/i18n/input-method/ibus.nix b/nixos/modules/i18n/input-method/ibus.nix
index 4af848c72015..7665b83e0f95 100644
--- a/nixos/modules/i18n/input-method/ibus.nix
+++ b/nixos/modules/i18n/input-method/ibus.nix
@@ -1,7 +1,4 @@
 { config, pkgs, lib, ... }:
-
-with lib;
-
 let
   imcfg = config.i18n.inputMethod;
   cfg = imcfg.ibus;
@@ -9,10 +6,10 @@ let
   ibusEngine = lib.types.mkOptionType {
     name  = "ibus-engine";
     inherit (lib.types.package) descriptionClass merge;
-    check = x: (lib.types.package.check x) && (attrByPath ["meta" "isIbusEngine"] false x);
+    check = x: (lib.types.package.check x) && (lib.attrByPath ["meta" "isIbusEngine"] false x);
   };
 
-  impanel = optionalString (cfg.panel != null) "--panel=${cfg.panel}";
+  impanel = lib.optionalString (cfg.panel != null) "--panel=${cfg.panel}";
 
   ibusAutostart = pkgs.writeTextFile {
     name = "autostart-ibus-daemon";
@@ -29,32 +26,32 @@ let
 in
 {
   imports = [
-    (mkRenamedOptionModule [ "programs" "ibus" "plugins" ] [ "i18n" "inputMethod" "ibus" "engines" ])
+    (lib.mkRenamedOptionModule [ "programs" "ibus" "plugins" ] [ "i18n" "inputMethod" "ibus" "engines" ])
   ];
 
   options = {
     i18n.inputMethod.ibus = {
-      engines = mkOption {
-        type    = with types; listOf ibusEngine;
+      engines = lib.mkOption {
+        type    = with lib.types; listOf ibusEngine;
         default = [];
-        example = literalExpression "with pkgs.ibus-engines; [ mozc hangul ]";
+        example = lib.literalExpression "with pkgs.ibus-engines; [ mozc hangul ]";
         description =
           let
-            enginesDrv = filterAttrs (const isDerivation) pkgs.ibus-engines;
-            engines = concatStringsSep ", "
-              (map (name: "`${name}`") (attrNames enginesDrv));
+            enginesDrv = lib.filterAttrs (lib.const lib.isDerivation) pkgs.ibus-engines;
+            engines = lib.concatStringsSep ", "
+              (map (name: "`${name}`") (lib.attrNames enginesDrv));
           in "Enabled IBus engines. Available engines are: ${engines}.";
       };
-      panel = mkOption {
-        type = with types; nullOr path;
+      panel = lib.mkOption {
+        type = with lib.types; nullOr path;
         default = null;
-        example = literalExpression ''"''${pkgs.plasma5Packages.plasma-desktop}/libexec/kimpanel-ibus-panel"'';
+        example = lib.literalExpression ''"''${pkgs.plasma5Packages.plasma-desktop}/libexec/kimpanel-ibus-panel"'';
         description = "Replace the IBus panel with another panel.";
       };
     };
   };
 
-  config = mkIf (imcfg.enable && imcfg.type == "ibus") {
+  config = lib.mkIf (imcfg.enable && imcfg.type == "ibus") {
     i18n.inputMethod.package = ibusPackage;
 
     environment.systemPackages = [
@@ -76,7 +73,7 @@ in
       XMODIFIERS = "@im=ibus";
     };
 
-    xdg.portal.extraPortals = mkIf config.xdg.portal.enable [
+    xdg.portal.extraPortals = lib.mkIf config.xdg.portal.enable [
       ibusPackage
     ];
   };
diff --git a/nixos/modules/i18n/input-method/nabi.nix b/nixos/modules/i18n/input-method/nabi.nix
index 0eb9a7c825c8..af01d1b0676d 100644
--- a/nixos/modules/i18n/input-method/nabi.nix
+++ b/nixos/modules/i18n/input-method/nabi.nix
@@ -1,11 +1,9 @@
 { config, pkgs, lib, ... }:
-
-with lib;
 let
   imcfg = config.i18n.inputMethod;
 in
 {
-  config = mkIf (imcfg.enable && imcfg.type == "nabi") {
+  config = lib.mkIf (imcfg.enable && imcfg.type == "nabi") {
     i18n.inputMethod.package = pkgs.nabi;
 
     environment.variables = {
diff --git a/nixos/modules/i18n/input-method/uim.nix b/nixos/modules/i18n/input-method/uim.nix
index 7517dead6b05..4edc121b2ccd 100644
--- a/nixos/modules/i18n/input-method/uim.nix
+++ b/nixos/modules/i18n/input-method/uim.nix
@@ -1,7 +1,4 @@
 { config, pkgs, lib, ... }:
-
-with lib;
-
 let
   imcfg = config.i18n.inputMethod;
   cfg = imcfg.uim;
@@ -10,8 +7,8 @@ in
   options = {
 
     i18n.inputMethod.uim = {
-      toolbar = mkOption {
-        type    = types.enum [ "gtk" "gtk3" "gtk-systray" "gtk3-systray" "qt5" ];
+      toolbar = lib.mkOption {
+        type    = lib.types.enum [ "gtk" "gtk3" "gtk-systray" "gtk3-systray" "qt5" ];
         default = "gtk";
         example = "gtk-systray";
         description = ''
@@ -22,7 +19,7 @@ in
 
   };
 
-  config = mkIf (imcfg.enable && imcfg.type == "uim") {
+  config = lib.mkIf (imcfg.enable && imcfg.type == "uim") {
     i18n.inputMethod.package = pkgs.uim;
 
     environment.variables = {
diff --git a/nixos/modules/misc/assertions.nix b/nixos/modules/misc/assertions.nix
index 550b3ac97f6a..489a2b8085ae 100644
--- a/nixos/modules/misc/assertions.nix
+++ b/nixos/modules/misc/assertions.nix
@@ -1,13 +1,10 @@
 { lib, ... }:
-
-with lib;
-
 {
 
   options = {
 
-    assertions = mkOption {
-      type = types.listOf types.unspecified;
+    assertions = lib.mkOption {
+      type = lib.types.listOf lib.types.unspecified;
       internal = true;
       default = [];
       example = [ { assertion = false; message = "you can't enable this for that reason"; } ];
@@ -18,10 +15,10 @@ with lib;
       '';
     };
 
-    warnings = mkOption {
+    warnings = lib.mkOption {
       internal = true;
       default = [];
-      type = types.listOf types.str;
+      type = lib.types.listOf lib.types.str;
       example = [ "The `foo' service is deprecated and will go away soon!" ];
       description = ''
         This option allows modules to show warnings to users during
diff --git a/nixos/modules/misc/crashdump.nix b/nixos/modules/misc/crashdump.nix
index b0f75d9caaa3..d67a4aa412ce 100644
--- a/nixos/modules/misc/crashdump.nix
+++ b/nixos/modules/misc/crashdump.nix
@@ -1,11 +1,8 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   crashdump = config.boot.crashDump;
 
-  kernelParams = concatStringsSep " " crashdump.kernelParams;
+  kernelParams = lib.concatStringsSep " " crashdump.kernelParams;
 
 in
 ###### interface
@@ -13,8 +10,8 @@ in
   options = {
     boot = {
       crashDump = {
-        enable = mkOption {
-          type = types.bool;
+        enable = lib.mkOption {
+          type = lib.types.bool;
           default = false;
           description = ''
             If enabled, NixOS will set up a kernel that will
@@ -24,17 +21,17 @@ in
             It also activates the NMI watchdog.
           '';
         };
-        reservedMemory = mkOption {
+        reservedMemory = lib.mkOption {
           default = "128M";
-          type = types.str;
+          type = lib.types.str;
           description = ''
             The amount of memory reserved for the crashdump kernel.
             If you choose a too high value, dmesg will mention
             "crashkernel reservation failed".
           '';
         };
-        kernelParams = mkOption {
-          type = types.listOf types.str;
+        kernelParams = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
           default = [ "1" "boot.shell_on_fail" ];
           description = ''
             Parameters that will be passed to the kernel kexec-ed on crash.
@@ -46,7 +43,7 @@ in
 
 ###### implementation
 
-  config = mkIf crashdump.enable {
+  config = lib.mkIf crashdump.enable {
     boot = {
       postBootCommands = ''
         echo "loading crashdump kernel...";
diff --git a/nixos/modules/misc/label.nix b/nixos/modules/misc/label.nix
index c7177f65a0fd..aba5ae23dc39 100644
--- a/nixos/modules/misc/label.nix
+++ b/nixos/modules/misc/label.nix
@@ -1,7 +1,4 @@
 { config, lib, ... }:
-
-with lib;
-
 let
   cfg = config.system.nixos;
 in
@@ -10,8 +7,8 @@ in
 
   options.system = {
 
-    nixos.label = mkOption {
-      type = types.strMatching "[a-zA-Z0-9:_\\.-]*";
+    nixos.label = lib.mkOption {
+      type = lib.types.strMatching "[a-zA-Z0-9:_\\.-]*";
       description = ''
         NixOS version name to be used in the names of generated
         outputs and boot labels.
@@ -43,8 +40,8 @@ in
       '';
     };
 
-    nixos.tags = mkOption {
-      type = types.listOf types.str;
+    nixos.tags = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
       default = [];
       example = [ "with-xen" ];
       description = ''
@@ -68,9 +65,9 @@ in
   config = {
     # This is set here rather than up there so that changing it would
     # not rebuild the manual
-    system.nixos.label = mkDefault (maybeEnv "NIXOS_LABEL"
-                                             (concatStringsSep "-" ((sort (x: y: x < y) cfg.tags)
-                                              ++ [ (maybeEnv "NIXOS_LABEL_VERSION" cfg.version) ])));
+    system.nixos.label = lib.mkDefault (lib.maybeEnv "NIXOS_LABEL"
+                                             (lib.concatStringsSep "-" ((lib.sort (x: y: x < y) cfg.tags)
+                                              ++ [ (lib.maybeEnv "NIXOS_LABEL_VERSION" cfg.version) ])));
   };
 
 }
diff --git a/nixos/modules/misc/meta.nix b/nixos/modules/misc/meta.nix
index e5ab3a951537..1569662b403c 100644
--- a/nixos/modules/misc/meta.nix
+++ b/nixos/modules/misc/meta.nix
@@ -1,28 +1,25 @@
 { lib, ... }:
-
-with lib;
-
 let
-  maintainer = mkOptionType {
+  maintainer = lib.mkOptionType {
     name = "maintainer";
-    check = email: elem email (attrValues lib.maintainers);
-    merge = loc: defs: listToAttrs (singleton (nameValuePair (last defs).file (last defs).value));
+    check = email: lib.elem email (lib.attrValues lib.maintainers);
+    merge = loc: defs: lib.listToAttrs (lib.singleton (lib.nameValuePair (lib.last defs).file (lib.last defs).value));
   };
 
-  listOfMaintainers = types.listOf maintainer // {
+  listOfMaintainers = lib.types.listOf maintainer // {
     # Returns list of
     #   { "module-file" = [
     #        "maintainer1 <first@nixos.org>"
     #        "maintainer2 <second@nixos.org>" ];
     #   }
     merge = loc: defs:
-      zipAttrs
-        (flatten (imap1 (n: def: imap1 (m: def':
+      lib.zipAttrs
+        (lib.flatten (lib.imap1 (n: def: lib.imap1 (m: def':
           maintainer.merge (loc ++ ["[${toString n}-${toString m}]"])
             [{ inherit (def) file; value = def'; }]) def.value) defs));
   };
 
-  docFile = types.path // {
+  docFile = lib.types.path // {
     # Returns tuples of
     #   { file = "module location"; value = <path/to/doc.xml>; }
     merge = loc: defs: defs;
@@ -33,18 +30,18 @@ in
   options = {
     meta = {
 
-      maintainers = mkOption {
+      maintainers = lib.mkOption {
         type = listOfMaintainers;
         internal = true;
         default = [];
-        example = literalExpression ''[ lib.maintainers.all ]'';
+        example = lib.literalExpression ''[ lib.maintainers.all ]'';
         description = ''
           List of maintainers of each module.  This option should be defined at
           most once per module.
         '';
       };
 
-      doc = mkOption {
+      doc = lib.mkOption {
         type = docFile;
         internal = true;
         example = "./meta.chapter.md";
@@ -54,8 +51,8 @@ in
         '';
       };
 
-      buildDocsInSandbox = mkOption {
-        type = types.bool // {
+      buildDocsInSandbox = lib.mkOption {
+        type = lib.types.bool // {
           merge = loc: defs: defs;
         };
         internal = true;
@@ -72,5 +69,5 @@ in
     };
   };
 
-  meta.maintainers = singleton lib.maintainers.pierron;
+  meta.maintainers = lib.singleton lib.maintainers.pierron;
 }
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 8551e1b3406c..fdda9fad8ca6 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -813,6 +813,7 @@
   ./services/misc/octoprint.nix
   ./services/misc/ollama.nix
   ./services/misc/ombi.nix
+  ./services/misc/omnom.nix
   ./services/misc/open-webui.nix
   ./services/misc/osrm.nix
   ./services/misc/owncast.nix
diff --git a/nixos/modules/programs/fcast-receiver.nix b/nixos/modules/programs/fcast-receiver.nix
index 2e4e6bf8b242..73e13cd1bc8d 100644
--- a/nixos/modules/programs/fcast-receiver.nix
+++ b/nixos/modules/programs/fcast-receiver.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.programs.fcast-receiver;
 in
@@ -11,20 +8,20 @@ in
   };
 
   options.programs.fcast-receiver = {
-    enable = mkEnableOption "FCast Receiver";
-    openFirewall = mkOption {
-      type = types.bool;
+    enable = lib.mkEnableOption "FCast Receiver";
+    openFirewall = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = ''
         Open ports needed for the functionality of the program.
       '';
     };
-    package = mkPackageOption pkgs "fcast-receiver" { };
+    package = lib.mkPackageOption pkgs "fcast-receiver" { };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     environment.systemPackages = [ cfg.package ];
-    networking.firewall = mkIf cfg.openFirewall {
+    networking.firewall = lib.mkIf cfg.openFirewall {
       allowedTCPPorts = [ 46899 ];
     };
   };
diff --git a/nixos/modules/security/apparmor.nix b/nixos/modules/security/apparmor.nix
index a4b3807e4e0f..d6195d24ea8d 100644
--- a/nixos/modules/security/apparmor.nix
+++ b/nixos/modules/security/apparmor.nix
@@ -1,30 +1,27 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   inherit (builtins) attrNames head map match readFile;
   inherit (lib) types;
   inherit (config.environment) etc;
   cfg = config.security.apparmor;
-  mkDisableOption = name: mkEnableOption name // {
+  mkDisableOption = name: lib.mkEnableOption name // {
     default = true;
     example = false;
   };
-  enabledPolicies = filterAttrs (n: p: p.enable) cfg.policies;
+  enabledPolicies = lib.filterAttrs (n: p: p.enable) cfg.policies;
 in
 
 {
   imports = [
-    (mkRemovedOptionModule [ "security" "apparmor" "confineSUIDApplications" ] "Please use the new options: `security.apparmor.policies.<policy>.enable'.")
-    (mkRemovedOptionModule [ "security" "apparmor" "profiles" ] "Please use the new option: `security.apparmor.policies'.")
+    (lib.mkRemovedOptionModule [ "security" "apparmor" "confineSUIDApplications" ] "Please use the new options: `security.apparmor.policies.<policy>.enable'.")
+    (lib.mkRemovedOptionModule [ "security" "apparmor" "profiles" ] "Please use the new option: `security.apparmor.policies'.")
     apparmor/includes.nix
     apparmor/profiles.nix
   ];
 
   options = {
     security.apparmor = {
-      enable = mkEnableOption ''
+      enable = lib.mkEnableOption ''
         the AppArmor Mandatory Access Control system.
 
         If you're enabling this module on a running system,
@@ -41,7 +38,7 @@ in
         Enable [](#opt-security.apparmor.killUnconfinedConfinables)
         if you want this service to do such killing
         by sending a `SIGTERM` to those running processes'';
-      policies = mkOption {
+      policies = lib.mkOption {
         description = ''
           AppArmor policies.
         '';
@@ -49,7 +46,7 @@ in
           options = {
             enable = mkDisableOption "loading of the profile into the kernel";
             enforce = mkDisableOption "enforcing of the policy or only complain in the logs";
-            profile = mkOption {
+            profile = lib.mkOption {
               description = "The policy of the profile.";
               type = types.lines;
               apply = pkgs.writeText name;
@@ -58,28 +55,28 @@ in
         }));
         default = {};
       };
-      includes = mkOption {
+      includes = lib.mkOption {
         type = types.attrsOf types.lines;
         default = {};
         description = ''
           List of paths to be added to AppArmor's searched paths
           when resolving `include` directives.
         '';
-        apply = mapAttrs pkgs.writeText;
+        apply = lib.mapAttrs pkgs.writeText;
       };
-      packages = mkOption {
+      packages = lib.mkOption {
         type = types.listOf types.package;
         default = [];
         description = "List of packages to be added to AppArmor's include path";
       };
-      enableCache = mkEnableOption ''
+      enableCache = lib.mkEnableOption ''
         caching of AppArmor policies
         in `/var/cache/apparmor/`.
 
         Beware that AppArmor policies almost always contain Nix store paths,
         and thus produce at each change of these paths
         a new cached version accumulating in the cache'';
-      killUnconfinedConfinables = mkEnableOption ''
+      killUnconfinedConfinables = lib.mkEnableOption ''
         killing of processes which have an AppArmor profile enabled
         (in [](#opt-security.apparmor.policies))
         but are not confined (because AppArmor can only confine new processes).
@@ -92,7 +89,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     assertions = map (policy:
       { assertion = match ".*/.*" policy == null;
         message = "`security.apparmor.policies.\"${policy}\"' must not contain a slash.";
@@ -108,15 +105,15 @@ in
     environment.etc."apparmor.d".source = pkgs.linkFarm "apparmor.d" (
       # It's important to put only enabledPolicies here and not all cfg.policies
       # because aa-remove-unknown reads profiles from all /etc/apparmor.d/*
-      mapAttrsToList (name: p: { inherit name; path = p.profile; }) enabledPolicies ++
-      mapAttrsToList (name: path: { inherit name path; }) cfg.includes
+      lib.mapAttrsToList (name: p: { inherit name; path = p.profile; }) enabledPolicies ++
+      lib.mapAttrsToList (name: path: { inherit name path; }) cfg.includes
     );
     environment.etc."apparmor/parser.conf".text = ''
         ${if cfg.enableCache then "write-cache" else "skip-cache"}
         cache-loc /var/cache/apparmor
         Include /etc/apparmor.d
       '' +
-      concatMapStrings (p: "Include ${p}/etc/apparmor.d\n") cfg.packages;
+      lib.concatMapStrings (p: "Include ${p}/etc/apparmor.d\n") cfg.packages;
     # For aa-logprof
     environment.etc."apparmor/apparmor.conf".text = ''
     '';
@@ -142,7 +139,7 @@ in
           # 3 - force all perms on the rule to be user
           default_owner_prompt = 1
 
-          custom_includes = /etc/apparmor.d ${concatMapStringsSep " " (p: "${p}/etc/apparmor.d") cfg.packages}
+          custom_includes = /etc/apparmor.d ${lib.concatMapStringsSep " " (p: "${p}/etc/apparmor.d") cfg.packages}
 
         [qualifiers]
           ${pkgs.runtimeShell} = icnu
@@ -187,17 +184,17 @@ in
           xargs --verbose --no-run-if-empty --delimiter='\n' \
           kill
         '';
-        commonOpts = p: "--verbose --show-cache ${optionalString (!p.enforce) "--complain "}${p.profile}";
+        commonOpts = p: "--verbose --show-cache ${lib.optionalString (!p.enforce) "--complain "}${p.profile}";
         in {
         Type = "oneshot";
         RemainAfterExit = "yes";
         ExecStartPre = "${pkgs.apparmor-utils}/bin/aa-teardown";
-        ExecStart = mapAttrsToList (n: p: "${pkgs.apparmor-parser}/bin/apparmor_parser --add ${commonOpts p}") enabledPolicies;
-        ExecStartPost = optional cfg.killUnconfinedConfinables killUnconfinedConfinables;
+        ExecStart = lib.mapAttrsToList (n: p: "${pkgs.apparmor-parser}/bin/apparmor_parser --add ${commonOpts p}") enabledPolicies;
+        ExecStartPost = lib.optional cfg.killUnconfinedConfinables killUnconfinedConfinables;
         ExecReload =
           # Add or replace into the kernel profiles in enabledPolicies
           # (because AppArmor can do that without stopping the processes already confined).
-          mapAttrsToList (n: p: "${pkgs.apparmor-parser}/bin/apparmor_parser --replace ${commonOpts p}") enabledPolicies ++
+          lib.mapAttrsToList (n: p: "${pkgs.apparmor-parser}/bin/apparmor_parser --replace ${commonOpts p}") enabledPolicies ++
           # Remove from the kernel any profile whose name is not
           # one of the names within the content of the profiles in enabledPolicies
           # (indirectly read from /etc/apparmor.d/*, without recursing into sub-directory).
@@ -205,7 +202,7 @@ in
           [ "${pkgs.apparmor-utils}/bin/aa-remove-unknown" ] ++
           # Optionally kill the processes which are unconfined but now have a profile loaded
           # (because AppArmor can only start to confine new processes).
-          optional cfg.killUnconfinedConfinables killUnconfinedConfinables;
+          lib.optional cfg.killUnconfinedConfinables killUnconfinedConfinables;
         ExecStop = "${pkgs.apparmor-utils}/bin/aa-teardown";
         CacheDirectory = [ "apparmor" "apparmor/logprof" ];
         CacheDirectoryMode = "0700";
@@ -213,5 +210,5 @@ in
     };
   };
 
-  meta.maintainers = with maintainers; [ julm ];
+  meta.maintainers = with lib.maintainers; [ julm ];
 }
diff --git a/nixos/modules/security/audit.nix b/nixos/modules/security/audit.nix
index 403aeff020dc..f7dde61f8d4b 100644
--- a/nixos/modules/security/audit.nix
+++ b/nixos/modules/security/audit.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.security.audit;
   enabled = cfg.enable == "lock" || cfg.enable;
@@ -29,7 +26,7 @@ let
 
     # Put the rules in a temporary file owned and only readable by root
     rulesfile="$(mktemp)"
-    ${concatMapStrings (x: "echo '${x}' >> $rulesfile\n") cfg.rules}
+    ${lib.concatMapStrings (x: "echo '${x}' >> $rulesfile\n") cfg.rules}
 
     # Apply the requested rules
     auditctl -R "$rulesfile"
@@ -53,8 +50,8 @@ let
 in {
   options = {
     security.audit = {
-      enable = mkOption {
-        type        = types.enum [ false true "lock" ];
+      enable = lib.mkOption {
+        type        = lib.types.enum [ false true "lock" ];
         default     = false;
         description = ''
           Whether to enable the Linux audit system. The special `lock` value can be used to
@@ -64,14 +61,14 @@ in {
         '';
       };
 
-      failureMode = mkOption {
-        type        = types.enum [ "silent" "printk" "panic" ];
+      failureMode = lib.mkOption {
+        type        = lib.types.enum [ "silent" "printk" "panic" ];
         default     = "printk";
         description = "How to handle critical errors in the auditing system";
       };
 
-      backlogLimit = mkOption {
-        type        = types.int;
+      backlogLimit = lib.mkOption {
+        type        = lib.types.int;
         default     = 64; # Apparently the kernel default
         description = ''
           The maximum number of outstanding audit buffers allowed; exceeding this is
@@ -79,8 +76,8 @@ in {
         '';
       };
 
-      rateLimit = mkOption {
-        type        = types.int;
+      rateLimit = lib.mkOption {
+        type        = lib.types.int;
         default     = 0;
         description = ''
           The maximum messages per second permitted before triggering a failure as
@@ -88,8 +85,8 @@ in {
         '';
       };
 
-      rules = mkOption {
-        type        = types.listOf types.str; # (types.either types.str (types.submodule rule));
+      rules = lib.mkOption {
+        type        = lib.types.listOf lib.types.str; # (types.either types.str (types.submodule rule));
         default     = [];
         example     = [ "-a exit,always -F arch=b64 -S execve" ];
         description = ''
diff --git a/nixos/modules/security/please.nix b/nixos/modules/security/please.nix
index 39df5dfd50d5..05a189dfbaaa 100644
--- a/nixos/modules/security/please.nix
+++ b/nixos/modules/security/please.nix
@@ -1,22 +1,19 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.security.please;
   ini = pkgs.formats.ini { };
 in
 {
   options.security.please = {
-    enable = mkEnableOption ''
+    enable = lib.mkEnableOption ''
       please, a Sudo clone which allows a users to execute a command or edit a
       file as another user
     '';
 
-    package = mkPackageOption pkgs "please" { };
+    package = lib.mkPackageOption pkgs "please" { };
 
-    wheelNeedsPassword = mkOption {
-      type = types.bool;
+    wheelNeedsPassword = lib.mkOption {
+      type = lib.types.bool;
       default = true;
       description = ''
         Whether users of the `wheel` group must provide a password to run
@@ -25,7 +22,7 @@ in
       '';
     };
 
-    settings = mkOption {
+    settings = lib.mkOption {
       type = ini.type;
       default = { };
       example = {
@@ -53,7 +50,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     security.wrappers =
       let
         owner = "root";
@@ -110,6 +107,6 @@ in
       usshAuth = true;
     };
 
-    meta.maintainers = with maintainers; [ azahi ];
+    meta.maintainers = with lib.maintainers; [ azahi ];
   };
 }
diff --git a/nixos/modules/services/admin/oxidized.nix b/nixos/modules/services/admin/oxidized.nix
index 49ea3ced76a4..e20994067448 100644
--- a/nixos/modules/services/admin/oxidized.nix
+++ b/nixos/modules/services/admin/oxidized.nix
@@ -1,39 +1,36 @@
 { config, pkgs, lib, ... }:
-
-with lib;
-
 let
   cfg = config.services.oxidized;
 in
 {
   options.services.oxidized = {
-    enable = mkEnableOption "the oxidized configuration backup service";
+    enable = lib.mkEnableOption "the oxidized configuration backup service";
 
-    user = mkOption {
-      type = types.str;
+    user = lib.mkOption {
+      type = lib.types.str;
       default = "oxidized";
       description = ''
         User under which the oxidized service runs.
       '';
     };
 
-    group = mkOption {
-      type = types.str;
+    group = lib.mkOption {
+      type = lib.types.str;
       default = "oxidized";
       description = ''
         Group under which the oxidized service runs.
       '';
     };
 
-    dataDir = mkOption {
-      type = types.path;
+    dataDir = lib.mkOption {
+      type = lib.types.path;
       default = "/var/lib/oxidized";
       description = "State directory for the oxidized service.";
     };
 
-    configFile = mkOption {
-      type = types.path;
-      example = literalExpression ''
+    configFile = lib.mkOption {
+      type = lib.types.path;
+      example = lib.literalExpression ''
         pkgs.writeText "oxidized-config.yml" '''
           ---
           debug: true
@@ -67,9 +64,9 @@ in
       '';
     };
 
-    routerDB = mkOption {
-      type = types.path;
-      example = literalExpression ''
+    routerDB = lib.mkOption {
+      type = lib.types.path;
+      example = lib.literalExpression ''
         pkgs.writeText "oxidized-router.db" '''
           hostname-sw1:powerconnect:username1:password2
           hostname-sw2:procurve:username2:password2
@@ -82,7 +79,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     users.groups.${cfg.group} = { };
     users.users.${cfg.user} = {
       description = "Oxidized service user";
diff --git a/nixos/modules/services/admin/salt/minion.nix b/nixos/modules/services/admin/salt/minion.nix
index 5d4efc6541c7..fde51a06769a 100644
--- a/nixos/modules/services/admin/salt/minion.nix
+++ b/nixos/modules/services/admin/salt/minion.nix
@@ -1,7 +1,4 @@
 { config, pkgs, lib, ... }:
-
-with lib;
-
 let
 
   cfg  = config.services.salt.minion;
@@ -21,9 +18,9 @@ in
 {
   options = {
     services.salt.minion = {
-      enable = mkEnableOption "Salt configuration management system minion service";
-      configuration = mkOption {
-        type = types.attrs;
+      enable = lib.mkEnableOption "Salt configuration management system minion service";
+      configuration = lib.mkOption {
+        type = lib.types.attrs;
         default = {};
         description = ''
           Salt minion configuration as Nix attribute set.
@@ -34,7 +31,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     environment = {
       # Set this up in /etc/salt/minion so `salt-call`, etc. work.
       # The alternatives are
diff --git a/nixos/modules/services/amqp/activemq/default.nix b/nixos/modules/services/amqp/activemq/default.nix
index 5c886161e44c..53814d71a5ac 100644
--- a/nixos/modules/services/amqp/activemq/default.nix
+++ b/nixos/modules/services/amqp/activemq/default.nix
@@ -1,18 +1,14 @@
 { config, lib, pkgs, ... }:
-
-with pkgs;
-with lib;
-
 let
 
   cfg = config.services.activemq;
 
-  activemqBroker = runCommand "activemq-broker"
+  activemqBroker = pkgs.runCommand "activemq-broker"
     {
-      nativeBuildInputs = [ jdk ];
+      nativeBuildInputs = [ pkgs.jdk ];
     } ''
     mkdir -p $out/lib
-    source ${activemq}/lib/classpath.env
+    source ${pkgs.activemq}/lib/classpath.env
     export CLASSPATH
     ln -s "${./ActiveMQBroker.java}" ActiveMQBroker.java
     javac -d $out/lib ActiveMQBroker.java
@@ -23,25 +19,25 @@ in
 
   options = {
     services.activemq = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Enable the Apache ActiveMQ message broker service.
         '';
       };
-      configurationDir = mkOption {
-        default = "${activemq}/conf";
-        defaultText = literalExpression ''"''${pkgs.activemq}/conf"'';
-        type = types.str;
+      configurationDir = lib.mkOption {
+        default = "${pkgs.activemq}/conf";
+        defaultText = lib.literalExpression ''"''${pkgs.activemq}/conf"'';
+        type = lib.types.str;
         description = ''
           The base directory for ActiveMQ's configuration.
           By default, this directory is searched for a file named activemq.xml,
           which should contain the configuration for the broker service.
         '';
       };
-      configurationURI = mkOption {
-        type = types.str;
+      configurationURI = lib.mkOption {
+        type = lib.types.str;
         default = "xbean:activemq.xml";
         description = ''
           The URI that is passed along to the BrokerFactory to
@@ -51,8 +47,8 @@ in
           an activemq.xml configuration file in it.
         '';
       };
-      baseDir = mkOption {
-        type = types.str;
+      baseDir = lib.mkOption {
+        type = lib.types.str;
         default = "/var/activemq";
         description = ''
           The base directory where ActiveMQ stores its persistent data and logs.
@@ -61,10 +57,10 @@ in
           this in activemq.xml.
         '';
       };
-      javaProperties = mkOption {
-        type = types.attrs;
+      javaProperties = lib.mkOption {
+        type = lib.types.attrs;
         default = { };
-        example = literalExpression ''
+        example = lib.literalExpression ''
           {
             "java.net.preferIPv4Stack" = "true";
           }
@@ -73,7 +69,7 @@ in
           "activemq.base" = "${cfg.baseDir}";
           "activemq.data" = "${cfg.baseDir}/data";
           "activemq.conf" = "${cfg.configurationDir}";
-          "activemq.home" = "${activemq}";
+          "activemq.home" = "${pkgs.activemq}";
         } // attrs;
         description = ''
           Specifies Java properties that are sent to the ActiveMQ
@@ -83,8 +79,8 @@ in
           given reasonable defaults.
         '';
       };
-      extraJavaOptions = mkOption {
-        type = types.separatedString " ";
+      extraJavaOptions = lib.mkOption {
+        type = lib.types.separatedString " ";
         default = "";
         example = "-Xmx2G -Xms2G -XX:MaxPermSize=512M";
         description = ''
@@ -95,7 +91,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     users.users.activemq = {
       description = "ActiveMQ server user";
       group = "activemq";
@@ -118,13 +114,13 @@ in
     systemd.services.activemq = {
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
-      path = [ jre ];
+      path = [ pkgs.jre ];
       serviceConfig.User = "activemq";
       script = ''
-        source ${activemq}/lib/classpath.env
+        source ${pkgs.activemq}/lib/classpath.env
         export CLASSPATH=${activemqBroker}/lib:${cfg.configurationDir}:$CLASSPATH
         exec java \
-          ${concatStringsSep " \\\n" (mapAttrsToList (name: value: "-D${name}=${value}") cfg.javaProperties)} \
+          ${lib.concatStringsSep " \\\n" (lib.mapAttrsToList (name: value: "-D${name}=${value}") cfg.javaProperties)} \
           ${cfg.extraJavaOptions} ActiveMQBroker "${cfg.configurationURI}"
       '';
     };
diff --git a/nixos/modules/services/audio/botamusique.nix b/nixos/modules/services/audio/botamusique.nix
index c764a79b1166..88ab232efae5 100644
--- a/nixos/modules/services/audio/botamusique.nix
+++ b/nixos/modules/services/audio/botamusique.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.botamusique;
 
@@ -12,34 +9,34 @@ in
   meta.maintainers = with lib.maintainers; [ hexa ];
 
   options.services.botamusique = {
-    enable = mkEnableOption "botamusique, a bot to play audio streams on mumble";
+    enable = lib.mkEnableOption "botamusique, a bot to play audio streams on mumble";
 
-    package = mkPackageOption pkgs "botamusique" { };
+    package = lib.mkPackageOption pkgs "botamusique" { };
 
-    settings = mkOption {
-      type = with types; submodule {
+    settings = lib.mkOption {
+      type = with lib.types; submodule {
         freeformType = format.type;
         options = {
-          server.host = mkOption {
+          server.host = lib.mkOption {
             type = types.str;
             default = "localhost";
             example = "mumble.example.com";
             description = "Hostname of the mumble server to connect to.";
           };
 
-          server.port = mkOption {
+          server.port = lib.mkOption {
             type = types.port;
             default = 64738;
             description = "Port of the mumble server to connect to.";
           };
 
-          bot.username = mkOption {
+          bot.username = lib.mkOption {
             type = types.str;
             default = "botamusique";
             description = "Name the bot should appear with.";
           };
 
-          bot.comment = mkOption {
+          bot.comment = lib.mkOption {
             type = types.str;
             default = "Hi, I'm here to play radio, local music or youtube/soundcloud music. Have fun!";
             description = "Comment displayed for the bot.";
@@ -54,7 +51,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.botamusique = {
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
diff --git a/nixos/modules/services/audio/gmediarender.nix b/nixos/modules/services/audio/gmediarender.nix
index 3f031aeedb7b..ee16400d48d4 100644
--- a/nixos/modules/services/audio/gmediarender.nix
+++ b/nixos/modules/services/audio/gmediarender.nix
@@ -1,58 +1,55 @@
 { pkgs, lib, config, utils, ... }:
-
-with lib;
-
 let
   cfg = config.services.gmediarender;
 in
 {
   options.services.gmediarender = {
-    enable = mkEnableOption "the gmediarender DLNA renderer";
+    enable = lib.mkEnableOption "the gmediarender DLNA renderer";
 
-    audioDevice = mkOption {
-      type = types.nullOr types.str;
+    audioDevice = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
       default = null;
       description = ''
         The audio device to use.
       '';
     };
 
-    audioSink = mkOption {
-      type = types.nullOr types.str;
+    audioSink = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
       default = null;
       description = ''
         The audio sink to use.
       '';
     };
 
-    friendlyName = mkOption {
-      type = types.nullOr types.str;
+    friendlyName = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
       default = null;
       description = ''
         A "friendly name" for identifying the endpoint.
       '';
     };
 
-    initialVolume = mkOption {
-      type = types.nullOr types.int;
+    initialVolume = lib.mkOption {
+      type = lib.types.nullOr lib.types.int;
       default = 0;
       description = ''
         A default volume attenuation (in dB) for the endpoint.
       '';
     };
 
-    package = mkPackageOption pkgs "gmediarender" {
+    package = lib.mkPackageOption pkgs "gmediarender" {
       default = "gmrender-resurrect";
     };
 
-    port = mkOption {
-      type = types.nullOr types.port;
+    port = lib.mkOption {
+      type = lib.types.nullOr lib.types.port;
       default = null;
       description = "Port that will be used to accept client connections.";
     };
 
-    uuid = mkOption {
-      type = types.nullOr types.str;
+    uuid = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
       default = null;
       description = ''
         A UUID for uniquely identifying the endpoint.  If you have
@@ -61,7 +58,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd = {
       services.gmediarender = {
         wants = [ "network-online.target" ];
@@ -78,12 +75,12 @@ in
           SupplementaryGroups = [ "audio" ];
           ExecStart =
             "${cfg.package}/bin/gmediarender " +
-            optionalString (cfg.audioDevice != null) ("--gstout-audiodevice=${utils.escapeSystemdExecArg cfg.audioDevice} ") +
-            optionalString (cfg.audioSink != null) ("--gstout-audiosink=${utils.escapeSystemdExecArg cfg.audioSink} ") +
-            optionalString (cfg.friendlyName != null) ("--friendly-name=${utils.escapeSystemdExecArg cfg.friendlyName} ") +
-            optionalString (cfg.initialVolume != 0) ("--initial-volume=${toString cfg.initialVolume} ") +
-            optionalString (cfg.port != null) ("--port=${toString cfg.port} ") +
-            optionalString (cfg.uuid != null) ("--uuid=${utils.escapeSystemdExecArg cfg.uuid} ");
+            lib.optionalString (cfg.audioDevice != null) ("--gstout-audiodevice=${utils.escapeSystemdExecArg cfg.audioDevice} ") +
+            lib.optionalString (cfg.audioSink != null) ("--gstout-audiosink=${utils.escapeSystemdExecArg cfg.audioSink} ") +
+            lib.optionalString (cfg.friendlyName != null) ("--friendly-name=${utils.escapeSystemdExecArg cfg.friendlyName} ") +
+            lib.optionalString (cfg.initialVolume != 0) ("--initial-volume=${toString cfg.initialVolume} ") +
+            lib.optionalString (cfg.port != null) ("--port=${toString cfg.port} ") +
+            lib.optionalString (cfg.uuid != null) ("--uuid=${utils.escapeSystemdExecArg cfg.uuid} ");
           Restart = "always";
           RuntimeDirectory = "gmediarender";
 
diff --git a/nixos/modules/services/audio/gonic.nix b/nixos/modules/services/audio/gonic.nix
index 15a35571acba..5f55f776bf8b 100644
--- a/nixos/modules/services/audio/gonic.nix
+++ b/nixos/modules/services/audio/gonic.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.gonic;
   settingsFormat = pkgs.formats.keyValue {
@@ -13,11 +10,11 @@ in
   options = {
     services.gonic = {
 
-      enable = mkEnableOption "Gonic music server";
+      enable = lib.mkEnableOption "Gonic music server";
 
-      settings = mkOption rec {
+      settings = lib.mkOption rec {
         type = settingsFormat.type;
-        apply = recursiveUpdate default;
+        apply = lib.recursiveUpdate default;
         default = {
           listen-addr = "127.0.0.1:4747";
           cache-path = "/var/cache/gonic";
@@ -36,7 +33,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.gonic = {
       description = "Gonic Media Server";
       after = [ "network.target" ];
@@ -45,7 +42,7 @@ in
         ExecStart =
           let
             # these values are null by default but should not appear in the final config
-            filteredSettings = filterAttrs (n: v: !((n == "tls-cert" || n == "tls-key") && v == null)) cfg.settings;
+            filteredSettings = lib.filterAttrs (n: v: !((n == "tls-cert" || n == "tls-key") && v == null)) cfg.settings;
           in
           "${pkgs.gonic}/bin/gonic -config-path ${settingsFormat.generate "gonic" filteredSettings}";
         DynamicUser = true;
@@ -89,5 +86,5 @@ in
     };
   };
 
-  meta.maintainers = [ maintainers.autrimpo ];
+  meta.maintainers = [ lib.maintainers.autrimpo ];
 }
diff --git a/nixos/modules/services/audio/goxlr-utility.nix b/nixos/modules/services/audio/goxlr-utility.nix
index 00aaa77a24d5..bd8f285d6739 100644
--- a/nixos/modules/services/audio/goxlr-utility.nix
+++ b/nixos/modules/services/audio/goxlr-utility.nix
@@ -1,25 +1,22 @@
 { config, lib, pkgs, ... }:
-
 let
   cfg = config.services.goxlr-utility;
 in
-
-with lib;
 {
 
   options = {
     services.goxlr-utility = {
-      enable = mkOption {
+      enable = lib.mkOption {
         default = false;
-        type = types.bool;
+        type = lib.types.bool;
         description = ''
           Whether to enable goxlr-utility for controlling your TC-Helicon GoXLR or GoXLR Mini
         '';
       };
-      package = mkPackageOption pkgs "goxlr-utility" { };
-      autoStart.xdg = mkOption {
+      package = lib.mkPackageOption pkgs "goxlr-utility" { };
+      autoStart.xdg = lib.mkOption {
         default = true;
-        type = with types; bool;
+        type = with lib.types; bool;
         description = ''
           Start the daemon automatically using XDG autostart.
           Sets `xdg.autostart.enable = true` if not already enabled.
@@ -44,16 +41,16 @@ with lib;
         '';
       };
     in
-    mkIf config.services.goxlr-utility.enable {
+    lib.mkIf config.services.goxlr-utility.enable {
       services.udev.packages = [ cfg.package ];
 
-      xdg.autostart.enable = mkIf cfg.autoStart.xdg true;
-      environment.systemPackages = mkIf cfg.autoStart.xdg
+      xdg.autostart.enable = lib.mkIf cfg.autoStart.xdg true;
+      environment.systemPackages = lib.mkIf cfg.autoStart.xdg
         [
           cfg.package
           goxlr-autostart
         ];
     };
 
-  meta.maintainers = with maintainers; [ errnoh ];
+  meta.maintainers = with lib.maintainers; [ errnoh ];
 }
diff --git a/nixos/modules/services/audio/hqplayerd.nix b/nixos/modules/services/audio/hqplayerd.nix
index d6ac8c58c03a..85e633b64457 100644
--- a/nixos/modules/services/audio/hqplayerd.nix
+++ b/nixos/modules/services/audio/hqplayerd.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.hqplayerd;
   pkg = pkgs.hqplayerd;
@@ -12,11 +9,11 @@ in
 {
   options = {
     services.hqplayerd = {
-      enable = mkEnableOption "HQPlayer Embedded";
+      enable = lib.mkEnableOption "HQPlayer Embedded";
 
       auth = {
-        username = mkOption {
-          type = types.nullOr types.str;
+        username = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
           default = null;
           description = ''
             Username used for HQPlayer's WebUI.
@@ -26,8 +23,8 @@ in
           '';
         };
 
-        password = mkOption {
-          type = types.nullOr types.str;
+        password = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
           default = null;
           description = ''
             Password used for HQPlayer's WebUI.
@@ -38,8 +35,8 @@ in
         };
       };
 
-      licenseFile = mkOption {
-        type = types.nullOr types.path;
+      licenseFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
         default = null;
         description = ''
           Path to the HQPlayer license key file.
@@ -49,16 +46,16 @@ in
         '';
       };
 
-      openFirewall = mkOption {
-        type = types.bool;
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Opens ports needed for the WebUI and controller API.
         '';
       };
 
-      config = mkOption {
-        type = types.nullOr types.lines;
+      config = lib.mkOption {
+        type = lib.types.nullOr lib.types.lines;
         default = null;
         description = ''
           HQplayer daemon configuration, written to /etc/hqplayer/hqplayerd.xml.
@@ -69,7 +66,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     assertions = [
       {
         assertion = (cfg.auth.username != null -> cfg.auth.password != null)
@@ -80,13 +77,13 @@ in
 
     environment = {
       etc = {
-        "hqplayer/hqplayerd.xml" = mkIf (cfg.config != null) { source = pkgs.writeText "hqplayerd.xml" cfg.config; };
-        "hqplayer/hqplayerd4-key.xml" = mkIf (cfg.licenseFile != null) { source = cfg.licenseFile; };
+        "hqplayer/hqplayerd.xml" = lib.mkIf (cfg.config != null) { source = pkgs.writeText "hqplayerd.xml" cfg.config; };
+        "hqplayer/hqplayerd4-key.xml" = lib.mkIf (cfg.licenseFile != null) { source = cfg.licenseFile; };
       };
       systemPackages = [ pkg ];
     };
 
-    networking.firewall = mkIf cfg.openFirewall {
+    networking.firewall = lib.mkIf cfg.openFirewall {
       allowedTCPPorts = [ 8088 4321 ];
     };
 
@@ -107,7 +104,7 @@ in
 
         unitConfig.ConditionPathExists = [ configDir stateDir ];
 
-        restartTriggers = optionals (cfg.config != null) [ config.environment.etc."hqplayer/hqplayerd.xml".source ];
+        restartTriggers = lib.optionals (cfg.config != null) [ config.environment.etc."hqplayer/hqplayerd.xml".source ];
 
         preStart = ''
           cp -r "${pkg}/var/lib/hqplayer/web" "${stateDir}"
@@ -117,7 +114,7 @@ in
             echo "creating initial config file"
             install -m 0644 "${pkg}/etc/hqplayer/hqplayerd.xml" "${configDir}/hqplayerd.xml"
           fi
-        '' + optionalString (cfg.auth.username != null && cfg.auth.password != null) ''
+        '' + lib.optionalString (cfg.auth.username != null && cfg.auth.password != null) ''
           ${pkg}/bin/hqplayerd -s ${cfg.auth.username} ${cfg.auth.password}
         '';
       };
diff --git a/nixos/modules/services/audio/icecast.nix b/nixos/modules/services/audio/icecast.nix
index 9237baa007da..820674c4341d 100644
--- a/nixos/modules/services/audio/icecast.nix
+++ b/nixos/modules/services/audio/icecast.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.icecast;
   configFile = pkgs.writeText "icecast.xml" ''
@@ -44,62 +41,62 @@ in {
 
     services.icecast = {
 
-      enable = mkEnableOption "Icecast server";
+      enable = lib.mkEnableOption "Icecast server";
 
-      hostname = mkOption {
-        type = types.nullOr types.str;
+      hostname = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         description = "DNS name or IP address that will be used for the stream directory lookups or possibly the playlist generation if a Host header is not provided.";
         default = config.networking.domain;
-        defaultText = literalExpression "config.networking.domain";
+        defaultText = lib.literalExpression "config.networking.domain";
       };
 
       admin = {
-        user = mkOption {
-          type = types.str;
+        user = lib.mkOption {
+          type = lib.types.str;
           description = "Username used for all administration functions.";
           default = "admin";
         };
 
-        password = mkOption {
-          type = types.str;
+        password = lib.mkOption {
+          type = lib.types.str;
           description = "Password used for all administration functions.";
         };
       };
 
-      logDir = mkOption {
-        type = types.path;
+      logDir = lib.mkOption {
+        type = lib.types.path;
         description = "Base directory used for logging.";
         default = "/var/log/icecast";
       };
 
       listen = {
-        port = mkOption {
-          type = types.port;
+        port = lib.mkOption {
+          type = lib.types.port;
           description = "TCP port that will be used to accept client connections.";
           default = 8000;
         };
 
-        address = mkOption {
-          type = types.str;
+        address = lib.mkOption {
+          type = lib.types.str;
           description = "Address Icecast will listen on.";
           default = "::";
         };
       };
 
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         description = "User privileges for the server.";
         default = "nobody";
       };
 
-      group = mkOption {
-        type = types.str;
+      group = lib.mkOption {
+        type = lib.types.str;
         description = "Group privileges for the server.";
         default = "nogroup";
       };
 
-      extraConf = mkOption {
-        type = types.lines;
+      extraConf = lib.mkOption {
+        type = lib.types.lines;
         description = "icecast.xml content.";
         default = "";
       };
@@ -111,7 +108,7 @@ in {
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     systemd.services.icecast = {
       after = [ "network.target" ];
diff --git a/nixos/modules/services/audio/jack.nix b/nixos/modules/services/audio/jack.nix
index 767f1add1cae..c71b8ff13fa6 100644
--- a/nixos/modules/services/audio/jack.nix
+++ b/nixos/modules/services/audio/jack.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.jack;
 
@@ -10,29 +7,29 @@ let
 
   enable32BitAlsaPlugins = cfg.alsa.support32Bit && pkgs.stdenv.hostPlatform.isx86_64 && pkgs.pkgsi686Linux.alsa-lib != null;
 
-  umaskNeeded = versionOlder cfg.jackd.package.version "1.9.12";
-  bridgeNeeded = versionAtLeast cfg.jackd.package.version "1.9.12";
+  umaskNeeded = lib.versionOlder cfg.jackd.package.version "1.9.12";
+  bridgeNeeded = lib.versionAtLeast cfg.jackd.package.version "1.9.12";
 in {
   options = {
     services.jack = {
       jackd = {
-        enable = mkEnableOption ''
+        enable = lib.mkEnableOption ''
           JACK Audio Connection Kit. You need to add yourself to the "jackaudio" group
         '';
 
-        package = mkPackageOption pkgs "jack2" {
+        package = lib.mkPackageOption pkgs "jack2" {
           example = "jack1";
         } // {
           # until jack1 promiscuous mode is fixed
           internal = true;
         };
 
-        extraOptions = mkOption {
-          type = types.listOf types.str;
+        extraOptions = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
           default = [
             "-dalsa"
           ];
-          example = literalExpression ''
+          example = lib.literalExpression ''
             [ "-dalsa" "--device" "hw:1" ];
           '';
           description = ''
@@ -40,8 +37,8 @@ in {
           '';
         };
 
-        session = mkOption {
-          type = types.lines;
+        session = lib.mkOption {
+          type = lib.types.lines;
           description = ''
             Commands to run after JACK is started.
           '';
@@ -50,16 +47,16 @@ in {
       };
 
       alsa = {
-        enable = mkOption {
-          type = types.bool;
+        enable = lib.mkOption {
+          type = lib.types.bool;
           default = true;
           description = ''
             Route audio to/from generic ALSA-using applications using ALSA JACK PCM plugin.
           '';
         };
 
-        support32Bit = mkOption {
-          type = types.bool;
+        support32Bit = lib.mkOption {
+          type = lib.types.bool;
           default = false;
           description = ''
             Whether to support sound for 32-bit ALSA applications on 64-bit system.
@@ -68,8 +65,8 @@ in {
       };
 
       loopback = {
-        enable = mkOption {
-          type = types.bool;
+        enable = lib.mkOption {
+          type = lib.types.bool;
           default = false;
           description = ''
             Create ALSA loopback device, instead of using PCM plugin. Has broader
@@ -78,23 +75,23 @@ in {
           '';
         };
 
-        index = mkOption {
-          type = types.int;
+        index = lib.mkOption {
+          type = lib.types.int;
           default = 10;
           description = ''
             Index of an ALSA loopback device.
           '';
         };
 
-        config = mkOption {
-          type = types.lines;
+        config = lib.mkOption {
+          type = lib.types.lines;
           description = ''
             ALSA config for loopback device.
           '';
         };
 
-        dmixConfig = mkOption {
-          type = types.lines;
+        dmixConfig = lib.mkOption {
+          type = lib.types.lines;
           default = "";
           example = ''
             period_size 2048
@@ -107,8 +104,8 @@ in {
           '';
         };
 
-        session = mkOption {
-          type = types.lines;
+        session = lib.mkOption {
+          type = lib.types.lines;
           description = ''
             Additional commands to run to setup loopback device.
           '';
@@ -119,9 +116,9 @@ in {
 
   };
 
-  config = mkMerge [
+  config = lib.mkMerge [
 
-    (mkIf pcmPlugin {
+    (lib.mkIf pcmPlugin {
       environment.etc."alsa/conf.d/98-jack.conf".text = ''
         pcm_type.jack {
           libs.native = ${pkgs.alsa-plugins}/lib/alsa-lib/libasound_module_pcm_jack.so ;
@@ -136,13 +133,13 @@ in {
       '';
     })
 
-    (mkIf loopback {
+    (lib.mkIf loopback {
       boot.kernelModules = [ "snd-aloop" ];
       boot.kernelParams = [ "snd-aloop.index=${toString cfg.loopback.index}" ];
       environment.etc."alsa/conf.d/99-jack-loopback.conf".text = cfg.loopback.config;
     })
 
-    (mkIf cfg.jackd.enable {
+    (lib.mkIf cfg.jackd.enable {
       services.jack.jackd.session = ''
         ${lib.optionalString bridgeNeeded "${pkgs.a2jmidid}/bin/a2jmidid -e &"}
       '';
@@ -247,7 +244,7 @@ in {
           ExecStart = "${cfg.jackd.package}/bin/jackd ${lib.escapeShellArgs cfg.jackd.extraOptions}";
           LimitRTPRIO = 99;
           LimitMEMLOCK = "infinity";
-        } // optionalAttrs umaskNeeded {
+        } // lib.optionalAttrs umaskNeeded {
           UMask = "007";
         };
         path = [ cfg.jackd.package ];
diff --git a/nixos/modules/services/audio/jmusicbot.nix b/nixos/modules/services/audio/jmusicbot.nix
index d1317facf273..6cd348e68e45 100644
--- a/nixos/modules/services/audio/jmusicbot.nix
+++ b/nixos/modules/services/audio/jmusicbot.nix
@@ -1,18 +1,16 @@
 { config, lib, pkgs, ... }:
-
-with lib;
 let
   cfg = config.services.jmusicbot;
 in
 {
   options = {
     services.jmusicbot = {
-      enable = mkEnableOption "jmusicbot, a Discord music bot that's easy to set up and run yourself";
+      enable = lib.mkEnableOption "jmusicbot, a Discord music bot that's easy to set up and run yourself";
 
-      package = mkPackageOption pkgs "jmusicbot" { };
+      package = lib.mkPackageOption pkgs "jmusicbot" { };
 
-      stateDir = mkOption {
-        type = types.path;
+      stateDir = lib.mkOption {
+        type = lib.types.path;
         description = ''
           The directory where config.txt and serversettings.json is saved.
           If left as the default value this directory will automatically be created before JMusicBot starts, otherwise the sysadmin is responsible for ensuring the directory exists with appropriate ownership and permissions.
@@ -23,20 +21,20 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.jmusicbot = {
       wantedBy = [ "multi-user.target" ];
       wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
       description = "Discord music bot that's easy to set up and run yourself!";
-      serviceConfig = mkMerge [{
+      serviceConfig = lib.mkMerge [{
         ExecStart = "${cfg.package}/bin/JMusicBot";
         WorkingDirectory = cfg.stateDir;
         Restart = "always";
         RestartSec = 20;
         DynamicUser = true;
       }
-        (mkIf (cfg.stateDir == "/var/lib/jmusicbot") { StateDirectory = "jmusicbot"; })];
+        (lib.mkIf (cfg.stateDir == "/var/lib/jmusicbot") { StateDirectory = "jmusicbot"; })];
     };
   };
 
diff --git a/nixos/modules/services/audio/liquidsoap.nix b/nixos/modules/services/audio/liquidsoap.nix
index bd35e01b60d6..ece282f0568f 100644
--- a/nixos/modules/services/audio/liquidsoap.nix
+++ b/nixos/modules/services/audio/liquidsoap.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   streams = builtins.attrNames config.services.liquidsoap.streams;
 
@@ -29,7 +26,7 @@ in
 
   options = {
 
-    services.liquidsoap.streams = mkOption {
+    services.liquidsoap.streams = lib.mkOption {
 
       description = ''
           Set of Liquidsoap streams to start,
@@ -38,7 +35,7 @@ in
 
       default = {};
 
-      example = literalExpression ''
+      example = lib.literalExpression ''
         {
           myStream1 = "/etc/liquidsoap/myStream1.liq";
           myStream2 = ./myStream2.liq;
@@ -46,13 +43,13 @@ in
         }
       '';
 
-      type = types.attrsOf (types.either types.path types.str);
+      type = lib.types.attrsOf (lib.types.either lib.types.path lib.types.str);
     };
 
   };
   ##### implementation
 
-  config = mkIf (builtins.length streams != 0) {
+  config = lib.mkIf (builtins.length streams != 0) {
 
     users.users.liquidsoap = {
       uid = config.ids.uids.liquidsoap;
diff --git a/nixos/modules/services/audio/mpdscribble.nix b/nixos/modules/services/audio/mpdscribble.nix
index 3c7270a3a4a4..9e1f2c50a924 100644
--- a/nixos/modules/services/audio/mpdscribble.nix
+++ b/nixos/modules/services/audio/mpdscribble.nix
@@ -1,7 +1,4 @@
 { config, lib, options, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.mpdscribble;
   mpdCfg = config.services.mpd;
@@ -22,7 +19,7 @@ let
     journal  = /var/lib/mpdscribble/${secname}.journal
   '';
 
-  endpoints = concatStringsSep "\n" (mapAttrsToList mkSection cfg.endpoints);
+  endpoints = lib.concatStringsSep "\n" (lib.mapAttrsToList mkSection cfg.endpoints);
   cfgTemplate = pkgs.writeText "mpdscribble.conf" ''
     ## This file was automatically genenrated by NixOS and will be overwritten.
     ## Do not edit. Edit your NixOS configuration instead.
@@ -31,7 +28,7 @@ let
     ## http://mpd.wikia.com/wiki/Client:mpdscribble
 
     # HTTP proxy URL.
-    ${optionalString (cfg.proxy != null) "proxy = ${cfg.proxy}"}
+    ${lib.optionalString (cfg.proxy != null) "proxy = ${cfg.proxy}"}
 
     # The location of the mpdscribble log file.  The special value
     # "syslog" makes mpdscribble use the local syslog daemon.  On most
@@ -47,7 +44,7 @@ let
 
     # The host running MPD, possibly protected by a password
     # ([PASSWORD@]HOSTNAME).
-    host = ${(optionalString (cfg.passwordFile != null) "{{MPD_PASSWORD}}@") + cfg.host}
+    host = ${(lib.optionalString (cfg.passwordFile != null) "{{MPD_PASSWORD}}@") + cfg.host}
 
     # The port that the MPD listens on and mpdscribble should try to
     # connect to.
@@ -59,13 +56,13 @@ let
   cfgFile = "/run/mpdscribble/mpdscribble.conf";
 
   replaceSecret = secretFile: placeholder: targetFile:
-    optionalString (secretFile != null) ''
+    lib.optionalString (secretFile != null) ''
       ${pkgs.replace-secret}/bin/replace-secret '${placeholder}' '${secretFile}' '${targetFile}' '';
 
   preStart = pkgs.writeShellScript "mpdscribble-pre-start" ''
     cp -f "${cfgTemplate}" "${cfgFile}"
     ${replaceSecret cfg.passwordFile "{{MPD_PASSWORD}}" cfgFile}
-    ${concatStringsSep "\n" (mapAttrsToList (secname: cfg:
+    ${lib.concatStringsSep "\n" (lib.mapAttrsToList (secname: cfg:
       replaceSecret cfg.passwordFile "{{${secname}_PASSWORD}}" cfgFile)
       cfg.endpoints)}
   '';
@@ -77,62 +74,62 @@ in {
 
   options.services.mpdscribble = {
 
-    enable = mkEnableOption "mpdscribble, an MPD client which submits info about tracks being played to Last.fm (formerly AudioScrobbler)";
+    enable = lib.mkEnableOption "mpdscribble, an MPD client which submits info about tracks being played to Last.fm (formerly AudioScrobbler)";
 
-    proxy = mkOption {
+    proxy = lib.mkOption {
       default = null;
-      type = types.nullOr types.str;
+      type = lib.types.nullOr lib.types.str;
       description = ''
         HTTP proxy URL.
       '';
     };
 
-    verbose = mkOption {
+    verbose = lib.mkOption {
       default = 1;
-      type = types.int;
+      type = lib.types.int;
       description = ''
         Log level for the mpdscribble daemon.
       '';
     };
 
-    journalInterval = mkOption {
+    journalInterval = lib.mkOption {
       default = 600;
       example = 60;
-      type = types.int;
+      type = lib.types.int;
       description = ''
         How often should mpdscribble save the journal file? [seconds]
       '';
     };
 
-    host = mkOption {
+    host = lib.mkOption {
       default = (if mpdCfg.network.listenAddress != "any" then
         mpdCfg.network.listenAddress
       else
         "localhost");
-      defaultText = literalExpression ''
+      defaultText = lib.literalExpression ''
         if config.${mpdOpt.network.listenAddress} != "any"
         then config.${mpdOpt.network.listenAddress}
         else "localhost"
       '';
-      type = types.str;
+      type = lib.types.str;
       description = ''
         Host for the mpdscribble daemon to search for a mpd daemon on.
       '';
     };
 
-    passwordFile = mkOption {
+    passwordFile = lib.mkOption {
       default = if localMpd then
-        (findFirst
-          (c: any (x: x == "read") c.permissions)
+        (lib.findFirst
+          (c: lib.any (x: x == "read") c.permissions)
           { passwordFile = null; }
           mpdCfg.credentials).passwordFile
       else
         null;
-      defaultText = literalMD ''
+      defaultText = lib.literalMD ''
         The first password file with read access configured for MPD when using a local instance,
         otherwise `null`.
       '';
-      type = types.nullOr types.str;
+      type = lib.types.nullOr lib.types.str;
       description = ''
         File containing the password for the mpd daemon.
         If there is a local mpd configured using {option}`services.mpd.credentials`
@@ -140,37 +137,37 @@ in {
       '';
     };
 
-    port = mkOption {
+    port = lib.mkOption {
       default = mpdCfg.network.port;
-      defaultText = literalExpression "config.${mpdOpt.network.port}";
-      type = types.port;
+      defaultText = lib.literalExpression "config.${mpdOpt.network.port}";
+      type = lib.types.port;
       description = ''
         Port for the mpdscribble daemon to search for a mpd daemon on.
       '';
     };
 
-    endpoints = mkOption {
+    endpoints = lib.mkOption {
       type = (let
         endpoint = { name, ... }: {
           options = {
-            url = mkOption {
-              type = types.str;
+            url = lib.mkOption {
+              type = lib.types.str;
               default = endpointUrls.${name} or "";
               description = "The url endpoint where the scrobble API is listening.";
             };
-            username = mkOption {
-              type = types.str;
+            username = lib.mkOption {
+              type = lib.types.str;
               description = ''
                 Username for the scrobble service.
               '';
             };
-            passwordFile = mkOption {
-              type = types.nullOr types.str;
+            passwordFile = lib.mkOption {
+              type = lib.types.nullOr lib.types.str;
               description = "File containing the password, either as MD5SUM or cleartext.";
             };
           };
         };
-      in types.attrsOf (types.submodule endpoint));
+      in lib.types.attrsOf (lib.types.submodule endpoint));
       default = { };
       example = {
         "last.fm" = {
@@ -181,7 +178,7 @@ in {
       description = ''
         Endpoints to scrobble to.
         If the endpoint is one of "${
-          concatStringsSep "\", \"" (attrNames endpointUrls)
+          lib.concatStringsSep "\", \"" (lib.attrNames endpointUrls)
         }" the url is set automatically.
       '';
     };
@@ -190,9 +187,9 @@ in {
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.mpdscribble = {
-      after = [ "network.target" ] ++ (optional localMpd "mpd.service");
+      after = [ "network.target" ] ++ (lib.optional localMpd "mpd.service");
       description = "mpdscribble mpd scrobble client";
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
diff --git a/nixos/modules/services/audio/networkaudiod.nix b/nixos/modules/services/audio/networkaudiod.nix
index 265a4e1d95d6..09e8fdcaacc3 100644
--- a/nixos/modules/services/audio/networkaudiod.nix
+++ b/nixos/modules/services/audio/networkaudiod.nix
@@ -1,18 +1,15 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   name = "networkaudiod";
   cfg = config.services.networkaudiod;
 in {
   options = {
     services.networkaudiod = {
-      enable = mkEnableOption "Networkaudiod (NAA)";
+      enable = lib.mkEnableOption "Networkaudiod (NAA)";
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.packages = [ pkgs.networkaudiod ];
     systemd.services.networkaudiod.wantedBy = [ "multi-user.target" ];
   };
diff --git a/nixos/modules/services/audio/roon-bridge.nix b/nixos/modules/services/audio/roon-bridge.nix
index 218bbb2a4845..049e84f02f0c 100644
--- a/nixos/modules/services/audio/roon-bridge.nix
+++ b/nixos/modules/services/audio/roon-bridge.nix
@@ -1,30 +1,27 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   name = "roon-bridge";
   cfg = config.services.roon-bridge;
 in {
   options = {
     services.roon-bridge = {
-      enable = mkEnableOption "Roon Bridge";
-      openFirewall = mkOption {
-        type = types.bool;
+      enable = lib.mkEnableOption "Roon Bridge";
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Open ports in the firewall for the bridge.
         '';
       };
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         default = "roon-bridge";
         description = ''
           User to run the Roon bridge as.
         '';
       };
-      group = mkOption {
-        type = types.str;
+      group = lib.mkOption {
+        type = lib.types.str;
         default = "roon-bridge";
         description = ''
           Group to run the Roon Bridge as.
@@ -33,7 +30,7 @@ in {
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.roon-bridge = {
       after = [ "network.target" ];
       description = "Roon Bridge";
@@ -50,17 +47,17 @@ in {
       };
     };
 
-    networking.firewall = mkIf cfg.openFirewall {
+    networking.firewall = lib.mkIf cfg.openFirewall {
       allowedTCPPortRanges = [{ from = 9100; to = 9200; }];
       allowedUDPPorts = [ 9003 ];
-      extraCommands = optionalString (!config.networking.nftables.enable) ''
+      extraCommands = lib.optionalString (!config.networking.nftables.enable) ''
         iptables -A INPUT -s 224.0.0.0/4 -j ACCEPT
         iptables -A INPUT -d 224.0.0.0/4 -j ACCEPT
         iptables -A INPUT -s 240.0.0.0/5 -j ACCEPT
         iptables -A INPUT -m pkttype --pkt-type multicast -j ACCEPT
         iptables -A INPUT -m pkttype --pkt-type broadcast -j ACCEPT
       '';
-      extraInputRules = optionalString config.networking.nftables.enable ''
+      extraInputRules = lib.optionalString config.networking.nftables.enable ''
         ip saddr { 224.0.0.0/4, 240.0.0.0/5 } accept
         ip daddr 224.0.0.0/4 accept
         pkttype { multicast, broadcast } accept
@@ -70,7 +67,7 @@ in {
 
     users.groups.${cfg.group} = {};
     users.users.${cfg.user} =
-      optionalAttrs (cfg.user == "roon-bridge") {
+      lib.optionalAttrs (cfg.user == "roon-bridge") {
         isSystemUser = true;
         description = "Roon Bridge user";
         group = cfg.group;
diff --git a/nixos/modules/services/audio/roon-server.nix b/nixos/modules/services/audio/roon-server.nix
index d3b3752dd728..58763f5ceeeb 100644
--- a/nixos/modules/services/audio/roon-server.nix
+++ b/nixos/modules/services/audio/roon-server.nix
@@ -1,31 +1,28 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   name = "roon-server";
   cfg = config.services.roon-server;
 in {
   options = {
     services.roon-server = {
-      enable = mkEnableOption "Roon Server";
+      enable = lib.mkEnableOption "Roon Server";
       package = lib.mkPackageOption pkgs "roon-server" { };
-      openFirewall = mkOption {
-        type = types.bool;
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Open ports in the firewall for the server.
         '';
       };
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         default = "roon-server";
         description = ''
           User to run the Roon Server as.
         '';
       };
-      group = mkOption {
-        type = types.str;
+      group = lib.mkOption {
+        type = lib.types.str;
         default = "roon-server";
         description = ''
           Group to run the Roon Server as.
@@ -34,7 +31,7 @@ in {
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.roon-server = {
       after = [ "network.target" ];
       description = "Roon Server";
@@ -52,14 +49,14 @@ in {
       };
     };
 
-    networking.firewall = mkIf cfg.openFirewall {
+    networking.firewall = lib.mkIf cfg.openFirewall {
       allowedTCPPortRanges = [
         { from = 9100; to = 9200; }
         { from = 9330; to = 9339; }
         { from = 30000; to = 30010; }
       ];
       allowedUDPPorts = [ 9003 ];
-      extraCommands = optionalString (!config.networking.nftables.enable) ''
+      extraCommands = lib.optionalString (!config.networking.nftables.enable) ''
         ## IGMP / Broadcast ##
         iptables -A INPUT -s 224.0.0.0/4 -j ACCEPT
         iptables -A INPUT -d 224.0.0.0/4 -j ACCEPT
@@ -67,7 +64,7 @@ in {
         iptables -A INPUT -m pkttype --pkt-type multicast -j ACCEPT
         iptables -A INPUT -m pkttype --pkt-type broadcast -j ACCEPT
       '';
-      extraInputRules = optionalString config.networking.nftables.enable ''
+      extraInputRules = lib.optionalString config.networking.nftables.enable ''
         ip saddr { 224.0.0.0/4, 240.0.0.0/5 } accept
         ip daddr 224.0.0.0/4 accept
         pkttype { multicast, broadcast } accept
@@ -77,7 +74,7 @@ in {
 
     users.groups.${cfg.group} = {};
     users.users.${cfg.user} =
-      optionalAttrs (cfg.user == "roon-server") {
+      lib.optionalAttrs (cfg.user == "roon-server") {
         isSystemUser = true;
         description = "Roon Server user";
         group = cfg.group;
diff --git a/nixos/modules/services/audio/slimserver.nix b/nixos/modules/services/audio/slimserver.nix
index a7f8968ef017..a9b5ed6bac00 100644
--- a/nixos/modules/services/audio/slimserver.nix
+++ b/nixos/modules/services/audio/slimserver.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
 
   cfg = config.services.slimserver;
@@ -11,18 +8,18 @@ in {
 
     services.slimserver = {
 
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to enable slimserver.
         '';
       };
 
-      package = mkPackageOption pkgs "slimserver" { };
+      package = lib.mkPackageOption pkgs "slimserver" { };
 
-      dataDir = mkOption {
-        type = types.path;
+      dataDir = lib.mkOption {
+        type = lib.types.path;
         default = "/var/lib/slimserver";
         description = ''
           The directory where slimserver stores its state, tag cache,
@@ -35,7 +32,7 @@ in {
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     systemd.tmpfiles.rules = [
       "d '${cfg.dataDir}' - slimserver slimserver - -"
diff --git a/nixos/modules/services/audio/spotifyd.nix b/nixos/modules/services/audio/spotifyd.nix
index 60a7f0fd4e94..c44617a7d6d7 100644
--- a/nixos/modules/services/audio/spotifyd.nix
+++ b/nixos/modules/services/audio/spotifyd.nix
@@ -1,14 +1,11 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.spotifyd;
   toml = pkgs.formats.toml {};
   warnConfig =
     if cfg.config != ""
     then lib.trace "Using the stringly typed .config attribute is discouraged. Use the TOML typed .settings attribute instead."
-    else id;
+    else lib.id;
   spotifydConf =
     if cfg.settings != {}
     then toml.generate "spotify.conf" cfg.settings
@@ -17,18 +14,18 @@ in
 {
   options = {
     services.spotifyd = {
-      enable = mkEnableOption "spotifyd, a Spotify playing daemon";
+      enable = lib.mkEnableOption "spotifyd, a Spotify playing daemon";
 
-      config = mkOption {
+      config = lib.mkOption {
         default = "";
-        type = types.lines;
+        type = lib.types.lines;
         description = ''
           (Deprecated) Configuration for Spotifyd. For syntax and directives, see
           <https://docs.spotifyd.rs/config/File.html>.
         '';
       };
 
-      settings = mkOption {
+      settings = lib.mkOption {
         default = {};
         type = toml.type;
         example = { global.bitrate = 320; };
@@ -40,7 +37,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     assertions = [
       {
         assertion = cfg.config == "" || cfg.settings == {};
@@ -65,5 +62,5 @@ in
     };
   };
 
-  meta.maintainers = [ maintainers.anderslundstedt ];
+  meta.maintainers = [ lib.maintainers.anderslundstedt ];
 }
diff --git a/nixos/modules/services/audio/ympd.nix b/nixos/modules/services/audio/ympd.nix
index ebbe59ca67c3..96977581a245 100644
--- a/nixos/modules/services/audio/ympd.nix
+++ b/nixos/modules/services/audio/ympd.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.ympd;
 in {
@@ -12,26 +9,26 @@ in {
 
     services.ympd = {
 
-      enable = mkEnableOption "ympd, the MPD Web GUI";
+      enable = lib.mkEnableOption "ympd, the MPD Web GUI";
 
-      webPort = mkOption {
-        type = types.either types.str types.port; # string for backwards compat
+      webPort = lib.mkOption {
+        type = lib.types.either lib.types.str lib.types.port; # string for backwards compat
         default = "8080";
         description = "The port where ympd's web interface will be available.";
         example = "ssl://8080:/path/to/ssl-private-key.pem";
       };
 
       mpd = {
-        host = mkOption {
-          type = types.str;
+        host = lib.mkOption {
+          type = lib.types.str;
           default = "localhost";
           description = "The host where MPD is listening.";
         };
 
-        port = mkOption {
-          type = types.port;
+        port = lib.mkOption {
+          type = lib.types.port;
           default = config.services.mpd.network.port;
-          defaultText = literalExpression "config.services.mpd.network.port";
+          defaultText = lib.literalExpression "config.services.mpd.network.port";
           description = "The port where MPD is listening.";
           example = 6600;
         };
@@ -44,7 +41,7 @@ in {
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     systemd.services.ympd = {
       description = "Standalone MPD Web GUI written in C";
diff --git a/nixos/modules/services/backup/borgmatic.nix b/nixos/modules/services/backup/borgmatic.nix
index 4d744a735582..1112182e8d23 100644
--- a/nixos/modules/services/backup/borgmatic.nix
+++ b/nixos/modules/services/backup/borgmatic.nix
@@ -1,20 +1,17 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.borgmatic;
   settingsFormat = pkgs.formats.yaml { };
 
-  repository = with types; submodule {
+  repository = with lib.types; submodule {
     options = {
-      path = mkOption {
+      path = lib.mkOption {
         type = str;
         description = ''
           Path to the repository
         '';
       };
-      label = mkOption {
+      label = lib.mkOption {
         type = str;
         description = ''
           Label to the repository
@@ -22,10 +19,10 @@ let
       };
     };
   };
-  cfgType = with types; submodule {
+  cfgType = with lib.types; submodule {
     freeformType = settingsFormat.type;
     options = {
-      source_directories = mkOption {
+      source_directories = lib.mkOption {
         type = listOf str;
         default = [];
         description = ''
@@ -34,7 +31,7 @@ let
         '';
         example = [ "/home" "/etc" "/var/log/syslog*" "/home/user/path with spaces" ];
       };
-      repositories = mkOption {
+      repositories = lib.mkOption {
         type = listOf repository;
         default = [];
         description = ''
@@ -59,33 +56,33 @@ let
 in
 {
   options.services.borgmatic = {
-    enable = mkEnableOption "borgmatic";
+    enable = lib.mkEnableOption "borgmatic";
 
-    settings = mkOption {
+    settings = lib.mkOption {
       description = ''
         See https://torsion.org/borgmatic/docs/reference/configuration/
       '';
       default = null;
-      type = types.nullOr cfgType;
+      type = lib.types.nullOr cfgType;
     };
 
-    configurations = mkOption {
+    configurations = lib.mkOption {
       description = ''
         Set of borgmatic configurations, see https://torsion.org/borgmatic/docs/reference/configuration/
       '';
       default = { };
-      type = types.attrsOf cfgType;
+      type = lib.types.attrsOf cfgType;
     };
 
-    enableConfigCheck = mkEnableOption "checking all configurations during build time" // { default = true; };
+    enableConfigCheck = lib.mkEnableOption "checking all configurations during build time" // { default = true; };
   };
 
   config =
     let
       configFiles =
-        (optionalAttrs (cfg.settings != null) { "borgmatic/config.yaml".source = cfgfile; }) //
-        mapAttrs'
-          (name: value: nameValuePair
+        (lib.optionalAttrs (cfg.settings != null) { "borgmatic/config.yaml".source = cfgfile; }) //
+        lib.mapAttrs'
+          (name: value: lib.nameValuePair
             "borgmatic.d/${name}.yaml"
             { source = settingsFormat.generate "${name}.yaml" value; })
           cfg.configurations;
@@ -94,12 +91,12 @@ in
             touch $out
           '';
     in
-      mkIf cfg.enable {
+      lib.mkIf cfg.enable {
 
         warnings = []
-          ++ optional (cfg.settings != null && cfg.settings ? location)
+          ++ lib.optional (cfg.settings != null && cfg.settings ? location)
             "`services.borgmatic.settings.location` is deprecated, please move your options out of sections to the global scope"
-          ++ optional (catAttrs "location" (attrValues cfg.configurations) != [])
+          ++ lib.optional (lib.catAttrs "location" (lib.attrValues cfg.configurations) != [])
             "`services.borgmatic.configurations.<name>.location` is deprecated, please move your options out of sections to the global scope"
         ;
 
@@ -112,6 +109,6 @@ in
         # Workaround: https://github.com/NixOS/nixpkgs/issues/81138
         systemd.timers.borgmatic.wantedBy = [ "timers.target" ];
 
-        system.checks = mkIf cfg.enableConfigCheck (mapAttrsToList borgmaticCheck configFiles);
+        system.checks = lib.mkIf cfg.enableConfigCheck (lib.mapAttrsToList borgmaticCheck configFiles);
       };
 }
diff --git a/nixos/modules/services/backup/duplicati.nix b/nixos/modules/services/backup/duplicati.nix
index 2b9e171d7d80..85f508141ba7 100644
--- a/nixos/modules/services/backup/duplicati.nix
+++ b/nixos/modules/services/backup/duplicati.nix
@@ -1,27 +1,24 @@
 { config, pkgs, lib, ... }:
-
-with lib;
-
 let
   cfg = config.services.duplicati;
 in
 {
   options = {
     services.duplicati = {
-      enable = mkEnableOption "Duplicati";
+      enable = lib.mkEnableOption "Duplicati";
 
-      package = mkPackageOption pkgs "duplicati" { };
+      package = lib.mkPackageOption pkgs "duplicati" { };
 
-      port = mkOption {
+      port = lib.mkOption {
         default = 8200;
-        type = types.port;
+        type = lib.types.port;
         description = ''
           Port serving the web interface
         '';
       };
 
-      dataDir = mkOption {
-        type = types.str;
+      dataDir = lib.mkOption {
+        type = lib.types.str;
         default = "/var/lib/duplicati";
         description = ''
           The directory where Duplicati stores its data files.
@@ -34,18 +31,18 @@ in
         '';
       };
 
-      interface = mkOption {
+      interface = lib.mkOption {
         default = "127.0.0.1";
-        type = types.str;
+        type = lib.types.str;
         description = ''
           Listening interface for the web UI
           Set it to "any" to listen on all available interfaces
         '';
       };
 
-      user = mkOption {
+      user = lib.mkOption {
         default = "duplicati";
-        type = types.str;
+        type = lib.types.str;
         description = ''
           Duplicati runs as it's own user. It will only be able to backup world-readable files.
           Run as root with special care.
@@ -54,21 +51,21 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     environment.systemPackages = [ cfg.package ];
 
     systemd.services.duplicati = {
       description = "Duplicati backup";
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
-      serviceConfig = mkMerge [
+      serviceConfig = lib.mkMerge [
         {
           User = cfg.user;
           Group = "duplicati";
           ExecStart = "${cfg.package}/bin/duplicati-server --webservice-interface=${cfg.interface} --webservice-port=${toString cfg.port} --server-datafolder=${cfg.dataDir}";
           Restart = "on-failure";
         }
-        (mkIf (cfg.dataDir == "/var/lib/duplicati") {
+        (lib.mkIf (cfg.dataDir == "/var/lib/duplicati") {
           StateDirectory = "duplicati";
         })
       ];
diff --git a/nixos/modules/services/backup/duplicity.nix b/nixos/modules/services/backup/duplicity.nix
index 46625ec5460e..d6927d63ca7a 100644
--- a/nixos/modules/services/backup/duplicity.nix
+++ b/nixos/modules/services/backup/duplicity.nix
@@ -1,30 +1,28 @@
 { config, lib, pkgs, ... }:
-
-with lib;
 let
   cfg = config.services.duplicity;
 
   stateDirectory = "/var/lib/duplicity";
 
   localTarget =
-    if hasPrefix "file://" cfg.targetUrl
-    then removePrefix "file://" cfg.targetUrl else null;
+    if lib.hasPrefix "file://" cfg.targetUrl
+    then lib.removePrefix "file://" cfg.targetUrl else null;
 
 in
 {
   options.services.duplicity = {
-    enable = mkEnableOption "backups with duplicity";
+    enable = lib.mkEnableOption "backups with duplicity";
 
-    root = mkOption {
-      type = types.path;
+    root = lib.mkOption {
+      type = lib.types.path;
       default = "/";
       description = ''
         Root directory to backup.
       '';
     };
 
-    include = mkOption {
-      type = types.listOf types.str;
+    include = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
       default = [ ];
       example = [ "/home" ];
       description = ''
@@ -33,8 +31,8 @@ in
       '';
     };
 
-    exclude = mkOption {
-      type = types.listOf types.str;
+    exclude = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
       default = [ ];
       description = ''
         List of paths to exclude from backups. See the FILE SELECTION section in
@@ -42,8 +40,8 @@ in
       '';
     };
 
-    includeFileList = mkOption {
-      type = types.nullOr types.path;
+    includeFileList = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
       default = null;
       example = /path/to/fileList.txt;
       description = ''
@@ -53,8 +51,8 @@ in
       '';
     };
 
-    excludeFileList = mkOption {
-      type = types.nullOr types.path;
+    excludeFileList = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
       default = null;
       example = /path/to/fileList.txt;
       description = ''
@@ -64,8 +62,8 @@ in
       '';
     };
 
-    targetUrl = mkOption {
-      type = types.str;
+    targetUrl = lib.mkOption {
+      type = lib.types.str;
       example = "s3://host:port/prefix";
       description = ''
         Target url to backup to. See the URL FORMAT section in
@@ -73,8 +71,8 @@ in
       '';
     };
 
-    secretFile = mkOption {
-      type = types.nullOr types.path;
+    secretFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
       default = null;
       description = ''
         Path of a file containing secrets (gpg passphrase, access key...) in
@@ -88,8 +86,8 @@ in
       '';
     };
 
-    frequency = mkOption {
-      type = types.nullOr types.str;
+    frequency = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
       default = "daily";
       description = ''
         Run duplicity with the given frequency (see
@@ -98,8 +96,8 @@ in
       '';
     };
 
-    extraFlags = mkOption {
-      type = types.listOf types.str;
+    extraFlags = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
       default = [ ];
       example = [ "--backend-retry-delay" "100" ];
       description = ''
@@ -108,8 +106,8 @@ in
       '';
     };
 
-    fullIfOlderThan = mkOption {
-      type = types.str;
+    fullIfOlderThan = lib.mkOption {
+      type = lib.types.str;
       default = "never";
       example = "1M";
       description = ''
@@ -123,8 +121,8 @@ in
     };
 
     cleanup = {
-      maxAge = mkOption {
-        type = types.nullOr types.str;
+      maxAge = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         example = "6M";
         description = ''
@@ -132,8 +130,8 @@ in
           will not be deleted if backup sets newer than time depend on them.
         '';
       };
-      maxFull = mkOption {
-        type = types.nullOr types.int;
+      maxFull = lib.mkOption {
+        type = lib.types.nullOr lib.types.int;
         default = null;
         example = 2;
         description = ''
@@ -142,8 +140,8 @@ in
           associated incremental sets).
         '';
       };
-      maxIncr = mkOption {
-        type = types.nullOr types.int;
+      maxIncr = lib.mkOption {
+        type = lib.types.nullOr lib.types.int;
         default = null;
         example = 1;
         description = ''
@@ -155,7 +153,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd = {
       services.duplicity = {
         description = "backup files with duplicity";
@@ -164,8 +162,8 @@ in
 
         script =
           let
-            target = escapeShellArg cfg.targetUrl;
-            extra = escapeShellArgs ([ "--archive-dir" stateDirectory ] ++ cfg.extraFlags);
+            target = lib.escapeShellArg cfg.targetUrl;
+            extra = lib.escapeShellArgs ([ "--archive-dir" stateDirectory ] ++ cfg.extraFlags);
             dup = "${pkgs.duplicity}/bin/duplicity";
           in
           ''
@@ -178,8 +176,8 @@ in
               [ cfg.root cfg.targetUrl ]
               ++ lib.optionals (cfg.includeFileList != null) [ "--include-filelist" cfg.includeFileList ]
               ++ lib.optionals (cfg.excludeFileList != null) [ "--exclude-filelist" cfg.excludeFileList ]
-              ++ concatMap (p: [ "--include" p ]) cfg.include
-              ++ concatMap (p: [ "--exclude" p ]) cfg.exclude
+              ++ lib.concatMap (p: [ "--include" p ]) cfg.include
+              ++ lib.concatMap (p: [ "--exclude" p ]) cfg.exclude
               ++ (lib.optionals (cfg.fullIfOlderThan != "never" && cfg.fullIfOlderThan != "always") [ "--full-if-older-than" cfg.fullIfOlderThan ])
               )} ${extra}
           '';
@@ -188,19 +186,19 @@ in
           ProtectSystem = "strict";
           ProtectHome = "read-only";
           StateDirectory = baseNameOf stateDirectory;
-        } // optionalAttrs (localTarget != null) {
+        } // lib.optionalAttrs (localTarget != null) {
           ReadWritePaths = localTarget;
-        } // optionalAttrs (cfg.secretFile != null) {
+        } // lib.optionalAttrs (cfg.secretFile != null) {
           EnvironmentFile = cfg.secretFile;
         };
-      } // optionalAttrs (cfg.frequency != null) {
+      } // lib.optionalAttrs (cfg.frequency != null) {
         startAt = cfg.frequency;
       };
 
-      tmpfiles.rules = optional (localTarget != null) "d ${localTarget} 0700 root root -";
+      tmpfiles.rules = lib.optional (localTarget != null) "d ${localTarget} 0700 root root -";
     };
 
-    assertions = singleton {
+    assertions = lib.singleton {
       # Duplicity will fail if the last file selection option is an include. It
       # is not always possible to detect but this simple case can be caught.
       assertion = cfg.include != [ ] -> cfg.exclude != [ ] || cfg.extraFlags != [ ];
diff --git a/nixos/modules/services/misc/omnom.nix b/nixos/modules/services/misc/omnom.nix
new file mode 100644
index 000000000000..da21648105e3
--- /dev/null
+++ b/nixos/modules/services/misc/omnom.nix
@@ -0,0 +1,251 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.omnom;
+  settingsFormat = pkgs.formats.yaml { };
+
+  configFile = settingsFormat.generate "omnom-config.yml" cfg.settings;
+in
+{
+  options = {
+    services.omnom = {
+      enable = lib.mkEnableOption "Omnom, a webpage bookmarking and snapshotting service";
+      package = lib.mkPackageOption pkgs "omnom" { };
+
+      dataDir = lib.mkOption {
+        type = lib.types.path;
+        default = "/var/lib/omnom";
+        description = "The directory where Omnom stores its data files.";
+      };
+
+      port = lib.mkOption {
+        type = lib.types.port;
+        default = 7331;
+        description = "The Omnom service port.";
+      };
+
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Whether to open ports in the firewall.";
+      };
+
+      user = lib.mkOption {
+        type = lib.types.nonEmptyStr;
+        default = "omnom";
+        description = "The Omnom service user.";
+      };
+
+      group = lib.mkOption {
+        type = lib.types.nonEmptyStr;
+        default = "omnom";
+        description = "The Omnom service group.";
+      };
+
+      passwordFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
+        default = null;
+        description = "File containing the password for the SMTP user.";
+      };
+
+      settings = lib.mkOption {
+        description = ''
+          Configuration options for the /etc/omnom/config.yml file.
+        '';
+        type = lib.types.submodule {
+          freeformType = settingsFormat.type;
+          options = {
+            app = {
+              debug = lib.mkEnableOption "debug mode";
+              disable_signup = lib.mkEnableOption "restricting user creation";
+              results_per_page = lib.mkOption {
+                type = lib.types.int;
+                default = 20;
+                description = "Number of results per page.";
+              };
+            };
+            db = {
+              connection = lib.mkOption {
+                type = lib.types.str;
+                default = "${cfg.dataDir}/db.sqlite3";
+                description = "Database connection URI.";
+                defaultText = lib.literalExpression ''
+                  "''${config.services.omnom.dataDir}/db.sqlite3"
+                '';
+              };
+              type = lib.mkOption {
+                type = lib.types.enum [ "sqlite" ];
+                default = "sqlite";
+                description = "Database type.";
+              };
+            };
+            server = {
+              address = lib.mkOption {
+                type = lib.types.str;
+                default = "127.0.0.1:${toString cfg.port}";
+                description = "Server address.";
+                defaultText = lib.literalExpression ''
+                  "127.0.0.1:''${config.services.omnom.port}"
+                '';
+              };
+              secure_cookie = lib.mkOption {
+                type = lib.types.bool;
+                default = true;
+                description = "Whether to limit cookies to a secure channel.";
+              };
+            };
+            storage = {
+              type = lib.mkOption {
+                type = lib.types.str;
+                default = "fs";
+                description = "Storage type.";
+              };
+              root = lib.mkOption {
+                type = lib.types.path;
+                default = "${cfg.dataDir}/static/data";
+                defaultText = lib.literalExpression ''
+                  "''${config.services.omnom.dataDir}/static/data"
+                '';
+                description = "Where the snapshots are saved.";
+              };
+            };
+            smtp = {
+              tls = lib.mkEnableOption "Whether TLS encryption should be used.";
+              tls_allow_insecure = lib.mkEnableOption "Whether to allow insecure TLS.";
+              host = lib.mkOption {
+                type = lib.types.str;
+                default = "";
+                description = "SMTP server hostname.";
+              };
+              port = lib.mkOption {
+                type = lib.types.port;
+                default = 25;
+                description = "SMTP server port address.";
+              };
+              sender = lib.mkOption {
+                type = lib.types.str;
+                default = "Omnom <omnom@127.0.0.1>";
+                description = "Omnom sender e-mail.";
+              };
+              send_timeout = lib.mkOption {
+                type = lib.types.int;
+                default = 10;
+                description = "Send timeout duration in seconds.";
+              };
+              connection_timeout = lib.mkOption {
+                type = lib.types.int;
+                default = 5;
+                description = "Connection timeout duration in seconds.";
+              };
+            };
+          };
+        };
+        default = { };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = !lib.hasAttr "password" cfg.settings.smtp;
+        message = ''
+          `services.omnom.settings.smtp.password` must be defined in `services.omnom.passwordFile`.
+        '';
+      }
+      {
+        assertion = !(cfg.settings.storage.root != "${cfg.dataDir}/static/data");
+        message = ''
+          For Omnom to access the snapshots, it needs the storage root
+          directory to be inside the service's working directory.
+
+          As such, `services.omnom.settings.storage.root` must be the same as
+          `''${services.omnom.dataDir}/static/data`.
+        '';
+      }
+    ];
+
+    systemd.services.omnom = {
+      path = with pkgs; [
+        yq-go # needed by startup script
+      ];
+
+      serviceConfig = {
+        User = cfg.user;
+        Group = cfg.group;
+        StateDirectory = "omnom";
+        WorkingDirectory = cfg.dataDir;
+        Restart = "on-failure";
+        RestartSec = "10s";
+        LoadCredential = lib.optional (cfg.passwordFile != null) "PASSWORD_FILE:${cfg.passwordFile}";
+      };
+      script = ''
+        install -m 600 ${configFile} $STATE_DIRECTORY/config.yml
+
+        ${lib.optionalString (cfg.passwordFile != null) ''
+          # merge password into main config
+          yq -i '.smtp.password = load(env(CREDENTIALS_DIRECTORY) + "/PASSWORD_FILE")' \
+            "$STATE_DIRECTORY/config.yml"
+        ''}
+
+        ${lib.getExe cfg.package} listen --config "$STATE_DIRECTORY/config.yml"
+      '';
+      after = [
+        "network.target"
+        "systemd-tmpfiles-setup.service"
+      ];
+      wantedBy = [ "multi-user.target" ];
+    };
+
+    # TODO: The program needs to run from the dataDir for it the work, which
+    # is difficult to do with a DynamicUser.
+    # After this has been fixed upstream, remove this and use DynamicUser, instead.
+    # See: https://github.com/asciimoo/omnom/issues/21
+    users = {
+      users = lib.mkIf (cfg.user == "omnom") {
+        omnom = {
+          group = cfg.group;
+          home = cfg.dataDir;
+          isSystemUser = true;
+        };
+      };
+      groups = lib.mkIf (cfg.group == "omnom") { omnom = { }; };
+    };
+
+    systemd.tmpfiles.settings."10-omnom" =
+      let
+        settings = {
+          inherit (cfg) user group;
+        };
+      in
+      {
+        "${cfg.dataDir}"."d" = settings;
+        "${cfg.dataDir}/templates"."L+" = settings // {
+          argument = "${cfg.package}/share/templates";
+        };
+        "${cfg.settings.storage.root}"."d" = settings;
+      };
+
+    networking.firewall = lib.mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.port ];
+    };
+
+    environment.systemPackages =
+      let
+        omnom-wrapped = pkgs.writeScriptBin "omnom" ''
+          #! ${pkgs.runtimeShell}
+          cd ${cfg.dataDir}
+          sudo=exec
+          if [[ "$USER" != ${cfg.user} ]]; then
+            sudo='exec /run/wrappers/bin/sudo -u ${cfg.user}'
+          fi
+          $sudo ${lib.getExe cfg.package} "$@"
+        '';
+      in
+      [ omnom-wrapped ];
+  };
+}
diff --git a/nixos/modules/services/misc/paperless.nix b/nixos/modules/services/misc/paperless.nix
index 3dfe3b87cae1..cbbd8b534504 100644
--- a/nixos/modules/services/misc/paperless.nix
+++ b/nixos/modules/services/misc/paperless.nix
@@ -1,6 +1,4 @@
 { config, pkgs, lib, ... }:
-
-with lib;
 let
   cfg = config.services.paperless;
 
@@ -17,16 +15,16 @@ let
     PAPERLESS_CONSUMPTION_DIR = cfg.consumptionDir;
     PAPERLESS_THUMBNAIL_FONT_NAME = defaultFont;
     GUNICORN_CMD_ARGS = "--bind=${cfg.address}:${toString cfg.port}";
-  } // optionalAttrs (config.time.timeZone != null) {
+  } // lib.optionalAttrs (config.time.timeZone != null) {
     PAPERLESS_TIME_ZONE = config.time.timeZone;
-  } // optionalAttrs enableRedis {
+  } // lib.optionalAttrs enableRedis {
     PAPERLESS_REDIS = "unix://${redisServer.unixSocket}";
-  } // optionalAttrs (cfg.settings.PAPERLESS_ENABLE_NLTK or true) {
+  } // lib.optionalAttrs (cfg.settings.PAPERLESS_ENABLE_NLTK or true) {
     PAPERLESS_NLTK_DIR = pkgs.symlinkJoin {
       name = "paperless_ngx_nltk_data";
       paths = cfg.package.nltkData;
     };
-  } // optionalAttrs (cfg.openMPThreadingWorkaround) {
+  } // lib.optionalAttrs (cfg.openMPThreadingWorkaround) {
     OMP_NUM_THREADS = "1";
   } // (lib.mapAttrs (_: s:
     if (lib.isAttrs s || lib.isList s) then builtins.toJSON s
@@ -53,7 +51,7 @@ let
     CapabilityBoundingSet = "";
     # ProtectClock adds DeviceAllow=char-rtc r
     DeviceAllow = "";
-    EnvironmentFile = mkIf (cfg.environmentFile != null) cfg.environmentFile;
+    EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
     LockPersonality = true;
     MemoryDenyWriteExecute = true;
     NoNewPrivileges = true;
@@ -80,22 +78,22 @@ let
     RestrictNamespaces = true;
     RestrictRealtime = true;
     RestrictSUIDSGID = true;
-    SupplementaryGroups = optional enableRedis redisServer.user;
+    SupplementaryGroups = lib.optional enableRedis redisServer.user;
     SystemCallArchitectures = "native";
     SystemCallFilter = [ "@system-service" "~@privileged @setuid @keyring" ];
     UMask = "0066";
   };
 in
 {
-  meta.maintainers = with maintainers; [ leona SuperSandro2000 erikarvstedt ];
+  meta.maintainers = with lib.maintainers; [ leona SuperSandro2000 erikarvstedt ];
 
   imports = [
-    (mkRenamedOptionModule [ "services" "paperless-ng" ] [ "services" "paperless" ])
-    (mkRenamedOptionModule [ "services" "paperless" "extraConfig" ] [ "services" "paperless" "settings" ])
+    (lib.mkRenamedOptionModule [ "services" "paperless-ng" ] [ "services" "paperless" ])
+    (lib.mkRenamedOptionModule [ "services" "paperless" "extraConfig" ] [ "services" "paperless" "settings" ])
   ];
 
   options.services.paperless = {
-    enable = mkOption {
+    enable = lib.mkOption {
       type = lib.types.bool;
       default = false;
       description = ''
@@ -110,34 +108,34 @@ in
       '';
     };
 
-    dataDir = mkOption {
-      type = types.str;
+    dataDir = lib.mkOption {
+      type = lib.types.str;
       default = "/var/lib/paperless";
       description = "Directory to store the Paperless data.";
     };
 
-    mediaDir = mkOption {
-      type = types.str;
+    mediaDir = lib.mkOption {
+      type = lib.types.str;
       default = "${cfg.dataDir}/media";
-      defaultText = literalExpression ''"''${dataDir}/media"'';
+      defaultText = lib.literalExpression ''"''${dataDir}/media"'';
       description = "Directory to store the Paperless documents.";
     };
 
-    consumptionDir = mkOption {
-      type = types.str;
+    consumptionDir = lib.mkOption {
+      type = lib.types.str;
       default = "${cfg.dataDir}/consume";
-      defaultText = literalExpression ''"''${dataDir}/consume"'';
+      defaultText = lib.literalExpression ''"''${dataDir}/consume"'';
       description = "Directory from which new documents are imported.";
     };
 
-    consumptionDirIsPublic = mkOption {
-      type = types.bool;
+    consumptionDirIsPublic = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = "Whether all users can write to the consumption dir.";
     };
 
-    passwordFile = mkOption {
-      type = types.nullOr types.path;
+    passwordFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
       default = null;
       example = "/run/keys/paperless-password";
       description = ''
@@ -158,19 +156,19 @@ in
       '';
     };
 
-    address = mkOption {
-      type = types.str;
+    address = lib.mkOption {
+      type = lib.types.str;
       default = "localhost";
       description = "Web interface address.";
     };
 
-    port = mkOption {
-      type = types.port;
+    port = lib.mkOption {
+      type = lib.types.port;
       default = 28981;
       description = "Web interface port.";
     };
 
-    settings = mkOption {
+    settings = lib.mkOption {
       type = lib.types.submodule {
         freeformType = with lib.types; attrsOf (let
           typeList = [ bool float int str path package ];
@@ -196,19 +194,19 @@ in
       };
     };
 
-    user = mkOption {
-      type = types.str;
+    user = lib.mkOption {
+      type = lib.types.str;
       default = defaultUser;
       description = "User under which Paperless runs.";
     };
 
-    package = mkPackageOption pkgs "paperless-ngx" { } // {
+    package = lib.mkPackageOption pkgs "paperless-ngx" { } // {
       apply = pkg: pkg.override {
         tesseract5 = pkg.tesseract5.override {
           # always enable detection modules
           # tesseract fails to build when eng is not present
           enableLanguages = if cfg.settings ? PAPERLESS_OCR_LANGUAGE then
-            lists.unique (
+            lib.lists.unique (
               [ "equ" "osd" "eng" ]
               ++ lib.splitString "+" cfg.settings.PAPERLESS_OCR_LANGUAGE
             )
@@ -217,7 +215,7 @@ in
       };
     };
 
-    openMPThreadingWorkaround = mkEnableOption ''
+    openMPThreadingWorkaround = lib.mkEnableOption ''
       a workaround for document classifier timeouts.
 
       Paperless uses OpenBLAS via scikit-learn for document classification.
@@ -229,10 +227,10 @@ in
 
       This sets `OMP_NUM_THREADS` to `1` in order to mitigate the issue. See
       https://github.com/NixOS/nixpkgs/issues/240591 for more information
-    '' // mkOption { default = true; };
+    '' // lib.mkOption { default = true; };
 
-    environmentFile = mkOption {
-      type = types.nullOr lib.types.path;
+    environmentFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
       default = null;
       example = "/run/secrets/paperless";
       description = ''
@@ -250,8 +248,8 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
-    services.redis.servers.paperless.enable = mkIf enableRedis true;
+  config = lib.mkIf cfg.enable {
+    services.redis.servers.paperless.enable = lib.mkIf enableRedis true;
 
     systemd.slices.system-paperless = {
       description = "Paperless Document Management System Slice";
@@ -308,7 +306,7 @@ in
           echo ${cfg.package.version} > "$versionFile"
         fi
       ''
-      + optionalString (cfg.passwordFile != null) ''
+      + lib.optionalString (cfg.passwordFile != null) ''
         export PAPERLESS_ADMIN_USER="''${PAPERLESS_ADMIN_USER:-admin}"
         PAPERLESS_ADMIN_PASSWORD=$(cat "$CREDENTIALS_DIRECTORY/PAPERLESS_ADMIN_PASSWORD")
         export PAPERLESS_ADMIN_PASSWORD
@@ -320,7 +318,7 @@ in
           echo "$superuserState" > "$superuserStateFile"
         fi
       '';
-    } // optionalAttrs enableRedis {
+    } // lib.optionalAttrs enableRedis {
       after = [ "redis-paperless.service" ];
     };
 
@@ -401,7 +399,7 @@ in
       unitConfig.JoinsNamespaceOf = "paperless-task-queue.service";
     };
 
-    users = optionalAttrs (cfg.user == defaultUser) {
+    users = lib.optionalAttrs (cfg.user == defaultUser) {
       users.${defaultUser} = {
         group = defaultUser;
         uid = config.ids.uids.paperless;
diff --git a/nixos/modules/services/misc/parsoid.nix b/nixos/modules/services/misc/parsoid.nix
index a1935d202172..bb168c4eca85 100644
--- a/nixos/modules/services/misc/parsoid.nix
+++ b/nixos/modules/services/misc/parsoid.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
 
   cfg = config.services.parsoid;
@@ -15,19 +12,19 @@ let
       module = "lib/index.js";
       entrypoint = "apiServiceWorker";
       conf = {
-        mwApis = map (x: if isAttrs x then x else { uri = x; }) cfg.wikis;
+        mwApis = map (x: if lib.isAttrs x then x else { uri = x; }) cfg.wikis;
         serverInterface = cfg.interface;
         serverPort = cfg.port;
       };
     }];
   };
 
-  confFile = pkgs.writeText "config.yml" (builtins.toJSON (recursiveUpdate confTree cfg.extraConfig));
+  confFile = pkgs.writeText "config.yml" (builtins.toJSON (lib.recursiveUpdate confTree cfg.extraConfig));
 
 in
 {
   imports = [
-    (mkRemovedOptionModule [ "services" "parsoid" "interwikis" ] "Use services.parsoid.wikis instead")
+    (lib.mkRemovedOptionModule [ "services" "parsoid" "interwikis" ] "Use services.parsoid.wikis instead")
   ];
 
   ##### interface
@@ -36,8 +33,8 @@ in
 
     services.parsoid = {
 
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to enable Parsoid -- bidirectional
@@ -45,40 +42,40 @@ in
         '';
       };
 
-      wikis = mkOption {
-        type = types.listOf (types.either types.str types.attrs);
+      wikis = lib.mkOption {
+        type = lib.types.listOf (lib.types.either lib.types.str lib.types.attrs);
         example = [ "http://localhost/api.php" ];
         description = ''
           Used MediaWiki API endpoints.
         '';
       };
 
-      workers = mkOption {
-        type = types.int;
+      workers = lib.mkOption {
+        type = lib.types.int;
         default = 2;
         description = ''
           Number of Parsoid workers.
         '';
       };
 
-      interface = mkOption {
-        type = types.str;
+      interface = lib.mkOption {
+        type = lib.types.str;
         default = "127.0.0.1";
         description = ''
           Interface to listen on.
         '';
       };
 
-      port = mkOption {
-        type = types.port;
+      port = lib.mkOption {
+        type = lib.types.port;
         default = 8000;
         description = ''
           Port to listen on.
         '';
       };
 
-      extraConfig = mkOption {
-        type = types.attrs;
+      extraConfig = lib.mkOption {
+        type = lib.types.attrs;
         default = {};
         description = ''
           Extra configuration to add to parsoid configuration.
@@ -91,7 +88,7 @@ in
 
   ##### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     systemd.services.parsoid = {
       description = "Bidirectional wikitext parser";
diff --git a/nixos/modules/services/misc/pinnwand.nix b/nixos/modules/services/misc/pinnwand.nix
index 9c26864dab56..3a5c47aeefd2 100644
--- a/nixos/modules/services/misc/pinnwand.nix
+++ b/nixos/modules/services/misc/pinnwand.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.pinnwand;
 
@@ -10,25 +7,25 @@ let
 in
 {
   options.services.pinnwand = {
-    enable = mkEnableOption "Pinnwand, a pastebin";
+    enable = lib.mkEnableOption "Pinnwand, a pastebin";
 
-    port = mkOption {
-      type = types.port;
+    port = lib.mkOption {
+      type = lib.types.port;
       description = "The port to listen on.";
       default = 8000;
     };
 
-    settings = mkOption {
+    settings = lib.mkOption {
       default = {};
       description = ''
         Your {file}`pinnwand.toml` as a Nix attribute set. Look up
         possible options in the [documentation](https://pinnwand.readthedocs.io/en/v${pkgs.pinnwand.version}/configuration.html).
       '';
-      type = types.submodule {
+      type = lib.types.submodule {
         freeformType = format.type;
         options = {
-          database_uri = mkOption {
-            type = types.str;
+          database_uri = lib.mkOption {
+            type = lib.types.str;
             default = "sqlite:////var/lib/pinnwand/pinnwand.db";
             example = "sqlite:///:memory";
             description = ''
@@ -38,16 +35,16 @@ in
             '';
           };
 
-          paste_size = mkOption {
-            type = types.ints.positive;
+          paste_size = lib.mkOption {
+            type = lib.types.ints.positive;
             default = 262144;
             example = 524288;
             description = ''
               Maximum size of a paste in bytes.
             '';
           };
-          paste_help = mkOption {
-            type = types.str;
+          paste_help = lib.mkOption {
+            type = lib.types.str;
             default = ''
               <p>Welcome to pinnwand, this site is a pastebin. It allows you to share code with others. If you write code in the text area below and press the paste button you will be given a link you can share with others so they can view your code as well.</p><p>People with the link can view your pasted code, only you can remove your paste and it expires automatically. Note that anyone could guess the URI to your paste so don't rely on it being private.</p>
               '';
@@ -55,8 +52,8 @@ in
               Raw HTML help text shown in the header area.
             '';
           };
-          footer = mkOption {
-            type = types.str;
+          footer = lib.mkOption {
+            type = lib.types.str;
             default = ''
               View <a href="//github.com/supakeen/pinnwand" target="_BLANK">source code</a>, the <a href="/removal">removal</a> or <a href="/expiry">expiry</a> stories, or read the <a href="/about">about</a> page.
             '';
@@ -69,7 +66,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.pinnwand = {
       description = "Pinnwannd HTTP Server";
       after = [ "network.target" ];
diff --git a/nixos/modules/services/misc/plex.nix b/nixos/modules/services/misc/plex.nix
index 212abda5d1e0..d1524aaae2a3 100644
--- a/nixos/modules/services/misc/plex.nix
+++ b/nixos/modules/services/misc/plex.nix
@@ -1,53 +1,50 @@
 { config, pkgs, lib, ... }:
-
-with lib;
-
 let
   cfg = config.services.plex;
 in
 {
   imports = [
-    (mkRemovedOptionModule [ "services" "plex" "managePlugins" ] "Please omit or define the option: `services.plex.extraPlugins' instead.")
+    (lib.mkRemovedOptionModule [ "services" "plex" "managePlugins" ] "Please omit or define the option: `services.plex.extraPlugins' instead.")
   ];
 
   options = {
     services.plex = {
-      enable = mkEnableOption "Plex Media Server";
+      enable = lib.mkEnableOption "Plex Media Server";
 
-      dataDir = mkOption {
-        type = types.str;
+      dataDir = lib.mkOption {
+        type = lib.types.str;
         default = "/var/lib/plex";
         description = ''
           The directory where Plex stores its data files.
         '';
       };
 
-      openFirewall = mkOption {
-        type = types.bool;
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Open ports in the firewall for the media server.
         '';
       };
 
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         default = "plex";
         description = ''
           User account under which Plex runs.
         '';
       };
 
-      group = mkOption {
-        type = types.str;
+      group = lib.mkOption {
+        type = lib.types.str;
         default = "plex";
         description = ''
           Group under which Plex runs.
         '';
       };
 
-      extraPlugins = mkOption {
-        type = types.listOf types.path;
+      extraPlugins = lib.mkOption {
+        type = lib.types.listOf lib.types.path;
         default = [];
         description = ''
           A list of paths to extra plugin bundles to install in Plex's plugin
@@ -55,7 +52,7 @@ in
           symlinks in Plex's plugin directory will be cleared and this module
           will symlink all of the paths specified here to that directory.
         '';
-        example = literalExpression ''
+        example = lib.literalExpression ''
           [
             (builtins.path {
               name = "Audnexus.bundle";
@@ -70,8 +67,8 @@ in
         '';
       };
 
-      extraScanners = mkOption {
-        type = types.listOf types.path;
+      extraScanners = lib.mkOption {
+        type = lib.types.listOf lib.types.path;
         default = [];
         description = ''
           A list of paths to extra scanners to install in Plex's scanners
@@ -81,7 +78,7 @@ in
           in Plex's scanners directory will be cleared and this module will
           symlink all of the paths specified here to that directory.
         '';
-        example = literalExpression ''
+        example = lib.literalExpression ''
           [
             (fetchFromGitHub {
               owner = "ZeroQI";
@@ -93,8 +90,8 @@ in
         '';
       };
 
-      accelerationDevices = mkOption {
-        type = types.listOf types.str;
+      accelerationDevices = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = ["*"];
         example = [ "/dev/dri/renderD128" ];
         description = ''
@@ -104,7 +101,7 @@ in
         '';
       };
 
-      package = mkPackageOption pkgs "plex" {
+      package = lib.mkPackageOption pkgs "plex" {
         extraDescription = ''
           Plex subscribers may wish to use their own package here,
           pointing to subscriber-only server versions.
@@ -113,7 +110,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     # Most of this is just copied from the RPM package's systemd service file.
     systemd.services.plex = {
       description = "Plex Media Server";
@@ -149,7 +146,7 @@ in
         NoNewPrivileges = true;
         PrivateTmp = true;
         PrivateDevices = cfg.accelerationDevices == [];
-        DeviceAllow = mkIf (cfg.accelerationDevices != [] && !lib.elem "*" cfg.accelerationDevices) cfg.accelerationDevices;
+        DeviceAllow = lib.mkIf (cfg.accelerationDevices != [] && !lib.elem "*" cfg.accelerationDevices) cfg.accelerationDevices;
         ProtectSystem = true;
         ProtectHome = true;
         ProtectControlGroups = true;
@@ -167,8 +164,8 @@ in
       environment = {
         # Configuration for our FHS userenv script
         PLEX_DATADIR=cfg.dataDir;
-        PLEX_PLUGINS=concatMapStringsSep ":" builtins.toString cfg.extraPlugins;
-        PLEX_SCANNERS=concatMapStringsSep ":" builtins.toString cfg.extraScanners;
+        PLEX_PLUGINS=lib.concatMapStringsSep ":" builtins.toString cfg.extraPlugins;
+        PLEX_SCANNERS=lib.concatMapStringsSep ":" builtins.toString cfg.extraScanners;
 
         # The following variables should be set by the FHS userenv script:
         #   PLEX_MEDIA_SERVER_APPLICATION_SUPPORT_DIR
@@ -186,19 +183,19 @@ in
       };
     };
 
-    networking.firewall = mkIf cfg.openFirewall {
+    networking.firewall = lib.mkIf cfg.openFirewall {
       allowedTCPPorts = [ 32400 3005 8324 32469 ];
       allowedUDPPorts = [ 1900 5353 32410 32412 32413 32414 ];
     };
 
-    users.users = mkIf (cfg.user == "plex") {
+    users.users = lib.mkIf (cfg.user == "plex") {
       plex = {
         group = cfg.group;
         uid = config.ids.uids.plex;
       };
     };
 
-    users.groups = mkIf (cfg.group == "plex") {
+    users.groups = lib.mkIf (cfg.group == "plex") {
       plex = {
         gid = config.ids.gids.plex;
       };
diff --git a/nixos/modules/services/misc/plikd.nix b/nixos/modules/services/misc/plikd.nix
index ec94cfc02979..477c1b413fd0 100644
--- a/nixos/modules/services/misc/plikd.nix
+++ b/nixos/modules/services/misc/plikd.nix
@@ -1,7 +1,4 @@
 { config, pkgs, lib, ... }:
-
-with lib;
-
 let
   cfg = config.services.plikd;
 
@@ -11,15 +8,15 @@ in
 {
   options = {
     services.plikd = {
-      enable = mkEnableOption "plikd, a temporary file upload system";
+      enable = lib.mkEnableOption "plikd, a temporary file upload system";
 
-      openFirewall = mkOption {
-        type = types.bool;
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Open ports in the firewall for the plikd.";
       };
 
-      settings = mkOption {
+      settings = lib.mkOption {
         type = format.type;
         default = {};
         description = ''
@@ -30,8 +27,8 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
-    services.plikd.settings = mapAttrs (name: mkDefault) {
+  config = lib.mkIf cfg.enable {
+    services.plikd.settings = lib.mapAttrs (name: lib.mkDefault) {
       ListenPort = 8080;
       ListenAddress = "localhost";
       DataBackend = "file";
@@ -75,7 +72,7 @@ in
       };
     };
 
-    networking.firewall = mkIf cfg.openFirewall {
+    networking.firewall = lib.mkIf cfg.openFirewall {
       allowedTCPPorts = [ cfg.settings.ListenPort ];
     };
   };
diff --git a/nixos/modules/services/misc/polaris.nix b/nixos/modules/services/misc/polaris.nix
index 4ac99eaad384..70c478d193e9 100644
--- a/nixos/modules/services/misc/polaris.nix
+++ b/nixos/modules/services/misc/polaris.nix
@@ -2,8 +2,6 @@
 , pkgs
 , lib
 , ...}:
-
-with lib;
 let
   cfg = config.services.polaris;
   settingsFormat = pkgs.formats.toml {};
@@ -11,31 +9,31 @@ in
 {
   options = {
     services.polaris = {
-      enable = mkEnableOption "Polaris Music Server";
+      enable = lib.mkEnableOption "Polaris Music Server";
 
-      package = mkPackageOption pkgs "polaris" { };
+      package = lib.mkPackageOption pkgs "polaris" { };
 
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         default = "polaris";
         description = "User account under which Polaris runs.";
       };
 
-      group = mkOption {
-        type = types.str;
+      group = lib.mkOption {
+        type = lib.types.str;
         default = "polaris";
         description = "Group under which Polaris is run.";
       };
 
-      extraGroups = mkOption {
-        type = types.listOf types.str;
+      extraGroups = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [];
         description = "Polaris' auxiliary groups.";
-        example = literalExpression ''["media" "music"]'';
+        example = lib.literalExpression ''["media" "music"]'';
       };
 
-      port = mkOption {
-        type = types.port;
+      port = lib.mkOption {
+        type = lib.types.port;
         default = 5050;
         description = ''
           The port which the Polaris REST api and web UI should listen to.
@@ -43,7 +41,7 @@ in
         '';
       };
 
-      settings = mkOption {
+      settings = lib.mkOption {
         type = settingsFormat.type;
         default = {};
         description = ''
@@ -51,7 +49,7 @@ in
           Although poorly documented, an example may be found here:
           [test-config.toml](https://github.com/agersant/polaris/blob/374d0ca56fc0a466d797a4b252e2078607476797/test-data/config.toml)
         '';
-        example = literalExpression ''
+        example = lib.literalExpression ''
           {
             settings.reindex_every_n_seconds = 7*24*60*60; # weekly, default is 1800
             settings.album_art_pattern =
@@ -70,8 +68,8 @@ in
         '';
       };
 
-      openFirewall = mkOption {
-        type = types.bool;
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Open the configured port in the firewall.
@@ -80,7 +78,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.polaris = {
       description = "Polaris Music Server";
       after = [ "network.target" ];
@@ -93,13 +91,13 @@ in
         SupplementaryGroups = cfg.extraGroups;
         StateDirectory = "polaris";
         CacheDirectory = "polaris";
-        ExecStart = escapeShellArgs ([
+        ExecStart = lib.escapeShellArgs ([
           "${cfg.package}/bin/polaris"
           "--foreground"
           "--port" cfg.port
           "--database" "/var/lib/${StateDirectory}/db.sqlite"
           "--cache" "/var/cache/${CacheDirectory}"
-        ] ++ optionals (cfg.settings != {}) [
+        ] ++ lib.optionals (cfg.settings != {}) [
           "--config" (settingsFormat.generate "polaris-config.toml" cfg.settings)
         ]);
         Restart = "on-failure";
@@ -141,11 +139,11 @@ in
       };
     };
 
-    networking.firewall = mkIf cfg.openFirewall {
+    networking.firewall = lib.mkIf cfg.openFirewall {
       allowedTCPPorts = [ cfg.port ];
     };
 
   };
 
-  meta.maintainers = with maintainers; [ pbsds ];
+  meta.maintainers = with lib.maintainers; [ pbsds ];
 }
diff --git a/nixos/modules/services/misc/preload.nix b/nixos/modules/services/misc/preload.nix
index d26e2c3d383e..4dadd0e26b16 100644
--- a/nixos/modules/services/misc/preload.nix
+++ b/nixos/modules/services/misc/preload.nix
@@ -1,25 +1,22 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.preload;
 in {
   meta = { maintainers = pkgs.preload.meta.maintainers; };
 
   options.services.preload = {
-    enable = mkEnableOption "preload";
-    package = mkPackageOption pkgs "preload" { };
+    enable = lib.mkEnableOption "preload";
+    package = lib.mkPackageOption pkgs "preload" { };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.preload = {
       description = "Loads data into ram during idle time of CPU.";
       wantedBy = [ "multi-user.target" ];
 
       serviceConfig = {
         EnvironmentFile = "${cfg.package}/etc/conf.d/preload";
-        ExecStart = "${getExe cfg.package} -l '' --foreground $PRELOAD_OPTS";
+        ExecStart = "${lib.getExe cfg.package} -l '' --foreground $PRELOAD_OPTS";
         Type = "simple";
         # Only preload data during CPU idle time
         IOSchedulingClass = 3;
diff --git a/nixos/modules/services/misc/prowlarr.nix b/nixos/modules/services/misc/prowlarr.nix
index e37f0dc36d14..906f75516abd 100644
--- a/nixos/modules/services/misc/prowlarr.nix
+++ b/nixos/modules/services/misc/prowlarr.nix
@@ -1,7 +1,4 @@
 { config, pkgs, lib, ... }:
-
-with lib;
-
 let
   cfg = config.services.prowlarr;
 
@@ -9,19 +6,19 @@ in
 {
   options = {
     services.prowlarr = {
-      enable = mkEnableOption "Prowlarr, an indexer manager/proxy for Torrent trackers and Usenet indexers";
+      enable = lib.mkEnableOption "Prowlarr, an indexer manager/proxy for Torrent trackers and Usenet indexers";
 
-      package = mkPackageOption pkgs "prowlarr" { };
+      package = lib.mkPackageOption pkgs "prowlarr" { };
 
-      openFirewall = mkOption {
-        type = types.bool;
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Open ports in the firewall for the Prowlarr web interface.";
       };
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.prowlarr = {
       description = "Prowlarr";
       after = [ "network.target" ];
@@ -37,7 +34,7 @@ in
       environment.HOME = "/var/empty";
     };
 
-    networking.firewall = mkIf cfg.openFirewall {
+    networking.firewall = lib.mkIf cfg.openFirewall {
       allowedTCPPorts = [ 9696 ];
     };
   };
diff --git a/nixos/modules/services/misc/pykms.nix b/nixos/modules/services/misc/pykms.nix
index d1b209e38932..5bdb0bd52c0f 100644
--- a/nixos/modules/services/misc/pykms.nix
+++ b/nixos/modules/services/misc/pykms.nix
@@ -1,6 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
 let
   cfg = config.services.pykms;
   libDir = "/var/lib/pykms";
@@ -10,56 +8,56 @@ in
   meta.maintainers = with lib.maintainers; [ peterhoeg ];
 
   imports = [
-    (mkRemovedOptionModule [ "services" "pykms" "verbose" ] "Use services.pykms.logLevel instead")
+    (lib.mkRemovedOptionModule [ "services" "pykms" "verbose" ] "Use services.pykms.logLevel instead")
   ];
 
   options = {
     services.pykms = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Whether to enable the PyKMS service.";
       };
 
-      listenAddress = mkOption {
-        type = types.str;
+      listenAddress = lib.mkOption {
+        type = lib.types.str;
         default = "0.0.0.0";
         description = "The IP address on which to listen.";
       };
 
-      port = mkOption {
-        type = types.port;
+      port = lib.mkOption {
+        type = lib.types.port;
         default = 1688;
         description = "The port on which to listen.";
       };
 
-      openFirewallPort = mkOption {
-        type = types.bool;
+      openFirewallPort = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Whether the listening port should be opened automatically.";
       };
 
-      memoryLimit = mkOption {
-        type = types.str;
+      memoryLimit = lib.mkOption {
+        type = lib.types.str;
         default = "64M";
         description = "How much memory to use at most.";
       };
 
-      logLevel = mkOption {
-        type = types.enum [ "CRITICAL" "ERROR" "WARNING" "INFO" "DEBUG" "MININFO" ];
+      logLevel = lib.mkOption {
+        type = lib.types.enum [ "CRITICAL" "ERROR" "WARNING" "INFO" "DEBUG" "MININFO" ];
         default = "INFO";
         description = "How much to log";
       };
 
-      extraArgs = mkOption {
-        type = types.listOf types.str;
+      extraArgs = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [ ];
         description = "Additional arguments";
       };
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewallPort [ cfg.port ];
 
     systemd.services.pykms = {
diff --git a/nixos/modules/services/misc/radarr.nix b/nixos/modules/services/misc/radarr.nix
index d9f78c4e8ee6..54c6e9577b31 100644
--- a/nixos/modules/services/misc/radarr.nix
+++ b/nixos/modules/services/misc/radarr.nix
@@ -1,7 +1,4 @@
 { config, pkgs, lib, ... }:
-
-with lib;
-
 let
   cfg = config.services.radarr;
 
@@ -9,37 +6,37 @@ in
 {
   options = {
     services.radarr = {
-      enable = mkEnableOption "Radarr, a UsetNet/BitTorrent movie downloader";
+      enable = lib.mkEnableOption "Radarr, a UsetNet/BitTorrent movie downloader";
 
-      package = mkPackageOption pkgs "radarr" { };
+      package = lib.mkPackageOption pkgs "radarr" { };
 
-      dataDir = mkOption {
-        type = types.str;
+      dataDir = lib.mkOption {
+        type = lib.types.str;
         default = "/var/lib/radarr/.config/Radarr";
         description = "The directory where Radarr stores its data files.";
       };
 
-      openFirewall = mkOption {
-        type = types.bool;
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Open ports in the firewall for the Radarr web interface.";
       };
 
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         default = "radarr";
         description = "User account under which Radarr runs.";
       };
 
-      group = mkOption {
-        type = types.str;
+      group = lib.mkOption {
+        type = lib.types.str;
         default = "radarr";
         description = "Group under which Radarr runs.";
       };
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.tmpfiles.settings."10-radarr".${cfg.dataDir}.d = {
       inherit (cfg) user group;
       mode = "0700";
@@ -59,11 +56,11 @@ in
       };
     };
 
-    networking.firewall = mkIf cfg.openFirewall {
+    networking.firewall = lib.mkIf cfg.openFirewall {
       allowedTCPPorts = [ 7878 ];
     };
 
-    users.users = mkIf (cfg.user == "radarr") {
+    users.users = lib.mkIf (cfg.user == "radarr") {
       radarr = {
         group = cfg.group;
         home = cfg.dataDir;
@@ -71,7 +68,7 @@ in
       };
     };
 
-    users.groups = mkIf (cfg.group == "radarr") {
+    users.groups = lib.mkIf (cfg.group == "radarr") {
       radarr.gid = config.ids.gids.radarr;
     };
   };
diff --git a/nixos/modules/services/misc/readarr.nix b/nixos/modules/services/misc/readarr.nix
index b76a70859f75..15f1bde2cdfc 100644
--- a/nixos/modules/services/misc/readarr.nix
+++ b/nixos/modules/services/misc/readarr.nix
@@ -1,41 +1,38 @@
 { config, pkgs, lib, ... }:
-
-with lib;
-
 let
   cfg = config.services.readarr;
 in
 {
   options = {
     services.readarr = {
-      enable = mkEnableOption "Readarr, a Usenet/BitTorrent ebook downloader";
+      enable = lib.mkEnableOption "Readarr, a Usenet/BitTorrent ebook downloader";
 
-      dataDir = mkOption {
-        type = types.str;
+      dataDir = lib.mkOption {
+        type = lib.types.str;
         default = "/var/lib/readarr/";
         description = "The directory where Readarr stores its data files.";
       };
 
-      package = mkPackageOption pkgs "readarr" { };
+      package = lib.mkPackageOption pkgs "readarr" { };
 
-      openFirewall = mkOption {
-        type = types.bool;
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Open ports in the firewall for Readarr
         '';
       };
 
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         default = "readarr";
         description = ''
           User account under which Readarr runs.
         '';
       };
 
-      group = mkOption {
-        type = types.str;
+      group = lib.mkOption {
+        type = lib.types.str;
         default = "readarr";
         description = ''
           Group under which Readarr runs.
@@ -44,7 +41,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.tmpfiles.settings."10-readarr".${cfg.dataDir}.d = {
       inherit (cfg) user group;
       mode = "0700";
@@ -64,11 +61,11 @@ in
       };
     };
 
-    networking.firewall = mkIf cfg.openFirewall {
+    networking.firewall = lib.mkIf cfg.openFirewall {
       allowedTCPPorts = [ 8787 ];
     };
 
-    users.users = mkIf (cfg.user == "readarr") {
+    users.users = lib.mkIf (cfg.user == "readarr") {
       readarr = {
         description = "Readarr service";
         home = cfg.dataDir;
@@ -77,7 +74,7 @@ in
       };
     };
 
-    users.groups = mkIf (cfg.group == "readarr") {
+    users.groups = lib.mkIf (cfg.group == "readarr") {
       readarr = { };
     };
   };
diff --git a/nixos/modules/services/misc/renovate.nix b/nixos/modules/services/misc/renovate.nix
index 9fbd8ec9e1ac..18a0e817b9d7 100644
--- a/nixos/modules/services/misc/renovate.nix
+++ b/nixos/modules/services/misc/renovate.nix
@@ -104,7 +104,6 @@ in
         Group = "renovate";
         DynamicUser = true;
         LoadCredential = lib.mapAttrsToList (name: value: "SECRET-${name}:${value}") cfg.credentials;
-        Restart = "on-failure";
         CacheDirectory = "renovate";
         StateDirectory = "renovate";
 
diff --git a/nixos/modules/services/misc/ripple-data-api.nix b/nixos/modules/services/misc/ripple-data-api.nix
index a699ce95cf0e..e01e891c95a8 100644
--- a/nixos/modules/services/misc/ripple-data-api.nix
+++ b/nixos/modules/services/misc/ripple-data-api.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.rippleDataApi;
 
@@ -23,8 +20,8 @@ let
 
   db_config = builtins.toJSON {
     production = {
-      username = optional (cfg.couchdb.pass != "") cfg.couchdb.user;
-      password = optional (cfg.couchdb.pass != "") cfg.couchdb.pass;
+      username = lib.optional (cfg.couchdb.pass != "") cfg.couchdb.user;
+      password = lib.optional (cfg.couchdb.pass != "") cfg.couchdb.pass;
       host = cfg.couchdb.host;
       port = cfg.couchdb.port;
       database = cfg.couchdb.db;
@@ -35,105 +32,105 @@ let
 in {
   options = {
     services.rippleDataApi = {
-      enable = mkEnableOption "ripple data api";
+      enable = lib.mkEnableOption "ripple data api";
 
-      port = mkOption {
+      port = lib.mkOption {
         description = "Ripple data api port";
         default = 5993;
-        type = types.port;
+        type = lib.types.port;
       };
 
-      importMode = mkOption {
+      importMode = lib.mkOption {
         description = "Ripple data api import mode.";
         default = "liveOnly";
-        type = types.enum ["live" "liveOnly"];
+        type = lib.types.enum ["live" "liveOnly"];
       };
 
-      minLedger = mkOption {
+      minLedger = lib.mkOption {
         description = "Ripple data api minimal ledger to fetch.";
         default = null;
-        type = types.nullOr types.int;
+        type = lib.types.nullOr lib.types.int;
       };
 
-      maxLedger = mkOption {
+      maxLedger = lib.mkOption {
         description = "Ripple data api maximal ledger to fetch.";
         default = null;
-        type = types.nullOr types.int;
+        type = lib.types.nullOr lib.types.int;
       };
 
       redis = {
-        enable = mkOption {
+        enable = lib.mkOption {
           description = "Whether to enable caching of ripple data to redis.";
           default = true;
-          type = types.bool;
+          type = lib.types.bool;
         };
 
-        host = mkOption {
+        host = lib.mkOption {
           description = "Ripple data api redis host.";
           default = "localhost";
-          type = types.str;
+          type = lib.types.str;
         };
 
-        port = mkOption {
+        port = lib.mkOption {
           description = "Ripple data api redis port.";
           default = 5984;
-          type = types.port;
+          type = lib.types.port;
         };
       };
 
       couchdb = {
-        host = mkOption {
+        host = lib.mkOption {
           description = "Ripple data api couchdb host.";
           default = "localhost";
-          type = types.str;
+          type = lib.types.str;
         };
 
-        port = mkOption {
+        port = lib.mkOption {
           description = "Ripple data api couchdb port.";
           default = 5984;
-          type = types.port;
+          type = lib.types.port;
         };
 
-        db = mkOption {
+        db = lib.mkOption {
           description = "Ripple data api couchdb database.";
           default = "rippled";
-          type = types.str;
+          type = lib.types.str;
         };
 
-        user = mkOption {
+        user = lib.mkOption {
           description = "Ripple data api couchdb username.";
           default = "rippled";
-          type = types.str;
+          type = lib.types.str;
         };
 
-        pass = mkOption {
+        pass = lib.mkOption {
           description = "Ripple data api couchdb password.";
           default = "";
-          type = types.str;
+          type = lib.types.str;
         };
 
-        create = mkOption {
+        create = lib.mkOption {
           description = "Whether to create couchdb database needed by ripple data api.";
-          type = types.bool;
+          type = lib.types.bool;
           default = true;
         };
       };
 
-      rippleds = mkOption {
+      rippleds = lib.mkOption {
         description = "List of rippleds to be used by ripple data api.";
         default = [
           "http://s_east.ripple.com:51234"
           "http://s_west.ripple.com:51234"
         ];
-        type = types.listOf types.str;
+        type = lib.types.listOf lib.types.str;
       };
     };
   };
 
-  config = mkIf (cfg.enable) {
-    services.couchdb.enable = mkDefault true;
-    services.couchdb.bindAddress = mkDefault "0.0.0.0";
-    services.redis.enable = mkDefault true;
+  config = lib.mkIf (cfg.enable) {
+    services.couchdb.enable = lib.mkDefault true;
+    services.couchdb.bindAddress = lib.mkDefault "0.0.0.0";
+    services.redis.enable = lib.mkDefault true;
 
     systemd.services.ripple-data-api = {
       after = [ "couchdb.service" "redis.service" "ripple-data-api-importer.service" ];
@@ -176,9 +173,9 @@ in {
         User = "ripple-data-api";
       };
 
-      preStart = mkMerge [
-        (mkIf (cfg.couchdb.create) ''
-          HOST="http://${optionalString (cfg.couchdb.pass != "") "${cfg.couchdb.user}:${cfg.couchdb.pass}@"}${cfg.couchdb.host}:${toString cfg.couchdb.port}"
+      preStart = lib.mkMerge [
+        (lib.mkIf (cfg.couchdb.create) ''
+          HOST="http://${lib.optionalString (cfg.couchdb.pass != "") "${cfg.couchdb.user}:${cfg.couchdb.pass}@"}${cfg.couchdb.host}:${toString cfg.couchdb.port}"
           curl -X PUT $HOST/${cfg.couchdb.db} || true
         '')
         "${pkgs.ripple-data-api}/bin/update-views"
diff --git a/nixos/modules/services/misc/rkvm.nix b/nixos/modules/services/misc/rkvm.nix
index ac747253635e..805b2923bb0f 100644
--- a/nixos/modules/services/misc/rkvm.nix
+++ b/nixos/modules/services/misc/rkvm.nix
@@ -1,6 +1,4 @@
 { options, config, pkgs, lib, ... }:
-
-with lib;
 let
   opt = options.services.rkvm;
   cfg = config.services.rkvm;
@@ -10,35 +8,35 @@ in
   meta.maintainers = [ ];
 
   options.services.rkvm = {
-    enable = mkOption {
+    enable = lib.mkOption {
       default = cfg.server.enable || cfg.client.enable;
-      defaultText = literalExpression "config.${opt.server.enable} || config.${opt.client.enable}";
-      type = types.bool;
+      defaultText = lib.literalExpression "config.${opt.server.enable} || config.${opt.client.enable}";
+      type = lib.types.bool;
       description = ''
         Whether to enable rkvm, a Virtual KVM switch for Linux machines.
       '';
     };
 
-    package = mkPackageOption pkgs "rkvm" { };
+    package = lib.mkPackageOption pkgs "rkvm" { };
 
     server = {
-      enable = mkEnableOption "the rkvm server daemon (input transmitter)";
+      enable = lib.mkEnableOption "the rkvm server daemon (input transmitter)";
 
-      settings = mkOption {
-        type = types.submodule
+      settings = lib.mkOption {
+        type = lib.types.submodule
           {
             freeformType = toml.type;
             options = {
-              listen = mkOption {
-                type = types.str;
+              listen = lib.mkOption {
+                type = lib.types.str;
                 default = "0.0.0.0:5258";
                 description = ''
                   An internet socket address to listen on, either IPv4 or IPv6.
                 '';
               };
 
-              switch-keys = mkOption {
-                type = types.listOf types.str;
+              switch-keys = lib.mkOption {
+                type = lib.types.listOf lib.types.str;
                 default = [ "left-alt" "left-ctrl" ];
                 description = ''
                   A key list specifying a host switch combination.
@@ -47,8 +45,8 @@ in
                 '';
               };
 
-              certificate = mkOption {
-                type = types.path;
+              certificate = lib.mkOption {
+                type = lib.types.path;
                 default = "/etc/rkvm/certificate.pem";
                 description = ''
                   TLS certificate path.
@@ -59,8 +57,8 @@ in
                 '';
               };
 
-              key = mkOption {
-                type = types.path;
+              key = lib.mkOption {
+                type = lib.types.path;
                 default = "/etc/rkvm/key.pem";
                 description = ''
                   TLS key path.
@@ -71,8 +69,8 @@ in
                 '';
               };
 
-              password = mkOption {
-                type = types.str;
+              password = lib.mkOption {
+                type = lib.types.str;
                 description = ''
                   Shared secret token to authenticate the client.
                   Make sure this matches your client's config.
@@ -87,23 +85,23 @@ in
     };
 
     client = {
-      enable = mkEnableOption "the rkvm client daemon (input receiver)";
+      enable = lib.mkEnableOption "the rkvm client daemon (input receiver)";
 
-      settings = mkOption {
-        type = types.submodule
+      settings = lib.mkOption {
+        type = lib.types.submodule
           {
             freeformType = toml.type;
             options = {
-              server = mkOption {
-                type = types.str;
+              server = lib.mkOption {
+                type = lib.types.str;
                 example = "192.168.0.123:5258";
                 description = ''
                   An RKVM server's internet socket address, either IPv4 or IPv6.
                 '';
               };
 
-              certificate = mkOption {
-                type = types.path;
+              certificate = lib.mkOption {
+                type = lib.types.path;
                 default = "/etc/rkvm/certificate.pem";
                 description = ''
                   TLS ceritficate path.
@@ -114,8 +112,8 @@ in
                 '';
               };
 
-              password = mkOption {
-                type = types.str;
+              password = lib.mkOption {
+                type = lib.types.str;
                 description = ''
                   Shared secret token to authenticate the client.
                   Make sure this matches your server's config.
@@ -131,7 +129,7 @@ in
 
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     environment.systemPackages = [ cfg.package ];
 
     systemd.services =
@@ -156,8 +154,8 @@ in
         };
       in
       {
-        rkvm-server = mkIf cfg.server.enable (mkBase "server");
-        rkvm-client = mkIf cfg.client.enable (mkBase "client");
+        rkvm-server = lib.mkIf cfg.server.enable (mkBase "server");
+        rkvm-client = lib.mkIf cfg.client.enable (mkBase "client");
       };
   };
 
diff --git a/nixos/modules/services/misc/rmfakecloud.nix b/nixos/modules/services/misc/rmfakecloud.nix
index d19a9969a3ff..b1f81c10b9a4 100644
--- a/nixos/modules/services/misc/rmfakecloud.nix
+++ b/nixos/modules/services/misc/rmfakecloud.nix
@@ -4,9 +4,6 @@
   pkgs,
   ...
 }:
-
-with lib;
-
 let
   cfg = config.services.rmfakecloud;
   serviceDataDir = "/var/lib/rmfakecloud";
@@ -15,28 +12,28 @@ in
 {
   options = {
     services.rmfakecloud = {
-      enable = mkEnableOption "rmfakecloud remarkable self-hosted cloud";
+      enable = lib.mkEnableOption "rmfakecloud remarkable self-hosted cloud";
 
-      package = mkPackageOption pkgs "rmfakecloud" { };
+      package = lib.mkPackageOption pkgs "rmfakecloud" { };
 
-      storageUrl = mkOption {
-        type = types.str;
+      storageUrl = lib.mkOption {
+        type = lib.types.str;
         example = "https://local.appspot.com";
         description = ''
           URL used by the tablet to access the rmfakecloud service.
         '';
       };
 
-      port = mkOption {
-        type = types.port;
+      port = lib.mkOption {
+        type = lib.types.port;
         default = 3000;
         description = ''
           Listening port number.
         '';
       };
 
-      logLevel = mkOption {
-        type = types.enum [
+      logLevel = lib.mkOption {
+        type = lib.types.enum [
           "info"
           "debug"
           "warn"
@@ -48,8 +45,8 @@ in
         '';
       };
 
-      extraSettings = mkOption {
-        type = with types; attrsOf str;
+      extraSettings = lib.mkOption {
+        type = with lib.types; attrsOf str;
         default = { };
         example = {
           DATADIR = "/custom/path/for/rmfakecloud/data";
@@ -63,8 +60,8 @@ in
         '';
       };
 
-      environmentFile = mkOption {
-        type = with types; nullOr path;
+      environmentFile = lib.mkOption {
+        type = with lib.types; nullOr path;
         default = null;
         example = "/etc/secrets/rmfakecloud.env";
         description = ''
@@ -78,7 +75,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.rmfakecloud = {
       description = "rmfakecloud remarkable self-hosted cloud";
 
@@ -113,9 +110,9 @@ in
         Type = "simple";
         Restart = "always";
 
-        EnvironmentFile = mkIf (cfg.environmentFile != null) cfg.environmentFile;
+        EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
 
-        AmbientCapabilities = mkIf (cfg.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
+        AmbientCapabilities = lib.mkIf (cfg.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
 
         DynamicUser = true;
         PrivateDevices = true;
@@ -148,5 +145,5 @@ in
     };
   };
 
-  meta.maintainers = with maintainers; [ pacien ];
+  meta.maintainers = with lib.maintainers; [ pacien ];
 }
diff --git a/nixos/modules/services/misc/safeeyes.nix b/nixos/modules/services/misc/safeeyes.nix
index 38970fd77527..1d225e4b39d9 100644
--- a/nixos/modules/services/misc/safeeyes.nix
+++ b/nixos/modules/services/misc/safeeyes.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
 
   cfg = config.services.safeeyes;
@@ -16,7 +13,7 @@ in
 
     services.safeeyes = {
 
-      enable = mkEnableOption "the safeeyes OSGi service";
+      enable = lib.mkEnableOption "the safeeyes OSGi service";
 
     };
 
@@ -24,7 +21,7 @@ in
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     environment.systemPackages = [ pkgs.safeeyes ];
 
diff --git a/nixos/modules/services/misc/sdrplay.nix b/nixos/modules/services/misc/sdrplay.nix
index d56b1e4124d6..83b709a340a8 100644
--- a/nixos/modules/services/misc/sdrplay.nix
+++ b/nixos/modules/services/misc/sdrplay.nix
@@ -1,8 +1,7 @@
 { config, lib, pkgs, ... }:
-with lib;
 {
   options.services.sdrplayApi = {
-    enable = mkOption {
+    enable = lib.mkOption {
       default = false;
       example = true;
       description = ''
@@ -17,7 +16,7 @@ with lib;
     };
   };
 
-  config = mkIf config.services.sdrplayApi.enable {
+  config = lib.mkIf config.services.sdrplayApi.enable {
     systemd.services.sdrplayApi = {
       description = "SDRplay API Service";
       after = [ "network.target" ];
diff --git a/nixos/modules/services/misc/serviio.nix b/nixos/modules/services/misc/serviio.nix
index a9449e54f5b0..60b6113c5e09 100644
--- a/nixos/modules/services/misc/serviio.nix
+++ b/nixos/modules/services/misc/serviio.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
 
   cfg = config.services.serviio;
@@ -28,16 +25,16 @@ in {
   options = {
     services.serviio = {
 
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to enable the Serviio Media Server.
         '';
       };
 
-      dataDir = mkOption {
-        type = types.path;
+      dataDir = lib.mkOption {
+        type = lib.types.path;
         default = "/var/lib/serviio";
         description = ''
           The directory where serviio stores its state, data, etc.
@@ -49,7 +46,7 @@ in {
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.serviio = {
       description = "Serviio Media Server";
       after = [ "network.target" ];
diff --git a/nixos/modules/services/misc/sickbeard.nix b/nixos/modules/services/misc/sickbeard.nix
index 51179fdb14d3..237abf7185a3 100644
--- a/nixos/modules/services/misc/sickbeard.nix
+++ b/nixos/modules/services/misc/sickbeard.nix
@@ -1,7 +1,4 @@
 { config, lib, options, pkgs, ... }:
-
-with lib;
-
 let
 
   name = "sickbeard";
@@ -17,41 +14,41 @@ in
 
   options = {
     services.sickbeard = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Whether to enable the sickbeard server.";
       };
-      package = mkPackageOption pkgs "sickbeard" {
+      package = lib.mkPackageOption pkgs "sickbeard" {
         example = "sickrage";
         extraDescription = ''
           Enable `pkgs.sickrage` or `pkgs.sickgear`
           as an alternative to SickBeard
         '';
       };
-      dataDir = mkOption {
-        type = types.path;
+      dataDir = lib.mkOption {
+        type = lib.types.path;
         default = "/var/lib/${name}";
         description = "Path where to store data files.";
       };
-      configFile = mkOption {
-        type = types.path;
+      configFile = lib.mkOption {
+        type = lib.types.path;
         default = "${cfg.dataDir}/config.ini";
-        defaultText = literalExpression ''"''${config.${opt.dataDir}}/config.ini"'';
+        defaultText = lib.literalExpression ''"''${config.${opt.dataDir}}/config.ini"'';
         description = "Path to config file.";
       };
-      port = mkOption {
-        type = types.ints.u16;
+      port = lib.mkOption {
+        type = lib.types.ints.u16;
         default = 8081;
         description = "Port to bind to.";
       };
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         default = name;
         description = "User to run the service as";
       };
-      group = mkOption {
-        type = types.str;
+      group = lib.mkOption {
+        type = lib.types.str;
         default = name;
         description = "Group to run the service as";
       };
@@ -61,9 +58,9 @@ in
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
-    users.users = optionalAttrs (cfg.user == name) {
+    users.users = lib.optionalAttrs (cfg.user == name) {
       ${name} = {
         uid = config.ids.uids.sickbeard;
         group = cfg.group;
@@ -73,7 +70,7 @@ in
       };
     };
 
-    users.groups = optionalAttrs (cfg.group == name) {
+    users.groups = lib.optionalAttrs (cfg.group == name) {
       ${name}.gid = config.ids.gids.sickbeard;
     };
 
diff --git a/nixos/modules/services/misc/signald.nix b/nixos/modules/services/misc/signald.nix
index 45cf1434882f..bd60c8b98947 100644
--- a/nixos/modules/services/misc/signald.nix
+++ b/nixos/modules/services/misc/signald.nix
@@ -1,6 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
 let
   cfg = config.services.signald;
   dataDir = "/var/lib/signald";
@@ -8,36 +6,36 @@ let
 in
 {
   options.services.signald = {
-    enable = mkEnableOption "signald, the unofficial daemon for interacting with Signal";
+    enable = lib.mkEnableOption "signald, the unofficial daemon for interacting with Signal";
 
-    user = mkOption {
-      type = types.str;
+    user = lib.mkOption {
+      type = lib.types.str;
       default = defaultUser;
       description = "User under which signald runs.";
     };
 
-    group = mkOption {
-      type = types.str;
+    group = lib.mkOption {
+      type = lib.types.str;
       default = defaultUser;
       description = "Group under which signald runs.";
     };
 
-    socketPath = mkOption {
-      type = types.str;
+    socketPath = lib.mkOption {
+      type = lib.types.str;
       default = "/run/signald/signald.sock";
       description = "Path to the signald socket";
     };
   };
 
-  config = mkIf cfg.enable {
-    users.users = optionalAttrs (cfg.user == defaultUser) {
+  config = lib.mkIf cfg.enable {
+    users.users = lib.optionalAttrs (cfg.user == defaultUser) {
       ${defaultUser} = {
         group = cfg.group;
         isSystemUser = true;
       };
     };
 
-    users.groups = optionalAttrs (cfg.group == defaultUser) {
+    users.groups = lib.optionalAttrs (cfg.group == defaultUser) {
       ${defaultUser} = { };
     };
 
diff --git a/nixos/modules/services/misc/siproxd.nix b/nixos/modules/services/misc/siproxd.nix
index bedc91e3b43c..f941ded12395 100644
--- a/nixos/modules/services/misc/siproxd.nix
+++ b/nixos/modules/services/misc/siproxd.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
 
   cfg = config.services.siproxd;
@@ -17,10 +14,10 @@ let
     rtp_port_high   = ${toString cfg.rtpPortHigh}
     rtp_dscp        = ${toString cfg.rtpDscp}
     sip_dscp        = ${toString cfg.sipDscp}
-    ${optionalString (cfg.hostsAllowReg != []) "hosts_allow_reg = ${concatStringsSep "," cfg.hostsAllowReg}"}
-    ${optionalString (cfg.hostsAllowSip != []) "hosts_allow_sip = ${concatStringsSep "," cfg.hostsAllowSip}"}
-    ${optionalString (cfg.hostsDenySip != []) "hosts_deny_sip  = ${concatStringsSep "," cfg.hostsDenySip}"}
-    ${optionalString (cfg.passwordFile != "") "proxy_auth_pwfile = ${cfg.passwordFile}"}
+    ${lib.optionalString (cfg.hostsAllowReg != []) "hosts_allow_reg = ${lib.concatStringsSep "," cfg.hostsAllowReg}"}
+    ${lib.optionalString (cfg.hostsAllowSip != []) "hosts_allow_sip = ${lib.concatStringsSep "," cfg.hostsAllowSip}"}
+    ${lib.optionalString (cfg.hostsDenySip != []) "hosts_deny_sip  = ${lib.concatStringsSep "," cfg.hostsDenySip}"}
+    ${lib.optionalString (cfg.passwordFile != "") "proxy_auth_pwfile = ${cfg.passwordFile}"}
     ${cfg.extraConfig}
   '';
 
@@ -34,8 +31,8 @@ in
 
     services.siproxd = {
 
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to enable the Siproxd SIP
@@ -43,20 +40,20 @@ in
         '';
       };
 
-      ifInbound = mkOption {
-        type = types.str;
+      ifInbound = lib.mkOption {
+        type = lib.types.str;
         example = "eth0";
         description = "Local network interface";
       };
 
-      ifOutbound = mkOption {
-        type = types.str;
+      ifOutbound = lib.mkOption {
+        type = lib.types.str;
         example = "ppp0";
         description = "Public network interface";
       };
 
-      hostsAllowReg = mkOption {
-        type = types.listOf types.str;
+      hostsAllowReg = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [ ];
         example = [ "192.168.1.0/24" "192.168.2.0/24" ];
         description = ''
@@ -64,8 +61,8 @@ in
         '';
       };
 
-      hostsAllowSip = mkOption {
-        type = types.listOf types.str;
+      hostsAllowSip = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [ ];
         example = [ "123.45.0.0/16" "123.46.0.0/16" ];
         description = ''
@@ -73,8 +70,8 @@ in
         '';
       };
 
-      hostsDenySip = mkOption {
-        type = types.listOf types.str;
+      hostsDenySip = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [ ];
         example = [ "10.0.0.0/8" "11.0.0.0/8" ];
         description = ''
@@ -83,32 +80,32 @@ in
         '';
       };
 
-      sipListenPort = mkOption {
-        type = types.int;
+      sipListenPort = lib.mkOption {
+        type = lib.types.int;
         default = 5060;
         description = ''
           Port to listen for incoming SIP messages.
         '';
       };
 
-      rtpPortLow = mkOption {
-        type = types.int;
+      rtpPortLow = lib.mkOption {
+        type = lib.types.int;
         default = 7070;
         description = ''
          Bottom of UDP port range for incoming and outgoing RTP traffic
         '';
       };
 
-      rtpPortHigh = mkOption {
-        type = types.int;
+      rtpPortHigh = lib.mkOption {
+        type = lib.types.int;
         default = 7089;
         description = ''
          Top of UDP port range for incoming and outgoing RTP traffic
         '';
       };
 
-      rtpTimeout = mkOption {
-        type = types.int;
+      rtpTimeout = lib.mkOption {
+        type = lib.types.int;
         default = 300;
         description = ''
           Timeout for an RTP stream. If for the specified
@@ -117,8 +114,8 @@ in
         '';
       };
 
-      rtpDscp = mkOption {
-        type = types.int;
+      rtpDscp = lib.mkOption {
+        type = lib.types.int;
         default = 46;
         description = ''
           DSCP (differentiated services) value to be assigned
@@ -127,8 +124,8 @@ in
         '';
       };
 
-      sipDscp = mkOption {
-        type = types.int;
+      sipDscp = lib.mkOption {
+        type = lib.types.int;
         default = 0;
         description = ''
           DSCP (differentiated services) value to be assigned
@@ -137,16 +134,16 @@ in
         '';
       };
 
-      passwordFile = mkOption {
-        type = types.str;
+      passwordFile = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = ''
           Path to per-user password file.
         '';
       };
 
-      extraConfig = mkOption {
-        type = types.lines;
+      extraConfig = lib.mkOption {
+        type = lib.types.lines;
         default = "";
         description = ''
           Extra configuration to add to siproxd configuration.
@@ -159,7 +156,7 @@ in
 
   ##### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     users.users.siproxyd = {
       uid = config.ids.uids.siproxd;
diff --git a/nixos/modules/services/misc/soft-serve.nix b/nixos/modules/services/misc/soft-serve.nix
index 1907d92adb85..9a3fb1af9b81 100644
--- a/nixos/modules/services/misc/soft-serve.nix
+++ b/nixos/modules/services/misc/soft-serve.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.soft-serve;
   configFile = format.generate "config.yaml" cfg.settings;
@@ -12,11 +9,11 @@ in
 {
   options = {
     services.soft-serve = {
-      enable = mkEnableOption "soft-serve";
+      enable = lib.mkEnableOption "soft-serve";
 
-      package = mkPackageOption pkgs "soft-serve" { };
+      package = lib.mkPackageOption pkgs "soft-serve" { };
 
-      settings = mkOption {
+      settings = lib.mkOption {
         type = format.type;
         default = { };
         description = ''
@@ -24,7 +21,7 @@ in
 
           See <${docUrl}>.
         '';
-        example = literalExpression ''
+        example = lib.literalExpression ''
           {
             name = "dadada's repos";
             log_format = "text";
@@ -41,7 +38,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     systemd.tmpfiles.rules = [
       # The config file has to be inside the state dir
@@ -61,7 +58,7 @@ in
         Type = "simple";
         DynamicUser = true;
         Restart = "always";
-        ExecStart = "${getExe cfg.package} serve";
+        ExecStart = "${lib.getExe cfg.package} serve";
         StateDirectory = "soft-serve";
         WorkingDirectory = stateDir;
         RuntimeDirectory = "soft-serve";
@@ -95,5 +92,5 @@ in
     };
   };
 
-  meta.maintainers = [ maintainers.dadada ];
+  meta.maintainers = [ lib.maintainers.dadada ];
 }
diff --git a/nixos/modules/services/misc/sonarr.nix b/nixos/modules/services/misc/sonarr.nix
index 60e73198d60d..b147bf9e69f4 100644
--- a/nixos/modules/services/misc/sonarr.nix
+++ b/nixos/modules/services/misc/sonarr.nix
@@ -1,46 +1,43 @@
 { config, pkgs, lib, utils, ... }:
-
-with lib;
-
 let
   cfg = config.services.sonarr;
 in
 {
   options = {
     services.sonarr = {
-      enable = mkEnableOption "Sonarr";
+      enable = lib.mkEnableOption "Sonarr";
 
-      dataDir = mkOption {
-        type = types.str;
+      dataDir = lib.mkOption {
+        type = lib.types.str;
         default = "/var/lib/sonarr/.config/NzbDrone";
         description = "The directory where Sonarr stores its data files.";
       };
 
-      openFirewall = mkOption {
-        type = types.bool;
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Open ports in the firewall for the Sonarr web interface
         '';
       };
 
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         default = "sonarr";
         description = "User account under which Sonaar runs.";
       };
 
-      group = mkOption {
-        type = types.str;
+      group = lib.mkOption {
+        type = lib.types.str;
         default = "sonarr";
         description = "Group under which Sonaar runs.";
       };
 
-      package = mkPackageOption pkgs "sonarr" { };
+      package = lib.mkPackageOption pkgs "sonarr" { };
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.tmpfiles.rules = [
       "d '${cfg.dataDir}' 0700 ${cfg.user} ${cfg.group} - -"
     ];
@@ -63,11 +60,11 @@ in
       };
     };
 
-    networking.firewall = mkIf cfg.openFirewall {
+    networking.firewall = lib.mkIf cfg.openFirewall {
       allowedTCPPorts = [ 8989 ];
     };
 
-    users.users = mkIf (cfg.user == "sonarr") {
+    users.users = lib.mkIf (cfg.user == "sonarr") {
       sonarr = {
         group = cfg.group;
         home = cfg.dataDir;
@@ -75,7 +72,7 @@ in
       };
     };
 
-    users.groups = mkIf (cfg.group == "sonarr") {
+    users.groups = lib.mkIf (cfg.group == "sonarr") {
       sonarr.gid = config.ids.gids.sonarr;
     };
   };
diff --git a/nixos/modules/services/misc/spice-vdagentd.nix b/nixos/modules/services/misc/spice-vdagentd.nix
index 2dd9fcf68ab0..762f9c95b615 100644
--- a/nixos/modules/services/misc/spice-vdagentd.nix
+++ b/nixos/modules/services/misc/spice-vdagentd.nix
@@ -1,17 +1,15 @@
 { config, pkgs, lib, ... }:
-
-with lib;
 let
   cfg = config.services.spice-vdagentd;
 in
 {
   options = {
     services.spice-vdagentd = {
-      enable = mkEnableOption "Spice guest vdagent daemon";
+      enable = lib.mkEnableOption "Spice guest vdagent daemon";
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     environment.systemPackages = [ pkgs.spice-vdagent ];
 
diff --git a/nixos/modules/services/misc/spice-webdavd.nix b/nixos/modules/services/misc/spice-webdavd.nix
index 9df0f7a420e7..6f12f4418aaa 100644
--- a/nixos/modules/services/misc/spice-webdavd.nix
+++ b/nixos/modules/services/misc/spice-webdavd.nix
@@ -1,19 +1,17 @@
 { config, pkgs, lib, ... }:
-
-with lib;
 let
   cfg = config.services.spice-webdavd;
 in
 {
   options = {
     services.spice-webdavd = {
-      enable = mkEnableOption "the spice guest webdav proxy daemon";
+      enable = lib.mkEnableOption "the spice guest webdav proxy daemon";
 
-      package = mkPackageOption pkgs "phodav" { };
+      package = lib.mkPackageOption pkgs "phodav" { };
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     # ensure the webdav fs this exposes can actually be mounted
     services.davfs2.enable = true;
 
diff --git a/nixos/modules/services/misc/sssd.nix b/nixos/modules/services/misc/sssd.nix
index f2798c1f30b4..6d6f855c57f1 100644
--- a/nixos/modules/services/misc/sssd.nix
+++ b/nixos/modules/services/misc/sssd.nix
@@ -1,5 +1,4 @@
 { config, lib, pkgs, ... }:
-with lib;
 let
   cfg = config.services.sssd;
   nscd = config.services.nscd;
@@ -10,10 +9,10 @@ let
 in {
   options = {
     services.sssd = {
-      enable = mkEnableOption "the System Security Services Daemon";
+      enable = lib.mkEnableOption "the System Security Services Daemon";
 
-      config = mkOption {
-        type = types.lines;
+      config = lib.mkOption {
+        type = lib.types.lines;
         description = "Contents of {file}`sssd.conf`.";
         default = ''
           [sssd]
@@ -34,8 +33,8 @@ in {
         '';
       };
 
-      sshAuthorizedKeysIntegration = mkOption {
-        type = types.bool;
+      sshAuthorizedKeysIntegration = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to make sshd look up authorized keys from SSS.
@@ -43,16 +42,16 @@ in {
         '';
       };
 
-      kcm = mkOption {
-        type = types.bool;
+      kcm = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to use SSS as a Kerberos Cache Manager (KCM).
           Kerberos will be configured to cache credentials in SSS.
         '';
       };
-      environmentFile = mkOption {
-        type = types.nullOr types.path;
+      environmentFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
         default = null;
         description = ''
           Environment file as defined in {manpage}`systemd.exec(5)`.
@@ -75,8 +74,8 @@ in {
       };
     };
   };
-  config = mkMerge [
-    (mkIf cfg.enable {
+  config = lib.mkMerge [
+    (lib.mkIf cfg.enable {
       # For `sssctl` to work.
       environment.etc."sssd/sssd.conf".source = settingsFile;
       environment.etc."sssd/conf.d".source = "${dataDir}/conf.d";
@@ -126,7 +125,7 @@ in {
       services.dbus.packages = [ pkgs.sssd ];
     })
 
-    (mkIf cfg.kcm {
+    (lib.mkIf cfg.kcm {
       systemd.services.sssd-kcm = {
         description = "SSSD Kerberos Cache Manager";
         requires = [ "sssd-kcm.socket" ];
@@ -148,7 +147,7 @@ in {
       security.krb5.settings.libdefaults.default_ccache_name = "KCM:";
     })
 
-    (mkIf cfg.sshAuthorizedKeysIntegration {
+    (lib.mkIf cfg.sshAuthorizedKeysIntegration {
     # Ugly: sshd refuses to start if a store path is given because /nix/store is group-writable.
     # So indirect by a symlink.
     environment.etc."ssh/authorized_keys_command" = {
@@ -162,5 +161,5 @@ in {
     services.openssh.authorizedKeysCommandUser = "nobody";
   })];
 
-  meta.maintainers = with maintainers; [ bbigras ];
+  meta.maintainers = with lib.maintainers; [ bbigras ];
 }
diff --git a/nixos/modules/services/misc/subsonic.nix b/nixos/modules/services/misc/subsonic.nix
index 2dda8970dd30..8d2ddf724f70 100644
--- a/nixos/modules/services/misc/subsonic.nix
+++ b/nixos/modules/services/misc/subsonic.nix
@@ -1,17 +1,14 @@
 { config, lib, options, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.subsonic;
   opt = options.services.subsonic;
 in {
   options = {
     services.subsonic = {
-      enable = mkEnableOption "Subsonic daemon";
+      enable = lib.mkEnableOption "Subsonic daemon";
 
-      home = mkOption {
-        type = types.path;
+      home = lib.mkOption {
+        type = lib.types.path;
         default = "/var/lib/subsonic";
         description = ''
           The directory where Subsonic will create files.
@@ -19,8 +16,8 @@ in {
         '';
       };
 
-      listenAddress = mkOption {
-        type = types.str;
+      listenAddress = lib.mkOption {
+        type = lib.types.str;
         default = "0.0.0.0";
         description = ''
           The host name or IP address on which to bind Subsonic.
@@ -30,8 +27,8 @@ in {
         '';
       };
 
-      port = mkOption {
-        type = types.port;
+      port = lib.mkOption {
+        type = lib.types.port;
         default = 4040;
         description = ''
           The port on which Subsonic will listen for
@@ -39,8 +36,8 @@ in {
         '';
       };
 
-      httpsPort = mkOption {
-        type = types.port;
+      httpsPort = lib.mkOption {
+        type = lib.types.port;
         default = 0;
         description = ''
           The port on which Subsonic will listen for
@@ -48,8 +45,8 @@ in {
         '';
       };
 
-      contextPath = mkOption {
-        type = types.path;
+      contextPath = lib.mkOption {
+        type = lib.types.path;
         default = "/";
         description = ''
           The context path, i.e., the last part of the Subsonic
@@ -57,8 +54,8 @@ in {
         '';
       };
 
-      maxMemory = mkOption {
-        type = types.int;
+      maxMemory = lib.mkOption {
+        type = lib.types.int;
         default = 100;
         description = ''
           The memory limit (max Java heap size) in megabytes.
@@ -66,8 +63,8 @@ in {
         '';
       };
 
-      defaultMusicFolder = mkOption {
-        type = types.path;
+      defaultMusicFolder = lib.mkOption {
+        type = lib.types.path;
         default = "/var/music";
         description = ''
           Configure Subsonic to use this folder for music.  This option
@@ -75,8 +72,8 @@ in {
         '';
       };
 
-      defaultPodcastFolder = mkOption {
-        type = types.path;
+      defaultPodcastFolder = lib.mkOption {
+        type = lib.types.path;
         default = "/var/music/Podcast";
         description = ''
           Configure Subsonic to use this folder for Podcasts.  This option
@@ -84,8 +81,8 @@ in {
         '';
       };
 
-      defaultPlaylistFolder = mkOption {
-        type = types.path;
+      defaultPlaylistFolder = lib.mkOption {
+        type = lib.types.path;
         default = "/var/playlists";
         description = ''
           Configure Subsonic to use this folder for playlists.  This option
@@ -93,10 +90,10 @@ in {
         '';
       };
 
-      transcoders = mkOption {
-        type = types.listOf types.path;
+      transcoders = lib.mkOption {
+        type = lib.types.listOf lib.types.path;
         default = [ "${pkgs.ffmpeg.bin}/bin/ffmpeg" ];
-        defaultText = literalExpression ''[ "''${pkgs.ffmpeg.bin}/bin/ffmpeg" ]'';
+        defaultText = lib.literalExpression ''[ "''${pkgs.ffmpeg.bin}/bin/ffmpeg" ]'';
         description = ''
           List of paths to transcoder executables that should be accessible
           from Subsonic. Symlinks will be created to each executable inside
@@ -106,7 +103,7 @@ in {
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.subsonic = {
       description = "Personal media streamer";
       after = [ "network.target" ];
diff --git a/nixos/modules/services/misc/sundtek.nix b/nixos/modules/services/misc/sundtek.nix
index e3234518c940..089d86cb5972 100644
--- a/nixos/modules/services/misc/sundtek.nix
+++ b/nixos/modules/services/misc/sundtek.nix
@@ -1,17 +1,14 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.sundtek;
 
 in
 {
   options.services.sundtek = {
-    enable = mkEnableOption "Sundtek driver";
+    enable = lib.mkEnableOption "Sundtek driver";
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     environment.systemPackages = [ pkgs.sundtek ];
 
diff --git a/nixos/modules/services/misc/svnserve.nix b/nixos/modules/services/misc/svnserve.nix
index 5fa262ca3b94..8e0aee51754c 100644
--- a/nixos/modules/services/misc/svnserve.nix
+++ b/nixos/modules/services/misc/svnserve.nix
@@ -1,8 +1,5 @@
 # SVN server
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
 
   cfg = config.services.svnserve;
@@ -17,14 +14,14 @@ in
 
     services.svnserve = {
 
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Whether to enable svnserve to serve Subversion repositories through the SVN protocol.";
       };
 
-      svnBaseDir = mkOption {
-        type = types.str;
+      svnBaseDir = lib.mkOption {
+        type = lib.types.str;
         default = "/repos";
         description = "Base directory from which Subversion repositories are accessed.";
       };
@@ -35,7 +32,7 @@ in
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.svnserve = {
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
diff --git a/nixos/modules/services/misc/synergy.nix b/nixos/modules/services/misc/synergy.nix
index fb664fc071d1..495f29ba1f91 100644
--- a/nixos/modules/services/misc/synergy.nix
+++ b/nixos/modules/services/misc/synergy.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
 
   cfgC = config.services.synergy.client;
@@ -19,60 +16,60 @@ in
       # !!! All these option descriptions needs to be cleaned up.
 
       client = {
-        enable = mkEnableOption "the Synergy client (receive keyboard and mouse events from a Synergy server)";
+        enable = lib.mkEnableOption "the Synergy client (receive keyboard and mouse events from a Synergy server)";
 
-        screenName = mkOption {
+        screenName = lib.mkOption {
           default = "";
-          type = types.str;
+          type = lib.types.str;
           description = ''
             Use the given name instead of the hostname to identify
             ourselves to the server.
           '';
         };
-        serverAddress = mkOption {
-          type = types.str;
+        serverAddress = lib.mkOption {
+          type = lib.types.str;
           description = ''
             The server address is of the form: [hostname][:port].  The
             hostname must be the address or hostname of the server.  The
             port overrides the default port, 24800.
           '';
         };
-        autoStart = mkOption {
+        autoStart = lib.mkOption {
           default = true;
-          type = types.bool;
+          type = lib.types.bool;
           description = "Whether the Synergy client should be started automatically.";
         };
       };
 
       server = {
-        enable = mkEnableOption "the Synergy server (send keyboard and mouse events)";
+        enable = lib.mkEnableOption "the Synergy server (send keyboard and mouse events)";
 
-        configFile = mkOption {
-          type = types.path;
+        configFile = lib.mkOption {
+          type = lib.types.path;
           default = "/etc/synergy-server.conf";
           description = "The Synergy server configuration file.";
         };
-        screenName = mkOption {
-          type = types.str;
+        screenName = lib.mkOption {
+          type = lib.types.str;
           default = "";
           description = ''
             Use the given name instead of the hostname to identify
             this screen in the configuration.
           '';
         };
-        address = mkOption {
-          type = types.str;
+        address = lib.mkOption {
+          type = lib.types.str;
           default = "";
           description = "Address on which to listen for clients.";
         };
-        autoStart = mkOption {
+        autoStart = lib.mkOption {
           default = true;
-          type = types.bool;
+          type = lib.types.bool;
           description = "Whether the Synergy server should be started automatically.";
         };
         tls = {
-          enable = mkOption {
-            type = types.bool;
+          enable = lib.mkOption {
+            type = lib.types.bool;
             default = false;
             description = ''
               Whether TLS encryption should be used.
@@ -83,8 +80,8 @@ in
             '';
           };
 
-          cert = mkOption {
-            type = types.nullOr types.str;
+          cert = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
             default = null;
             example = "~/.synergy/SSL/Synergy.pem";
             description = "The TLS certificate to use for encryption.";
@@ -98,24 +95,24 @@ in
 
   ###### implementation
 
-  config = mkMerge [
-    (mkIf cfgC.enable {
+  config = lib.mkMerge [
+    (lib.mkIf cfgC.enable {
       systemd.user.services.synergy-client = {
         after = [ "network.target" "graphical-session.target" ];
         description = "Synergy client";
-        wantedBy = optional cfgC.autoStart "graphical-session.target";
+        wantedBy = lib.optional cfgC.autoStart "graphical-session.target";
         path = [ pkgs.synergy ];
-        serviceConfig.ExecStart = ''${pkgs.synergy}/bin/synergyc -f ${optionalString (cfgC.screenName != "") "-n ${cfgC.screenName}"} ${cfgC.serverAddress}'';
+        serviceConfig.ExecStart = ''${pkgs.synergy}/bin/synergyc -f ${lib.optionalString (cfgC.screenName != "") "-n ${cfgC.screenName}"} ${cfgC.serverAddress}'';
         serviceConfig.Restart = "on-failure";
       };
     })
-    (mkIf cfgS.enable {
+    (lib.mkIf cfgS.enable {
       systemd.user.services.synergy-server = {
         after = [ "network.target" "graphical-session.target" ];
         description = "Synergy server";
-        wantedBy = optional cfgS.autoStart "graphical-session.target";
+        wantedBy = lib.optional cfgS.autoStart "graphical-session.target";
         path = [ pkgs.synergy ];
-        serviceConfig.ExecStart = ''${pkgs.synergy}/bin/synergys -c ${cfgS.configFile} -f${optionalString (cfgS.address != "") " -a ${cfgS.address}"}${optionalString (cfgS.screenName != "") " -n ${cfgS.screenName}"}${optionalString cfgS.tls.enable " --enable-crypto"}${optionalString (cfgS.tls.cert != null) (" --tls-cert ${cfgS.tls.cert}")}'';
+        serviceConfig.ExecStart = ''${pkgs.synergy}/bin/synergys -c ${cfgS.configFile} -f${lib.optionalString (cfgS.address != "") " -a ${cfgS.address}"}${lib.optionalString (cfgS.screenName != "") " -n ${cfgS.screenName}"}${lib.optionalString cfgS.tls.enable " --enable-crypto"}${lib.optionalString (cfgS.tls.cert != null) (" --tls-cert ${cfgS.tls.cert}")}'';
         serviceConfig.Restart = "on-failure";
       };
     })
diff --git a/nixos/modules/services/misc/tandoor-recipes.nix b/nixos/modules/services/misc/tandoor-recipes.nix
index f8a85e0ac221..dd458f72565b 100644
--- a/nixos/modules/services/misc/tandoor-recipes.nix
+++ b/nixos/modules/services/misc/tandoor-recipes.nix
@@ -1,6 +1,4 @@
 { config, pkgs, lib, ... }:
-
-with lib;
 let
   cfg = config.services.tandoor-recipes;
   pkg = cfg.package;
@@ -11,7 +9,7 @@ let
     DEBUG = "0";
     DEBUG_TOOLBAR = "0";
     MEDIA_ROOT = "/var/lib/tandoor-recipes";
-  } // optionalAttrs (config.time.timeZone != null) {
+  } // lib.optionalAttrs (config.time.timeZone != null) {
     TZ = config.time.timeZone;
   } // (
     lib.mapAttrs (_: toString) cfg.extraConfig
@@ -27,10 +25,10 @@ let
   '';
 in
 {
-  meta.maintainers = with maintainers; [ ambroisie ];
+  meta.maintainers = with lib.maintainers; [ ambroisie ];
 
   options.services.tandoor-recipes = {
-    enable = mkOption {
+    enable = lib.mkOption {
       type = lib.types.bool;
       default = false;
       description = ''
@@ -45,20 +43,20 @@ in
       '';
     };
 
-    address = mkOption {
-      type = types.str;
+    address = lib.mkOption {
+      type = lib.types.str;
       default = "localhost";
       description = "Web interface address.";
     };
 
-    port = mkOption {
-      type = types.port;
+    port = lib.mkOption {
+      type = lib.types.port;
       default = 8080;
       description = "Web interface port.";
     };
 
-    extraConfig = mkOption {
-      type = types.attrs;
+    extraConfig = lib.mkOption {
+      type = lib.types.attrs;
       default = { };
       description = ''
         Extra tandoor recipes config options.
@@ -71,10 +69,10 @@ in
       };
     };
 
-    package = mkPackageOption pkgs "tandoor-recipes" { };
+    package = lib.mkPackageOption pkgs "tandoor-recipes" { };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.tandoor-recipes = {
       description = "Tandoor Recipes server";
 
diff --git a/nixos/modules/services/misc/tautulli.nix b/nixos/modules/services/misc/tautulli.nix
index 6afdbd212aa8..467a632c7280 100644
--- a/nixos/modules/services/misc/tautulli.nix
+++ b/nixos/modules/services/misc/tautulli.nix
@@ -1,60 +1,57 @@
 { config, pkgs, lib, ... }:
-
-with lib;
-
 let
   cfg = config.services.tautulli;
 in
 {
   imports = [
-    (mkRenamedOptionModule [ "services" "plexpy" ] [ "services" "tautulli" ])
+    (lib.mkRenamedOptionModule [ "services" "plexpy" ] [ "services" "tautulli" ])
   ];
 
   options = {
     services.tautulli = {
-      enable = mkEnableOption "Tautulli Plex Monitor";
+      enable = lib.mkEnableOption "Tautulli Plex Monitor";
 
-      dataDir = mkOption {
-        type = types.str;
+      dataDir = lib.mkOption {
+        type = lib.types.str;
         default = "/var/lib/plexpy";
         description = "The directory where Tautulli stores its data files.";
       };
 
-      configFile = mkOption {
-        type = types.str;
+      configFile = lib.mkOption {
+        type = lib.types.str;
         default = "/var/lib/plexpy/config.ini";
         description = "The location of Tautulli's config file.";
       };
 
-      port = mkOption {
-        type = types.port;
+      port = lib.mkOption {
+        type = lib.types.port;
         default = 8181;
         description = "TCP port where Tautulli listens.";
       };
 
-      openFirewall = mkOption {
-        type = types.bool;
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Open ports in the firewall for Tautulli.";
       };
 
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         default = "plexpy";
         description = "User account under which Tautulli runs.";
       };
 
-      group = mkOption {
-        type = types.str;
+      group = lib.mkOption {
+        type = lib.types.str;
         default = "nogroup";
         description = "Group under which Tautulli runs.";
       };
 
-      package = mkPackageOption pkgs "tautulli" { };
+      package = lib.mkPackageOption pkgs "tautulli" { };
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.tmpfiles.rules = [
       "d '${cfg.dataDir}' - ${cfg.user} ${cfg.group} - -"
     ];
@@ -73,9 +70,9 @@ in
       };
     };
 
-    networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ];
+    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ cfg.port ];
 
-    users.users = mkIf (cfg.user == "plexpy") {
+    users.users = lib.mkIf (cfg.user == "plexpy") {
       plexpy = { group = cfg.group; uid = config.ids.uids.plexpy; };
     };
   };
diff --git a/nixos/modules/services/misc/tiddlywiki.nix b/nixos/modules/services/misc/tiddlywiki.nix
index 7ae657dd862d..4cff412132d1 100644
--- a/nixos/modules/services/misc/tiddlywiki.nix
+++ b/nixos/modules/services/misc/tiddlywiki.nix
@@ -1,11 +1,8 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
 
   cfg = config.services.tiddlywiki;
-  listenParams = concatStrings (mapAttrsToList (n: v: " '${n}=${toString v}' ") cfg.listenOptions);
+  listenParams = lib.concatStrings (lib.mapAttrsToList (n: v: " '${n}=${toString v}' ") cfg.listenOptions);
   exe = "${pkgs.nodePackages.tiddlywiki}/lib/node_modules/.bin/tiddlywiki";
   name = "tiddlywiki";
   dataDir = "/var/lib/" + name;
@@ -14,10 +11,10 @@ in {
 
   options.services.tiddlywiki = {
 
-    enable = mkEnableOption "TiddlyWiki nodejs server";
+    enable = lib.mkEnableOption "TiddlyWiki nodejs server";
 
-    listenOptions = mkOption {
-      type = types.attrs;
+    listenOptions = lib.mkOption {
+      type = lib.types.attrs;
       default = {};
       example = {
         credentials = "../credentials.csv";
@@ -32,7 +29,7 @@ in {
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd = {
       services.tiddlywiki = {
         description = "TiddlyWiki nodejs server";
diff --git a/nixos/modules/services/misc/tp-auto-kbbl.nix b/nixos/modules/services/misc/tp-auto-kbbl.nix
index 4ea356a133d8..fe0192116982 100644
--- a/nixos/modules/services/misc/tp-auto-kbbl.nix
+++ b/nixos/modules/services/misc/tp-auto-kbbl.nix
@@ -1,28 +1,25 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let cfg = config.services.tp-auto-kbbl;
 
 in {
-  meta.maintainers = with maintainers; [ sebtm ];
+  meta.maintainers = with lib.maintainers; [ sebtm ];
 
   options = {
     services.tp-auto-kbbl = {
-      enable = mkEnableOption "auto toggle keyboard back-lighting on Thinkpads (and maybe other laptops) for Linux";
+      enable = lib.mkEnableOption "auto toggle keyboard back-lighting on Thinkpads (and maybe other laptops) for Linux";
 
-      package = mkPackageOption pkgs "tp-auto-kbbl" { };
+      package = lib.mkPackageOption pkgs "tp-auto-kbbl" { };
 
-      arguments = mkOption {
-        type = types.listOf types.str;
+      arguments = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [ ];
         description = ''
           List of arguments appended to `./tp-auto-kbbl --device [device] [arguments]`
         '';
       };
 
-      device = mkOption {
-        type = types.str;
+      device = lib.mkOption {
+        type = lib.types.str;
         default = "/dev/input/event0";
         description = "Device watched for activities.";
       };
@@ -30,12 +27,12 @@ in {
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     environment.systemPackages = [ cfg.package ];
 
     systemd.services.tp-auto-kbbl = {
       serviceConfig = {
-        ExecStart = concatStringsSep " "
+        ExecStart = lib.concatStringsSep " "
           ([ "${cfg.package}/bin/tp-auto-kbbl" "--device ${cfg.device}" ] ++ cfg.arguments);
         Restart = "always";
         Type = "simple";
diff --git a/nixos/modules/services/misc/tuxclocker.nix b/nixos/modules/services/misc/tuxclocker.nix
index 4c2f9e39bcfc..ccbd4c6980e0 100644
--- a/nixos/modules/services/misc/tuxclocker.nix
+++ b/nixos/modules/services/misc/tuxclocker.nix
@@ -1,23 +1,20 @@
 { config, pkgs, lib, ... }:
-
-with lib;
-
 let
   cfg = config.programs.tuxclocker;
 in
 {
   options.programs.tuxclocker = {
-    enable = mkEnableOption ''
+    enable = lib.mkEnableOption ''
       TuxClocker, a hardware control and monitoring program
     '';
 
-    enableAMD = mkEnableOption ''
+    enableAMD = lib.mkEnableOption ''
       AMD GPU controls.
       Sets the `amdgpu.ppfeaturemask` kernel parameter to 0xfffd7fff to enable all TuxClocker controls
     '';
 
-    enabledNVIDIADevices = mkOption {
-      type = types.listOf types.int;
+    enabledNVIDIADevices = lib.mkOption {
+      type = lib.types.listOf lib.types.int;
       default = [ ];
       example = [ 0 1 ];
       description = ''
@@ -26,8 +23,8 @@ in
       '';
     };
 
-    useUnfree = mkOption {
-      type = types.bool;
+    useUnfree = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       example = true;
       description = ''
@@ -40,7 +37,7 @@ in
   config = let
       package = if cfg.useUnfree then pkgs.tuxclocker else pkgs.tuxclocker-without-unfree;
     in
-      mkIf cfg.enable {
+      lib.mkIf cfg.enable {
         environment.systemPackages = [
           package
         ];
@@ -62,10 +59,10 @@ in
             EndSection
           '');
         in
-          concatStrings (map configSection cfg.enabledNVIDIADevices);
+          lib.concatStrings (map configSection cfg.enabledNVIDIADevices);
 
         # https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/gpu/drm/amd/include/amd_shared.h#n207
         # Enable everything modifiable in TuxClocker
-        boot.kernelParams = mkIf cfg.enableAMD [ "amdgpu.ppfeaturemask=0xfffd7fff" ];
+        boot.kernelParams = lib.mkIf cfg.enableAMD [ "amdgpu.ppfeaturemask=0xfffd7fff" ];
       };
 }
diff --git a/nixos/modules/services/misc/tzupdate.nix b/nixos/modules/services/misc/tzupdate.nix
index 9e979bb47675..17868e1c1171 100644
--- a/nixos/modules/services/misc/tzupdate.nix
+++ b/nixos/modules/services/misc/tzupdate.nix
@@ -1,13 +1,10 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.tzupdate;
 in {
   options.services.tzupdate = {
-    enable = mkOption {
-      type = types.bool;
+    enable = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = ''
         Enable the tzupdate timezone updating service. This provides
@@ -17,7 +14,7 @@ in {
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     # We need to have imperative time zone management for this to work.
     # This will give users an error if they have set an explicit time
     # zone, which is better than silently overriding it.
diff --git a/nixos/modules/services/misc/uhub.nix b/nixos/modules/services/misc/uhub.nix
index 99774fbb920a..58bf6a2c2ed7 100644
--- a/nixos/modules/services/misc/uhub.nix
+++ b/nixos/modules/services/misc/uhub.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   settingsFormat = {
     type = with lib.types; attrsOf (oneOf [ bool int str ]);
@@ -13,21 +10,21 @@ let
 in {
   options = {
 
-    services.uhub = mkOption {
+    services.uhub = lib.mkOption {
       default = { };
       description = "Uhub ADC hub instances";
-      type = types.attrsOf (types.submodule {
+      type = lib.types.attrsOf (lib.types.submodule {
         options = {
 
-          enable = mkEnableOption "hub instance" // { default = true; };
+          enable = lib.mkEnableOption "hub instance" // { default = true; };
 
-          enableTLS = mkOption {
-            type = types.bool;
+          enableTLS = lib.mkOption {
+            type = lib.types.bool;
             default = false;
             description = "Whether to enable TLS support.";
           };
 
-          settings = mkOption {
+          settings = lib.mkOption {
             inherit (settingsFormat) type;
             description = ''
               Configuration of uhub.
@@ -43,18 +40,18 @@ in {
             };
           };
 
-          plugins = mkOption {
+          plugins = lib.mkOption {
             description = "Uhub plugin configuration.";
-            type = with types;
+            type = with lib.types;
               listOf (submodule {
                 options = {
-                  plugin = mkOption {
+                  plugin = lib.mkOption {
                     type = path;
-                    example = literalExpression
+                    example = lib.literalExpression
                       "$${pkgs.uhub}/plugins/mod_auth_sqlite.so";
                     description = "Path to plugin file.";
                   };
-                  settings = mkOption {
+                  settings = lib.mkOption {
                     description = "Settings specific to this plugin.";
                     type = with types; attrsOf str;
                     example = { file = "/etc/uhub/users.db"; };
diff --git a/nixos/modules/services/misc/weechat.nix b/nixos/modules/services/misc/weechat.nix
index 6f6c78b1c9dc..45180e2bbd5f 100644
--- a/nixos/modules/services/misc/weechat.nix
+++ b/nixos/modules/services/misc/weechat.nix
@@ -1,34 +1,31 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.weechat;
 in
 
 {
   options.services.weechat = {
-    enable = mkEnableOption "weechat";
-    root = mkOption {
+    enable = lib.mkEnableOption "weechat";
+    root = lib.mkOption {
       description = "Weechat state directory.";
-      type = types.str;
+      type = lib.types.str;
       default = "/var/lib/weechat";
     };
-    sessionName = mkOption {
+    sessionName = lib.mkOption {
       description = "Name of the `screen` session for weechat.";
       default = "weechat-screen";
-      type = types.str;
+      type = lib.types.str;
     };
-    binary = mkOption {
-      type = types.path;
+    binary = lib.mkOption {
+      type = lib.types.path;
       description = "Binary to execute.";
       default = "${pkgs.weechat}/bin/weechat";
-      defaultText = literalExpression ''"''${pkgs.weechat}/bin/weechat"'';
-      example = literalExpression ''"''${pkgs.weechat}/bin/weechat-headless"'';
+      defaultText = lib.literalExpression ''"''${pkgs.weechat}/bin/weechat"'';
+      example = lib.literalExpression ''"''${pkgs.weechat}/bin/weechat-headless"'';
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     users = {
       groups.weechat = {};
       users.weechat = {
diff --git a/nixos/modules/services/misc/xmrig.nix b/nixos/modules/services/misc/xmrig.nix
index d4e1be779972..4317f197d008 100644
--- a/nixos/modules/services/misc/xmrig.nix
+++ b/nixos/modules/services/misc/xmrig.nix
@@ -1,28 +1,22 @@
 { config, pkgs, lib, ... }:
-
-
 let
   cfg = config.services.xmrig;
-
   json = pkgs.formats.json { };
   configFile = json.generate "config.json" cfg.settings;
 in
-
-with lib;
-
 {
   options = {
     services.xmrig = {
-      enable = mkEnableOption "XMRig Mining Software";
+      enable = lib.mkEnableOption "XMRig Mining Software";
 
-      package = mkPackageOption pkgs "xmrig" {
+      package = lib.mkPackageOption pkgs "xmrig" {
         example = "xmrig-mo";
       };
 
-      settings = mkOption {
+      settings = lib.mkOption {
         default = { };
         type = json.type;
-        example = literalExpression ''
+        example = lib.literalExpression ''
           {
             autosave = true;
             cpu = true;
@@ -47,7 +41,7 @@ with lib;
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     hardware.cpu.x86.msr.enable = true;
 
     systemd.services.xmrig = {
diff --git a/nixos/modules/services/misc/zookeeper.nix b/nixos/modules/services/misc/zookeeper.nix
index 3861a3cd2f4d..fc06d56b0d5a 100644
--- a/nixos/modules/services/misc/zookeeper.nix
+++ b/nixos/modules/services/misc/zookeeper.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.zookeeper;
 
@@ -24,31 +21,31 @@ let
 in {
 
   options.services.zookeeper = {
-    enable = mkEnableOption "Zookeeper";
+    enable = lib.mkEnableOption "Zookeeper";
 
-    port = mkOption {
+    port = lib.mkOption {
       description = "Zookeeper Client port.";
       default = 2181;
-      type = types.port;
+      type = lib.types.port;
     };
 
-    id = mkOption {
+    id = lib.mkOption {
       description = "Zookeeper ID.";
       default = 0;
-      type = types.int;
+      type = lib.types.int;
     };
 
-    purgeInterval = mkOption {
+    purgeInterval = lib.mkOption {
       description = ''
         The time interval in hours for which the purge task has to be triggered. Set to a positive integer (1 and above) to enable the auto purging.
       '';
       default = 1;
-      type = types.int;
+      type = lib.types.int;
     };
 
-    extraConf = mkOption {
+    extraConf = lib.mkOption {
       description = "Extra configuration for Zookeeper.";
-      type = types.lines;
+      type = lib.types.lines;
       default = ''
         initLimit=5
         syncLimit=2
@@ -56,10 +53,10 @@ in {
       '';
     };
 
-    servers = mkOption {
+    servers = lib.mkOption {
       description = "All Zookeeper Servers.";
       default = "";
-      type = types.lines;
+      type = lib.types.lines;
       example = ''
         server.0=host0:2888:3888
         server.1=host1:2888:3888
@@ -67,7 +64,7 @@ in {
       '';
     };
 
-    logging = mkOption {
+    logging = lib.mkOption {
       description = "Zookeeper logging configuration.";
       default = ''
         zookeeper.root.logger=INFO, CONSOLE
@@ -77,45 +74,45 @@ in {
         log4j.appender.CONSOLE.layout=org.apache.log4j.PatternLayout
         log4j.appender.CONSOLE.layout.ConversionPattern=[myid:%X{myid}] - %-5p [%t:%C{1}@%L] - %m%n
       '';
-      type = types.lines;
+      type = lib.types.lines;
     };
 
-    dataDir = mkOption {
-      type = types.path;
+    dataDir = lib.mkOption {
+      type = lib.types.path;
       default = "/var/lib/zookeeper";
       description = ''
         Data directory for Zookeeper
       '';
     };
 
-    extraCmdLineOptions = mkOption {
+    extraCmdLineOptions = lib.mkOption {
       description = "Extra command line options for the Zookeeper launcher.";
       default = [ "-Dcom.sun.management.jmxremote" "-Dcom.sun.management.jmxremote.local.only=true" ];
-      type = types.listOf types.str;
+      type = lib.types.listOf lib.types.str;
       example = [ "-Djava.net.preferIPv4Stack=true" "-Dcom.sun.management.jmxremote" "-Dcom.sun.management.jmxremote.local.only=true" ];
     };
 
-    preferIPv4 = mkOption {
-      type = types.bool;
+    preferIPv4 = lib.mkOption {
+      type = lib.types.bool;
       default = true;
       description = ''
         Add the -Djava.net.preferIPv4Stack=true flag to the Zookeeper server.
       '';
     };
 
-    package = mkPackageOption pkgs "zookeeper" { };
+    package = lib.mkPackageOption pkgs "zookeeper" { };
 
-    jre = mkOption {
+    jre = lib.mkOption {
       description = "The JRE with which to run Zookeeper";
       default = cfg.package.jre;
-      defaultText = literalExpression "pkgs.zookeeper.jre";
-      example = literalExpression "pkgs.jre";
-      type = types.package;
+      defaultText = lib.literalExpression "pkgs.zookeeper.jre";
+      example = lib.literalExpression "pkgs.jre";
+      type = lib.types.package;
     };
   };
 
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     environment.systemPackages = [cfg.package];
 
     systemd.tmpfiles.rules = [
@@ -131,9 +128,9 @@ in {
         ExecStart = ''
           ${cfg.jre}/bin/java \
             -cp "${cfg.package}/lib/*:${configDir}" \
-            ${escapeShellArgs cfg.extraCmdLineOptions} \
+            ${lib.escapeShellArgs cfg.extraCmdLineOptions} \
             -Dzookeeper.datadir.autocreate=false \
-            ${optionalString cfg.preferIPv4 "-Djava.net.preferIPv4Stack=true"} \
+            ${lib.optionalString cfg.preferIPv4 "-Djava.net.preferIPv4Stack=true"} \
             org.apache.zookeeper.server.quorum.QuorumPeerMain \
             ${configDir}/zoo.cfg
         '';
diff --git a/nixos/modules/services/monitoring/alerta.nix b/nixos/modules/services/monitoring/alerta.nix
index 32c71e730102..54aff7d6a92c 100644
--- a/nixos/modules/services/monitoring/alerta.nix
+++ b/nixos/modules/services/monitoring/alerta.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.alerta;
 
@@ -12,7 +9,7 @@ let
       DATABASE_NAME = '${cfg.databaseName}'
       LOG_FILE = '${cfg.logDir}/alertad.log'
       LOG_FORMAT = '%(asctime)s - %(name)s - %(levelname)s - %(message)s'
-      CORS_ORIGINS = [ ${concatMapStringsSep ", " (s: "\"" + s + "\"") cfg.corsOrigins} ];
+      CORS_ORIGINS = [ ${lib.concatMapStringsSep ", " (s: "\"" + s + "\"") cfg.corsOrigins} ];
       AUTH_REQUIRED = ${if cfg.authenticationRequired then "True" else "False"}
       SIGNUP_ENABLED = ${if cfg.signupEnabled then "True" else "False"}
       ${cfg.extraConfig}
@@ -21,64 +18,64 @@ let
 in
 {
   options.services.alerta = {
-    enable = mkEnableOption "alerta";
+    enable = lib.mkEnableOption "alerta";
 
-    port = mkOption {
-      type = types.port;
+    port = lib.mkOption {
+      type = lib.types.port;
       default = 5000;
       description = "Port of Alerta";
     };
 
-    bind = mkOption {
-      type = types.str;
+    bind = lib.mkOption {
+      type = lib.types.str;
       default = "0.0.0.0";
       description = "Address to bind to. The default is to bind to all addresses";
     };
 
-    logDir = mkOption {
-      type = types.path;
+    logDir = lib.mkOption {
+      type = lib.types.path;
       description = "Location where the logfiles are stored";
       default = "/var/log/alerta";
     };
 
-    databaseUrl = mkOption {
-      type = types.str;
+    databaseUrl = lib.mkOption {
+      type = lib.types.str;
       description = "URL of the MongoDB or PostgreSQL database to connect to";
       default = "mongodb://localhost";
     };
 
-    databaseName = mkOption {
-      type = types.str;
+    databaseName = lib.mkOption {
+      type = lib.types.str;
       description = "Name of the database instance to connect to";
       default = "monitoring";
     };
 
-    corsOrigins = mkOption {
-      type = types.listOf types.str;
+    corsOrigins = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
       description = "List of URLs that can access the API for Cross-Origin Resource Sharing (CORS)";
       default = [ "http://localhost" "http://localhost:5000" ];
     };
 
-    authenticationRequired = mkOption {
-      type = types.bool;
+    authenticationRequired = lib.mkOption {
+      type = lib.types.bool;
       description = "Whether users must authenticate when using the web UI or command-line tool";
       default = false;
     };
 
-    signupEnabled = mkOption {
-      type = types.bool;
+    signupEnabled = lib.mkOption {
+      type = lib.types.bool;
       description = "Whether to prevent sign-up of new users via the web UI";
       default = true;
     };
 
-    extraConfig = mkOption {
+    extraConfig = lib.mkOption {
       description = "These lines go into alertad.conf verbatim.";
       default = "";
-      type = types.lines;
+      type = lib.types.lines;
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.tmpfiles.settings."10-alerta".${cfg.logDir}.d = {
       user = "alerta";
       group = "alerta";
diff --git a/nixos/modules/services/monitoring/alloy.nix b/nixos/modules/services/monitoring/alloy.nix
index abe8fcd7e1be..8507900756b6 100644
--- a/nixos/modules/services/monitoring/alloy.nix
+++ b/nixos/modules/services/monitoring/alloy.nix
@@ -1,19 +1,18 @@
 { lib, pkgs, config, ... }:
-with lib;
 let
   cfg = config.services.alloy;
 in
 {
   meta = {
-    maintainers = with maintainers; [ flokli hbjydev ];
+    maintainers = with lib.maintainers; [ flokli hbjydev ];
   };
 
   options.services.alloy = {
-    enable = mkEnableOption "Grafana Alloy";
+    enable = lib.mkEnableOption "Grafana Alloy";
 
-    package = mkPackageOption pkgs "grafana-alloy" { };
+    package = lib.mkPackageOption pkgs "grafana-alloy" { };
 
-    configPath = mkOption {
+    configPath = lib.mkOption {
       type = lib.types.path;
       default = "/etc/alloy";
       description = ''
@@ -43,7 +42,7 @@ in
       '';
     };
 
-    extraFlags = mkOption {
+    extraFlags = lib.mkOption {
       type = with lib.types; listOf str;
       default = [ ];
       example = [ "--server.http.listen-addr=127.0.0.1:12346" "--disable-reporting" ];
@@ -56,7 +55,7 @@ in
   };
 
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.alloy = {
       wantedBy = [ "multi-user.target" ];
       reloadTriggers = [ config.environment.etc."alloy/config.alloy".source or null ];
@@ -68,7 +67,7 @@ in
           # allow to read the systemd journal for loki log forwarding
           "systemd-journal"
         ];
-        ExecStart = "${lib.getExe cfg.package} run ${cfg.configPath} ${escapeShellArgs cfg.extraFlags}";
+        ExecStart = "${lib.getExe cfg.package} run ${cfg.configPath} ${lib.escapeShellArgs cfg.extraFlags}";
         ExecReload = "${pkgs.coreutils}/bin/kill -SIGHUP $MAINPID";
         ConfigurationDirectory = "alloy";
         StateDirectory = "alloy";
diff --git a/nixos/modules/services/monitoring/apcupsd.nix b/nixos/modules/services/monitoring/apcupsd.nix
index 09cf593f5d5e..21b27cb3f520 100644
--- a/nixos/modules/services/monitoring/apcupsd.nix
+++ b/nixos/modules/services/monitoring/apcupsd.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.apcupsd;
 
@@ -58,7 +55,7 @@ let
     rm "$out/apcupsd.conf"
     # Set the SCRIPTDIR= line in apccontrol to the dir we're creating now
     sed -i -e "s|^SCRIPTDIR=.*|SCRIPTDIR=$out|" "$out/apccontrol"
-    '' + concatStringsSep "\n" (map eventToShellCmds eventList)
+    '' + lib.concatStringsSep "\n" (map eventToShellCmds eventList)
 
   );
 
@@ -87,9 +84,9 @@ in
 
     services.apcupsd = {
 
-      enable = mkOption {
+      enable = lib.mkOption {
         default = false;
-        type = types.bool;
+        type = lib.types.bool;
         description = ''
           Whether to enable the APC UPS daemon. apcupsd monitors your UPS and
           permits orderly shutdown of your computer in the event of a power
@@ -99,14 +96,14 @@ in
         '';
       };
 
-      configText = mkOption {
+      configText = lib.mkOption {
         default = ''
           UPSTYPE usb
           NISIP 127.0.0.1
           BATTERYLEVEL 50
           MINUTES 5
         '';
-        type = types.lines;
+        type = lib.types.lines;
         description = ''
           Contents of the runtime configuration file, apcupsd.conf. The default
           settings makes apcupsd autodetect USB UPSes, limit network access to
@@ -116,12 +113,12 @@ in
         '';
       };
 
-      hooks = mkOption {
+      hooks = lib.mkOption {
         default = {};
         example = {
           doshutdown = "# shell commands to notify that the computer is shutting down";
         };
-        type = types.attrsOf types.lines;
+        type = lib.types.attrsOf lib.types.lines;
         description = ''
           Each attribute in this option names an apcupsd event and the string
           value it contains will be executed in a shell, in response to that
@@ -141,10 +138,10 @@ in
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     assertions = [ {
-      assertion = let hooknames = builtins.attrNames cfg.hooks; in all (x: elem x eventList) hooknames;
+      assertion = let hooknames = builtins.attrNames cfg.hooks; in lib.all (x: lib.elem x eventList) hooknames;
       message = ''
         One (or more) attribute names in services.apcupsd.hooks are invalid.
         Current attribute names: ${toString (builtins.attrNames cfg.hooks)}
diff --git a/nixos/modules/services/monitoring/arbtt.nix b/nixos/modules/services/monitoring/arbtt.nix
index cf9a236c079c..9c04e4447c73 100644
--- a/nixos/modules/services/monitoring/arbtt.nix
+++ b/nixos/modules/services/monitoring/arbtt.nix
@@ -1,18 +1,15 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.arbtt;
 in {
   options = {
     services.arbtt = {
-      enable = mkEnableOption "Arbtt statistics capture service";
+      enable = lib.mkEnableOption "Arbtt statistics capture service";
 
-      package = mkPackageOption pkgs [ "haskellPackages" "arbtt" ] { };
+      package = lib.mkPackageOption pkgs [ "haskellPackages" "arbtt" ] { };
 
-      logFile = mkOption {
-        type = types.str;
+      logFile = lib.mkOption {
+        type = lib.types.str;
         default = "%h/.arbtt/capture.log";
         example = "/home/username/.arbtt-capture.log";
         description = ''
@@ -20,8 +17,8 @@ in {
         '';
       };
 
-      sampleRate = mkOption {
-        type = types.int;
+      sampleRate = lib.mkOption {
+        type = lib.types.int;
         default = 60;
         example = 120;
         description = ''
@@ -31,7 +28,7 @@ in {
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.user.services.arbtt = {
       description = "arbtt statistics capture service";
       wantedBy = [ "graphical-session.target" ];
diff --git a/nixos/modules/services/monitoring/below.nix b/nixos/modules/services/monitoring/below.nix
index 729734828142..26a38e5f82a4 100644
--- a/nixos/modules/services/monitoring/below.nix
+++ b/nixos/modules/services/monitoring/below.nix
@@ -1,32 +1,31 @@
 { config, lib, pkgs, ... }:
-with lib;
 let
   cfg = config.services.below;
-  cfgContents = concatStringsSep "\n" (
-    mapAttrsToList (n: v: ''${n} = "${v}"'') (filterAttrs (_k: v: v != null) {
+  cfgContents = lib.concatStringsSep "\n" (
+    lib.mapAttrsToList (n: v: ''${n} = "${v}"'') (lib.filterAttrs (_k: v: v != null) {
       log_dir = cfg.dirs.log;
       store_dir = cfg.dirs.store;
       cgroup_filter_out = cfg.cgroupFilterOut;
     })
   );
 
-  mkDisableOption = n: mkOption {
-    type = types.bool;
+  mkDisableOption = n: lib.mkOption {
+    type = lib.types.bool;
     default = true;
     description = "Whether to enable ${n}.";
   };
-  optionalType = ty: x: mkOption (x // {
+  optionalType = ty: x: lib.mkOption (x // {
     description = x.description;
-    type = (types.nullOr ty);
+    type = (lib.types.nullOr ty);
     default = null;
   });
-  optionalPath = optionalType types.path;
-  optionalStr = optionalType types.str;
-  optionalInt = optionalType types.int;
+  optionalPath = optionalType lib.types.path;
+  optionalStr = optionalType lib.types.str;
+  optionalInt = optionalType lib.types.int;
 in {
   options = {
     services.below = {
-      enable = mkEnableOption "'below' resource monitor";
+      enable = lib.mkEnableOption "'below' resource monitor";
 
       cgroupFilterOut = optionalStr {
         description = "A regexp matching the full paths of cgroups whose data shouldn't be collected";
@@ -34,10 +33,10 @@ in {
       };
       collect = {
         diskStats = mkDisableOption "dist_stat collection";
-        ioStats   = mkEnableOption "io.stat collection for cgroups";
+        ioStats   = lib.mkEnableOption "io.stat collection for cgroups";
         exitStats = mkDisableOption "eBPF-based exitstats";
       };
-      compression.enable = mkEnableOption "data compression";
+      compression.enable = lib.mkEnableOption "data compression";
       retention = {
         size = optionalInt {
           description = ''
@@ -75,7 +74,7 @@ in {
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     environment.systemPackages = [ pkgs.below ];
     # /etc/below.conf is also refered to by the `below` CLI tool,
     #  so this can't be a store-only file whose path is passed to the service
@@ -90,14 +89,14 @@ in {
 
         serviceConfig.ExecStart = [
           ""
-          ("${lib.getExe pkgs.below} record " + (concatStringsSep " " (
-            optional (!cfg.collect.diskStats) "--disable-disk-stat" ++
-            optional   cfg.collect.ioStats    "--collect-io-stat"   ++
-            optional (!cfg.collect.exitStats) "--disable-exitstats" ++
-            optional   cfg.compression.enable "--compress"          ++
+          ("${lib.getExe pkgs.below} record " + (lib.concatStringsSep " " (
+            lib.optional (!cfg.collect.diskStats) "--disable-disk-stat" ++
+            lib.optional   cfg.collect.ioStats    "--collect-io-stat"   ++
+            lib.optional (!cfg.collect.exitStats) "--disable-exitstats" ++
+            lib.optional   cfg.compression.enable "--compress"          ++
 
-            optional (cfg.retention.size != null) "--store-size-limit ${toString cfg.retention.size}" ++
-            optional (cfg.retention.time != null) "--retain-for-s ${toString cfg.retention.time}"
+            lib.optional (cfg.retention.size != null) "--store-size-limit ${toString cfg.retention.size}" ++
+            lib.optional (cfg.retention.time != null) "--retain-for-s ${toString cfg.retention.time}"
           )))
         ];
       };
diff --git a/nixos/modules/services/monitoring/bosun.nix b/nixos/modules/services/monitoring/bosun.nix
index 4b855b96e949..08288f644e77 100644
--- a/nixos/modules/services/monitoring/bosun.nix
+++ b/nixos/modules/services/monitoring/bosun.nix
@@ -1,13 +1,10 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.bosun;
 
   configFile = pkgs.writeText "bosun.conf" ''
-    ${optionalString (cfg.opentsdbHost !=null) "tsdbHost = ${cfg.opentsdbHost}"}
-    ${optionalString (cfg.influxHost !=null) "influxHost = ${cfg.influxHost}"}
+    ${lib.optionalString (cfg.opentsdbHost !=null) "tsdbHost = ${cfg.opentsdbHost}"}
+    ${lib.optionalString (cfg.influxHost !=null) "influxHost = ${cfg.influxHost}"}
     httpListen = ${cfg.listenAddress}
     stateFile = ${cfg.stateFile}
     ledisDir = ${cfg.ledisDir}
@@ -22,28 +19,28 @@ in {
 
     services.bosun = {
 
-      enable = mkEnableOption "bosun";
+      enable = lib.mkEnableOption "bosun";
 
-      package = mkPackageOption pkgs "bosun" { };
+      package = lib.mkPackageOption pkgs "bosun" { };
 
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         default = "bosun";
         description = ''
           User account under which bosun runs.
         '';
       };
 
-      group = mkOption {
-        type = types.str;
+      group = lib.mkOption {
+        type = lib.types.str;
         default = "bosun";
         description = ''
           Group account under which bosun runs.
         '';
       };
 
-      opentsdbHost = mkOption {
-        type = types.nullOr types.str;
+      opentsdbHost = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = "localhost:4242";
         description = ''
           Host and port of the OpenTSDB database that stores bosun data.
@@ -51,8 +48,8 @@ in {
         '';
       };
 
-      influxHost = mkOption {
-        type = types.nullOr types.str;
+      influxHost = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         example = "localhost:8086";
         description = ''
@@ -60,40 +57,40 @@ in {
         '';
       };
 
-      listenAddress = mkOption {
-        type = types.str;
+      listenAddress = lib.mkOption {
+        type = lib.types.str;
         default = ":8070";
         description = ''
           The host address and port that bosun's web interface will listen on.
         '';
       };
 
-      stateFile = mkOption {
-        type = types.path;
+      stateFile = lib.mkOption {
+        type = lib.types.path;
         default = "/var/lib/bosun/bosun.state";
         description = ''
           Path to bosun's state file.
         '';
       };
 
-      ledisDir = mkOption {
-        type = types.path;
+      ledisDir = lib.mkOption {
+        type = lib.types.path;
         default = "/var/lib/bosun/ledis_data";
         description = ''
           Path to bosun's ledis data dir
         '';
       };
 
-      checkFrequency = mkOption {
-        type = types.str;
+      checkFrequency = lib.mkOption {
+        type = lib.types.str;
         default = "5m";
         description = ''
           Bosun's check frequency
         '';
       };
 
-      extraConfig = mkOption {
-        type = types.lines;
+      extraConfig = lib.mkOption {
+        type = lib.types.lines;
         default = "";
         description = ''
           Extra configuration options for Bosun. You should describe your
@@ -109,7 +106,7 @@ in {
 
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     systemd.services.bosun = {
       description = "bosun metrics collector (part of Bosun)";
diff --git a/nixos/modules/services/monitoring/cadvisor.nix b/nixos/modules/services/monitoring/cadvisor.nix
index 6b0852cfe3ef..b801cde833d6 100644
--- a/nixos/modules/services/monitoring/cadvisor.nix
+++ b/nixos/modules/services/monitoring/cadvisor.nix
@@ -1,55 +1,52 @@
 { config, pkgs, lib, ... }:
-
-with lib;
-
 let
   cfg = config.services.cadvisor;
 
 in {
   options = {
     services.cadvisor = {
-      enable = mkEnableOption "Cadvisor service";
+      enable = lib.mkEnableOption "Cadvisor service";
 
-      listenAddress = mkOption {
+      listenAddress = lib.mkOption {
         default = "127.0.0.1";
-        type = types.str;
+        type = lib.types.str;
         description = "Cadvisor listening host";
       };
 
-      port = mkOption {
+      port = lib.mkOption {
         default = 8080;
-        type = types.port;
+        type = lib.types.port;
         description = "Cadvisor listening port";
       };
 
-      storageDriver = mkOption {
+      storageDriver = lib.mkOption {
         default = null;
-        type = types.nullOr types.str;
+        type = lib.types.nullOr lib.types.str;
         example = "influxdb";
         description = "Cadvisor storage driver.";
       };
 
-      storageDriverHost = mkOption {
+      storageDriverHost = lib.mkOption {
         default = "localhost:8086";
-        type = types.str;
+        type = lib.types.str;
         description = "Cadvisor storage driver host.";
       };
 
-      storageDriverDb = mkOption {
+      storageDriverDb = lib.mkOption {
         default = "root";
-        type = types.str;
+        type = lib.types.str;
         description = "Cadvisord storage driver database name.";
       };
 
-      storageDriverUser = mkOption {
+      storageDriverUser = lib.mkOption {
         default = "root";
-        type = types.str;
+        type = lib.types.str;
         description = "Cadvisor storage driver username.";
       };
 
-      storageDriverPassword = mkOption {
+      storageDriverPassword = lib.mkOption {
         default = "root";
-        type = types.str;
+        type = lib.types.str;
         description = ''
           Cadvisor storage driver password.
 
@@ -60,8 +57,8 @@ in {
         '';
       };
 
-      storageDriverPasswordFile = mkOption {
-        type = types.str;
+      storageDriverPasswordFile = lib.mkOption {
+        type = lib.types.str;
         description = ''
           File that contains the cadvisor storage driver password.
 
@@ -75,14 +72,14 @@ in {
         '';
       };
 
-      storageDriverSecure = mkOption {
+      storageDriverSecure = lib.mkOption {
         default = false;
-        type = types.bool;
+        type = lib.types.bool;
         description = "Cadvisor storage driver, enable secure communication.";
       };
 
-      extraOptions = mkOption {
-        type = types.listOf types.str;
+      extraOptions = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [];
         description = ''
           Additional cadvisor options.
@@ -93,23 +90,23 @@ in {
     };
   };
 
-  config = mkMerge [
-    { services.cadvisor.storageDriverPasswordFile = mkIf (cfg.storageDriverPassword != "") (
-        mkDefault (toString (pkgs.writeTextFile {
+  config = lib.mkMerge [
+    { services.cadvisor.storageDriverPasswordFile = lib.mkIf (cfg.storageDriverPassword != "") (
+        lib.mkDefault (toString (pkgs.writeTextFile {
           name = "cadvisor-storage-driver-password";
           text = cfg.storageDriverPassword;
         }))
       );
     }
 
-    (mkIf cfg.enable {
+    (lib.mkIf cfg.enable {
       systemd.services.cadvisor = {
         wantedBy = [ "multi-user.target" ];
         after = [ "network.target" "docker.service" "influxdb.service" ];
 
-        path = optionals config.boot.zfs.enabled [ pkgs.zfs ];
+        path = lib.optionals config.boot.zfs.enabled [ pkgs.zfs ];
 
-        postStart = mkBefore ''
+        postStart = lib.mkBefore ''
           until ${pkgs.curl.bin}/bin/curl -s -o /dev/null 'http://${cfg.listenAddress}:${toString cfg.port}/containers/'; do
             sleep 1;
           done
@@ -120,14 +117,14 @@ in {
             -logtostderr=true \
             -listen_ip="${cfg.listenAddress}" \
             -port="${toString cfg.port}" \
-            ${escapeShellArgs cfg.extraOptions} \
-            ${optionalString (cfg.storageDriver != null) ''
+            ${lib.escapeShellArgs cfg.extraOptions} \
+            ${lib.optionalString (cfg.storageDriver != null) ''
               -storage_driver "${cfg.storageDriver}" \
               -storage_driver_host "${cfg.storageDriverHost}" \
               -storage_driver_db "${cfg.storageDriverDb}" \
               -storage_driver_user "${cfg.storageDriverUser}" \
               -storage_driver_password "$(cat "${cfg.storageDriverPasswordFile}")" \
-              ${optionalString cfg.storageDriverSecure "-storage_driver_secure"}
+              ${lib.optionalString cfg.storageDriverSecure "-storage_driver_secure"}
             ''}
         '';
 
diff --git a/nixos/modules/services/monitoring/collectd.nix b/nixos/modules/services/monitoring/collectd.nix
index fe9b1214e5c1..1bd7da52fef8 100644
--- a/nixos/modules/services/monitoring/collectd.nix
+++ b/nixos/modules/services/monitoring/collectd.nix
@@ -1,7 +1,4 @@
 { config, pkgs, lib, ... }:
-
-with lib;
-
 let
   cfg = config.services.collectd;
 
@@ -28,10 +25,10 @@ let
   };
 
 in {
-  options.services.collectd = with types; {
-    enable = mkEnableOption "collectd agent";
+  options.services.collectd = with lib.types; {
+    enable = lib.mkEnableOption "collectd agent";
 
-    validateConfig = mkOption {
+    validateConfig = lib.mkOption {
       default = true;
       description = ''
         Validate the syntax of collectd configuration file at build time.
@@ -41,9 +38,9 @@ in {
       type = types.bool;
     };
 
-    package = mkPackageOption pkgs "collectd" { };
+    package = lib.mkPackageOption pkgs "collectd" { };
 
-    buildMinimalPackage = mkOption {
+    buildMinimalPackage = lib.mkOption {
       default = false;
       description = ''
         Build a minimal collectd package with only the configured `services.collectd.plugins`
@@ -51,7 +48,7 @@ in {
       type = bool;
     };
 
-    user = mkOption {
+    user = lib.mkOption {
       default = "collectd";
       description = ''
         User under which to run collectd.
@@ -59,7 +56,7 @@ in {
       type = nullOr str;
     };
 
-    dataDir = mkOption {
+    dataDir = lib.mkOption {
       default = "/var/lib/collectd";
       description = ''
         Data directory for collectd agent.
@@ -67,7 +64,7 @@ in {
       type = path;
     };
 
-    autoLoadPlugin = mkOption {
+    autoLoadPlugin = lib.mkOption {
       default = false;
       description = ''
         Enable plugin autoloading.
@@ -75,7 +72,7 @@ in {
       type = bool;
     };
 
-    include = mkOption {
+    include = lib.mkOption {
       default = [];
       description = ''
         Additional paths to load config from.
@@ -83,7 +80,7 @@ in {
       type = listOf str;
     };
 
-    plugins = mkOption {
+    plugins = lib.mkOption {
       default = {};
       example = { cpu = ""; memory = ""; network = "Server 192.168.1.1 25826"; };
       description = ''
@@ -92,7 +89,7 @@ in {
       type = attrsOf lines;
     };
 
-    extraConfig = mkOption {
+    extraConfig = lib.mkOption {
       default = "";
       description = ''
         Extra configuration for collectd. Use mkBefore to add lines before the
@@ -103,11 +100,11 @@ in {
 
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     # 1200 is after the default (1000) but before mkAfter (1500).
     services.collectd.extraConfig = lib.mkOrder 1200 ''
       ${baseDirLine}
-      AutoLoadPlugin ${boolToString cfg.autoLoadPlugin}
+      AutoLoadPlugin ${lib.boolToString cfg.autoLoadPlugin}
       Hostname "${config.networking.hostName}"
 
       LoadPlugin syslog
@@ -116,14 +113,14 @@ in {
         NotifyLevel "OKAY"
       </Plugin>
 
-      ${concatStrings (mapAttrsToList (plugin: pluginConfig: ''
+      ${lib.concatStrings (lib.mapAttrsToList (plugin: pluginConfig: ''
         LoadPlugin ${plugin}
         <Plugin "${plugin}">
         ${pluginConfig}
         </Plugin>
       '') cfg.plugins)}
 
-      ${concatMapStrings (f: ''
+      ${lib.concatMapStrings (f: ''
         Include "${f}"
       '') cfg.include}
     '';
@@ -145,14 +142,14 @@ in {
       };
     };
 
-    users.users = optionalAttrs (cfg.user == "collectd") {
+    users.users = lib.optionalAttrs (cfg.user == "collectd") {
       collectd = {
         isSystemUser = true;
         group = "collectd";
       };
     };
 
-    users.groups = optionalAttrs (cfg.user == "collectd") {
+    users.groups = lib.optionalAttrs (cfg.user == "collectd") {
       collectd = {};
     };
   };
diff --git a/nixos/modules/services/monitoring/das_watchdog.nix b/nixos/modules/services/monitoring/das_watchdog.nix
index 88ca3a9227d2..e076bf64364e 100644
--- a/nixos/modules/services/monitoring/das_watchdog.nix
+++ b/nixos/modules/services/monitoring/das_watchdog.nix
@@ -1,9 +1,6 @@
 # A general watchdog for the linux operating system that should run in the
 # background at all times to ensure a realtime process won't hang the machine
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
 
   inherit (pkgs) das_watchdog;
@@ -12,12 +9,12 @@ in {
   ###### interface
 
   options = {
-    services.das_watchdog.enable = mkEnableOption "realtime watchdog";
+    services.das_watchdog.enable = lib.mkEnableOption "realtime watchdog";
   };
 
   ###### implementation
 
-  config = mkIf config.services.das_watchdog.enable {
+  config = lib.mkIf config.services.das_watchdog.enable {
     environment.systemPackages = [ das_watchdog ];
     systemd.services.das_watchdog = {
       description = "Watchdog to ensure a realtime process won't hang the machine";
diff --git a/nixos/modules/services/monitoring/datadog-agent.nix b/nixos/modules/services/monitoring/datadog-agent.nix
index 04232b3c9346..8256226041ea 100644
--- a/nixos/modules/services/monitoring/datadog-agent.nix
+++ b/nixos/modules/services/monitoring/datadog-agent.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.datadog-agent;
 
@@ -11,19 +8,19 @@ let
     additional_checksd  = "/etc/datadog-agent/checks.d";
     use_dogstatsd       = true;
   }
-  // optionalAttrs (cfg.logLevel != null) { log_level = cfg.logLevel; }
-  // optionalAttrs (cfg.hostname != null) { inherit (cfg) hostname; }
-  // optionalAttrs (cfg.ddUrl != null) { dd_url = cfg.ddUrl; }
-  // optionalAttrs (cfg.site != null) { site = cfg.site; }
-  // optionalAttrs (cfg.tags != null ) { tags = concatStringsSep ", " cfg.tags; }
-  // optionalAttrs (cfg.enableLiveProcessCollection) { process_config = { enabled = "true"; }; }
-  // optionalAttrs (cfg.enableTraceAgent) { apm_config = { enabled = true; }; }
+  // lib.optionalAttrs (cfg.logLevel != null) { log_level = cfg.logLevel; }
+  // lib.optionalAttrs (cfg.hostname != null) { inherit (cfg) hostname; }
+  // lib.optionalAttrs (cfg.ddUrl != null) { dd_url = cfg.ddUrl; }
+  // lib.optionalAttrs (cfg.site != null) { site = cfg.site; }
+  // lib.optionalAttrs (cfg.tags != null ) { tags = lib.concatStringsSep ", " cfg.tags; }
+  // lib.optionalAttrs (cfg.enableLiveProcessCollection) { process_config = { enabled = "true"; }; }
+  // lib.optionalAttrs (cfg.enableTraceAgent) { apm_config = { enabled = true; }; }
   // cfg.extraConfig;
 
   # Generate Datadog configuration files for each configured checks.
   # This works because check configurations have predictable paths,
   # and because JSON is a valid subset of YAML.
-  makeCheckConfigs = entries: mapAttrs' (name: conf: {
+  makeCheckConfigs = entries: lib.mapAttrs' (name: conf: {
     name = "datadog-agent/conf.d/${name}.d/conf.yaml";
     value.source = pkgs.writeText "${name}-check-conf.yaml" (builtins.toJSON conf);
   }) entries;
@@ -49,9 +46,9 @@ let
   };
 in {
   options.services.datadog-agent = {
-    enable = mkEnableOption "Datadog-agent v7 monitoring service";
+    enable = lib.mkEnableOption "Datadog-agent v7 monitoring service";
 
-    package = mkPackageOption pkgs "datadog-agent" {
+    package = lib.mkPackageOption pkgs "datadog-agent" {
       extraDescription = ''
         ::: {.note}
         The provided package is expected to have an overridable `pythonPackages`-attribute
@@ -60,16 +57,16 @@ in {
       '';
     };
 
-    apiKeyFile = mkOption {
+    apiKeyFile = lib.mkOption {
       description = ''
         Path to a file containing the Datadog API key to associate the
         agent with your account.
       '';
       example = "/run/keys/datadog_api_key";
-      type = types.path;
+      type = lib.types.path;
     };
 
-    ddUrl = mkOption {
+    ddUrl = lib.mkOption {
       description = ''
         Custom dd_url to configure the agent with. Useful if traffic to datadog
         needs to go through a proxy.
@@ -77,42 +74,42 @@ in {
       '';
       default = null;
       example = "http://haproxy.example.com:3834";
-      type = types.nullOr types.str;
+      type = lib.types.nullOr lib.types.str;
     };
 
-    site = mkOption {
+    site = lib.mkOption {
       description = ''
         The datadog site to point the agent towards.
         Set to datadoghq.eu to point it to their EU site.
       '';
       default = null;
       example = "datadoghq.eu";
-      type = types.nullOr types.str;
+      type = lib.types.nullOr lib.types.str;
     };
 
-    tags = mkOption {
+    tags = lib.mkOption {
       description = "The tags to mark this Datadog agent";
       example = [ "test" "service" ];
       default = null;
-      type = types.nullOr (types.listOf types.str);
+      type = lib.types.nullOr (lib.types.listOf lib.types.str);
     };
 
-    hostname = mkOption {
+    hostname = lib.mkOption {
       description = "The hostname to show in the Datadog dashboard (optional)";
       default = null;
       example = "mymachine.mydomain";
-      type = types.nullOr types.str;
+      type = lib.types.nullOr lib.types.str;
     };
 
-    logLevel = mkOption {
+    logLevel = lib.mkOption {
       description = "Logging verbosity.";
       default = null;
-      type = types.nullOr (types.enum ["DEBUG" "INFO" "WARN" "ERROR"]);
+      type = lib.types.nullOr (lib.types.enum ["DEBUG" "INFO" "WARN" "ERROR"]);
     };
 
-    extraIntegrations = mkOption {
+    extraIntegrations = lib.mkOption {
       default = {};
-      type    = types.attrs;
+      type    = lib.types.attrs;
 
       description = ''
         Extra integrations from the Datadog core-integrations
@@ -126,51 +123,51 @@ in {
         package set must be provided.
       '';
 
-      example = literalExpression ''
+      example = lib.literalExpression ''
         {
           ntp = pythonPackages: [ pythonPackages.ntplib ];
         }
       '';
     };
 
-    extraConfig = mkOption {
+    extraConfig = lib.mkOption {
       default = {};
-      type = types.attrs;
+      type = lib.types.attrs;
       description = ''
         Extra configuration options that will be merged into the
         main config file {file}`datadog.yaml`.
       '';
      };
 
-    enableLiveProcessCollection = mkOption {
+    enableLiveProcessCollection = lib.mkOption {
       description = ''
         Whether to enable the live process collection agent.
       '';
       default = false;
-      type = types.bool;
+      type = lib.types.bool;
     };
 
-    processAgentPackage = mkOption {
+    processAgentPackage = lib.mkOption {
       default = pkgs.datadog-process-agent;
-      defaultText = literalExpression "pkgs.datadog-process-agent";
+      defaultText = lib.literalExpression "pkgs.datadog-process-agent";
       description = ''
         Which DataDog v7 agent package to use. Note that the provided
         package is expected to have an overridable `pythonPackages`-attribute
         which configures the Python environment with the Datadog
         checks.
       '';
-      type = types.package;
+      type = lib.types.package;
     };
 
-    enableTraceAgent = mkOption {
+    enableTraceAgent = lib.mkOption {
       description = ''
         Whether to enable the trace agent.
       '';
       default = false;
-      type = types.bool;
+      type = lib.types.bool;
     };
 
-    checks = mkOption {
+    checks = lib.mkOption {
       description = ''
         Configuration for all Datadog checks. Keys of this attribute
         set will be used as the name of the check to create the
@@ -206,21 +203,21 @@ in {
 
       # sic! The structure of the values is up to the check, so we can
       # not usefully constrain the type further.
-      type = with types; attrsOf attrs;
+      type = with lib.types; attrsOf attrs;
     };
 
-    diskCheck = mkOption {
+    diskCheck = lib.mkOption {
       description = "Disk check config";
-      type = types.attrs;
+      type = lib.types.attrs;
       default = {
         init_config = {};
         instances = [ { use_mount = "false"; } ];
       };
     };
 
-    networkCheck = mkOption {
+    networkCheck = lib.mkOption {
       description = "Network check config";
-      type = types.attrs;
+      type = lib.types.attrs;
       default = {
         init_config = {};
         # Network check only supports one configured instance
@@ -229,7 +226,7 @@ in {
       };
     };
   };
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     environment.systemPackages = [ datadogPkg pkgs.sysstat pkgs.procps pkgs.iproute2 ];
 
     users.users.datadog = {
@@ -243,7 +240,7 @@ in {
     users.groups.datadog.gid = config.ids.gids.datadog;
 
     systemd.services = let
-      makeService = attrs: recursiveUpdate {
+      makeService = attrs: lib.recursiveUpdate {
         path = [ datadogPkg pkgs.sysstat pkgs.procps pkgs.iproute2 ];
         wantedBy = [ "multi-user.target" ];
         serviceConfig = {
@@ -252,7 +249,7 @@ in {
           Restart = "always";
           RestartSec = 2;
         };
-        restartTriggers = [ datadogPkg ] ++  map (x: x.source) (attrValues etcfiles);
+        restartTriggers = [ datadogPkg ] ++  map (x: x.source) (lib.attrValues etcfiles);
       } attrs;
     in {
       datadog-agent = makeService {
diff --git a/nixos/modules/services/monitoring/do-agent.nix b/nixos/modules/services/monitoring/do-agent.nix
index 4dfb6236727b..e5f1bdf7fdfc 100644
--- a/nixos/modules/services/monitoring/do-agent.nix
+++ b/nixos/modules/services/monitoring/do-agent.nix
@@ -1,17 +1,14 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.do-agent;
 
 in
 {
   options.services.do-agent = {
-    enable = mkEnableOption "do-agent, the DigitalOcean droplet metrics agent";
+    enable = lib.mkEnableOption "do-agent, the DigitalOcean droplet metrics agent";
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.packages = [ pkgs.do-agent ];
 
     systemd.services.do-agent = {
diff --git a/nixos/modules/services/monitoring/fusion-inventory.nix b/nixos/modules/services/monitoring/fusion-inventory.nix
index 9b65c76ce02e..cb6c8a827390 100644
--- a/nixos/modules/services/monitoring/fusion-inventory.nix
+++ b/nixos/modules/services/monitoring/fusion-inventory.nix
@@ -1,13 +1,10 @@
 # Fusion Inventory daemon.
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.fusionInventory;
 
   configFile = pkgs.writeText "fusion_inventory.conf" ''
-    server = ${concatStringsSep ", " cfg.servers}
+    server = ${lib.concatStringsSep ", " cfg.servers}
 
     logger = stderr
 
@@ -22,18 +19,18 @@ in {
 
     services.fusionInventory = {
 
-      enable = mkEnableOption "Fusion Inventory Agent";
+      enable = lib.mkEnableOption "Fusion Inventory Agent";
 
-      servers = mkOption {
-        type = types.listOf types.str;
+      servers = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         description = ''
           The urls of the OCS/GLPI servers to connect to.
         '';
       };
 
-      extraConfig = mkOption {
+      extraConfig = lib.mkOption {
         default = "";
-        type = types.lines;
+        type = lib.types.lines;
         description = ''
           Configuration that is injected verbatim into the configuration file.
         '';
@@ -44,7 +41,7 @@ in {
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     users.users.fusion-inventory = {
       description = "FusionInventory user";
diff --git a/nixos/modules/services/monitoring/grafana-agent.nix b/nixos/modules/services/monitoring/grafana-agent.nix
index 655ec8ded1e0..f82675c8c6cb 100644
--- a/nixos/modules/services/monitoring/grafana-agent.nix
+++ b/nixos/modules/services/monitoring/grafana-agent.nix
@@ -1,5 +1,4 @@
 { lib, pkgs, config, generators, ... }:
-with lib;
 let
   cfg = config.services.grafana-agent;
   settingsFormat = pkgs.formats.yaml { };
@@ -7,19 +6,19 @@ let
 in
 {
   meta = {
-    maintainers = with maintainers; [ flokli zimbatm ];
+    maintainers = with lib.maintainers; [ flokli zimbatm ];
   };
 
   options.services.grafana-agent = {
-    enable = mkEnableOption "grafana-agent";
+    enable = lib.mkEnableOption "grafana-agent";
 
-    package = mkPackageOption pkgs "grafana-agent" { };
+    package = lib.mkPackageOption pkgs "grafana-agent" { };
 
-    credentials = mkOption {
+    credentials = lib.mkOption {
       description = ''
         Credentials to load at service startup. Keys that are UPPER_SNAKE will be loaded as env vars. Values are absolute paths to the credentials.
       '';
-      type = types.attrsOf types.str;
+      type = lib.types.attrsOf lib.types.str;
       default = { };
 
       example = {
@@ -32,8 +31,8 @@ in
       };
     };
 
-    extraFlags = mkOption {
-      type = with types; listOf str;
+    extraFlags = lib.mkOption {
+      type = with lib.types; listOf str;
       default = [ ];
       example = [ "-enable-features=integrations-next" "-disable-reporting" ];
       description = ''
@@ -43,14 +42,14 @@ in
       '';
     };
 
-    settings = mkOption {
+    settings = lib.mkOption {
       description = ''
         Configuration for {command}`grafana-agent`.
 
         See <https://grafana.com/docs/agent/latest/configuration/>
       '';
 
-      type = types.submodule {
+      type = lib.types.submodule {
         freeformType = settingsFormat.type;
       };
 
@@ -110,17 +109,17 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     services.grafana-agent.settings = {
       # keep this in sync with config.services.grafana-agent.settings.defaultText.
       metrics = {
-        wal_directory = mkDefault "\${STATE_DIRECTORY}";
-        global.scrape_interval = mkDefault "5s";
+        wal_directory = lib.mkDefault "\${STATE_DIRECTORY}";
+        global.scrape_interval = lib.mkDefault "5s";
       };
       integrations = {
-        agent.enabled = mkDefault true;
-        agent.scrape_integration = mkDefault true;
-        node_exporter.enabled = mkDefault true;
+        agent.enabled = lib.mkDefault true;
+        agent.scrape_integration = lib.mkDefault true;
+        node_exporter.enabled = lib.mkDefault true;
       };
     };
 
@@ -144,7 +143,7 @@ in
         # We can't use Environment=HOSTNAME=%H, as it doesn't include the domain part.
         export HOSTNAME=$(< /proc/sys/kernel/hostname)
 
-        exec ${lib.getExe cfg.package} -config.expand-env -config.file ${configFile} ${escapeShellArgs cfg.extraFlags}
+        exec ${lib.getExe cfg.package} -config.expand-env -config.file ${configFile} ${lib.escapeShellArgs cfg.extraFlags}
       '';
       serviceConfig = {
         Restart = "always";
diff --git a/nixos/modules/services/monitoring/grafana-image-renderer.nix b/nixos/modules/services/monitoring/grafana-image-renderer.nix
index e06720b15302..e477f73adaa1 100644
--- a/nixos/modules/services/monitoring/grafana-image-renderer.nix
+++ b/nixos/modules/services/monitoring/grafana-image-renderer.nix
@@ -1,7 +1,4 @@
 { lib, pkgs, config, ... }:
-
-with lib;
-
 let
   cfg = config.services.grafana-image-renderer;
 
@@ -10,34 +7,34 @@ let
   configFile = format.generate "grafana-image-renderer-config.json" cfg.settings;
 in {
   options.services.grafana-image-renderer = {
-    enable = mkEnableOption "grafana-image-renderer";
+    enable = lib.mkEnableOption "grafana-image-renderer";
 
-    chromium = mkOption {
-      type = types.package;
+    chromium = lib.mkOption {
+      type = lib.types.package;
       description = ''
         The chromium to use for image rendering.
       '';
     };
 
-    verbose = mkEnableOption "verbosity for the service";
+    verbose = lib.mkEnableOption "verbosity for the service";
 
-    provisionGrafana = mkEnableOption "Grafana configuration for grafana-image-renderer";
+    provisionGrafana = lib.mkEnableOption "Grafana configuration for grafana-image-renderer";
 
-    settings = mkOption {
-      type = types.submodule {
+    settings = lib.mkOption {
+      type = lib.types.submodule {
         freeformType = format.type;
 
         options = {
           service = {
-            port = mkOption {
-              type = types.port;
+            port = lib.mkOption {
+              type = lib.types.port;
               default = 8081;
               description = ''
                 The TCP port to use for the rendering server.
               '';
             };
-            logging.level = mkOption {
-              type = types.enum [ "error" "warning" "info" "debug" ];
+            logging.level = lib.mkOption {
+              type = lib.types.enum [ "error" "warning" "info" "debug" ];
               default = "info";
               description = ''
                 The log-level of the {file}`grafana-image-renderer.service`-unit.
@@ -45,23 +42,23 @@ in {
             };
           };
           rendering = {
-            width = mkOption {
+            width = lib.mkOption {
               default = 1000;
-              type = types.ints.positive;
+              type = lib.types.ints.positive;
               description = ''
                 Width of the PNG used to display the alerting graph.
               '';
             };
-            height = mkOption {
+            height = lib.mkOption {
               default = 500;
-              type = types.ints.positive;
+              type = lib.types.ints.positive;
               description = ''
                 Height of the PNG used to display the alerting graph.
               '';
             };
-            mode = mkOption {
+            mode = lib.mkOption {
               default = "default";
-              type = types.enum [ "default" "reusable" "clustered" ];
+              type = lib.types.enum [ "default" "reusable" "clustered" ];
               description = ''
                 Rendering mode of `grafana-image-renderer`:
 
@@ -74,8 +71,8 @@ in {
                   for that mode can be declared in `rendering.clustering`.
               '';
             };
-            args = mkOption {
-              type = types.listOf types.str;
+            args = lib.mkOption {
+              type = lib.types.listOf lib.types.str;
               default = [ "--no-sandbox" ];
               description = ''
                 List of CLI flags passed to `chromium`.
@@ -96,7 +93,7 @@ in {
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     assertions = [
       { assertion = cfg.provisionGrafana -> config.services.grafana.enable;
         message = ''
@@ -106,23 +103,23 @@ in {
       }
     ];
 
-    services.grafana.settings.rendering = mkIf cfg.provisionGrafana {
+    services.grafana.settings.rendering = lib.mkIf cfg.provisionGrafana {
       server_url = "http://localhost:${toString cfg.settings.service.port}/render";
       callback_url = "http://${config.services.grafana.settings.server.http_addr}:${toString config.services.grafana.settings.server.http_port}";
     };
 
-    services.grafana-image-renderer.chromium = mkDefault pkgs.chromium;
+    services.grafana-image-renderer.chromium = lib.mkDefault pkgs.chromium;
 
     services.grafana-image-renderer.settings = {
-      rendering = mapAttrs (const mkDefault) {
+      rendering = lib.mapAttrs (lib.const lib.mkDefault) {
         chromeBin = "${cfg.chromium}/bin/chromium";
         verboseLogging = cfg.verbose;
         timezone = config.time.timeZone;
       };
 
       service = {
-        logging.level = mkIf cfg.verbose (mkDefault "debug");
-        metrics.enabled = mkDefault false;
+        logging.level = lib.mkIf cfg.verbose (lib.mkDefault "debug");
+        metrics.enabled = lib.mkDefault false;
       };
     };
 
@@ -144,5 +141,5 @@ in {
     };
   };
 
-  meta.maintainers = with maintainers; [ ma27 ];
+  meta.maintainers = with lib.maintainers; [ ma27 ];
 }
diff --git a/nixos/modules/services/monitoring/grafana-reporter.nix b/nixos/modules/services/monitoring/grafana-reporter.nix
index 528041cab37a..91725206ea12 100644
--- a/nixos/modules/services/monitoring/grafana-reporter.nix
+++ b/nixos/modules/services/monitoring/grafana-reporter.nix
@@ -1,53 +1,50 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.grafana_reporter;
 
 in {
   options.services.grafana_reporter = {
-    enable = mkEnableOption "grafana_reporter";
+    enable = lib.mkEnableOption "grafana_reporter";
 
     grafana = {
-      protocol = mkOption {
+      protocol = lib.mkOption {
         description = "Grafana protocol.";
         default = "http";
-        type = types.enum ["http" "https"];
+        type = lib.types.enum ["http" "https"];
       };
-      addr = mkOption {
+      addr = lib.mkOption {
         description = "Grafana address.";
         default = "127.0.0.1";
-        type = types.str;
+        type = lib.types.str;
       };
-      port = mkOption {
+      port = lib.mkOption {
         description = "Grafana port.";
         default = 3000;
-        type = types.port;
+        type = lib.types.port;
       };
 
     };
-    addr = mkOption {
+    addr = lib.mkOption {
       description = "Listening address.";
       default = "127.0.0.1";
-      type = types.str;
+      type = lib.types.str;
     };
 
-    port = mkOption {
+    port = lib.mkOption {
       description = "Listening port.";
       default = 8686;
-      type = types.port;
+      type = lib.types.port;
     };
 
-    templateDir = mkOption {
+    templateDir = lib.mkOption {
       description = "Optional template directory to use custom tex templates";
       default = pkgs.grafana_reporter;
-      defaultText = literalExpression "pkgs.grafana_reporter";
-      type = types.either types.str types.path;
+      defaultText = lib.literalExpression "pkgs.grafana_reporter";
+      type = lib.types.either lib.types.str lib.types.path;
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.grafana_reporter = {
       description = "Grafana Reporter Service Daemon";
       wantedBy = ["multi-user.target"];
diff --git a/nixos/modules/services/monitoring/hdaps.nix b/nixos/modules/services/monitoring/hdaps.nix
index 366367ef835c..ee9b85a50ae4 100644
--- a/nixos/modules/services/monitoring/hdaps.nix
+++ b/nixos/modules/services/monitoring/hdaps.nix
@@ -1,20 +1,17 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.hdapsd;
   hdapsd = [ pkgs.hdapsd ];
 in
 {
   options = {
-    services.hdapsd.enable = mkEnableOption ''
+    services.hdapsd.enable = lib.mkEnableOption ''
         Hard Drive Active Protection System Daemon,
         devices are detected and managed automatically by udev and systemd
       '';
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     boot.kernelModules = [ "hdapsd" ];
     services.udev.packages = hdapsd;
     systemd.packages = hdapsd;
diff --git a/nixos/modules/services/monitoring/heapster.nix b/nixos/modules/services/monitoring/heapster.nix
index b8ba3632caca..ea03ec46c55c 100644
--- a/nixos/modules/services/monitoring/heapster.nix
+++ b/nixos/modules/services/monitoring/heapster.nix
@@ -1,35 +1,32 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.heapster;
 in {
   options.services.heapster = {
-    enable = mkEnableOption "Heapster monitoring";
+    enable = lib.mkEnableOption "Heapster monitoring";
 
-    source = mkOption {
+    source = lib.mkOption {
       description = "Heapster metric source";
       example = "kubernetes:https://kubernetes.default";
-      type = types.str;
+      type = lib.types.str;
     };
 
-    sink = mkOption {
+    sink = lib.mkOption {
       description = "Heapster metic sink";
       example = "influxdb:http://localhost:8086";
-      type = types.str;
+      type = lib.types.str;
     };
 
-    extraOpts = mkOption {
+    extraOpts = lib.mkOption {
       description = "Heapster extra options";
       default = "";
-      type = types.separatedString " ";
+      type = lib.types.separatedString " ";
     };
 
-    package = mkPackageOption pkgs "heapster" { };
+    package = lib.mkPackageOption pkgs "heapster" { };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.heapster = {
       wantedBy = ["multi-user.target"];
       after = ["cadvisor.service" "kube-apiserver.service"];
diff --git a/nixos/modules/services/monitoring/incron.nix b/nixos/modules/services/monitoring/incron.nix
index 58b07bf97f1d..f7370e4eac23 100644
--- a/nixos/modules/services/monitoring/incron.nix
+++ b/nixos/modules/services/monitoring/incron.nix
@@ -1,8 +1,4 @@
-
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
 
   cfg = config.services.incron;
@@ -14,8 +10,8 @@ in
 
     services.incron = {
 
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to enable the incron daemon.
@@ -24,8 +20,8 @@ in
         '';
       };
 
-      allow = mkOption {
-        type = types.nullOr (types.listOf types.str);
+      allow = lib.mkOption {
+        type = lib.types.nullOr (lib.types.listOf lib.types.str);
         default = null;
         description = ''
           Users allowed to use incrontab.
@@ -37,14 +33,14 @@ in
         '';
       };
 
-      deny = mkOption {
-        type = types.nullOr (types.listOf types.str);
+      deny = lib.mkOption {
+        type = lib.types.nullOr (lib.types.listOf lib.types.str);
         default = null;
         description = "Users forbidden from using incrontab.";
       };
 
-      systab = mkOption {
-        type = types.lines;
+      systab = lib.mkOption {
+        type = lib.types.lines;
         default = "";
         description = "The system incrontab contents.";
         example = ''
@@ -53,10 +49,10 @@ in
         '';
       };
 
-      extraPackages = mkOption {
-        type = types.listOf types.package;
+      extraPackages = lib.mkOption {
+        type = lib.types.listOf lib.types.package;
         default = [];
-        example = literalExpression "[ pkgs.rsync ]";
+        example = lib.literalExpression "[ pkgs.rsync ]";
         description = "Extra packages available to the system incrontab.";
       };
 
@@ -64,9 +60,9 @@ in
 
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
-    warnings = optional (cfg.allow != null && cfg.deny != null)
+    warnings = lib.optional (cfg.allow != null && cfg.deny != null)
       "If `services.incron.allow` is set then `services.incron.deny` will be ignored.";
 
     environment.systemPackages = [ pkgs.incron ];
@@ -83,11 +79,11 @@ in
       mode = "0444";
       text = cfg.systab;
     };
-    environment.etc."incron.allow" = mkIf (cfg.allow != null) {
-      text = concatStringsSep "\n" cfg.allow;
+    environment.etc."incron.allow" = lib.mkIf (cfg.allow != null) {
+      text = lib.concatStringsSep "\n" cfg.allow;
     };
-    environment.etc."incron.deny" = mkIf (cfg.deny != null) {
-      text = concatStringsSep "\n" cfg.deny;
+    environment.etc."incron.deny" = lib.mkIf (cfg.deny != null) {
+      text = lib.concatStringsSep "\n" cfg.deny;
     };
 
     systemd.services.incron = {
diff --git a/nixos/modules/services/monitoring/kapacitor.nix b/nixos/modules/services/monitoring/kapacitor.nix
index 01919e73f734..f42dfff623a0 100644
--- a/nixos/modules/services/monitoring/kapacitor.nix
+++ b/nixos/modules/services/monitoring/kapacitor.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.kapacitor;
 
@@ -26,13 +23,13 @@ let
       [storage]
         boltdb = "${cfg.dataDir}/kapacitor.db"
 
-      ${optionalString (cfg.loadDirectory != null) ''
+      ${lib.optionalString (cfg.loadDirectory != null) ''
         [load]
           enabled = true
           dir = "${cfg.loadDirectory}"
       ''}
 
-      ${optionalString (cfg.defaultDatabase.enable) ''
+      ${lib.optionalString (cfg.defaultDatabase.enable) ''
         [[influxdb]]
           name = "default"
           enabled = true
@@ -42,7 +39,7 @@ let
           password = "${cfg.defaultDatabase.password}"
       ''}
 
-      ${optionalString (cfg.alerta.enable) ''
+      ${lib.optionalString (cfg.alerta.enable) ''
         [alerta]
           enabled = true
           url = "${cfg.alerta.url}"
@@ -57,107 +54,107 @@ let
 in
 {
   options.services.kapacitor = {
-    enable = mkEnableOption "kapacitor";
+    enable = lib.mkEnableOption "kapacitor";
 
-    dataDir = mkOption {
-      type = types.path;
+    dataDir = lib.mkOption {
+      type = lib.types.path;
       default = "/var/lib/kapacitor";
       description = "Location where Kapacitor stores its state";
     };
 
-    port = mkOption {
-      type = types.port;
+    port = lib.mkOption {
+      type = lib.types.port;
       default = 9092;
       description = "Port of Kapacitor";
     };
 
-    bind = mkOption {
-      type = types.str;
+    bind = lib.mkOption {
+      type = lib.types.str;
       default = "";
       example = "0.0.0.0";
       description = "Address to bind to. The default is to bind to all addresses";
     };
 
-    extraConfig = mkOption {
+    extraConfig = lib.mkOption {
       description = "These lines go into kapacitord.conf verbatim.";
       default = "";
-      type = types.lines;
+      type = lib.types.lines;
     };
 
-    user = mkOption {
-      type = types.str;
+    user = lib.mkOption {
+      type = lib.types.str;
       default = "kapacitor";
       description = "User account under which Kapacitor runs";
     };
 
-    group = mkOption {
-      type = types.str;
+    group = lib.mkOption {
+      type = lib.types.str;
       default = "kapacitor";
       description = "Group under which Kapacitor runs";
     };
 
-    taskSnapshotInterval = mkOption {
-      type = types.str;
+    taskSnapshotInterval = lib.mkOption {
+      type = lib.types.str;
       description = "Specifies how often to snapshot the task state  (in InfluxDB time units)";
       default = "1m0s";
     };
 
-    loadDirectory = mkOption {
-      type = types.nullOr types.path;
+    loadDirectory = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
       description = "Directory where to load services from, such as tasks, templates and handlers (or null to disable service loading on startup)";
       default = null;
     };
 
     defaultDatabase = {
-      enable = mkEnableOption "kapacitor.defaultDatabase";
+      enable = lib.mkEnableOption "kapacitor.defaultDatabase";
 
-      url = mkOption {
+      url = lib.mkOption {
         description = "The URL to an InfluxDB server that serves as the default database";
         example = "http://localhost:8086";
-        type = types.str;
+        type = lib.types.str;
       };
 
-      username = mkOption {
+      username = lib.mkOption {
         description = "The username to connect to the remote InfluxDB server";
-        type = types.str;
+        type = lib.types.str;
       };
 
-      password = mkOption {
+      password = lib.mkOption {
         description = "The password to connect to the remote InfluxDB server";
-        type = types.str;
+        type = lib.types.str;
       };
     };
 
     alerta = {
-      enable = mkEnableOption "kapacitor alerta integration";
+      enable = lib.mkEnableOption "kapacitor alerta integration";
 
-      url = mkOption {
+      url = lib.mkOption {
         description = "The URL to the Alerta REST API";
         default = "http://localhost:5000";
-        type = types.str;
+        type = lib.types.str;
       };
 
-      token = mkOption {
+      token = lib.mkOption {
         description = "Default Alerta authentication token";
-        type = types.str;
+        type = lib.types.str;
         default = "";
       };
 
-      environment = mkOption {
+      environment = lib.mkOption {
         description = "Default Alerta environment";
-        type = types.str;
+        type = lib.types.str;
         default = "Production";
       };
 
-      origin = mkOption {
+      origin = lib.mkOption {
         description = "Default origin of alert";
-        type = types.str;
+        type = lib.types.str;
         default = "kapacitor";
       };
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     environment.systemPackages = [ pkgs.kapacitor ];
 
     systemd.tmpfiles.settings."10-kapacitor".${cfg.dataDir}.d = {
diff --git a/nixos/modules/services/monitoring/karma.nix b/nixos/modules/services/monitoring/karma.nix
index b7ec5e4ae6fb..2300067719ff 100644
--- a/nixos/modules/services/monitoring/karma.nix
+++ b/nixos/modules/services/monitoring/karma.nix
@@ -1,17 +1,16 @@
 { config, pkgs, lib, ... }:
-with lib;
 let
   cfg = config.services.karma;
   yaml = pkgs.formats.yaml { };
 in
 {
   options.services.karma = {
-    enable = mkEnableOption "the Karma dashboard service";
+    enable = lib.mkEnableOption "the Karma dashboard service";
 
-    package = mkPackageOption pkgs "karma" { };
+    package = lib.mkPackageOption pkgs "karma" { };
 
-    configFile = mkOption {
-      type = types.path;
+    configFile = lib.mkOption {
+      type = lib.types.path;
       default = yaml.generate "karma.yaml" cfg.settings;
       defaultText = "A configuration file generated from the provided nix attributes settings option.";
       description = ''
@@ -20,8 +19,8 @@ in
       example = "/etc/karma/karma.conf";
     };
 
-    environment = mkOption {
-      type = with types; attrsOf str;
+    environment = lib.mkOption {
+      type = with lib.types; attrsOf str;
       default = {};
       description = ''
         Additional environment variables to provide to karma.
@@ -32,16 +31,16 @@ in
       };
     };
 
-    openFirewall = mkOption {
-      type = types.bool;
+    openFirewall = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = ''
         Whether to open ports in the firewall needed for karma to function.
       '';
     };
 
-    extraOptions = mkOption {
-      type = with types; listOf str;
+    extraOptions = lib.mkOption {
+      type = with lib.types; listOf str;
       default = [];
       description = ''
         Extra command line options.
@@ -51,13 +50,13 @@ in
       ];
     };
 
-    settings = mkOption {
-      type = types.submodule {
+    settings = lib.mkOption {
+      type = lib.types.submodule {
         freeformType = yaml.type;
 
         options.listen = {
-          address = mkOption {
-            type = types.str;
+          address = lib.mkOption {
+            type = lib.types.str;
             default = "127.0.0.1";
             description = ''
               Hostname or IP to listen on.
@@ -65,8 +64,8 @@ in
             example = "[::]";
           };
 
-          port = mkOption {
-            type = types.port;
+          port = lib.mkOption {
+            type = lib.types.port;
             default = 8080;
             description = ''
               HTTP port to listen on.
@@ -104,7 +103,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.karma = {
       description = "Alert dashboard for Prometheus Alertmanager";
       wantedBy = [ "multi-user.target" ];
@@ -113,9 +112,9 @@ in
         Type = "simple";
         DynamicUser = true;
         Restart = "on-failure";
-        ExecStart = "${pkgs.karma}/bin/karma --config.file ${cfg.configFile} ${concatStringsSep " " cfg.extraOptions}";
+        ExecStart = "${pkgs.karma}/bin/karma --config.file ${cfg.configFile} ${lib.concatStringsSep " " cfg.extraOptions}";
       };
     };
-    networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.settings.listen.port ];
+    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ cfg.settings.listen.port ];
   };
 }
diff --git a/nixos/modules/services/monitoring/kthxbye.nix b/nixos/modules/services/monitoring/kthxbye.nix
index 81f47fba6679..a4ea97f0fa75 100644
--- a/nixos/modules/services/monitoring/kthxbye.nix
+++ b/nixos/modules/services/monitoring/kthxbye.nix
@@ -1,33 +1,31 @@
 { config, pkgs, lib, ... }:
-with lib;
-
 let
   cfg = config.services.kthxbye;
 in
 
 {
   options.services.kthxbye = {
-    enable = mkEnableOption "kthxbye alert acknowledgement management daemon";
+    enable = lib.mkEnableOption "kthxbye alert acknowledgement management daemon";
 
-    package = mkPackageOption pkgs "kthxbye" { };
+    package = lib.mkPackageOption pkgs "kthxbye" { };
 
-    openFirewall = mkOption {
-      type = types.bool;
+    openFirewall = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = ''
         Whether to open ports in the firewall needed for the daemon to function.
       '';
     };
 
-    extraOptions = mkOption {
-      type = with types; listOf str;
+    extraOptions = lib.mkOption {
+      type = with lib.types; listOf str;
       default = [];
       description = ''
         Extra command line options.
 
         Documentation can be found [here](https://github.com/prymitive/kthxbye/blob/main/README.md).
       '';
-      example = literalExpression ''
+      example = lib.literalExpression ''
         [
           "-extend-with-prefix 'ACK!'"
         ];
@@ -35,16 +33,16 @@ in
     };
 
     alertmanager = {
-      timeout = mkOption {
-        type = types.str;
+      timeout = lib.mkOption {
+        type = lib.types.str;
         default = "1m0s";
         description = ''
           Alertmanager request timeout duration in the [time.Duration](https://pkg.go.dev/time#ParseDuration) format.
         '';
         example = "30s";
       };
-      uri = mkOption {
-        type = types.str;
+      uri = lib.mkOption {
+        type = lib.types.str;
         default = "http://localhost:9093";
         description = ''
           Alertmanager URI to use.
@@ -53,8 +51,8 @@ in
       };
     };
 
-    extendBy = mkOption {
-      type = types.str;
+    extendBy = lib.mkOption {
+      type = lib.types.str;
       default = "15m0s";
       description = ''
         Extend silences by adding DURATION seconds.
@@ -64,8 +62,8 @@ in
       example = "6h0m0s";
     };
 
-    extendIfExpiringIn = mkOption {
-      type = types.str;
+    extendIfExpiringIn = lib.mkOption {
+      type = lib.types.str;
       default = "5m0s";
       description = ''
         Extend silences that are about to expire in the next DURATION seconds.
@@ -75,8 +73,8 @@ in
       example = "1m0s";
     };
 
-    extendWithPrefix = mkOption {
-      type = types.str;
+    extendWithPrefix = lib.mkOption {
+      type = lib.types.str;
       default = "ACK!";
       description = ''
         Extend silences with comment starting with PREFIX string.
@@ -84,8 +82,8 @@ in
       example = "!perma-silence";
     };
 
-    interval = mkOption {
-      type = types.str;
+    interval = lib.mkOption {
+      type = lib.types.str;
       default = "45s";
       description = ''
         Silence check interval duration in the [time.Duration](https://pkg.go.dev/time#ParseDuration) format.
@@ -93,8 +91,8 @@ in
       example = "30s";
     };
 
-    listenAddress = mkOption {
-      type = types.str;
+    listenAddress = lib.mkOption {
+      type = lib.types.str;
       default = "0.0.0.0";
       description = ''
         The address to listen on for HTTP requests.
@@ -102,24 +100,24 @@ in
       example = "127.0.0.1";
     };
 
-    port = mkOption {
-      type = types.port;
+    port = lib.mkOption {
+      type = lib.types.port;
       default = 8080;
       description = ''
         The port to listen on for HTTP requests.
       '';
     };
 
-    logJSON = mkOption {
-      type = types.bool;
+    logJSON = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = ''
         Format logged messages as JSON.
       '';
     };
 
-    maxDuration = mkOption {
-      type = with types; nullOr str;
+    maxDuration = lib.mkOption {
+      type = with lib.types; nullOr str;
       default = null;
       description = ''
         Maximum duration of a silence, it won't be extended anymore after reaching it.
@@ -130,7 +128,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.kthxbye = {
       description = "kthxbye Alertmanager ack management daemon";
       wantedBy = [ "multi-user.target" ];
@@ -143,9 +141,9 @@ in
           -extend-with-prefix ${cfg.extendWithPrefix} \
           -interval ${cfg.interval} \
           -listen ${cfg.listenAddress}:${toString cfg.port} \
-          ${optionalString cfg.logJSON "-log-json"} \
-          ${optionalString (cfg.maxDuration != null) "-max-duration ${cfg.maxDuration}"} \
-          ${concatStringsSep " " cfg.extraOptions}
+          ${lib.optionalString cfg.logJSON "-log-json"} \
+          ${lib.optionalString (cfg.maxDuration != null) "-max-duration ${cfg.maxDuration}"} \
+          ${lib.concatStringsSep " " cfg.extraOptions}
       '';
       serviceConfig = {
         Type = "simple";
@@ -154,6 +152,6 @@ in
       };
     };
 
-    networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ];
+    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ cfg.port ];
   };
 }
diff --git a/nixos/modules/services/monitoring/longview.nix b/nixos/modules/services/monitoring/longview.nix
index aafe54b994ab..ecb4836169db 100644
--- a/nixos/modules/services/monitoring/longview.nix
+++ b/nixos/modules/services/monitoring/longview.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.longview;
 
@@ -13,16 +10,16 @@ in {
 
     services.longview = {
 
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           If enabled, system metrics will be sent to Linode LongView.
         '';
       };
 
-      apiKey = mkOption {
-        type = types.str;
+      apiKey = lib.mkOption {
+        type = lib.types.str;
         default = "";
         example = "01234567-89AB-CDEF-0123456789ABCDEF";
         description = ''
@@ -34,8 +31,8 @@ in {
         '';
       };
 
-      apiKeyFile = mkOption {
-        type = types.nullOr types.path;
+      apiKeyFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
         default = null;
         example = "/run/keys/longview-api-key";
         description = ''
@@ -47,8 +44,8 @@ in {
         '';
       };
 
-      apacheStatusUrl = mkOption {
-        type = types.str;
+      apacheStatusUrl = lib.mkOption {
+        type = lib.types.str;
         default = "";
         example = "http://127.0.0.1/server-status";
         description = ''
@@ -58,8 +55,8 @@ in {
         '';
       };
 
-      nginxStatusUrl = mkOption {
-        type = types.str;
+      nginxStatusUrl = lib.mkOption {
+        type = lib.types.str;
         default = "";
         example = "http://127.0.0.1/nginx_status";
         description = ''
@@ -69,8 +66,8 @@ in {
         '';
       };
 
-      mysqlUser = mkOption {
-        type = types.str;
+      mysqlUser = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = ''
           The user for connecting to the MySQL database. If provided,
@@ -80,8 +77,8 @@ in {
         '';
       };
 
-      mysqlPassword = mkOption {
-        type = types.str;
+      mysqlPassword = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = ''
           The password corresponding to {option}`mysqlUser`.
@@ -90,8 +87,8 @@ in {
         '';
       };
 
-      mysqlPasswordFile = mkOption {
-        type = types.nullOr types.path;
+      mysqlPasswordFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
         default = null;
         example = "/run/keys/dbpassword";
         description = ''
@@ -103,7 +100,7 @@ in {
 
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.longview =
       { description = "Longview Metrics Collection";
         after = [ "network.target" ];
@@ -116,27 +113,27 @@ in {
         preStart = ''
           umask 077
           mkdir -p ${configsDir}
-        '' + (optionalString (cfg.apiKeyFile != null) ''
+        '' + (lib.optionalString (cfg.apiKeyFile != null) ''
           cp --no-preserve=all "${cfg.apiKeyFile}" ${runDir}/longview.key
-        '') + (optionalString (cfg.apacheStatusUrl != "") ''
+        '') + (lib.optionalString (cfg.apacheStatusUrl != "") ''
           cat > ${configsDir}/Apache.conf <<EOF
           location ${cfg.apacheStatusUrl}?auto
           EOF
-        '') + (optionalString (cfg.mysqlUser != "" && cfg.mysqlPasswordFile != null) ''
+        '') + (lib.optionalString (cfg.mysqlUser != "" && cfg.mysqlPasswordFile != null) ''
           cat > ${configsDir}/MySQL.conf <<EOF
           username ${cfg.mysqlUser}
           password `head -n1 "${cfg.mysqlPasswordFile}"`
           EOF
-        '') + (optionalString (cfg.nginxStatusUrl != "") ''
+        '') + (lib.optionalString (cfg.nginxStatusUrl != "") ''
           cat > ${configsDir}/Nginx.conf <<EOF
           location ${cfg.nginxStatusUrl}
           EOF
         '');
       };
 
-    warnings = let warn = k: optional (cfg.${k} != "")
+    warnings = let warn = k: lib.optional (cfg.${k} != "")
                  "config.services.longview.${k} is insecure. Use ${k}File instead.";
-               in concatMap warn [ "apiKey" "mysqlPassword" ];
+               in lib.concatMap warn [ "apiKey" "mysqlPassword" ];
 
     assertions = [
       { assertion = cfg.apiKeyFile != null;
@@ -145,14 +142,14 @@ in {
     ];
 
     # Create API key file if not configured.
-    services.longview.apiKeyFile = mkIf (cfg.apiKey != "")
-      (mkDefault (toString (pkgs.writeTextFile {
+    services.longview.apiKeyFile = lib.mkIf (cfg.apiKey != "")
+      (lib.mkDefault (toString (pkgs.writeTextFile {
         name = "longview.key";
         text = cfg.apiKey;
       })));
 
     # Create MySQL password file if not configured.
-    services.longview.mysqlPasswordFile = mkDefault (toString (pkgs.writeTextFile {
+    services.longview.mysqlPasswordFile = lib.mkDefault (toString (pkgs.writeTextFile {
       name = "mysql-password-file";
       text = cfg.mysqlPassword;
     }));
diff --git a/nixos/modules/services/monitoring/mackerel-agent.nix b/nixos/modules/services/monitoring/mackerel-agent.nix
index 0908ea9ca68e..4d2d2e6c5972 100644
--- a/nixos/modules/services/monitoring/mackerel-agent.nix
+++ b/nixos/modules/services/monitoring/mackerel-agent.nix
@@ -1,24 +1,21 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.mackerel-agent;
   settingsFmt = pkgs.formats.toml {};
 in {
   options.services.mackerel-agent = {
-    enable = mkEnableOption "mackerel.io agent";
+    enable = lib.mkEnableOption "mackerel.io agent";
 
     # the upstream package runs as root, but doesn't seem to be strictly
     # necessary for basic functionality
-    runAsRoot = mkEnableOption "running as root";
+    runAsRoot = lib.mkEnableOption "running as root";
 
-    autoRetirement = mkEnableOption ''
+    autoRetirement = lib.mkEnableOption ''
       retiring the host upon OS shutdown
     '';
 
-    apiKeyFile = mkOption {
-      type = types.path;
+    apiKeyFile = lib.mkOption {
+      type = lib.types.path;
       example = "/run/keys/mackerel-api-key";
       description = ''
         Path to file containing the Mackerel API key. The file should contain a
@@ -28,7 +25,7 @@ in {
       '';
     };
 
-    settings = mkOption {
+    settings = lib.mkOption {
       description = ''
         Options for mackerel-agent.conf.
 
@@ -42,29 +39,29 @@ in {
         silent = false;
       };
 
-      type = types.submodule {
+      type = lib.types.submodule {
         freeformType = settingsFmt.type;
 
         options.host_status = {
-          on_start = mkOption {
-            type = types.enum [ "working" "standby" "maintenance" "poweroff" ];
+          on_start = lib.mkOption {
+            type = lib.types.enum [ "working" "standby" "maintenance" "poweroff" ];
             description = "Host status after agent startup.";
             default = "working";
           };
-          on_stop = mkOption {
-            type = types.enum [ "working" "standby" "maintenance" "poweroff" ];
+          on_stop = lib.mkOption {
+            type = lib.types.enum [ "working" "standby" "maintenance" "poweroff" ];
             description = "Host status after agent shutdown.";
             default = "poweroff";
           };
         };
 
         options.diagnostic =
-          mkEnableOption "collecting memory usage for the agent itself";
+          lib.mkEnableOption "collecting memory usage for the agent itself";
       };
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     environment.systemPackages = with pkgs; [ mackerel-agent ];
 
     environment.etc = {
@@ -74,11 +71,11 @@ in {
     };
 
     services.mackerel-agent.settings = {
-      root = mkDefault "/var/lib/mackerel-agent";
-      pidfile = mkDefault "/run/mackerel-agent/mackerel-agent.pid";
+      root = lib.mkDefault "/var/lib/mackerel-agent";
+      pidfile = lib.mkDefault "/run/mackerel-agent/mackerel-agent.pid";
 
       # conf.d stores the symlink to cfg.apiKeyFile
-      include = mkDefault "/etc/mackerel-agent/conf.d/*.conf";
+      include = lib.mkDefault "/etc/mackerel-agent/conf.d/*.conf";
     };
 
     # upstream service file in https://github.com/mackerelio/mackerel-agent/blob/master/packaging/rpm/src/mackerel-agent.service
@@ -88,20 +85,20 @@ in {
       after = [ "network-online.target" "nss-lookup.target" ];
       wantedBy = [ "multi-user.target" ];
       environment = {
-        MACKEREL_PLUGIN_WORKDIR = mkDefault "%C/mackerel-agent";
+        MACKEREL_PLUGIN_WORKDIR = lib.mkDefault "%C/mackerel-agent";
       };
       serviceConfig = {
         DynamicUser = !cfg.runAsRoot;
-        PrivateTmp = mkDefault true;
+        PrivateTmp = lib.mkDefault true;
         CacheDirectory = "mackerel-agent";
         ConfigurationDirectory = "mackerel-agent";
         RuntimeDirectory = "mackerel-agent";
         StateDirectory = "mackerel-agent";
         ExecStart = "${pkgs.mackerel-agent}/bin/mackerel-agent supervise";
-        ExecStopPost = mkIf cfg.autoRetirement "${pkgs.mackerel-agent}/bin/mackerel-agent retire -force";
+        ExecStopPost = lib.mkIf cfg.autoRetirement "${pkgs.mackerel-agent}/bin/mackerel-agent retire -force";
         ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
-        LimitNOFILE = mkDefault 65536;
-        LimitNPROC = mkDefault 65536;
+        LimitNOFILE = lib.mkDefault 65536;
+        LimitNPROC = lib.mkDefault 65536;
       };
       restartTriggers = [
         config.environment.etc."mackerel-agent/mackerel-agent.conf".source
diff --git a/nixos/modules/services/monitoring/monit.nix b/nixos/modules/services/monitoring/monit.nix
index 379ee967620e..3fa4e178b113 100644
--- a/nixos/modules/services/monitoring/monit.nix
+++ b/nixos/modules/services/monitoring/monit.nix
@@ -1,7 +1,4 @@
 {config, pkgs, lib, ...}:
-
-with lib;
-
 let
   cfg = config.services.monit;
 in
@@ -9,17 +6,17 @@ in
 {
   options.services.monit = {
 
-    enable = mkEnableOption "Monit";
+    enable = lib.mkEnableOption "Monit";
 
-    config = mkOption {
-      type = types.lines;
+    config = lib.mkOption {
+      type = lib.types.lines;
       default = "";
       description = "monitrc content";
     };
 
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     environment.systemPackages = [ pkgs.monit ];
 
@@ -44,5 +41,5 @@ in
 
   };
 
-  meta.maintainers = with maintainers; [ ryantm ];
+  meta.maintainers = with lib.maintainers; [ ryantm ];
 }
diff --git a/nixos/modules/services/monitoring/munin.nix b/nixos/modules/services/monitoring/munin.nix
index 401f6383cb57..91a000ade87b 100644
--- a/nixos/modules/services/monitoring/munin.nix
+++ b/nixos/modules/services/monitoring/munin.nix
@@ -1,18 +1,12 @@
 { config, lib, pkgs, ... }:
-
 # TODO: support munin-async
 # TODO: LWP/Pg perl libs aren't recognized
-
 # TODO: support fastcgi
 # https://guide.munin-monitoring.org/en/latest/example/webserver/apache-cgi.html
 # spawn-fcgi -s /run/munin/fastcgi-graph.sock -U www-data   -u munin -g munin /usr/lib/munin/cgi/munin-cgi-graph
 # spawn-fcgi -s /run/munin/fastcgi-html.sock  -U www-data   -u munin -g munin /usr/lib/munin/cgi/munin-cgi-html
 # https://paste.sh/vofcctHP#-KbDSXVeWoifYncZmLfZzgum
 # nginx https://munin.readthedocs.org/en/latest/example/webserver/nginx.html
-
-
-with lib;
-
 let
   nodeCfg = config.services.munin-node;
   cronCfg = config.services.munin-cron;
@@ -140,9 +134,9 @@ in
 
     services.munin-node = {
 
-      enable = mkOption {
+      enable = lib.mkOption {
         default = false;
-        type = types.bool;
+        type = lib.types.bool;
         description = ''
           Enable Munin Node agent. Munin node listens on 0.0.0.0 and
           by default accepts connections only from 127.0.0.1 for security reasons.
@@ -151,18 +145,18 @@ in
         '';
       };
 
-      extraConfig = mkOption {
+      extraConfig = lib.mkOption {
         default = "";
-        type = types.lines;
+        type = lib.types.lines;
         description = ''
           {file}`munin-node.conf` extra configuration. See
           <https://guide.munin-monitoring.org/en/latest/reference/munin-node.conf.html>
         '';
       };
 
-      extraPluginConfig = mkOption {
+      extraPluginConfig = lib.mkOption {
         default = "";
-        type = types.lines;
+        type = lib.types.lines;
         description = ''
           {file}`plugin-conf.d` extra plugin configuration. See
           <https://guide.munin-monitoring.org/en/latest/plugin/use.html>
@@ -173,9 +167,9 @@ in
         '';
       };
 
-      extraPlugins = mkOption {
+      extraPlugins = lib.mkOption {
         default = {};
-        type = with types; attrsOf path;
+        type = with lib.types; attrsOf path;
         description = ''
           Additional Munin plugins to activate. Keys are the name of the plugin
           symlink, values are the path to the underlying plugin script. You
@@ -194,7 +188,7 @@ in
           `/bin`, `/usr/bin`,
           `/sbin`, and `/usr/sbin`.
         '';
-        example = literalExpression ''
+        example = lib.literalExpression ''
           {
             zfs_usage_bigpool = /src/munin-contrib/plugins/zfs/zfs_usage_;
             zfs_usage_smallpool = /src/munin-contrib/plugins/zfs/zfs_usage_;
@@ -203,9 +197,9 @@ in
         '';
       };
 
-      extraAutoPlugins = mkOption {
+      extraAutoPlugins = lib.mkOption {
         default = [];
-        type = with types; listOf path;
+        type = with lib.types; listOf path;
         description = ''
           Additional Munin plugins to autoconfigure, using
           `munin-node-configure --suggest`. These should be
@@ -225,7 +219,7 @@ in
           `/bin`, `/usr/bin`,
           `/sbin`, and `/usr/sbin`.
         '';
-        example = literalExpression ''
+        example = lib.literalExpression ''
           [
             /src/munin-contrib/plugins/zfs
             /src/munin-contrib/plugins/ssh
@@ -233,12 +227,12 @@ in
         '';
       };
 
-      disabledPlugins = mkOption {
+      disabledPlugins = lib.mkOption {
         # TODO: figure out why Munin isn't writing the log file and fix it.
         # In the meantime this at least suppresses a useless graph full of
         # NaNs in the output.
         default = [ "munin_stats" ];
-        type = with types; listOf str;
+        type = with lib.types; listOf str;
         description = ''
           Munin plugins to disable, even if
           `munin-node-configure --suggest` tries to enable
@@ -255,9 +249,9 @@ in
 
     services.munin-cron = {
 
-      enable = mkOption {
+      enable = lib.mkOption {
         default = false;
-        type = types.bool;
+        type = lib.types.bool;
         description = ''
           Enable munin-cron. Takes care of all heavy lifting to collect data from
           nodes and draws graphs to html. Runs munin-update, munin-limits,
@@ -268,9 +262,9 @@ in
         '';
       };
 
-      extraGlobalConfig = mkOption {
+      extraGlobalConfig = lib.mkOption {
         default = "";
-        type = types.lines;
+        type = lib.types.lines;
         description = ''
           {file}`munin.conf` extra global configuration.
           See <https://guide.munin-monitoring.org/en/latest/reference/munin.conf.html>.
@@ -282,15 +276,15 @@ in
         '';
       };
 
-      hosts = mkOption {
+      hosts = lib.mkOption {
         default = "";
-        type = types.lines;
+        type = lib.types.lines;
         description = ''
           Definitions of hosts of nodes to collect data from. Needs at least one
           host for cron to succeed. See
           <https://guide.munin-monitoring.org/en/latest/reference/munin.conf.html>
         '';
-        example = literalExpression ''
+        example = lib.literalExpression ''
           '''
             [''${config.networking.hostName}]
             address localhost
@@ -298,9 +292,9 @@ in
         '';
       };
 
-      extraCSS = mkOption {
+      extraCSS = lib.mkOption {
         default = "";
-        type = types.lines;
+        type = lib.types.lines;
         description = ''
           Custom styling for the HTML that munin-cron generates. This will be
           appended to the CSS files used by munin-cron and will thus take
@@ -320,7 +314,7 @@ in
 
   };
 
-  config = mkMerge [ (mkIf (nodeCfg.enable || cronCfg.enable)  {
+  config = lib.mkMerge [ (lib.mkIf (nodeCfg.enable || cronCfg.enable)  {
 
     environment.systemPackages = [ pkgs.munin ];
 
@@ -335,7 +329,7 @@ in
       gid = config.ids.gids.munin;
     };
 
-  }) (mkIf nodeCfg.enable {
+  }) (lib.mkIf nodeCfg.enable {
 
     systemd.services.munin-node = {
       description = "Munin Node";
@@ -380,7 +374,7 @@ in
       group = "munin";
     };
 
-  }) (mkIf cronCfg.enable {
+  }) (lib.mkIf cronCfg.enable {
 
     # Munin is hardcoded to use DejaVu Mono and the graphs come out wrong if
     # it's not available.
diff --git a/nixos/modules/services/monitoring/nagios.nix b/nixos/modules/services/monitoring/nagios.nix
index e475d41270b1..b8bb4cae8a06 100644
--- a/nixos/modules/services/monitoring/nagios.nix
+++ b/nixos/modules/services/monitoring/nagios.nix
@@ -1,8 +1,5 @@
 # Nagios system/network monitoring daemon.
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.nagios;
 
@@ -35,8 +32,8 @@ let
       illegal_macro_output_chars="`~$&|'\"<>";
       retain_state_information="1";
     };
-    lines = mapAttrsToList (key: value: "${key}=${value}") (default // cfg.extraConfig);
-    content = concatStringsSep "\n" lines;
+    lines = lib.mapAttrsToList (key: value: "${key}=${value}") (default // cfg.extraConfig);
+    content = lib.concatStringsSep "\n" lines;
     file = pkgs.writeText "nagios.cfg" content;
     validated =  pkgs.runCommand "nagios-checked.cfg" {preferLocalBuild=true;} ''
       cp ${file} nagios.cfg
@@ -81,45 +78,45 @@ let
 in
 {
   imports = [
-    (mkRemovedOptionModule [ "services" "nagios" "urlPath" ] "The urlPath option has been removed as it is hard coded to /nagios in the nagios package.")
+    (lib.mkRemovedOptionModule [ "services" "nagios" "urlPath" ] "The urlPath option has been removed as it is hard coded to /nagios in the nagios package.")
   ];
 
   meta.maintainers = with lib.maintainers; [ symphorien ];
 
   options = {
     services.nagios = {
-      enable = mkEnableOption ''[Nagios](https://www.nagios.org/) to monitor your system or network'';
+      enable = lib.mkEnableOption ''[Nagios](https://www.nagios.org/) to monitor your system or network'';
 
-      objectDefs = mkOption {
+      objectDefs = lib.mkOption {
         description = ''
           A list of Nagios object configuration files that must define
           the hosts, host groups, services and contacts for the
           network that you want Nagios to monitor.
         '';
-        type = types.listOf types.path;
-        example = literalExpression "[ ./objects.cfg ]";
+        type = lib.types.listOf lib.types.path;
+        example = lib.literalExpression "[ ./objects.cfg ]";
       };
 
-      plugins = mkOption {
-        type = types.listOf types.package;
+      plugins = lib.mkOption {
+        type = lib.types.listOf lib.types.package;
         default = with pkgs; [ monitoring-plugins msmtp mailutils ];
-        defaultText = literalExpression "[pkgs.monitoring-plugins pkgs.msmtp pkgs.mailutils]";
+        defaultText = lib.literalExpression "[pkgs.monitoring-plugins pkgs.msmtp pkgs.mailutils]";
         description = ''
           Packages to be added to the Nagios {env}`PATH`.
           Typically used to add plugins, but can be anything.
         '';
       };
 
-      mainConfigFile = mkOption {
-        type = types.nullOr types.package;
+      mainConfigFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.package;
         default = null;
         description = ''
           If non-null, overrides the main configuration file of Nagios.
         '';
       };
 
-      extraConfig = mkOption {
-        type = types.attrsOf types.str;
+      extraConfig = lib.mkOption {
+        type = lib.types.attrsOf lib.types.str;
         example = {
           debug_level = "-1";
           debug_file = "/var/log/nagios/debug.log";
@@ -128,25 +125,25 @@ in
         description = "Configuration to add to /etc/nagios.cfg";
       };
 
-      validateConfig = mkOption {
-        type = types.bool;
+      validateConfig = lib.mkOption {
+        type = lib.types.bool;
         default = pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform;
-        defaultText = literalExpression "pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform";
+        defaultText = lib.literalExpression "pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform";
         description = "if true, the syntax of the nagios configuration file is checked at build time";
       };
 
-      cgiConfigFile = mkOption {
-        type = types.package;
+      cgiConfigFile = lib.mkOption {
+        type = lib.types.package;
         default = nagiosCGICfgFile;
-        defaultText = literalExpression "nagiosCGICfgFile";
+        defaultText = lib.literalExpression "nagiosCGICfgFile";
         description = ''
           Derivation for the configuration file of Nagios CGI scripts
           that can be used in web servers for running the Nagios web interface.
         '';
       };
 
-      enableWebInterface = mkOption {
-        type = types.bool;
+      enableWebInterface = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to enable the Nagios web interface.  You should also
@@ -154,9 +151,9 @@ in
         '';
       };
 
-      virtualHost = mkOption {
-        type = types.submodule (import ../web-servers/apache-httpd/vhost-options.nix);
-        example = literalExpression ''
+      virtualHost = lib.mkOption {
+        type = lib.types.submodule (import ../web-servers/apache-httpd/vhost-options.nix);
+        example = lib.literalExpression ''
           { hostName = "example.org";
             adminAddr = "webmaster@example.org";
             enableSSL = true;
@@ -173,7 +170,7 @@ in
   };
 
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     users.users.nagios = {
       description = "Nagios user";
       uid         = config.ids.uids.nagios;
@@ -206,8 +203,8 @@ in
       };
     };
 
-    services.httpd.virtualHosts = optionalAttrs cfg.enableWebInterface {
-      ${cfg.virtualHost.hostName} = mkMerge [ cfg.virtualHost { extraConfig = extraHttpdConfig; } ];
+    services.httpd.virtualHosts = lib.optionalAttrs cfg.enableWebInterface {
+      ${cfg.virtualHost.hostName} = lib.mkMerge [ cfg.virtualHost { extraConfig = extraHttpdConfig; } ];
     };
   };
 }
diff --git a/nixos/modules/services/monitoring/netdata.nix b/nixos/modules/services/monitoring/netdata.nix
index 6e18ef562b8f..cbcfc2d008d5 100644
--- a/nixos/modules/services/monitoring/netdata.nix
+++ b/nixos/modules/services/monitoring/netdata.nix
@@ -1,7 +1,4 @@
 { config, pkgs, lib, ... }:
-
-with lib;
-
 let
   cfg = config.services.netdata;
 
@@ -25,7 +22,7 @@ let
 
   configDirectory = pkgs.runCommand "netdata-config-d" { } ''
     mkdir $out
-    ${concatStringsSep "\n" (mapAttrsToList (path: file: ''
+    ${lib.concatStringsSep "\n" (lib.mapAttrsToList (path: file: ''
         mkdir -p "$out/$(dirname ${path})"
         ln -s "${file}" "$out/${path}"
       '') cfg.configDir)}
@@ -34,7 +31,7 @@ let
   localConfig = {
     global = {
       "config directory" = "/etc/netdata/conf.d";
-      "plugins directory" = concatStringsSep " " plugins;
+      "plugins directory" = lib.concatStringsSep " " plugins;
     };
     web = {
       "web files owner" = "root";
@@ -45,7 +42,7 @@ let
       "use unified cgroups" = "yes";
     };
   };
-  mkConfig = generators.toINI {} (recursiveUpdate localConfig cfg.config);
+  mkConfig = lib.generators.toINI {} (lib.recursiveUpdate localConfig cfg.config);
   configFile = pkgs.writeText "netdata.conf" (if cfg.configText != null then cfg.configText else mkConfig);
 
   defaultUser = "netdata";
@@ -54,24 +51,24 @@ let
 in {
   options = {
     services.netdata = {
-      enable = mkEnableOption "netdata";
+      enable = lib.mkEnableOption "netdata";
 
-      package = mkPackageOption pkgs "netdata" { };
+      package = lib.mkPackageOption pkgs "netdata" { };
 
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         default = "netdata";
         description = "User account under which netdata runs.";
       };
 
-      group = mkOption {
-        type = types.str;
+      group = lib.mkOption {
+        type = lib.types.str;
         default = "netdata";
         description = "Group under which netdata runs.";
       };
 
-      configText = mkOption {
-        type = types.nullOr types.lines;
+      configText = lib.mkOption {
+        type = lib.types.nullOr lib.types.lines;
         description = "Verbatim netdata.conf, cannot be combined with config.";
         default = null;
         example = ''
@@ -83,26 +80,26 @@ in {
       };
 
       python = {
-        enable = mkOption {
-          type = types.bool;
+        enable = lib.mkOption {
+          type = lib.types.bool;
           default = true;
           description = ''
             Whether to enable python-based plugins
           '';
         };
-        recommendedPythonPackages = mkOption {
-          type = types.bool;
+        recommendedPythonPackages = lib.mkOption {
+          type = lib.types.bool;
           default = false;
           description = ''
             Whether to enable a set of recommended Python plugins
             by installing extra Python packages.
           '';
         };
-        extraPackages = mkOption {
-          type = types.functionTo (types.listOf types.package);
+        extraPackages = lib.mkOption {
+          type = lib.types.functionTo (lib.types.listOf lib.types.package);
           default = ps: [];
-          defaultText = literalExpression "ps: []";
-          example = literalExpression ''
+          defaultText = lib.literalExpression "ps: []";
+          example = lib.literalExpression ''
             ps: [
               ps.psycopg2
               ps.docker
@@ -116,10 +113,10 @@ in {
         };
       };
 
-      extraPluginPaths = mkOption {
-        type = types.listOf types.path;
+      extraPluginPaths = lib.mkOption {
+        type = lib.types.listOf lib.types.path;
         default = [ ];
-        example = literalExpression ''
+        example = lib.literalExpression ''
           [ "/path/to/plugins.d" ]
         '';
         description = ''
@@ -134,11 +131,11 @@ in {
         '';
       };
 
-      config = mkOption {
-        type = types.attrsOf types.attrs;
+      config = lib.mkOption {
+        type = lib.types.attrsOf lib.types.attrs;
         default = {};
         description = "netdata.conf configuration as nix attributes. cannot be combined with configText.";
-        example = literalExpression ''
+        example = lib.literalExpression ''
           global = {
             "debug log" = "syslog";
             "access log" = "syslog";
@@ -147,8 +144,8 @@ in {
         '';
       };
 
-      configDir = mkOption {
-        type = types.attrsOf types.path;
+      configDir = lib.mkOption {
+        type = lib.types.attrsOf lib.types.path;
         default = {};
         description = ''
           Complete netdata config directory except netdata.conf.
@@ -159,7 +156,7 @@ in {
           Its value is the absolute path and must be readable by netdata.
           Cannot be combined with configText.
         '';
-        example = literalExpression ''
+        example = lib.literalExpression ''
           "health_alarm_notify.conf" = pkgs.writeText "health_alarm_notify.conf" '''
             sendmail="/path/to/sendmail"
           ''';
@@ -167,8 +164,8 @@ in {
         '';
       };
 
-      claimTokenFile = mkOption {
-        type = types.nullOr types.path;
+      claimTokenFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
         default = null;
         description = ''
           If set, automatically registers the agent using the given claim token
@@ -176,8 +173,8 @@ in {
         '';
       };
 
-      enableAnalyticsReporting = mkOption {
-        type = types.bool;
+      enableAnalyticsReporting = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Enable reporting of anonymous usage statistics to Netdata Inc. via either
@@ -187,8 +184,8 @@ in {
         '';
       };
 
-      deadlineBeforeStopSec = mkOption {
-        type = types.int;
+      deadlineBeforeStopSec = lib.mkOption {
+        type = lib.types.int;
         default = 120;
         description = ''
           In order to detect when netdata is misbehaving, we run a concurrent task pinging netdata (wait-for-netdata-up)
@@ -203,7 +200,7 @@ in {
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     assertions =
       [ { assertion = cfg.config != {} -> cfg.configText == null ;
           message = "Cannot specify both config and configText";
@@ -220,7 +217,7 @@ in {
       ps.netdata-pandas
     ]);
 
-    services.netdata.configDir.".opt-out-from-anonymous-statistics" = mkIf (!cfg.enableAnalyticsReporting) (pkgs.writeText ".opt-out-from-anonymous-statistics" "");
+    services.netdata.configDir.".opt-out-from-anonymous-statistics" = lib.mkIf (!cfg.enableAnalyticsReporting) (pkgs.writeText ".opt-out-from-anonymous-statistics" "");
     environment.etc."netdata/netdata.conf".source = configFile;
     environment.etc."netdata/conf.d".source = configDirectory;
 
@@ -381,7 +378,7 @@ in {
         permissions = "u+rx,g+x,o-rwx";
       };
 
-    } // optionalAttrs (cfg.package.withIpmi) {
+    } // lib.optionalAttrs (cfg.package.withIpmi) {
       "freeipmi.plugin" = {
         source = "${cfg.package}/libexec/netdata/plugins.d/freeipmi.plugin.org";
         capabilities = "cap_dac_override,cap_fowner+ep";
@@ -389,7 +386,7 @@ in {
         group = cfg.group;
         permissions = "u+rx,g+x,o-rwx";
       };
-    } // optionalAttrs (cfg.package.withNetworkViewer) {
+    } // lib.optionalAttrs (cfg.package.withNetworkViewer) {
       "network-viewer.plugin" = {
         source = "${cfg.package}/libexec/netdata/plugins.d/network-viewer.plugin.org";
         capabilities = "cap_sys_admin,cap_dac_read_search,cap_sys_ptrace+ep";
@@ -404,7 +401,7 @@ in {
       { domain = "netdata"; type = "hard"; item = "nofile"; value = "30000"; }
     ];
 
-    users.users = optionalAttrs (cfg.user == defaultUser) {
+    users.users = lib.optionalAttrs (cfg.user == defaultUser) {
       ${defaultUser} = {
         group = defaultUser;
         isSystemUser = true;
@@ -413,7 +410,7 @@ in {
       };
     };
 
-    users.groups = optionalAttrs (cfg.group == defaultUser) {
+    users.groups = lib.optionalAttrs (cfg.group == defaultUser) {
       ${defaultUser} = { };
     };
 
diff --git a/nixos/modules/services/monitoring/osquery.nix b/nixos/modules/services/monitoring/osquery.nix
index 872f5e96a412..8f728ebab115 100644
--- a/nixos/modules/services/monitoring/osquery.nix
+++ b/nixos/modules/services/monitoring/osquery.nix
@@ -1,6 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
 let
   cfg = config.services.osquery;
   dirname = path: with lib.strings; with lib.lists; concatStringsSep "/"
@@ -13,8 +11,8 @@ let
   # flagfile is the file containing osquery command line flags to be
   # provided to the application using the special --flagfile option.
   flagfile = pkgs.writeText "osquery.flags"
-    (concatStringsSep "\n"
-      (mapAttrsToList (name: value: "--${name}=${value}")
+    (lib.concatStringsSep "\n"
+      (lib.mapAttrsToList (name: value: "--${name}=${value}")
         # Use the conf derivation if not otherwise specified.
         ({ config_path = conf; } // cfg.flags)));
 
@@ -26,9 +24,9 @@ let
 in
 {
   options.services.osquery = {
-    enable = mkEnableOption "osqueryd daemon";
+    enable = lib.mkEnableOption "osqueryd daemon";
 
-    settings = mkOption {
+    settings = lib.mkOption {
       default = { };
       description = ''
         Configuration to be written to the osqueryd JSON configuration file.
@@ -37,10 +35,10 @@ in
       example = {
         options.utc = false;
       };
-      type = types.attrs;
+      type = lib.types.attrs;
     };
 
-    flags = mkOption {
+    flags = lib.mkOption {
       default = { };
       description = ''
         Attribute set of flag names and values to be written to the osqueryd flagfile.
@@ -49,23 +47,23 @@ in
       example = {
         config_refresh = "10";
       };
-      type = with types;
+      type = with lib.types;
         submodule {
           freeformType = attrsOf str;
           options = {
-            database_path = mkOption {
+            database_path = lib.mkOption {
               default = "/var/lib/osquery/osquery.db";
               readOnly = true;
               description = "Path used for the database file.";
               type = path;
             };
-            logger_path = mkOption {
+            logger_path = lib.mkOption {
               default = "/var/log/osquery";
               readOnly = true;
               description = "Base directory used for logging.";
               type = path;
             };
-            pidfile = mkOption {
+            pidfile = lib.mkOption {
               default = "/run/osquery/osqueryd.pid";
               readOnly = true;
               description = "Path used for pid file.";
@@ -76,7 +74,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     environment.systemPackages = [ osqueryi ];
     systemd.services.osqueryd = {
       after = [ "network.target" "syslog.service" ];
diff --git a/nixos/modules/services/monitoring/prometheus/alertmanager-irc-relay.nix b/nixos/modules/services/monitoring/prometheus/alertmanager-irc-relay.nix
index eda4277c1bac..4995663ed7ca 100644
--- a/nixos/modules/services/monitoring/prometheus/alertmanager-irc-relay.nix
+++ b/nixos/modules/services/monitoring/prometheus/alertmanager-irc-relay.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.prometheus.alertmanagerIrcRelay;
 
@@ -10,19 +7,19 @@ let
 in
 {
   options.services.prometheus.alertmanagerIrcRelay = {
-    enable = mkEnableOption "Alertmanager IRC Relay";
+    enable = lib.mkEnableOption "Alertmanager IRC Relay";
 
-    package = mkPackageOption pkgs "alertmanager-irc-relay" { };
+    package = lib.mkPackageOption pkgs "alertmanager-irc-relay" { };
 
-    extraFlags = mkOption {
-      type = types.listOf types.str;
+    extraFlags = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
       default = [];
       description = "Extra command line options to pass to alertmanager-irc-relay.";
     };
 
-    settings = mkOption {
+    settings = lib.mkOption {
       type = configFormat.type;
-      example = literalExpression ''
+      example = lib.literalExpression ''
         {
           http_host = "localhost";
           http_port = 8000;
@@ -50,7 +47,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.alertmanager-irc-relay = {
       description = "Alertmanager IRC Relay";
 
@@ -61,7 +58,7 @@ in
         ExecStart = ''
           ${cfg.package}/bin/alertmanager-irc-relay \
           -config ${configFile} \
-          ${escapeShellArgs cfg.extraFlags}
+          ${lib.escapeShellArgs cfg.extraFlags}
         '';
 
         DynamicUser = true;
@@ -98,5 +95,5 @@ in
     };
   };
 
-  meta.maintainers = [ maintainers.oxzi ];
+  meta.maintainers = [ lib.maintainers.oxzi ];
 }
diff --git a/nixos/modules/services/monitoring/prometheus/alertmanager-webhook-logger.nix b/nixos/modules/services/monitoring/prometheus/alertmanager-webhook-logger.nix
index b3665b66ba40..1761e6305107 100644
--- a/nixos/modules/services/monitoring/prometheus/alertmanager-webhook-logger.nix
+++ b/nixos/modules/services/monitoring/prometheus/alertmanager-webhook-logger.nix
@@ -1,24 +1,21 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.prometheus.alertmanagerWebhookLogger;
 in
 {
   options.services.prometheus.alertmanagerWebhookLogger = {
-    enable = mkEnableOption "Alertmanager Webhook Logger";
+    enable = lib.mkEnableOption "Alertmanager Webhook Logger";
 
-    package = mkPackageOption pkgs "alertmanager-webhook-logger" { };
+    package = lib.mkPackageOption pkgs "alertmanager-webhook-logger" { };
 
-    extraFlags = mkOption {
-      type = types.listOf types.str;
+    extraFlags = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
       default = [];
       description = "Extra command line options to pass to alertmanager-webhook-logger.";
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.alertmanager-webhook-logger = {
       description = "Alertmanager Webhook Logger";
 
@@ -29,7 +26,7 @@ in
       serviceConfig = {
         ExecStart = ''
           ${cfg.package}/bin/alertmanager-webhook-logger \
-          ${escapeShellArgs cfg.extraFlags}
+          ${lib.escapeShellArgs cfg.extraFlags}
         '';
 
         CapabilityBoundingSet = [ "" ];
@@ -77,5 +74,5 @@ in
     };
   };
 
-  meta.maintainers = [ maintainers.jpds ];
+  meta.maintainers = [ lib.maintainers.jpds ];
 }
diff --git a/nixos/modules/services/monitoring/prometheus/alertmanager.nix b/nixos/modules/services/monitoring/prometheus/alertmanager.nix
index 7e53ca04cb39..70bd07c59820 100644
--- a/nixos/modules/services/monitoring/prometheus/alertmanager.nix
+++ b/nixos/modules/services/monitoring/prometheus/alertmanager.nix
@@ -1,7 +1,4 @@
 { config, pkgs, lib, ... }:
-
-with lib;
-
 let
   cfg = config.services.prometheus.alertmanager;
   mkConfigFile = pkgs.writeText "alertmanager.yml" (builtins.toJSON cfg.configuration);
@@ -25,16 +22,16 @@ let
     "--log.level ${cfg.logLevel}"
     "--storage.path /var/lib/alertmanager"
     (toString (map (peer: "--cluster.peer ${peer}:9094") cfg.clusterPeers))
-    ] ++ (optional (cfg.webExternalUrl != null)
+    ] ++ (lib.optional (cfg.webExternalUrl != null)
       "--web.external-url ${cfg.webExternalUrl}"
-    ) ++ (optional (cfg.logFormat != null)
+    ) ++ (lib.optional (cfg.logFormat != null)
       "--log.format ${cfg.logFormat}"
   );
 in {
   imports = [
-    (mkRemovedOptionModule [ "services" "prometheus" "alertmanager" "user" ] "The alertmanager service is now using systemd's DynamicUser mechanism which obviates a user setting.")
-    (mkRemovedOptionModule [ "services" "prometheus" "alertmanager" "group" ] "The alertmanager service is now using systemd's DynamicUser mechanism which obviates a group setting.")
-    (mkRemovedOptionModule [ "services" "prometheus" "alertmanagerURL" ] ''
+    (lib.mkRemovedOptionModule [ "services" "prometheus" "alertmanager" "user" ] "The alertmanager service is now using systemd's DynamicUser mechanism which obviates a user setting.")
+    (lib.mkRemovedOptionModule [ "services" "prometheus" "alertmanager" "group" ] "The alertmanager service is now using systemd's DynamicUser mechanism which obviates a group setting.")
+    (lib.mkRemovedOptionModule [ "services" "prometheus" "alertmanagerURL" ] ''
       Due to incompatibility, the alertmanagerURL option has been removed,
       please use 'services.prometheus.alertmanagers' instead.
     '')
@@ -42,12 +39,12 @@ in {
 
   options = {
     services.prometheus.alertmanager = {
-      enable = mkEnableOption "Prometheus Alertmanager";
+      enable = lib.mkEnableOption "Prometheus Alertmanager";
 
-      package = mkPackageOption pkgs "prometheus-alertmanager" { };
+      package = lib.mkPackageOption pkgs "prometheus-alertmanager" { };
 
-      configuration = mkOption {
-        type = types.nullOr types.attrs;
+      configuration = lib.mkOption {
+        type = lib.types.nullOr lib.types.attrs;
         default = null;
         description = ''
           Alertmanager configuration as nix attribute set.
@@ -57,8 +54,8 @@ in {
         '';
       };
 
-      configText = mkOption {
-        type = types.nullOr types.lines;
+      configText = lib.mkOption {
+        type = lib.types.nullOr lib.types.lines;
         default = null;
         description = ''
           Alertmanager configuration as YAML text. If non-null, this option
@@ -71,8 +68,8 @@ in {
         '';
       };
 
-      checkConfig = mkOption {
-        type = types.bool;
+      checkConfig = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = ''
           Check configuration with `amtool check-config`. The call to `amtool` is
@@ -85,24 +82,24 @@ in {
         '';
       };
 
-      logFormat = mkOption {
-        type = types.nullOr types.str;
+      logFormat = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         description = ''
           If set use a syslog logger or JSON logging.
         '';
       };
 
-      logLevel = mkOption {
-        type = types.enum ["debug" "info" "warn" "error" "fatal"];
+      logLevel = lib.mkOption {
+        type = lib.types.enum ["debug" "info" "warn" "error" "fatal"];
         default = "warn";
         description = ''
           Only log messages with the given severity or above.
         '';
       };
 
-      webExternalUrl = mkOption {
-        type = types.nullOr types.str;
+      webExternalUrl = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         description = ''
           The URL under which Alertmanager is externally reachable (for example, if Alertmanager is served via a reverse proxy).
@@ -112,8 +109,8 @@ in {
         '';
       };
 
-      listenAddress = mkOption {
-        type = types.str;
+      listenAddress = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = ''
           Address to listen on for the web interface and API. Empty string will listen on all interfaces.
@@ -121,40 +118,40 @@ in {
         '';
       };
 
-      port = mkOption {
-        type = types.port;
+      port = lib.mkOption {
+        type = lib.types.port;
         default = 9093;
         description = ''
           Port to listen on for the web interface and API.
         '';
       };
 
-      openFirewall = mkOption {
-        type = types.bool;
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Open port in firewall for incoming connections.
         '';
       };
 
-      clusterPeers = mkOption {
-        type = types.listOf types.str;
+      clusterPeers = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [];
         description = ''
           Initial peers for HA cluster.
         '';
       };
 
-      extraFlags = mkOption {
-        type = types.listOf types.str;
+      extraFlags = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [];
         description = ''
           Extra commandline options when launching the Alertmanager.
         '';
       };
 
-      environmentFile = mkOption {
-        type = types.nullOr types.path;
+      environmentFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
         default = null;
         example = "/root/alertmanager.env";
         description = ''
@@ -167,16 +164,16 @@ in {
     };
   };
 
-  config = mkMerge [
-    (mkIf cfg.enable {
-      assertions = singleton {
+  config = lib.mkMerge [
+    (lib.mkIf cfg.enable {
+      assertions = lib.singleton {
         assertion = cfg.configuration != null || cfg.configText != null;
         message = "Can not enable alertmanager without a configuration. "
          + "Set either the `configuration` or `configText` attribute.";
       };
     })
-    (mkIf cfg.enable {
-      networking.firewall.allowedTCPPorts = optional cfg.openFirewall cfg.port;
+    (lib.mkIf cfg.enable {
+      networking.firewall.allowedTCPPorts = lib.optional cfg.openFirewall cfg.port;
 
       systemd.services.alertmanager = {
         wantedBy = [ "multi-user.target" ];
@@ -188,8 +185,8 @@ in {
         '';
         serviceConfig = {
           ExecStart = "${cfg.package}/bin/alertmanager" +
-            optionalString (length cmdlineArgs != 0) (" \\\n  " +
-              concatStringsSep " \\\n  " cmdlineArgs);
+            lib.optionalString (lib.length cmdlineArgs != 0) (" \\\n  " +
+              lib.concatStringsSep " \\\n  " cmdlineArgs);
           ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
 
           EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
diff --git a/nixos/modules/services/monitoring/prometheus/pushgateway.nix b/nixos/modules/services/monitoring/prometheus/pushgateway.nix
index d4f9c4a29f38..ebc8b9d889dc 100644
--- a/nixos/modules/services/monitoring/prometheus/pushgateway.nix
+++ b/nixos/modules/services/monitoring/prometheus/pushgateway.nix
@@ -1,7 +1,4 @@
 { config, pkgs, lib, ... }:
-
-with lib;
-
 let
   cfg = config.services.prometheus.pushgateway;
 
@@ -10,23 +7,23 @@ let
     ++ opt "web.telemetry-path" cfg.web.telemetry-path
     ++ opt "web.external-url" cfg.web.external-url
     ++ opt "web.route-prefix" cfg.web.route-prefix
-    ++ optional cfg.persistMetrics ''--persistence.file="/var/lib/${cfg.stateDir}/metrics"''
+    ++ lib.optional cfg.persistMetrics ''--persistence.file="/var/lib/${cfg.stateDir}/metrics"''
     ++ opt "persistence.interval" cfg.persistence.interval
     ++ opt "log.level" cfg.log.level
     ++ opt "log.format" cfg.log.format
     ++ cfg.extraFlags;
 
-  opt = k : v : optional (v != null) ''--${k}="${v}"'';
+  opt = k : v : lib.optional (v != null) ''--${k}="${v}"'';
 
 in {
   options = {
     services.prometheus.pushgateway = {
-      enable = mkEnableOption "Prometheus Pushgateway";
+      enable = lib.mkEnableOption "Prometheus Pushgateway";
 
-      package = mkPackageOption pkgs "prometheus-pushgateway" { };
+      package = lib.mkPackageOption pkgs "prometheus-pushgateway" { };
 
-      web.listen-address = mkOption {
-        type = types.nullOr types.str;
+      web.listen-address = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         description = ''
           Address to listen on for the web interface, API and telemetry.
@@ -35,8 +32,8 @@ in {
         '';
       };
 
-      web.telemetry-path = mkOption {
-        type = types.nullOr types.str;
+      web.telemetry-path = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         description = ''
           Path under which to expose metrics.
@@ -45,16 +42,16 @@ in {
         '';
       };
 
-      web.external-url = mkOption {
-        type = types.nullOr types.str;
+      web.external-url = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         description = ''
           The URL under which Pushgateway is externally reachable.
         '';
       };
 
-      web.route-prefix = mkOption {
-        type = types.nullOr types.str;
+      web.route-prefix = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         description = ''
           Prefix for the internal routes of web endpoints.
@@ -64,8 +61,8 @@ in {
         '';
       };
 
-      persistence.interval = mkOption {
-        type = types.nullOr types.str;
+      persistence.interval = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         example = "10m";
         description = ''
@@ -75,8 +72,8 @@ in {
         '';
       };
 
-      log.level = mkOption {
-        type = types.nullOr (types.enum ["debug" "info" "warn" "error" "fatal"]);
+      log.level = lib.mkOption {
+        type = lib.types.nullOr (lib.types.enum ["debug" "info" "warn" "error" "fatal"]);
         default = null;
         description = ''
           Only log messages with the given severity or above.
@@ -85,8 +82,8 @@ in {
         '';
       };
 
-      log.format = mkOption {
-        type = types.nullOr types.str;
+      log.format = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
         default = null;
         example = "logger:syslog?appname=bob&local=7";
         description = ''
@@ -96,16 +93,16 @@ in {
         '';
       };
 
-      extraFlags = mkOption {
-        type = types.listOf types.str;
+      extraFlags = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [];
         description = ''
           Extra commandline options when launching the Pushgateway.
         '';
       };
 
-      persistMetrics = mkOption {
-        type = types.bool;
+      persistMetrics = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to persist metrics to a file.
@@ -118,8 +115,8 @@ in {
         '';
       };
 
-      stateDir = mkOption {
-        type = types.str;
+      stateDir = lib.mkOption {
+        type = lib.types.str;
         default = "pushgateway";
         description = ''
           Directory below `/var/lib` to store metrics.
@@ -133,10 +130,10 @@ in {
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     assertions = [
       {
-        assertion = !hasPrefix "/" cfg.stateDir;
+        assertion = !lib.hasPrefix "/" cfg.stateDir;
         message =
           "The option services.prometheus.pushgateway.stateDir" +
           " shouldn't be an absolute directory." +
@@ -148,8 +145,8 @@ in {
       after    = [ "network.target" ];
       serviceConfig = {
         ExecStart = "${cfg.package}/bin/pushgateway" +
-          optionalString (length cmdlineArgs != 0) (" \\\n  " +
-            concatStringsSep " \\\n  " cmdlineArgs);
+          lib.optionalString (lib.length cmdlineArgs != 0) (" \\\n  " +
+            lib.concatStringsSep " \\\n  " cmdlineArgs);
 
         CapabilityBoundingSet = [ "" ];
         DeviceAllow = [ "" ];
diff --git a/nixos/modules/services/monitoring/prometheus/sachet.nix b/nixos/modules/services/monitoring/prometheus/sachet.nix
index 3deb29aeb222..bc1416308f16 100644
--- a/nixos/modules/services/monitoring/prometheus/sachet.nix
+++ b/nixos/modules/services/monitoring/prometheus/sachet.nix
@@ -1,7 +1,4 @@
 { config, pkgs, lib, ... }:
-
-with lib;
-
 let
   cfg = config.services.prometheus.sachet;
   configFile = pkgs.writeText "sachet.yml" (builtins.toJSON cfg.configuration);
@@ -9,12 +6,12 @@ in
 {
   options = {
     services.prometheus.sachet = {
-      enable = mkEnableOption "Sachet, an SMS alerting tool for the Prometheus Alertmanager";
+      enable = lib.mkEnableOption "Sachet, an SMS alerting tool for the Prometheus Alertmanager";
 
-      configuration = mkOption {
-        type = types.nullOr types.attrs;
+      configuration = lib.mkOption {
+        type = lib.types.nullOr lib.types.attrs;
         default = null;
-        example = literalExpression ''
+        example = lib.literalExpression ''
           {
             providers = {
               twilio = {
@@ -37,16 +34,16 @@ in
         '';
       };
 
-      address = mkOption {
-        type = types.str;
+      address = lib.mkOption {
+        type = lib.types.str;
         default = "localhost";
         description = ''
           The address Sachet will listen to.
         '';
       };
 
-      port = mkOption {
-        type = types.port;
+      port = lib.mkOption {
+        type = lib.types.port;
         default = 9876;
         description = ''
           The port Sachet will listen to.
@@ -56,8 +53,8 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
-    assertions = singleton {
+  config = lib.mkIf cfg.enable {
+    assertions = lib.singleton {
       assertion = cfg.configuration != null;
       message = "Cannot enable Sachet without a configuration.";
     };
diff --git a/nixos/modules/services/monitoring/prometheus/xmpp-alerts.nix b/nixos/modules/services/monitoring/prometheus/xmpp-alerts.nix
index f3f553cd8642..2e367e47cc61 100644
--- a/nixos/modules/services/monitoring/prometheus/xmpp-alerts.nix
+++ b/nixos/modules/services/monitoring/prometheus/xmpp-alerts.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.prometheus.xmpp-alerts;
   settingsFormat = pkgs.formats.yaml {};
@@ -9,15 +6,15 @@ let
 in
 {
   imports = [
-    (mkRenamedOptionModule
+    (lib.mkRenamedOptionModule
       [ "services" "prometheus" "xmpp-alerts" "configuration" ]
       [ "services" "prometheus" "xmpp-alerts" "settings" ])
   ];
 
   options.services.prometheus.xmpp-alerts = {
-    enable = mkEnableOption "XMPP Web hook service for Alertmanager";
+    enable = lib.mkEnableOption "XMPP Web hook service for Alertmanager";
 
-    settings = mkOption {
+    settings = lib.mkOption {
       type = settingsFormat.type;
       default = {};
 
@@ -29,7 +26,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.prometheus-xmpp-alerts = {
       wantedBy = [ "multi-user.target" ];
       after = [ "network-online.target" ];
diff --git a/nixos/modules/services/monitoring/riemann-dash.nix b/nixos/modules/services/monitoring/riemann-dash.nix
index 243d0edb3aae..47db86035e40 100644
--- a/nixos/modules/services/monitoring/riemann-dash.nix
+++ b/nixos/modules/services/monitoring/riemann-dash.nix
@@ -1,19 +1,15 @@
 { config, pkgs, lib, ... }:
-
-with pkgs;
-with lib;
-
 let
 
   cfg = config.services.riemann-dash;
 
-  conf = writeText "config.rb" ''
+  conf = pkgs.writeText "config.rb" ''
     riemann_base = "${cfg.dataDir}"
     config.store[:ws_config] = "#{riemann_base}/config/config.json"
     ${cfg.config}
   '';
 
-  launcher = writeScriptBin "riemann-dash" ''
+  launcher = pkgs.writeScriptBin "riemann-dash" ''
     #!/bin/sh
     exec ${pkgs.riemann-dash}/bin/riemann-dash ${conf}
   '';
@@ -23,21 +19,21 @@ in {
   options = {
 
     services.riemann-dash = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Enable the riemann-dash dashboard daemon.
         '';
       };
-      config = mkOption {
-        type = types.lines;
+      config = lib.mkOption {
+        type = lib.types.lines;
         description = ''
           Contents added to the end of the riemann-dash configuration file.
         '';
       };
-      dataDir = mkOption {
-        type = types.str;
+      dataDir = lib.mkOption {
+        type = lib.types.str;
         default = "/var/riemann-dash";
         description = ''
           Location of the riemann-base dir. The dashboard configuration file is
@@ -49,7 +45,7 @@ in {
 
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     users.groups.riemanndash.gid = config.ids.gids.riemanndash;
 
diff --git a/nixos/modules/services/monitoring/riemann-tools.nix b/nixos/modules/services/monitoring/riemann-tools.nix
index 86a11694e7b4..fc15dcf85344 100644
--- a/nixos/modules/services/monitoring/riemann-tools.nix
+++ b/nixos/modules/services/monitoring/riemann-tools.nix
@@ -1,15 +1,11 @@
 { config, pkgs, lib, ... }:
-
-with pkgs;
-with lib;
-
 let
 
   cfg = config.services.riemann-tools;
 
   riemannHost = "${cfg.riemannHost}";
 
-  healthLauncher = writeScriptBin "riemann-health" ''
+  healthLauncher = pkgs.writeScriptBin "riemann-health" ''
     #!/bin/sh
     exec ${pkgs.riemann-tools}/bin/riemann-health ${builtins.concatStringsSep " " cfg.extraArgs} --host ${riemannHost}
   '';
@@ -20,22 +16,22 @@ in {
   options = {
 
     services.riemann-tools = {
-      enableHealth = mkOption {
-        type = types.bool;
+      enableHealth = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Enable the riemann-health daemon.
         '';
       };
-      riemannHost = mkOption {
-        type = types.str;
+      riemannHost = lib.mkOption {
+        type = lib.types.str;
         default = "127.0.0.1";
         description = ''
           Address of the host riemann node. Defaults to localhost.
         '';
       };
-      extraArgs = mkOption {
-        type = types.listOf types.str;
+      extraArgs = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [];
         description = ''
           A list of commandline-switches forwarded to a riemann-tool.
@@ -46,7 +42,7 @@ in {
     };
   };
 
-  config = mkIf cfg.enableHealth {
+  config = lib.mkIf cfg.enableHealth {
 
     users.groups.riemanntools.gid = config.ids.gids.riemanntools;
 
@@ -58,7 +54,7 @@ in {
 
     systemd.services.riemann-health = {
       wantedBy = [ "multi-user.target" ];
-      path = [ procps ];
+      path = [ pkgs.procps ];
       serviceConfig = {
         User = "riemanntools";
         ExecStart = "${healthLauncher}/bin/riemann-health";
diff --git a/nixos/modules/services/monitoring/riemann.nix b/nixos/modules/services/monitoring/riemann.nix
index fd625e34e013..97ae9e2211af 100644
--- a/nixos/modules/services/monitoring/riemann.nix
+++ b/nixos/modules/services/monitoring/riemann.nix
@@ -1,23 +1,19 @@
 { config, pkgs, lib, ... }:
-
-with pkgs;
-with lib;
-
 let
 
   cfg = config.services.riemann;
 
-  classpath = concatStringsSep ":" (
-    cfg.extraClasspathEntries ++ [ "${riemann}/share/java/riemann.jar" ]
+  classpath = lib.concatStringsSep ":" (
+    cfg.extraClasspathEntries ++ [ "${pkgs.riemann}/share/java/riemann.jar" ]
   );
 
-  riemannConfig = concatStringsSep "\n" (
+  riemannConfig = lib.concatStringsSep "\n" (
     [cfg.config] ++ (map (f: ''(load-file "${f}")'') cfg.configFiles)
   );
 
-  launcher = writeScriptBin "riemann" ''
+  launcher = pkgs.writeScriptBin "riemann" ''
     #!/bin/sh
-    exec ${jdk}/bin/java ${concatStringsSep " " cfg.extraJavaOpts} \
+    exec ${pkgs.jdk}/bin/java ${lib.concatStringsSep " " cfg.extraJavaOpts} \
       -cp ${classpath} \
       riemann.bin ${cfg.configFile}
   '';
@@ -27,17 +23,17 @@ in {
   options = {
 
     services.riemann = {
-      enable = mkEnableOption "Riemann network monitoring daemon";
+      enable = lib.mkEnableOption "Riemann network monitoring daemon";
 
-      config = mkOption {
-        type = types.lines;
+      config = lib.mkOption {
+        type = lib.types.lines;
         description = ''
           Contents of the Riemann configuration file. For more complicated
           config you should use configFile.
         '';
       };
-      configFiles = mkOption {
-        type = with types; listOf path;
+      configFiles = lib.mkOption {
+        type = with lib.types; listOf path;
         default = [];
         description = ''
           Extra files containing Riemann configuration. These files will be
@@ -47,22 +43,22 @@ in {
           use configFile.
         '';
       };
-      configFile = mkOption {
-        type = types.str;
+      configFile = lib.mkOption {
+        type = lib.types.str;
         description = ''
           A Riemann config file. Any files in the same directory as this file
           will be added to the classpath by Riemann.
         '';
       };
-      extraClasspathEntries = mkOption {
-        type = with types; listOf str;
+      extraClasspathEntries = lib.mkOption {
+        type = with lib.types; listOf str;
         default = [];
         description = ''
           Extra entries added to the Java classpath when running Riemann.
         '';
       };
-      extraJavaOpts = mkOption {
-        type = with types; listOf str;
+      extraJavaOpts = lib.mkOption {
+        type = with lib.types; listOf str;
         default = [];
         description = ''
           Extra Java options used when launching Riemann.
@@ -71,7 +67,7 @@ in {
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     users.groups.riemann.gid = config.ids.gids.riemann;
 
@@ -81,13 +77,13 @@ in {
       group = "riemann";
     };
 
-    services.riemann.configFile = mkDefault (
-      writeText "riemann-config.clj" riemannConfig
+    services.riemann.configFile = lib.mkDefault (
+      pkgs.writeText "riemann-config.clj" riemannConfig
     );
 
     systemd.services.riemann = {
       wantedBy = [ "multi-user.target" ];
-      path = [ inetutils ];
+      path = [ pkgs.inetutils ];
       serviceConfig = {
         User = "riemann";
         ExecStart = "${launcher}/bin/riemann";
diff --git a/nixos/modules/services/monitoring/scollector.nix b/nixos/modules/services/monitoring/scollector.nix
index 49c3788e086f..19625e057436 100644
--- a/nixos/modules/services/monitoring/scollector.nix
+++ b/nixos/modules/services/monitoring/scollector.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.scollector;
 
@@ -32,34 +29,34 @@ in {
 
     services.scollector = {
 
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to run scollector.
         '';
       };
 
-      package = mkPackageOption pkgs "scollector" { };
+      package = lib.mkPackageOption pkgs "scollector" { };
 
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         default = "scollector";
         description = ''
           User account under which scollector runs.
         '';
       };
 
-      group = mkOption {
-        type = types.str;
+      group = lib.mkOption {
+        type = lib.types.str;
         default = "scollector";
         description = ''
           Group account under which scollector runs.
         '';
       };
 
-      bosunHost = mkOption {
-        type = types.str;
+      bosunHost = lib.mkOption {
+        type = lib.types.str;
         default = "localhost:8070";
         description = ''
           Host and port of the bosun server that will store the collected
@@ -67,10 +64,10 @@ in {
         '';
       };
 
-      collectors = mkOption {
-        type = with types; attrsOf (listOf path);
+      collectors = lib.mkOption {
+        type = with lib.types; attrsOf (listOf path);
         default = {};
-        example = literalExpression ''{ "0" = [ "''${postgresStats}/bin/collect-stats" ]; }'';
+        example = lib.literalExpression ''{ "0" = [ "''${postgresStats}/bin/collect-stats" ]; }'';
         description = ''
           An attribute set mapping the frequency of collection to a list of
           binaries that should be executed at that frequency. You can use "0"
@@ -78,8 +75,8 @@ in {
         '';
       };
 
-      extraOpts = mkOption {
-        type = with types; listOf str;
+      extraOpts = lib.mkOption {
+        type = with lib.types; listOf str;
         default = [];
         example = [ "-d" ];
         description = ''
@@ -87,8 +84,8 @@ in {
         '';
       };
 
-      extraConfig = mkOption {
-        type = types.lines;
+      extraConfig = lib.mkOption {
+        type = lib.types.lines;
         default = "";
         description = ''
           Extra scollector configuration added to the end of scollector.toml
@@ -99,7 +96,7 @@ in {
 
   };
 
-  config = mkIf config.services.scollector.enable {
+  config = lib.mkIf config.services.scollector.enable {
 
     systemd.services.scollector = {
       description = "scollector metrics collector (part of Bosun)";
diff --git a/nixos/modules/services/monitoring/smartd.nix b/nixos/modules/services/monitoring/smartd.nix
index 65b6259c12bd..2cb5897f5d4c 100644
--- a/nixos/modules/services/monitoring/smartd.nix
+++ b/nixos/modules/services/monitoring/smartd.nix
@@ -1,7 +1,4 @@
 { config, lib, options, pkgs, ... }:
-
-with lib;
-
 let
 
   host = config.networking.fqdnOrHostName;
@@ -16,7 +13,7 @@ let
 
   smartdNotify = pkgs.writeScript "smartd-notify.sh" ''
     #! ${pkgs.runtimeShell}
-    ${optionalString nm.enable ''
+    ${lib.optionalString nm.enable ''
       {
       ${pkgs.coreutils}/bin/cat << EOF
       From: smartd on ${host} <${nm.sender}>
@@ -29,13 +26,13 @@ let
       ${pkgs.smartmontools}/sbin/smartctl -a -d "$SMARTD_DEVICETYPE" "$SMARTD_DEVICE"
       } | ${nm.mailer} -i "${nm.recipient}"
     ''}
-    ${optionalString ns.enable ''
+    ${lib.optionalString ns.enable ''
       ${pkgs.dbus}/bin/dbus-send --system \
         / net.nuetzlich.SystemNotifications.Notify \
         "string:Problem detected with disk: $SMARTD_DEVICESTRING" \
         "string:Warning message from smartd is: $SMARTD_MESSAGE"
     ''}
-    ${optionalString nw.enable ''
+    ${lib.optionalString nw.enable ''
       {
       ${pkgs.coreutils}/bin/cat << EOF
       Problem detected with disk: $SMARTD_DEVICESTRING
@@ -45,7 +42,7 @@ let
       EOF
       } | ${pkgs.util-linux}/bin/wall 2>/dev/null
     ''}
-    ${optionalString nx.enable ''
+    ${lib.optionalString nx.enable ''
       export DISPLAY=${nx.display}
       {
       ${pkgs.coreutils}/bin/cat << EOF
@@ -58,16 +55,16 @@ let
     ''}
   '';
 
-  notifyOpts = optionalString (nm.enable || nw.enable || nx.enable)
-    ("-m <nomailer> -M exec ${smartdNotify} " + optionalString cfg.notifications.test "-M test ");
+  notifyOpts = lib.optionalString (nm.enable || nw.enable || nx.enable)
+    ("-m <nomailer> -M exec ${smartdNotify} " + lib.optionalString cfg.notifications.test "-M test ");
 
   smartdConf = pkgs.writeText "smartd.conf" ''
     # Autogenerated smartd startup config file
     DEFAULT ${notifyOpts}${cfg.defaults.monitored}
 
-    ${concatMapStringsSep "\n" (d: "${d.device} ${d.options}") cfg.devices}
+    ${lib.concatMapStringsSep "\n" (d: "${d.device} ${d.options}") cfg.devices}
 
-    ${optionalString cfg.autodetect
+    ${lib.optionalString cfg.autodetect
        "DEVICESCAN ${notifyOpts}${cfg.defaults.autodetected}"}
   '';
 
@@ -75,16 +72,16 @@ let
 
     options = {
 
-      device = mkOption {
+      device = lib.mkOption {
         example = "/dev/sda";
-        type = types.str;
+        type = lib.types.str;
         description = "Location of the device.";
       };
 
-      options = mkOption {
+      options = lib.mkOption {
         default = "";
         example = "-d sat";
-        type = types.separatedString " ";
+        type = lib.types.separatedString " ";
         description = "Options that determine how smartd monitors the device.";
       };
 
@@ -101,11 +98,11 @@ in
 
     services.smartd = {
 
-      enable = mkEnableOption "smartd daemon from `smartmontools` package";
+      enable = lib.mkEnableOption "smartd daemon from `smartmontools` package";
 
-      autodetect = mkOption {
+      autodetect = lib.mkOption {
         default = true;
-        type = types.bool;
+        type = lib.types.bool;
         description = ''
           Whenever smartd should monitor all devices connected to the
           machine at the time it's being started (the default).
@@ -115,9 +112,9 @@ in
         '';
       };
 
-      extraOptions = mkOption {
+      extraOptions = lib.mkOption {
         default = [];
-        type = types.listOf types.str;
+        type = lib.types.listOf lib.types.str;
         example = ["-A /var/log/smartd/" "--interval=3600"];
         description = ''
           Extra command-line options passed to the `smartd`
@@ -130,32 +127,32 @@ in
       notifications = {
 
         mail = {
-          enable = mkOption {
+          enable = lib.mkOption {
             default = config.services.mail.sendmailSetuidWrapper != null;
-            defaultText = literalExpression "config.services.mail.sendmailSetuidWrapper != null";
-            type = types.bool;
+            defaultText = lib.literalExpression "config.services.mail.sendmailSetuidWrapper != null";
+            type = lib.types.bool;
             description = "Whenever to send e-mail notifications.";
           };
 
-          sender = mkOption {
+          sender = lib.mkOption {
             default = "root";
             example = "example@domain.tld";
-            type = types.str;
+            type = lib.types.str;
             description = ''
               Sender of the notification messages.
               Acts as the value of `email` in the emails' `From: ...` field.
             '';
           };
 
-          recipient = mkOption {
+          recipient = lib.mkOption {
             default = "root";
-            type = types.str;
+            type = lib.types.str;
             description = "Recipient of the notification messages.";
           };
 
-          mailer = mkOption {
+          mailer = lib.mkOption {
             default = "/run/wrappers/bin/sendmail";
-            type = types.path;
+            type = lib.types.path;
             description = ''
               Sendmail-compatible binary to be used to send the messages.
 
@@ -167,9 +164,9 @@ in
         };
 
         systembus-notify = {
-          enable = mkOption {
+          enable = lib.mkOption {
             default = false;
-            type = types.bool;
+            type = lib.types.bool;
             description = ''
               Whenever to send systembus-notify notifications.
 
@@ -185,41 +182,41 @@ in
         };
 
         wall = {
-          enable = mkOption {
+          enable = lib.mkOption {
             default = true;
-            type = types.bool;
+            type = lib.types.bool;
             description = "Whenever to send wall notifications to all users.";
           };
         };
 
         x11 = {
-          enable = mkOption {
+          enable = lib.mkOption {
             default = config.services.xserver.enable;
-            defaultText = literalExpression "config.services.xserver.enable";
-            type = types.bool;
+            defaultText = lib.literalExpression "config.services.xserver.enable";
+            type = lib.types.bool;
             description = "Whenever to send X11 xmessage notifications.";
           };
 
-          display = mkOption {
+          display = lib.mkOption {
             default = ":${toString config.services.xserver.display}";
-            defaultText = literalExpression ''":''${toString config.services.xserver.display}"'';
-            type = types.str;
+            defaultText = lib.literalExpression ''":''${toString config.services.xserver.display}"'';
+            type = lib.types.str;
             description = "DISPLAY to send X11 notifications to.";
           };
         };
 
-        test = mkOption {
+        test = lib.mkOption {
           default = false;
-          type = types.bool;
+          type = lib.types.bool;
           description = "Whenever to send a test notification on startup.";
         };
 
       };
 
       defaults = {
-        monitored = mkOption {
+        monitored = lib.mkOption {
           default = "-a";
-          type = types.separatedString " ";
+          type = lib.types.separatedString " ";
           example = "-a -o on -s (S/../.././02|L/../../7/04)";
           description = ''
             Common default options for explicitly monitored (listed in
@@ -234,10 +231,10 @@ in
           '';
         };
 
-        autodetected = mkOption {
+        autodetected = lib.mkOption {
           default = cfg.defaults.monitored;
-          defaultText = literalExpression "config.${opt.defaults.monitored}";
-          type = types.separatedString " ";
+          defaultText = lib.literalExpression "config.${opt.defaults.monitored}";
+          type = lib.types.separatedString " ";
           description = ''
             Like {option}`services.smartd.defaults.monitored`, but for the
             autodetected devices.
@@ -245,10 +242,10 @@ in
         };
       };
 
-      devices = mkOption {
+      devices = lib.mkOption {
         default = [];
         example = [ { device = "/dev/sda"; } { device = "/dev/sdb"; options = "-d sat"; } ];
-        type = with types; listOf (submodule smartdDeviceOpts);
+        type = with lib.types; listOf (submodule smartdDeviceOpts);
         description = "List of devices to monitor.";
       };
 
@@ -259,7 +256,7 @@ in
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     assertions = [ {
       assertion = cfg.autodetect || cfg.devices != [];
@@ -275,7 +272,7 @@ in
       };
     };
 
-    services.systembus-notify.enable = mkDefault ns.enable;
+    services.systembus-notify.enable = lib.mkDefault ns.enable;
 
   };
 
diff --git a/nixos/modules/services/monitoring/statsd.nix b/nixos/modules/services/monitoring/statsd.nix
index 30b2916a9928..814d00fadc3b 100644
--- a/nixos/modules/services/monitoring/statsd.nix
+++ b/nixos/modules/services/monitoring/statsd.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
 
   cfg = config.services.statsd;
@@ -13,7 +10,7 @@ let
     mkMap = list: name:
       if isBuiltinBackend name then list
       else list ++ [ pkgs.nodePackages.${name} ];
-  in foldl mkMap [];
+  in lib.foldl mkMap [];
 
   configFile = pkgs.writeText "statsd.conf" ''
     {
@@ -22,20 +19,20 @@ let
       mgmt_address: "${cfg.mgmt_address}",
       mgmt_port: "${toString cfg.mgmt_port}",
       backends: [${
-        concatMapStringsSep "," (name:
+        lib.concatMapStringsSep "," (name:
           if (isBuiltinBackend name)
           then ''"./backends/${name}"''
           else ''"${name}"''
         ) cfg.backends}],
-      ${optionalString (cfg.graphiteHost!=null) ''graphiteHost: "${cfg.graphiteHost}",''}
-      ${optionalString (cfg.graphitePort!=null) ''graphitePort: "${toString cfg.graphitePort}",''}
+      ${lib.optionalString (cfg.graphiteHost!=null) ''graphiteHost: "${cfg.graphiteHost}",''}
+      ${lib.optionalString (cfg.graphitePort!=null) ''graphitePort: "${toString cfg.graphitePort}",''}
       console: {
         prettyprint: false
       },
       log: {
         backend: "stdout"
       },
-      automaticConfigReload: false${optionalString (cfg.extraConfig != null) ","}
+      automaticConfigReload: false${lib.optionalString (cfg.extraConfig != null) ","}
       ${cfg.extraConfig}
     }
   '';
@@ -56,33 +53,33 @@ in
 
   options.services.statsd = {
 
-    enable = mkEnableOption "statsd";
+    enable = lib.mkEnableOption "statsd";
 
-    listenAddress = mkOption {
+    listenAddress = lib.mkOption {
       description = "Address that statsd listens on over UDP";
       default = "127.0.0.1";
-      type = types.str;
+      type = lib.types.str;
     };
 
-    port = mkOption {
+    port = lib.mkOption {
       description = "Port that stats listens for messages on over UDP";
       default = 8125;
-      type = types.int;
+      type = lib.types.int;
     };
 
-    mgmt_address = mkOption {
+    mgmt_address = lib.mkOption {
       description = "Address to run management TCP interface on";
       default = "127.0.0.1";
-      type = types.str;
+      type = lib.types.str;
     };
 
-    mgmt_port = mkOption {
+    mgmt_port = lib.mkOption {
       description = "Port to run the management TCP interface on";
       default = 8126;
-      type = types.int;
+      type = lib.types.int;
     };
 
-    backends = mkOption {
+    backends = lib.mkOption {
       description = "List of backends statsd will use for data persistence";
       default = [];
       example = [
@@ -93,35 +90,35 @@ in
         "stackdriver-statsd-backend"
         "statsd-influxdb-backend"
       ];
-      type = types.listOf types.str;
+      type = lib.types.listOf lib.types.str;
     };
 
-    graphiteHost = mkOption {
+    graphiteHost = lib.mkOption {
       description = "Hostname or IP of Graphite server";
       default = null;
-      type = types.nullOr types.str;
+      type = lib.types.nullOr lib.types.str;
     };
 
-    graphitePort = mkOption {
+    graphitePort = lib.mkOption {
       description = "Port of Graphite server (i.e. carbon-cache).";
       default = null;
-      type = types.nullOr types.int;
+      type = lib.types.nullOr lib.types.int;
     };
 
-    extraConfig = mkOption {
+    extraConfig = lib.mkOption {
       description = "Extra configuration options for statsd";
       default = "";
-      type = types.nullOr types.str;
+      type = lib.types.nullOr lib.types.str;
     };
 
   };
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     assertions = map (backend: {
-      assertion = !isBuiltinBackend backend -> hasAttrByPath [ backend ] pkgs.nodePackages;
+      assertion = !isBuiltinBackend backend -> lib.hasAttrByPath [ backend ] pkgs.nodePackages;
       message = "Only builtin backends (graphite, console, repeater) or backends enumerated in `pkgs.nodePackages` are allowed!";
     }) cfg.backends;
 
diff --git a/nixos/modules/services/monitoring/sysstat.nix b/nixos/modules/services/monitoring/sysstat.nix
index ca2cff827232..ca674defd65e 100644
--- a/nixos/modules/services/monitoring/sysstat.nix
+++ b/nixos/modules/services/monitoring/sysstat.nix
@@ -1,22 +1,21 @@
 { config, lib, pkgs, ... }:
-with lib;
 let
   cfg = config.services.sysstat;
 in {
   options = {
     services.sysstat = {
-      enable = mkEnableOption "sar system activity collection";
+      enable = lib.mkEnableOption "sar system activity collection";
 
-      collect-frequency = mkOption {
-        type = types.str;
+      collect-frequency = lib.mkOption {
+        type = lib.types.str;
         default = "*:00/10";
         description = ''
           OnCalendar specification for sysstat-collect
         '';
       };
 
-      collect-args = mkOption {
-        type = types.str;
+      collect-args = lib.mkOption {
+        type = lib.types.str;
         default = "1 1";
         description = ''
           Arguments to pass sa1 when collecting statistics
@@ -25,7 +24,7 @@ in {
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.sysstat = {
       description = "Resets System Activity Logs";
       wantedBy = [ "multi-user.target" ];
diff --git a/nixos/modules/services/monitoring/telegraf.nix b/nixos/modules/services/monitoring/telegraf.nix
index dfff80e1bac2..06339269b427 100644
--- a/nixos/modules/services/monitoring/telegraf.nix
+++ b/nixos/modules/services/monitoring/telegraf.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.telegraf;
 
@@ -11,12 +8,12 @@ in {
   ###### interface
   options = {
     services.telegraf = {
-      enable = mkEnableOption "telegraf server";
+      enable = lib.mkEnableOption "telegraf server";
 
-      package = mkPackageOption pkgs "telegraf" { };
+      package = lib.mkPackageOption pkgs "telegraf" { };
 
-      environmentFiles = mkOption {
-        type = types.listOf types.path;
+      environmentFiles = lib.mkOption {
+        type = lib.types.listOf lib.types.path;
         default = [];
         example = [ "/run/keys/telegraf.env" ];
         description = ''
@@ -27,7 +24,7 @@ in {
         '';
       };
 
-      extraConfig = mkOption {
+      extraConfig = lib.mkOption {
         default = {};
         description = "Extra configuration options for telegraf";
         type = settingsFormat.type;
@@ -47,7 +44,7 @@ in {
 
 
   ###### implementation
-  config = mkIf config.services.telegraf.enable {
+  config = lib.mkIf config.services.telegraf.enable {
     services.telegraf.extraConfig = {
       inputs = {};
       outputs = {};
diff --git a/nixos/modules/services/monitoring/tremor-rs.nix b/nixos/modules/services/monitoring/tremor-rs.nix
index c8a77ab93def..ebd27771c239 100644
--- a/nixos/modules/services/monitoring/tremor-rs.nix
+++ b/nixos/modules/services/monitoring/tremor-rs.nix
@@ -1,6 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
 let
 
   cfg = config.services.tremor-rs;
@@ -13,31 +11,31 @@ in {
     services.tremor-rs = {
       enable = lib.mkEnableOption "Tremor event- or stream-processing system";
 
-      troyFileList = mkOption {
-        type = types.listOf types.path;
+      troyFileList = lib.mkOption {
+        type = lib.types.listOf lib.types.path;
         default = [];
         description = "List of troy files to load.";
       };
 
-      tremorLibDir = mkOption {
-        type = types.path;
+      tremorLibDir = lib.mkOption {
+        type = lib.types.path;
         default = "";
         description = "Directory where to find /lib containing tremor script files";
       };
 
-      host = mkOption {
-        type = types.str;
+      host = lib.mkOption {
+        type = lib.types.str;
         default = "127.0.0.1";
         description = "The host tremor should be listening on";
       };
 
-      port = mkOption {
-        type = types.port;
+      port = lib.mkOption {
+        type = lib.types.port;
         default = 9898;
         description = "the port tremor should be listening on";
       };
 
-      loggerSettings = mkOption {
+      loggerSettings = lib.mkOption {
         description = "Tremor logger configuration";
         default = {};
         type = loggerSettingsFormat.type;
@@ -63,7 +61,7 @@ in {
           };
         };
 
-        defaultText = literalExpression ''
+        defaultText = lib.literalExpression ''
           {
             refresh_rate = "30 seconds";
             appenders.stdout.kind = "console";
@@ -90,7 +88,7 @@ in {
     };
   };
 
-  config = mkIf (cfg.enable) {
+  config = lib.mkIf (cfg.enable) {
 
     environment.systemPackages = [ pkgs.tremor-rs ] ;
 
@@ -103,7 +101,7 @@ in {
       environment.TREMOR_PATH = "${pkgs.tremor-rs}/lib:${cfg.tremorLibDir}";
 
       serviceConfig = {
-        ExecStart = "${pkgs.tremor-rs}/bin/tremor --logger-config ${loggerConfigFile} server run ${concatStringsSep " " cfg.troyFileList} --api-host ${cfg.host}:${toString cfg.port}";
+        ExecStart = "${pkgs.tremor-rs}/bin/tremor --logger-config ${loggerConfigFile} server run ${lib.concatStringsSep " " cfg.troyFileList} --api-host ${cfg.host}:${toString cfg.port}";
         DynamicUser = true;
         Restart = "always";
         NoNewPrivileges = true;
diff --git a/nixos/modules/services/monitoring/tuptime.nix b/nixos/modules/services/monitoring/tuptime.nix
index 334f911a6c71..07ada853760b 100644
--- a/nixos/modules/services/monitoring/tuptime.nix
+++ b/nixos/modules/services/monitoring/tuptime.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
 
   cfg = config.services.tuptime;
@@ -10,17 +7,17 @@ in {
 
   options.services.tuptime = {
 
-    enable = mkEnableOption "the total uptime service";
+    enable = lib.mkEnableOption "the total uptime service";
 
     timer = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = "Whether to regularly log uptime to detect bad shutdowns.";
       };
 
-      period = mkOption {
-        type = types.str;
+      period = lib.mkOption {
+        type = lib.types.str;
         default = "*:0/5";
         description = "systemd calendar event";
       };
@@ -28,7 +25,7 @@ in {
   };
 
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     environment.systemPackages = [ pkgs.tuptime ];
 
@@ -59,7 +56,7 @@ in {
           };
         };
 
-        tuptime-sync = mkIf cfg.timer.enable {
+        tuptime-sync = lib.mkIf cfg.timer.enable {
           description = "Tuptime scheduled sync service";
           serviceConfig = {
             Type = "oneshot";
@@ -69,7 +66,7 @@ in {
         };
       };
 
-      timers.tuptime-sync = mkIf cfg.timer.enable {
+      timers.tuptime-sync = lib.mkIf cfg.timer.enable {
         description = "Tuptime scheduled sync timer";
         # this timer should be started if the service is started
         # even if the timer was previously stopped
@@ -85,6 +82,6 @@ in {
     };
   };
 
-  meta.maintainers = [ maintainers.evils ];
+  meta.maintainers = [ lib.maintainers.evils ];
 
 }
diff --git a/nixos/modules/services/monitoring/uptime-kuma.nix b/nixos/modules/services/monitoring/uptime-kuma.nix
index 4c7dd900f52b..1d7ff10227a9 100644
--- a/nixos/modules/services/monitoring/uptime-kuma.nix
+++ b/nixos/modules/services/monitoring/uptime-kuma.nix
@@ -1,7 +1,4 @@
 { config, pkgs, lib, ... }:
-
-with lib;
-
 let
   cfg = config.services.uptime-kuma;
 in
@@ -11,11 +8,11 @@ in
 
   options = {
     services.uptime-kuma = {
-      enable = mkEnableOption "Uptime Kuma, this assumes a reverse proxy to be set";
+      enable = lib.mkEnableOption "Uptime Kuma, this assumes a reverse proxy to be set";
 
-      package = mkPackageOption pkgs "uptime-kuma" { };
+      package = lib.mkPackageOption pkgs "uptime-kuma" { };
 
-      appriseSupport = mkEnableOption "apprise support for notifications";
+      appriseSupport = lib.mkEnableOption "apprise support for notifications";
 
       settings = lib.mkOption {
         type = lib.types.submodule { freeformType = with lib.types; attrsOf str; };
@@ -33,13 +30,13 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     services.uptime-kuma.settings = {
       DATA_DIR = "/var/lib/uptime-kuma/";
-      NODE_ENV = mkDefault "production";
-      HOST = mkDefault "127.0.0.1";
-      PORT = mkDefault "3001";
+      NODE_ENV = lib.mkDefault "production";
+      HOST = lib.mkDefault "127.0.0.1";
+      PORT = lib.mkDefault "3001";
     };
 
     systemd.services.uptime-kuma = {
diff --git a/nixos/modules/services/monitoring/vnstat.nix b/nixos/modules/services/monitoring/vnstat.nix
index 5e19c399568d..afacb696420b 100644
--- a/nixos/modules/services/monitoring/vnstat.nix
+++ b/nixos/modules/services/monitoring/vnstat.nix
@@ -1,15 +1,12 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.vnstat;
 in {
   options.services.vnstat = {
-    enable = mkEnableOption "update of network usage statistics via vnstatd";
+    enable = lib.mkEnableOption "update of network usage statistics via vnstatd";
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     environment.systemPackages = [ pkgs.vnstat ];
 
@@ -56,5 +53,5 @@ in {
     };
   };
 
-  meta.maintainers = [ maintainers.evils ];
+  meta.maintainers = [ lib.maintainers.evils ];
 }
diff --git a/nixos/modules/services/monitoring/watchdogd.nix b/nixos/modules/services/monitoring/watchdogd.nix
index e8d104651c6a..f54d7aa80b18 100644
--- a/nixos/modules/services/monitoring/watchdogd.nix
+++ b/nixos/modules/services/monitoring/watchdogd.nix
@@ -1,33 +1,32 @@
 { config, lib, pkgs, ... }:
-with lib;
 let
   cfg = config.services.watchdogd;
 
   mkPluginOpts = plugin: defWarn: defCrit: {
-    enabled = mkEnableOption "watchdogd plugin ${plugin}";
-    interval = mkOption {
-      type = types.ints.unsigned;
+    enabled = lib.mkEnableOption "watchdogd plugin ${plugin}";
+    interval = lib.mkOption {
+      type = lib.types.ints.unsigned;
       default = 300;
       description = ''
         Amount of seconds between every poll.
       '';
     };
-    logmark = mkOption {
-      type = types.bool;
+    logmark = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = ''
         Whether to log current stats every poll interval.
       '';
     };
-    warning = mkOption {
-      type = types.numbers.nonnegative;
+    warning = lib.mkOption {
+      type = lib.types.numbers.nonnegative;
       default = defWarn;
       description = ''
         The high watermark level. Alert sent to log.
       '';
     };
-    critical = mkOption {
-      type = types.numbers.nonnegative;
+    critical = lib.mkOption {
+      type = lib.types.numbers.nonnegative;
       default = defCrit;
       description = ''
         The critical watermark level. Alert sent to log, followed by reboot or script action.
@@ -36,11 +35,11 @@ let
   };
 in {
   options.services.watchdogd = {
-    enable = mkEnableOption "watchdogd, an advanced system & process supervisor";
-    package = mkPackageOption pkgs "watchdogd" { };
+    enable = lib.mkEnableOption "watchdogd, an advanced system & process supervisor";
+    package = lib.mkPackageOption pkgs "watchdogd" { };
 
-    settings = mkOption {
-      type = with types; submodule {
+    settings = lib.mkOption {
+      type = with lib.types; submodule {
         freeformType = let
           valueType = oneOf [
             bool
@@ -51,14 +50,14 @@ in {
         in attrsOf (either valueType (attrsOf valueType));
 
         options = {
-          timeout = mkOption {
+          timeout = lib.mkOption {
             type = types.ints.unsigned;
             default = 15;
             description = ''
               The WDT timeout before reset.
             '';
           };
-          interval = mkOption {
+          interval = lib.mkOption {
             type = types.ints.unsigned;
             default = 5;
             description = ''
@@ -66,7 +65,7 @@ in {
             '';
           };
 
-          safe-exit = mkOption {
+          safe-exit = lib.mkOption {
             type = types.bool;
             default = true;
             description = ''
@@ -91,26 +90,26 @@ in {
   };
 
   config = let
-    toConfig = attrs: concatStringsSep "\n" (mapAttrsToList toValue attrs);
+    toConfig = attrs: lib.concatStringsSep "\n" (lib.mapAttrsToList toValue attrs);
 
     toValue = name: value:
-      if isAttrs value
-        then pipe value [
-          (mapAttrsToList toValue)
+      if lib.isAttrs value
+        then lib.pipe value [
+          (lib.mapAttrsToList toValue)
           (map (s: "  ${s}"))
-          (concatStringsSep "\n")
+          (lib.concatStringsSep "\n")
           (s: "${name} {\n${s}\n}")
         ]
-      else if isBool value
-        then "${name} = ${boolToString value}"
-      else if any (f: f value) [isString isInt isFloat]
+      else if lib.isBool value
+        then "${name} = ${lib.boolToString value}"
+      else if lib.any (f: f value) [lib.isString lib.isInt lib.isFloat]
         then "${name} = ${toString value}"
       else throw ''
-        Found invalid type in `services.watchdogd.settings`: '${typeOf value}'
+        Found invalid type in `services.watchdogd.settings`: '${lib.typeOf value}'
       '';
 
     watchdogdConf = pkgs.writeText "watchdogd.conf" (toConfig cfg.settings);
-  in mkIf cfg.enable {
+  in lib.mkIf cfg.enable {
     environment.systemPackages = [ cfg.package ];
 
     systemd.services.watchdogd = {
@@ -127,5 +126,5 @@ in {
     };
   };
 
-  meta.maintainers = with maintainers; [ vifino ];
+  meta.maintainers = with lib.maintainers; [ vifino ];
 }
diff --git a/nixos/modules/services/network-filesystems/cachefilesd.nix b/nixos/modules/services/network-filesystems/cachefilesd.nix
index 8db0fdb8a417..b1c13cf41501 100644
--- a/nixos/modules/services/network-filesystems/cachefilesd.nix
+++ b/nixos/modules/services/network-filesystems/cachefilesd.nix
@@ -1,7 +1,4 @@
 { config, pkgs, lib, ... }:
-
-with lib;
-
 let
 
   cfg = config.services.cachefilesd;
@@ -17,20 +14,20 @@ in
   options = {
     services.cachefilesd = {
 
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Whether to enable cachefilesd network filesystems caching daemon.";
       };
 
-      cacheDir = mkOption {
-        type = types.str;
+      cacheDir = lib.mkOption {
+        type = lib.types.str;
         default = "/var/cache/fscache";
         description = "Directory to contain filesystem cache.";
       };
 
-      extraConfig = mkOption {
-        type = types.lines;
+      extraConfig = lib.mkOption {
+        type = lib.types.lines;
         default = "";
         example = "brun 10%";
         description = "Additional configuration file entries. See cachefilesd.conf(5) for more information.";
@@ -41,7 +38,7 @@ in
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     boot.kernelModules = [ "cachefiles" ];
 
diff --git a/nixos/modules/services/network-filesystems/diod.nix b/nixos/modules/services/network-filesystems/diod.nix
index 063bae6ddb1d..8b3f4f9bd8c5 100644
--- a/nixos/modules/services/network-filesystems/diod.nix
+++ b/nixos/modules/services/network-filesystems/diod.nix
@@ -1,5 +1,4 @@
 { config, lib, pkgs, ... }:
-with lib;
 let
   cfg = config.services.diod;
 
@@ -9,9 +8,9 @@ let
     allsquash = ${diodBool cfg.allsquash}
     auth_required = ${diodBool cfg.authRequired}
     exportall = ${diodBool cfg.exportall}
-    exportopts = "${concatStringsSep "," cfg.exportopts}"
-    exports = { ${concatStringsSep ", " (map (s: ''"${s}"'' ) cfg.exports)} }
-    listen = { ${concatStringsSep ", " (map (s: ''"${s}"'' ) cfg.listen)} }
+    exportopts = "${lib.concatStringsSep "," cfg.exportopts}"
+    exports = { ${lib.concatStringsSep ", " (map (s: ''"${s}"'' ) cfg.exports)} }
+    listen = { ${lib.concatStringsSep ", " (map (s: ''"${s}"'' ) cfg.listen)} }
     logdest = "${cfg.logdest}"
     nwthreads = ${toString cfg.nwthreads}
     squashuser = "${cfg.squashuser}"
@@ -23,14 +22,14 @@ in
 {
   options = {
     services.diod = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Whether to enable the diod 9P file server.";
       };
 
-      listen = mkOption {
-        type = types.listOf types.str;
+      listen = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [ "0.0.0.0:564" ];
         description = ''
           [ "IP:PORT" [,"IP:PORT",...] ]
@@ -38,8 +37,8 @@ in
         '';
       };
 
-      exports = mkOption {
-        type = types.listOf types.str;
+      exports = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [];
         description = ''
           List the file systems that clients will be allowed to mount. All paths should
@@ -54,8 +53,8 @@ in
         '';
       };
 
-      exportall = mkOption {
-        type = types.bool;
+      exportall = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = ''
           Export all file systems listed in /proc/mounts. If new file systems are mounted
@@ -65,8 +64,8 @@ in
         '';
       };
 
-      exportopts = mkOption {
-        type = types.listOf types.str;
+      exportopts = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [];
         description = ''
           Establish a default set of export options. These are overridden, not appended
@@ -74,8 +73,8 @@ in
         '';
       };
 
-      nwthreads = mkOption {
-        type = types.int;
+      nwthreads = lib.mkOption {
+        type = lib.types.int;
         default = 16;
         description = ''
           Sets the (fixed) number of worker threads created to handle 9P
@@ -83,16 +82,16 @@ in
         '';
       };
 
-      authRequired = mkOption {
-        type = types.bool;
+      authRequired = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Allow clients to connect without authentication, i.e. without a valid MUNGE credential.
         '';
       };
 
-      userdb = mkOption {
-        type = types.bool;
+      userdb = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           This option disables password/group lookups. It allows any uid to attach and
@@ -100,8 +99,8 @@ in
         '';
       };
 
-      allsquash = mkOption {
-        type = types.bool;
+      allsquash = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = ''
           Remap all users to "nobody". The attaching user need not be present in the
@@ -109,16 +108,16 @@ in
         '';
       };
 
-      squashuser = mkOption {
-        type = types.str;
+      squashuser = lib.mkOption {
+        type = lib.types.str;
         default = "nobody";
         description = ''
           Change the squash user. The squash user must be present in the password file.
         '';
       };
 
-      logdest = mkOption {
-        type = types.str;
+      logdest = lib.mkOption {
+        type = lib.types.str;
         default = "syslog:daemon:err";
         description = ''
           Set the destination for logging.
@@ -127,8 +126,8 @@ in
       };
 
 
-      statfsPassthru = mkOption {
-        type = types.bool;
+      statfsPassthru = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           This option configures statfs to return the host file system's type
@@ -136,15 +135,15 @@ in
         '';
       };
 
-      extraConfig = mkOption {
-        type = types.lines;
+      extraConfig = lib.mkOption {
+        type = lib.types.lines;
         default = "";
         description = "Extra configuration options for diod.conf.";
       };
     };
   };
 
-  config = mkIf config.services.diod.enable {
+  config = lib.mkIf config.services.diod.enable {
     environment.systemPackages = [ pkgs.diod ];
 
     systemd.services.diod = {
diff --git a/nixos/modules/services/network-filesystems/drbd.nix b/nixos/modules/services/network-filesystems/drbd.nix
index b971fadebf71..2ecf8558a10f 100644
--- a/nixos/modules/services/network-filesystems/drbd.nix
+++ b/nixos/modules/services/network-filesystems/drbd.nix
@@ -1,9 +1,5 @@
 # Support for DRBD, the Distributed Replicated Block Device.
-
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let cfg = config.services.drbd; in
 
 {
@@ -12,18 +8,18 @@ let cfg = config.services.drbd; in
 
   options = {
 
-    services.drbd.enable = mkOption {
+    services.drbd.enable = lib.mkOption {
       default = false;
-      type = types.bool;
+      type = lib.types.bool;
       description = ''
         Whether to enable support for DRBD, the Distributed Replicated
         Block Device.
       '';
     };
 
-    services.drbd.config = mkOption {
+    services.drbd.config = lib.mkOption {
       default = "";
-      type = types.lines;
+      type = lib.types.lines;
       description = ''
         Contents of the {file}`drbd.conf` configuration file.
       '';
@@ -34,7 +30,7 @@ let cfg = config.services.drbd; in
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     environment.systemPackages = [ pkgs.drbd ];
 
diff --git a/nixos/modules/services/network-filesystems/glusterfs.nix b/nixos/modules/services/network-filesystems/glusterfs.nix
index f23e2842f3a8..d34370875f6b 100644
--- a/nixos/modules/services/network-filesystems/glusterfs.nix
+++ b/nixos/modules/services/network-filesystems/glusterfs.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   inherit (pkgs) glusterfs rsync;
 
@@ -15,7 +12,7 @@ let
     rm -f /var/lib/glusterd/secure-access
   '';
 
-  restartTriggers = optionals (cfg.tlsSettings != null) [
+  restartTriggers = lib.optionals (cfg.tlsSettings != null) [
     config.environment.etc."ssl/glusterfs.pem".source
     config.environment.etc."ssl/glusterfs.key".source
     config.environment.etc."ssl/glusterfs.ca".source
@@ -33,16 +30,16 @@ in
 
     services.glusterfs = {
 
-      enable = mkEnableOption "GlusterFS Daemon";
+      enable = lib.mkEnableOption "GlusterFS Daemon";
 
-      logLevel = mkOption {
-        type = types.enum ["DEBUG" "INFO" "WARNING" "ERROR" "CRITICAL" "TRACE" "NONE"];
+      logLevel = lib.mkOption {
+        type = lib.types.enum ["DEBUG" "INFO" "WARNING" "ERROR" "CRITICAL" "TRACE" "NONE"];
         description = "Log level used by the GlusterFS daemon";
         default = "INFO";
       };
 
-      useRpcbind = mkOption {
-        type = types.bool;
+      useRpcbind = lib.mkOption {
+        type = lib.types.bool;
         description = ''
           Enable use of rpcbind. This is required for Gluster's NFS functionality.
 
@@ -54,14 +51,14 @@ in
         default = true;
       };
 
-      enableGlustereventsd = mkOption {
-        type = types.bool;
+      enableGlustereventsd = lib.mkOption {
+        type = lib.types.bool;
         description = "Whether to enable the GlusterFS Events Daemon";
         default = true;
       };
 
-      killMode = mkOption {
-        type = types.enum ["control-group" "process" "mixed" "none"];
+      killMode = lib.mkOption {
+        type = lib.types.enum ["control-group" "process" "mixed" "none"];
         description = ''
           The systemd KillMode to use for glusterd.
 
@@ -77,8 +74,8 @@ in
         default = "control-group";
       };
 
-      stopKillTimeout = mkOption {
-        type = types.str;
+      stopKillTimeout = lib.mkOption {
+        type = lib.types.str;
         description = ''
           The systemd TimeoutStopSec to use.
 
@@ -92,13 +89,13 @@ in
         default = "5s";
       };
 
-      extraFlags = mkOption {
-        type = types.listOf types.str;
+      extraFlags = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         description = "Extra flags passed to the GlusterFS daemon";
         default = [];
       };
 
-      tlsSettings = mkOption {
+      tlsSettings = lib.mkOption {
         description = ''
           Make the server communicate via TLS.
           This means it will only connect to other gluster
@@ -110,20 +107,20 @@ in
           See also: https://gluster.readthedocs.io/en/latest/Administrator%20Guide/SSL/
         '';
         default = null;
-        type = types.nullOr (types.submodule {
+        type = lib.types.nullOr (lib.types.submodule {
           options = {
-            tlsKeyPath = mkOption {
-              type = types.str;
+            tlsKeyPath = lib.mkOption {
+              type = lib.types.str;
               description = "Path to the private key used for TLS.";
             };
 
-            tlsPem = mkOption {
-              type = types.path;
+            tlsPem = lib.mkOption {
+              type = lib.types.path;
               description = "Path to the certificate used for TLS.";
             };
 
-            caCert = mkOption {
-              type = types.path;
+            caCert = lib.mkOption {
+              type = lib.types.path;
               description = "Path certificate authority used to sign the cluster certificates.";
             };
           };
@@ -134,12 +131,12 @@ in
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     environment.systemPackages = [ pkgs.glusterfs ];
 
     services.rpcbind.enable = cfg.useRpcbind;
 
-    environment.etc = mkIf (cfg.tlsSettings != null) {
+    environment.etc = lib.mkIf (cfg.tlsSettings != null) {
       "ssl/glusterfs.pem".source = cfg.tlsSettings.tlsPem;
       "ssl/glusterfs.key".source = cfg.tlsSettings.tlsKeyPath;
       "ssl/glusterfs.ca".source = cfg.tlsSettings.caCert;
@@ -181,7 +178,7 @@ in
       };
     };
 
-    systemd.services.glustereventsd = mkIf cfg.enableGlustereventsd {
+    systemd.services.glustereventsd = lib.mkIf cfg.enableGlustereventsd {
       inherit restartTriggers;
 
       description = "Gluster Events Notifier";
diff --git a/nixos/modules/services/networking/ncdns.nix b/nixos/modules/services/networking/ncdns.nix
index d9aeb29e285f..115726381eb7 100644
--- a/nixos/modules/services/networking/ncdns.nix
+++ b/nixos/modules/services/networking/ncdns.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfgs = config.services;
   cfg  = cfgs.ncdns;
@@ -9,10 +6,10 @@ let
   dataDir  = "/var/lib/ncdns";
   username = "ncdns";
 
-  valueType = with types; oneOf [ int str bool path ]
+  valueType = with lib.types; oneOf [ int str bool path ]
     // { description = "setting type (integer, string, bool or path)"; };
 
-  configType = with types; attrsOf (nullOr (either valueType configType))
+  configType = with lib.types; attrsOf (nullOr (either valueType configType))
     // { description = ''
           ncdns.conf configuration type. The format consists of an
           attribute set of settings. Each setting can be either `null`,
@@ -35,10 +32,10 @@ let
   };
 
   # if all keys are the default value
-  needsKeygen = all id (flip mapAttrsToList cfg.dnssec.keys
-    (n: v: v == getAttr n defaultFiles));
+  needsKeygen = lib.all lib.id (lib.flip lib.mapAttrsToList cfg.dnssec.keys
+    (n: v: v == lib.getAttr n defaultFiles));
 
-  mkDefaultAttrs = mapAttrs (n: v: mkDefault v);
+  mkDefaultAttrs = lib.mapAttrs (n: v: lib.mkDefault v);
 
 in
 
@@ -50,14 +47,14 @@ in
 
     services.ncdns = {
 
-      enable = mkEnableOption ''
+      enable = lib.mkEnableOption ''
         ncdns, a Go daemon to bridge Namecoin to DNS.
         To resolve .bit domains set `services.namecoind.enable = true;`
         and an RPC username/password
       '';
 
-      address = mkOption {
-        type = types.str;
+      address = lib.mkOption {
+        type = lib.types.str;
         default = "[::1]";
         description = ''
           The IP address the ncdns resolver will bind to.  Leave this unchanged
@@ -65,18 +62,18 @@ in
         '';
       };
 
-      port = mkOption {
-        type = types.port;
+      port = lib.mkOption {
+        type = lib.types.port;
         default = 5333;
         description = ''
           The port the ncdns resolver will bind to.
         '';
       };
 
-      identity.hostname = mkOption {
-        type = types.str;
+      identity.hostname = lib.mkOption {
+        type = lib.types.str;
         default = config.networking.hostName;
-        defaultText = literalExpression "config.networking.hostName";
+        defaultText = lib.literalExpression "config.networking.hostName";
         example = "example.com";
         description = ''
           The hostname of this ncdns instance, which defaults to the machine
@@ -92,8 +89,8 @@ in
         '';
       };
 
-      identity.hostmaster = mkOption {
-        type = types.str;
+      identity.hostmaster = lib.mkOption {
+        type = lib.types.str;
         default = "";
         example = "root@example.com";
         description = ''
@@ -102,8 +99,8 @@ in
         '';
       };
 
-      identity.address = mkOption {
-        type = types.str;
+      identity.address = lib.mkOption {
+        type = lib.types.str;
         default = "127.127.127.127";
         description = ''
           The IP address the hostname specified in
@@ -112,7 +109,7 @@ in
         '';
       };
 
-      dnssec.enable = mkEnableOption ''
+      dnssec.enable = lib.mkEnableOption ''
         DNSSEC support in ncdns. This will generate KSK and ZSK keypairs
         (unless provided via the options
         {option}`services.ncdns.dnssec.publicKey`,
@@ -120,8 +117,8 @@ in
         anchor to recursive resolvers
       '';
 
-      dnssec.keys.public = mkOption {
-        type = types.path;
+      dnssec.keys.public = lib.mkOption {
+        type = lib.types.path;
         default = defaultFiles.public;
         description = ''
           Path to the file containing the KSK public key.
@@ -133,16 +130,16 @@ in
         '';
       };
 
-      dnssec.keys.private = mkOption {
-        type = types.path;
+      dnssec.keys.private = lib.mkOption {
+        type = lib.types.path;
         default = defaultFiles.private;
         description = ''
           Path to the file containing the KSK private key.
         '';
       };
 
-      dnssec.keys.zonePublic = mkOption {
-        type = types.path;
+      dnssec.keys.zonePublic = lib.mkOption {
+        type = lib.types.path;
         default = defaultFiles.zonePublic;
         description = ''
           Path to the file containing the ZSK public key.
@@ -154,18 +151,18 @@ in
         '';
       };
 
-      dnssec.keys.zonePrivate = mkOption {
-        type = types.path;
+      dnssec.keys.zonePrivate = lib.mkOption {
+        type = lib.types.path;
         default = defaultFiles.zonePrivate;
         description = ''
           Path to the file containing the ZSK private key.
         '';
       };
 
-      settings = mkOption {
+      settings = lib.mkOption {
         type = configType;
         default = { };
-        example = literalExpression ''
+        example = lib.literalExpression ''
           { # enable webserver
             ncdns.httplistenaddr = ":8202";
 
@@ -186,8 +183,8 @@ in
 
     };
 
-    services.pdns-recursor.resolveNamecoin = mkOption {
-      type = types.bool;
+    services.pdns-recursor.resolveNamecoin = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = ''
         Resolve `.bit` top-level domains using ncdns and namecoin.
@@ -199,9 +196,9 @@ in
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
-    services.pdns-recursor = mkIf cfgs.pdns-recursor.resolveNamecoin {
+    services.pdns-recursor = lib.mkIf cfgs.pdns-recursor.resolveNamecoin {
       forwardZonesRecurse.bit = "${cfg.address}:${toString cfg.port}";
       luaConfig =
         if cfg.dnssec.enable
@@ -210,7 +207,7 @@ in
     };
 
     # Avoid pdns-recursor not finding the DNSSEC keys
-    systemd.services.pdns-recursor = mkIf cfgs.pdns-recursor.resolveNamecoin {
+    systemd.services.pdns-recursor = lib.mkIf cfgs.pdns-recursor.resolveNamecoin {
       after = [ "ncdns.service" ];
       wants = [ "ncdns.service" ];
     };
@@ -231,7 +228,7 @@ in
           # Other
           bind = "${cfg.address}:${toString cfg.port}";
         }
-        // optionalAttrs cfg.dnssec.enable
+        // lib.optionalAttrs cfg.dnssec.enable
         { # DNSSEC
           publickey  = "../.." + cfg.dnssec.keys.public;
           privatekey = "../.." + cfg.dnssec.keys.private;
@@ -263,7 +260,7 @@ in
         ExecStart = "${pkgs.ncdns}/bin/ncdns -conf=${configFile}";
       };
 
-      preStart = optionalString (cfg.dnssec.enable && needsKeygen) ''
+      preStart = lib.optionalString (cfg.dnssec.enable && needsKeygen) ''
         cd ${dataDir}
         if [ ! -e bit.key ]; then
           ${pkgs.bind}/bin/dnssec-keygen -a RSASHA256 -3 -b 2048 bit
diff --git a/nixos/modules/services/networking/nebula.nix b/nixos/modules/services/networking/nebula.nix
index 477731f3f5a4..2ddad4e4094c 100644
--- a/nixos/modules/services/networking/nebula.nix
+++ b/nixos/modules/services/networking/nebula.nix
@@ -1,11 +1,8 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
 
   cfg = config.services.nebula;
-  enabledNetworks = filterAttrs (n: v: v.enable) cfg.networks;
+  enabledNetworks = lib.filterAttrs (n: v: v.enable) cfg.networks;
 
   format = pkgs.formats.yaml {};
 
@@ -25,39 +22,39 @@ in
 
   options = {
     services.nebula = {
-      networks = mkOption {
+      networks = lib.mkOption {
         description = "Nebula network definitions.";
         default = {};
-        type = types.attrsOf (types.submodule {
+        type = lib.types.attrsOf (lib.types.submodule {
           options = {
-            enable = mkOption {
-              type = types.bool;
+            enable = lib.mkOption {
+              type = lib.types.bool;
               default = true;
               description = "Enable or disable this network.";
             };
 
-            package = mkPackageOption pkgs "nebula" { };
+            package = lib.mkPackageOption pkgs "nebula" { };
 
-            ca = mkOption {
-              type = types.path;
+            ca = lib.mkOption {
+              type = lib.types.path;
               description = "Path to the certificate authority certificate.";
               example = "/etc/nebula/ca.crt";
             };
 
-            cert = mkOption {
-              type = types.path;
+            cert = lib.mkOption {
+              type = lib.types.path;
               description = "Path to the host certificate.";
               example = "/etc/nebula/host.crt";
             };
 
-            key = mkOption {
-              type = types.oneOf [types.nonEmptyStr types.path];
+            key = lib.mkOption {
+              type = lib.types.oneOf [lib.types.nonEmptyStr lib.types.path];
               description = "Path or reference to the host key.";
               example = "/etc/nebula/host.key";
             };
 
-            staticHostMap = mkOption {
-              type = types.attrsOf (types.listOf (types.str));
+            staticHostMap = lib.mkOption {
+              type = lib.types.attrsOf (lib.types.listOf (lib.types.str));
               default = {};
               description = ''
                 The static host map defines a set of hosts with fixed IP addresses on the internet (or any network).
@@ -66,20 +63,20 @@ in
               example = { "192.168.100.1" = [ "100.64.22.11:4242" ]; };
             };
 
-            isLighthouse = mkOption {
-              type = types.bool;
+            isLighthouse = lib.mkOption {
+              type = lib.types.bool;
               default = false;
               description = "Whether this node is a lighthouse.";
             };
 
-            isRelay = mkOption {
-              type = types.bool;
+            isRelay = lib.mkOption {
+              type = lib.types.bool;
               default = false;
               description = "Whether this node is a relay.";
             };
 
-            lighthouses = mkOption {
-              type = types.listOf types.str;
+            lighthouses = lib.mkOption {
+              type = lib.types.listOf lib.types.str;
               default = [];
               description = ''
                 List of IPs of lighthouse hosts this node should report to and query from. This should be empty on lighthouse
@@ -88,8 +85,8 @@ in
               example = [ "192.168.100.1" ];
             };
 
-            relays = mkOption {
-              type = types.listOf types.str;
+            relays = lib.mkOption {
+              type = lib.types.listOf lib.types.str;
               default = [];
               description = ''
                 List of IPs of relays that this node should allow traffic from.
@@ -97,14 +94,14 @@ in
               example = [ "192.168.100.1" ];
             };
 
-            listen.host = mkOption {
-              type = types.str;
+            listen.host = lib.mkOption {
+              type = lib.types.str;
               default = "0.0.0.0";
               description = "IP address to listen on.";
             };
 
-            listen.port = mkOption {
-              type = types.nullOr types.port;
+            listen.port = lib.mkOption {
+              type = lib.types.nullOr lib.types.port;
               default = null;
               defaultText = lib.literalExpression ''
                 if (config.services.nebula.networks.''${name}.isLighthouse ||
@@ -116,35 +113,35 @@ in
               description = "Port number to listen on.";
             };
 
-            tun.disable = mkOption {
-              type = types.bool;
+            tun.disable = lib.mkOption {
+              type = lib.types.bool;
               default = false;
               description = ''
                 When tun is disabled, a lighthouse can be started without a local tun interface (and therefore without root).
               '';
             };
 
-            tun.device = mkOption {
-              type = types.nullOr types.str;
+            tun.device = lib.mkOption {
+              type = lib.types.nullOr lib.types.str;
               default = null;
               description = "Name of the tun device. Defaults to nebula.\${networkName}.";
             };
 
-            firewall.outbound = mkOption {
-              type = types.listOf types.attrs;
+            firewall.outbound = lib.mkOption {
+              type = lib.types.listOf lib.types.attrs;
               default = [];
               description = "Firewall rules for outbound traffic.";
               example = [ { port = "any"; proto = "any"; host = "any"; } ];
             };
 
-            firewall.inbound = mkOption {
-              type = types.listOf types.attrs;
+            firewall.inbound = lib.mkOption {
+              type = lib.types.listOf lib.types.attrs;
               default = [];
               description = "Firewall rules for inbound traffic.";
               example = [ { port = "any"; proto = "any"; host = "any"; } ];
             };
 
-            settings = mkOption {
+            settings = lib.mkOption {
               type = format.type;
               default = {};
               description = ''
@@ -152,7 +149,7 @@ in
                 <https://github.com/slackhq/nebula/blob/master/examples/config.yml>
                 for details on supported values.
               '';
-              example = literalExpression ''
+              example = lib.literalExpression ''
                 {
                   lighthouse.dns = {
                     host = "0.0.0.0";
@@ -168,11 +165,11 @@ in
   };
 
   # Implementation
-  config = mkIf (enabledNetworks != {}) {
-    systemd.services = mkMerge (mapAttrsToList (netName: netCfg:
+  config = lib.mkIf (enabledNetworks != {}) {
+    systemd.services = lib.mkMerge (lib.mapAttrsToList (netName: netCfg:
       let
         networkId = nameToId netName;
-        settings = recursiveUpdate {
+        settings = lib.recursiveUpdate {
           pki = {
             ca = netCfg.ca;
             cert = netCfg.cert;
@@ -202,7 +199,7 @@ in
           };
         } netCfg.settings;
         configFile = format.generate "nebula-config-${netName}.yml" (
-          warnIf
+          lib.warnIf
             ((settings.lighthouse.am_lighthouse || settings.relay.am_relay) && settings.listen.port == 0)
             ''
               Nebula network '${netName}' is configured as a lighthouse or relay, and its port is ${builtins.toString settings.listen.port}.
@@ -253,10 +250,10 @@ in
 
     # Open the chosen ports for UDP.
     networking.firewall.allowedUDPPorts =
-      unique (filter (port: port > 0) (mapAttrsToList (netName: netCfg: resolveFinalPort netCfg) enabledNetworks));
+      lib.unique (lib.filter (port: port > 0) (lib.mapAttrsToList (netName: netCfg: resolveFinalPort netCfg) enabledNetworks));
 
     # Create the service users and groups.
-    users.users = mkMerge (mapAttrsToList (netName: netCfg:
+    users.users = lib.mkMerge (lib.mapAttrsToList (netName: netCfg:
       {
         ${nameToId netName} = {
           group = nameToId netName;
@@ -265,10 +262,10 @@ in
         };
       }) enabledNetworks);
 
-    users.groups = mkMerge (mapAttrsToList (netName: netCfg: {
+    users.groups = lib.mkMerge (lib.mapAttrsToList (netName: netCfg: {
       ${nameToId netName} = {};
     }) enabledNetworks);
   };
 
-  meta.maintainers = with maintainers; [ numinit ];
+  meta.maintainers = with lib.maintainers; [ numinit ];
 }
diff --git a/nixos/modules/services/networking/nftables.nix b/nixos/modules/services/networking/nftables.nix
index ada9b83716a5..0c1725f12b3d 100644
--- a/nixos/modules/services/networking/nftables.nix
+++ b/nixos/modules/services/networking/nftables.nix
@@ -1,34 +1,33 @@
 { config, pkgs, lib, ... }:
-with lib;
 let
   cfg = config.networking.nftables;
 
   tableSubmodule = { name, ... }: {
     options = {
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = "Enable this table.";
       };
 
-      name = mkOption {
-        type = types.str;
+      name = lib.mkOption {
+        type = lib.types.str;
         description = "Table name.";
       };
 
-      content = mkOption {
-        type = types.lines;
+      content = lib.mkOption {
+        type = lib.types.lines;
         description = "The table content.";
       };
 
-      family = mkOption {
+      family = lib.mkOption {
         description = "Table family.";
-        type = types.enum [ "ip" "ip6" "inet" "arp" "bridge" "netdev" ];
+        type = lib.types.enum [ "ip" "ip6" "inet" "arp" "bridge" "netdev" ];
       };
     };
 
     config = {
-      name = mkDefault name;
+      name = lib.mkDefault name;
     };
   };
 in
@@ -36,8 +35,8 @@ in
   ###### interface
 
   options = {
-    networking.nftables.enable = mkOption {
-      type = types.bool;
+    networking.nftables.enable = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = ''
           Whether to enable nftables and use nftables based firewall if enabled.
@@ -57,8 +56,8 @@ in
         '';
     };
 
-    networking.nftables.checkRuleset = mkOption {
-      type = types.bool;
+    networking.nftables.checkRuleset = lib.mkOption {
+      type = lib.types.bool;
       default = true;
       description = ''
         Run `nft check` on the ruleset to spot syntax errors during build.
@@ -69,14 +68,14 @@ in
       '';
     };
 
-    networking.nftables.checkRulesetRedirects = mkOption {
-      type = types.addCheck (types.attrsOf types.path) (attrs: all types.path.check (attrNames attrs));
+    networking.nftables.checkRulesetRedirects = lib.mkOption {
+      type = lib.types.addCheck (lib.types.attrsOf lib.types.path) (attrs: lib.all lib.types.path.check (lib.attrNames attrs));
       default = {
         "/etc/hosts" = config.environment.etc.hosts.source;
         "/etc/protocols" = config.environment.etc.protocols.source;
         "/etc/services" = config.environment.etc.services.source;
       };
-      defaultText = literalExpression ''
+      defaultText = lib.literalExpression ''
         {
           "/etc/hosts" = config.environment.etc.hosts.source;
           "/etc/protocols" = config.environment.etc.protocols.source;
@@ -89,8 +88,8 @@ in
       '';
     };
 
-    networking.nftables.preCheckRuleset = mkOption {
-      type = types.lines;
+    networking.nftables.preCheckRuleset = lib.mkOption {
+      type = lib.types.lines;
       default = "";
       example = lib.literalExpression ''
         sed 's/skgid meadow/skgid nogroup/g' -i ruleset.conf
@@ -102,10 +101,10 @@ in
       '';
     };
 
-    networking.nftables.flushRuleset = mkEnableOption "flushing the entire ruleset on each reload";
+    networking.nftables.flushRuleset = lib.mkEnableOption "flushing the entire ruleset on each reload";
 
-    networking.nftables.extraDeletions = mkOption {
-      type = types.lines;
+    networking.nftables.extraDeletions = lib.mkOption {
+      type = lib.types.lines;
       default = "";
       example = ''
         # this makes deleting a non-existing table a no-op instead of an error
@@ -119,8 +118,8 @@ in
         '';
     };
 
-    networking.nftables.ruleset = mkOption {
-      type = types.lines;
+    networking.nftables.ruleset = lib.mkOption {
+      type = lib.types.lines;
       default = "";
       example = ''
         # Check out https://wiki.nftables.org/ for better documentation.
@@ -173,8 +172,8 @@ in
           - or networking.nftables.tables can be used, which will clean up the table automatically
         '';
     };
-    networking.nftables.rulesetFile = mkOption {
-      type = types.nullOr types.path;
+    networking.nftables.rulesetFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
       default = null;
       description = ''
           The ruleset file to be used with nftables.  Should be in a format that
@@ -182,8 +181,8 @@ in
         '';
     };
 
-    networking.nftables.flattenRulesetFile = mkOption {
-      type = types.bool;
+    networking.nftables.flattenRulesetFile = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = ''
         Use `builtins.readFile` rather than `include` to handle {option}`networking.nftables.rulesetFile`. It is useful when you want to apply {option}`networking.nftables.preCheckRuleset` to {option}`networking.nftables.rulesetFile`.
@@ -194,8 +193,8 @@ in
       '';
     };
 
-    networking.nftables.tables = mkOption {
-      type = types.attrsOf (types.submodule tableSubmodule);
+    networking.nftables.tables = lib.mkOption {
+      type = lib.types.attrsOf (lib.types.submodule tableSubmodule);
 
       default = {};
 
@@ -254,11 +253,11 @@ in
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     boot.blacklistedKernelModules = [ "ip_tables" ];
     environment.systemPackages = [ pkgs.nftables ];
     # versionOlder for backportability, remove afterwards
-    networking.nftables.flushRuleset = mkDefault (versionOlder config.system.stateVersion "23.11" || (cfg.rulesetFile != null || cfg.ruleset != ""));
+    networking.nftables.flushRuleset = lib.mkDefault (lib.versionOlder config.system.stateVersion "23.11" || (cfg.rulesetFile != null || cfg.ruleset != ""));
     systemd.services.nftables = {
       description = "nftables firewall";
       after = [ "sysinit.target" ];
@@ -268,11 +267,11 @@ in
       wantedBy = [ "multi-user.target" ];
       reloadIfChanged = true;
       serviceConfig = let
-        enabledTables = filterAttrs (_: table: table.enable) cfg.tables;
+        enabledTables = lib.filterAttrs (_: table: table.enable) cfg.tables;
         deletionsScript = pkgs.writeScript "nftables-deletions" ''
           #! ${pkgs.nftables}/bin/nft -f
           ${if cfg.flushRuleset then "flush ruleset"
-            else concatStringsSep "\n" (mapAttrsToList (_: table: ''
+            else lib.concatStringsSep "\n" (lib.mapAttrsToList (_: table: ''
               table ${table.family} ${table.name}
               delete table ${table.family} ${table.name}
             '') enabledTables)}
@@ -298,7 +297,7 @@ in
             include "${deletionsScriptVar}"
             # current deletions
             include "${deletionsScript}"
-            ${concatStringsSep "\n" (mapAttrsToList (_: table: ''
+            ${lib.concatStringsSep "\n" (lib.mapAttrsToList (_: table: ''
               table ${table.family} ${table.name} {
                 ${table.content}
               }
@@ -316,7 +315,7 @@ in
             cp $out ruleset.conf
             sed 's|include "${deletionsScriptVar}"||' -i ruleset.conf
             ${cfg.preCheckRuleset}
-            export NIX_REDIRECTS=${escapeShellArg (concatStringsSep ":" (mapAttrsToList (n: v: "${n}=${v}") cfg.checkRulesetRedirects))}
+            export NIX_REDIRECTS=${lib.escapeShellArg (lib.concatStringsSep ":" (lib.mapAttrsToList (n: v: "${n}=${v}") cfg.checkRulesetRedirects))}
             LD_PRELOAD="${pkgs.buildPackages.libredirect}/lib/libredirect.so ${pkgs.buildPackages.lklWithFirewall.lib}/lib/liblkl-hijack.so" \
               ${pkgs.buildPackages.nftables}/bin/nft --check --file ruleset.conf
           '';
diff --git a/nixos/modules/services/networking/nylon.nix b/nixos/modules/services/networking/nylon.nix
index f1b9abf61d60..2e5399a05c3c 100644
--- a/nixos/modules/services/networking/nylon.nix
+++ b/nixos/modules/services/networking/nylon.nix
@@ -1,7 +1,4 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
 
   cfg = config.services.nylon;
@@ -18,78 +15,78 @@ let
     Binding-Interface=${cfg.acceptInterface}
     Connecting-Interface=${cfg.bindInterface}
     Port=${toString cfg.port}
-    Allow-IP=${concatStringsSep " " cfg.allowedIPRanges}
-    Deny-IP=${concatStringsSep " " cfg.deniedIPRanges}
+    Allow-IP=${lib.concatStringsSep " " cfg.allowedIPRanges}
+    Deny-IP=${lib.concatStringsSep " " cfg.deniedIPRanges}
   '';
 
   nylonOpts = { name, ... }: {
 
     options = {
 
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Enables nylon as a running service upon activation.
         '';
       };
 
-      name = mkOption {
-        type = types.str;
+      name = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = "The name of this nylon instance.";
       };
 
-      nrConnections = mkOption {
-        type = types.int;
+      nrConnections = lib.mkOption {
+        type = lib.types.int;
         default = 10;
         description = ''
           The number of allowed simultaneous connections to the daemon, default 10.
         '';
       };
 
-      logging = mkOption {
-        type = types.bool;
+      logging = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Enable logging, default is no logging.
         '';
       };
 
-      verbosity = mkOption {
-        type = types.bool;
+      verbosity = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Enable verbose output, default is to not be verbose.
         '';
       };
 
-      acceptInterface = mkOption {
-        type = types.str;
+      acceptInterface = lib.mkOption {
+        type = lib.types.str;
         default = "lo";
         description = ''
           Tell nylon which interface to listen for client requests on, default is "lo".
         '';
       };
 
-      bindInterface = mkOption {
-        type = types.str;
+      bindInterface = lib.mkOption {
+        type = lib.types.str;
         default = "enp3s0f0";
         description = ''
           Tell nylon which interface to use as an uplink, default is "enp3s0f0".
         '';
       };
 
-      port = mkOption {
-        type = types.port;
+      port = lib.mkOption {
+        type = lib.types.port;
         default = 1080;
         description = ''
           What port to listen for client requests, default is 1080.
         '';
       };
 
-      allowedIPRanges = mkOption {
-        type = with types; listOf str;
+      allowedIPRanges = lib.mkOption {
+        type = with lib.types; listOf str;
         default = [ "192.168.0.0/16" "127.0.0.1/8" "172.16.0.1/12" "10.0.0.0/8" ];
         description = ''
            Allowed client IP ranges are evaluated first, defaults to ARIN IPv4 private ranges:
@@ -97,8 +94,8 @@ let
         '';
       };
 
-      deniedIPRanges = mkOption {
-        type = with types; listOf str;
+      deniedIPRanges = lib.mkOption {
+        type = with lib.types; listOf str;
         default = [ "0.0.0.0/0" ];
         description = ''
           Denied client IP ranges, these gets evaluated after the allowed IP ranges, defaults to all IPv4 addresses:
@@ -107,7 +104,7 @@ let
         '';
       };
     };
-    config = { name = mkDefault name; };
+    config = { name = lib.mkDefault name; };
   };
 
   mkNamedNylon = cfg: {
@@ -125,8 +122,8 @@ let
     };
   };
 
-  anyNylons = collect (p: p ? enable) cfg;
-  enabledNylons = filter (p: p.enable == true) anyNylons;
+  anyNylons = lib.collect (p: p ? enable) cfg;
+  enabledNylons = lib.filter (p: p.enable == true) anyNylons;
   nylonUnits = map (nylon: mkNamedNylon nylon) enabledNylons;
 
 in
@@ -137,10 +134,10 @@ in
 
   options = {
 
-    services.nylon = mkOption {
+    services.nylon = lib.mkOption {
       default = {};
       description = "Collection of named nylon instances";
-      type = with types; attrsOf (submodule nylonOpts);
+      type = with lib.types; attrsOf (submodule nylonOpts);
       internal = true;
     };
 
@@ -148,7 +145,7 @@ in
 
   ###### implementation
 
-  config = mkIf (length(enabledNylons) > 0) {
+  config = lib.mkIf (lib.length(enabledNylons) > 0) {
 
     users.users.nylon = {
       group = "nylon";
@@ -160,7 +157,7 @@ in
 
     users.groups.nylon.gid = config.ids.gids.nylon;
 
-    systemd.services = foldr (a: b: a // b) {} nylonUnits;
+    systemd.services = lib.foldr (a: b: a // b) {} nylonUnits;
 
   };
 }
diff --git a/nixos/modules/services/networking/oink.nix b/nixos/modules/services/networking/oink.nix
index 3497ca9220a8..7954cbed709d 100644
--- a/nixos/modules/services/networking/oink.nix
+++ b/nixos/modules/services/networking/oink.nix
@@ -1,11 +1,8 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.oink;
   makeOinkConfig = attrs: (pkgs.formats.json { }).generate
-    "oink.json" (mapAttrs' (k: v: nameValuePair (toLower k) v) attrs);
+    "oink.json" (lib.mapAttrs' (k: v: lib.nameValuePair (lib.toLower k) v) attrs);
   oinkConfig = makeOinkConfig {
     global = cfg.settings;
     domains = cfg.domains;
@@ -13,25 +10,25 @@ let
 in
 {
   options.services.oink = {
-    enable = mkEnableOption "Oink, a dynamic DNS client for Porkbun";
-    package = mkPackageOption pkgs "oink" { };
+    enable = lib.mkEnableOption "Oink, a dynamic DNS client for Porkbun";
+    package = lib.mkPackageOption pkgs "oink" { };
     settings = {
-      apiKey = mkOption {
-        type = types.str;
+      apiKey = lib.mkOption {
+        type = lib.types.str;
         description = "API key to use when modifying DNS records.";
       };
-      secretApiKey = mkOption {
-        type = types.str;
+      secretApiKey = lib.mkOption {
+        type = lib.types.str;
         description = "Secret API key to use when modifying DNS records.";
       };
-      interval = mkOption {
+      interval = lib.mkOption {
         # https://github.com/rlado/oink/blob/v1.1.1/src/main.go#L364
-        type = types.ints.between 60 172800; # 48 hours
+        type = lib.types.ints.between 60 172800; # 48 hours
         default = 900;
         description = "Seconds to wait before sending another request.";
       };
-      ttl = mkOption {
-        type = types.ints.between 600 172800;
+      ttl = lib.mkOption {
+        type = lib.types.ints.between 600 172800;
         default = 600;
         description = ''
           The TTL ("Time to Live") value to set for your DNS records.
@@ -41,8 +38,8 @@ in
         '';
       };
     };
-    domains = mkOption {
-      type = with types; listOf (attrsOf anything);
+    domains = lib.mkOption {
+      type = with lib.types; listOf (attrsOf anything);
       default = [];
       example = [
         {
@@ -74,7 +71,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     systemd.services.oink = {
       description = "Dynamic DNS client for Porkbun";
       after = [ "network.target" ];
diff --git a/nixos/modules/services/networking/stunnel.nix b/nixos/modules/services/networking/stunnel.nix
index 9f9068c8e077..da308dde8b26 100644
--- a/nixos/modules/services/networking/stunnel.nix
+++ b/nixos/modules/services/networking/stunnel.nix
@@ -1,14 +1,11 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
 
   cfg = config.services.stunnel;
   yesNo = val: if val then "yes" else "no";
 
   verifyRequiredField = type: field: n: c: {
-    assertion = hasAttr field c;
+    assertion = lib.hasAttr field c;
     message =  "stunnel: \"${n}\" ${type} configuration - Field ${field} is required.";
   };
 
@@ -18,14 +15,14 @@ let
       "is not possible without either verifyChain or verifyPeer enabled";
   };
 
-  removeNulls = mapAttrs (_: filterAttrs (_: v: v != null));
+  removeNulls = lib.mapAttrs (_: lib.filterAttrs (_: v: v != null));
   mkValueString = v:
     if v == true then "yes"
     else if v == false then "no"
-    else generators.mkValueStringDefault {} v;
+    else lib.generators.mkValueStringDefault {} v;
   generateConfig = c:
-    generators.toINI {
-      mkSectionName = id;
+    lib.generators.toINI {
+      mkSectionName = lib.id;
       mkKeyValue = k: v: "${k} = ${mkValueString v}";
     } (removeNulls c);
 
@@ -39,50 +36,50 @@ in
 
     services.stunnel = {
 
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Whether to enable the stunnel TLS tunneling service.";
       };
 
-      user = mkOption {
-        type = with types; nullOr str;
+      user = lib.mkOption {
+        type = with lib.types; nullOr str;
         default = "nobody";
         description = "The user under which stunnel runs.";
       };
 
-      group = mkOption {
-        type = with types; nullOr str;
+      group = lib.mkOption {
+        type = with lib.types; nullOr str;
         default = "nogroup";
         description = "The group under which stunnel runs.";
       };
 
-      logLevel = mkOption {
-        type = types.enum [ "emerg" "alert" "crit" "err" "warning" "notice" "info" "debug" ];
+      logLevel = lib.mkOption {
+        type = lib.types.enum [ "emerg" "alert" "crit" "err" "warning" "notice" "info" "debug" ];
         default = "info";
         description = "Verbosity of stunnel output.";
       };
 
-      fipsMode = mkOption {
-        type = types.bool;
+      fipsMode = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Enable FIPS 140-2 mode required for compliance.";
       };
 
-      enableInsecureSSLv3 = mkOption {
-        type = types.bool;
+      enableInsecureSSLv3 = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = "Enable support for the insecure SSLv3 protocol.";
       };
 
 
-      servers = mkOption {
+      servers = lib.mkOption {
         description = ''
           Define the server configurations.
 
           See "SERVICE-LEVEL OPTIONS" in {manpage}`stunnel(8)`.
         '';
-        type = with types; attrsOf (attrsOf (nullOr (oneOf [bool int str])));
+        type = with lib.types; attrsOf (attrsOf (nullOr (oneOf [bool int str])));
         example = {
           fancyWebserver = {
             accept = 443;
@@ -93,7 +90,7 @@ in
         default = { };
       };
 
-      clients = mkOption {
+      clients = lib.mkOption {
         description = ''
           Define the client configurations.
 
@@ -101,7 +98,7 @@ in
 
           See "SERVICE-LEVEL OPTIONS" in {manpage}`stunnel(8)`.
         '';
-        type = with types; attrsOf (attrsOf (nullOr (oneOf [bool int str])));
+        type = with lib.types; attrsOf (attrsOf (nullOr (oneOf [bool int str])));
 
         apply = let
           applyDefaults = c:
@@ -118,7 +115,7 @@ in
               verifyHostname = null; # Not a real stunnel configuration setting
             };
           forceClient = c: c // { client = true; };
-        in mapAttrs (_: c: forceClient (setCheckHostFromVerifyHostname (applyDefaults c)));
+        in lib.mapAttrs (_: c: forceClient (setCheckHostFromVerifyHostname (applyDefaults c)));
 
         example = {
           foobar = {
@@ -135,32 +132,32 @@ in
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
-    assertions = concatLists [
-      (singleton {
-        assertion = (length (attrValues cfg.servers) != 0) || ((length (attrValues cfg.clients)) != 0);
+    assertions = lib.concatLists [
+      (lib.singleton {
+        assertion = (lib.length (lib.attrValues cfg.servers) != 0) || ((lib.length (lib.attrValues cfg.clients)) != 0);
         message = "stunnel: At least one server- or client-configuration has to be present.";
       })
 
-      (mapAttrsToList verifyChainPathAssert cfg.clients)
-      (mapAttrsToList (verifyRequiredField "client" "accept") cfg.clients)
-      (mapAttrsToList (verifyRequiredField "client" "connect") cfg.clients)
-      (mapAttrsToList (verifyRequiredField "server" "accept") cfg.servers)
-      (mapAttrsToList (verifyRequiredField "server" "cert") cfg.servers)
-      (mapAttrsToList (verifyRequiredField "server" "connect") cfg.servers)
+      (lib.mapAttrsToList verifyChainPathAssert cfg.clients)
+      (lib.mapAttrsToList (verifyRequiredField "client" "accept") cfg.clients)
+      (lib.mapAttrsToList (verifyRequiredField "client" "connect") cfg.clients)
+      (lib.mapAttrsToList (verifyRequiredField "server" "accept") cfg.servers)
+      (lib.mapAttrsToList (verifyRequiredField "server" "cert") cfg.servers)
+      (lib.mapAttrsToList (verifyRequiredField "server" "connect") cfg.servers)
     ];
 
     environment.systemPackages = [ pkgs.stunnel ];
 
     environment.etc."stunnel.cfg".text = ''
-      ${ optionalString (cfg.user != null) "setuid = ${cfg.user}" }
-      ${ optionalString (cfg.group != null) "setgid = ${cfg.group}" }
+      ${ lib.optionalString (cfg.user != null) "setuid = ${cfg.user}" }
+      ${ lib.optionalString (cfg.group != null) "setgid = ${cfg.group}" }
 
       debug = ${cfg.logLevel}
 
-      ${ optionalString cfg.fipsMode "fips = yes" }
-      ${ optionalString cfg.enableInsecureSSLv3 "options = -NO_SSLv3" }
+      ${ lib.optionalString cfg.fipsMode "fips = yes" }
+      ${ lib.optionalString cfg.enableInsecureSSLv3 "options = -NO_SSLv3" }
 
       ; ----- SERVER CONFIGURATIONS -----
       ${ generateConfig cfg.servers }
@@ -181,7 +178,7 @@ in
       };
     };
 
-    meta.maintainers = with maintainers; [
+    meta.maintainers = with lib.maintainers; [
       # Server side
       lschuermann
       # Client side
diff --git a/nixos/modules/virtualisation/lxc-container.nix b/nixos/modules/virtualisation/lxc-container.nix
index 42c323ee4503..ff7a4c11060b 100644
--- a/nixos/modules/virtualisation/lxc-container.nix
+++ b/nixos/modules/virtualisation/lxc-container.nix
@@ -31,6 +31,22 @@
         ${config.nix.package.out}/bin/nix-env -p /nix/var/nix/profiles/system --set /run/current-system
       '';
 
+    # supplement 99-ethernet-default-dhcp which excludes veth
+    systemd.network = lib.mkIf config.networking.useDHCP {
+      networks."99-lxc-veth-default-dhcp" = {
+        matchConfig = {
+          Type = "ether";
+          Kind = "veth";
+          Name = [
+            "en*"
+            "eth*"
+          ];
+        };
+        DHCP = "yes";
+        networkConfig.IPv6PrivacyExtensions = "kernel";
+      };
+    };
+
     system.build.tarball = pkgs.callPackage ../../lib/make-system-tarball.nix {
       extraArgs = "--owner=0";
 
diff --git a/pkgs/applications/audio/plexamp/default.nix b/pkgs/applications/audio/plexamp/default.nix
index 5b83e9968af8..0dbe7c515f7f 100644
--- a/pkgs/applications/audio/plexamp/default.nix
+++ b/pkgs/applications/audio/plexamp/default.nix
@@ -25,7 +25,7 @@ appimageTools.wrapType2 {
       --replace 'Exec=AppRun' 'Exec=${pname}'
     source "${makeWrapper}/nix-support/setup-hook"
     wrapProgram "$out/bin/plexamp" \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}"
   '';
 
   passthru.updateScript = ./update-plexamp.sh;
diff --git a/pkgs/applications/audio/youtube-music/default.nix b/pkgs/applications/audio/youtube-music/default.nix
index b46e11a35e8d..faca81bfe9a7 100644
--- a/pkgs/applications/audio/youtube-music/default.nix
+++ b/pkgs/applications/audio/youtube-music/default.nix
@@ -67,7 +67,7 @@ stdenv.mkDerivation (finalAttrs: {
   postFixup = lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
     makeWrapper ${electron}/bin/electron $out/bin/youtube-music \
       --add-flags $out/share/lib/youtube-music/resources/app.asar \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}" \
       --set-default ELECTRON_FORCE_IS_PACKAGED 1 \
       --set-default ELECTRON_IS_DEV 0 \
       --inherit-argv0
diff --git a/pkgs/applications/editors/vscode/generic.nix b/pkgs/applications/editors/vscode/generic.nix
index 352c25fe1720..6a23b4c2aeb5 100644
--- a/pkgs/applications/editors/vscode/generic.nix
+++ b/pkgs/applications/editors/vscode/generic.nix
@@ -211,7 +211,7 @@ in
           "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libdbusmenu ]}"}
       # Add gio to PATH so that moving files to the trash works when not using a desktop environment
       --prefix PATH : ${glib.bin}/bin
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}"
       --add-flags ${lib.escapeShellArg commandLineArgs}
     )
   '';
diff --git a/pkgs/applications/graphics/drawio/default.nix b/pkgs/applications/graphics/drawio/default.nix
index 5b551da388dc..3e094bbf6229 100644
--- a/pkgs/applications/graphics/drawio/default.nix
+++ b/pkgs/applications/graphics/drawio/default.nix
@@ -93,7 +93,7 @@ stdenv.mkDerivation rec {
 
     makeWrapper '${electron}/bin/electron' "$out/bin/drawio" \
       --add-flags "$out/share/lib/drawio/resources/app.asar" \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}" \
       --inherit-argv0
   '' + ''
 
diff --git a/pkgs/applications/misc/1password-gui/linux.nix b/pkgs/applications/misc/1password-gui/linux.nix
index 5b9af43cc169..2bad0a25656d 100644
--- a/pkgs/applications/misc/1password-gui/linux.nix
+++ b/pkgs/applications/misc/1password-gui/linux.nix
@@ -151,6 +151,6 @@ stdenv.mkDerivation {
       # See: https://github.com/NixOS/nixpkgs/pull/232718#issuecomment-1582123406
       # Remove this comment when upstream fixes:
       # https://1password.community/discussion/comment/624011/#Comment_624011
-      #--add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
+      #--add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}"
   '';
 }
diff --git a/pkgs/applications/misc/whalebird/default.nix b/pkgs/applications/misc/whalebird/default.nix
index e46a1af85c82..a99d4c047ceb 100644
--- a/pkgs/applications/misc/whalebird/default.nix
+++ b/pkgs/applications/misc/whalebird/default.nix
@@ -96,7 +96,7 @@ stdenv.mkDerivation rec {
 
     makeWrapper "${electron}/bin/electron" "$out/bin/whalebird" \
       --add-flags "$out/opt/Whalebird/resources/app.asar" \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}"
 
     runHook postInstall
   '';
diff --git a/pkgs/applications/misc/zettlr/generic.nix b/pkgs/applications/misc/zettlr/generic.nix
index 65e9f03de642..ab23bf9e4831 100644
--- a/pkgs/applications/misc/zettlr/generic.nix
+++ b/pkgs/applications/misc/zettlr/generic.nix
@@ -30,7 +30,7 @@ appimageTools.wrapType2 rec {
 
   extraInstallCommands = ''
     wrapProgram $out/bin/zettlr \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}"
     install -m 444 -D ${appimageContents}/Zettlr.desktop $out/share/applications/Zettlr.desktop
     install -m 444 -D ${appimageContents}/Zettlr.png $out/share/icons/hicolor/512x512/apps/Zettlr.png
     substituteInPlace $out/share/applications/Zettlr.desktop \
diff --git a/pkgs/applications/networking/browsers/chromium/default.nix b/pkgs/applications/networking/browsers/chromium/default.nix
index ecce9b395a75..cc2e5b0003f8 100644
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@@ -124,7 +124,7 @@ in stdenv.mkDerivation {
     mkdir -p "$out/bin"
 
     makeWrapper "${browserBinary}" "$out/bin/chromium" \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}" \
       --add-flags ${lib.escapeShellArg commandLineArgs}
 
     ed -v -s "$out/bin/chromium" << EOF
diff --git a/pkgs/applications/networking/browsers/vivaldi/default.nix b/pkgs/applications/networking/browsers/vivaldi/default.nix
index b97f7a79a61d..bd3e7b71679e 100644
--- a/pkgs/applications/networking/browsers/vivaldi/default.nix
+++ b/pkgs/applications/networking/browsers/vivaldi/default.nix
@@ -110,7 +110,7 @@ in stdenv.mkDerivation rec {
     done
     wrapProgram "$out/bin/vivaldi" \
       --add-flags ${lib.escapeShellArg commandLineArgs} \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}" \
       --set-default FONTCONFIG_FILE "${fontconfig.out}/etc/fonts/fonts.conf" \
       --set-default FONTCONFIG_PATH "${fontconfig.out}/etc/fonts" \
       --suffix XDG_DATA_DIRS : ${gtk3}/share/gsettings-schemas/${gtk3.name}/ \
diff --git a/pkgs/applications/networking/instant-messengers/discord/linux.nix b/pkgs/applications/networking/instant-messengers/discord/linux.nix
index a7c41de91166..ef38b4c23852 100644
--- a/pkgs/applications/networking/instant-messengers/discord/linux.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/linux.nix
@@ -168,7 +168,7 @@ stdenv.mkDerivation rec {
 
     wrapProgramShell $out/opt/${binaryName}/${binaryName} \
         "''${gappsWrapperArgs[@]}" \
-        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland --enable-features=WaylandWindowDecorations}}" \
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland --enable-features=WaylandWindowDecorations --enable-wayland-ime}}" \
         ${lib.strings.optionalString withTTS "--add-flags \"--enable-speech-dispatcher\""} \
         --prefix XDG_DATA_DIRS : "${gtk3}/share/gsettings-schemas/${gtk3.name}/" \
         --prefix LD_LIBRARY_PATH : ${libPath}:$out/opt/${binaryName} \
diff --git a/pkgs/applications/networking/instant-messengers/element/element-desktop.nix b/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
index e2c1c8da00ad..ed98829d6486 100644
--- a/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
@@ -109,7 +109,7 @@ stdenv.mkDerivation (finalAttrs: builtins.removeAttrs pinData [ "hashes" ] // {
     makeWrapper '${electron}/bin/electron' "$out/bin/${executableName}" \
       --set LD_PRELOAD ${sqlcipher}/lib/libsqlcipher.so \
       --add-flags "$out/share/element/electron" \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}" \
       --add-flags ${lib.escapeShellArg commandLineArgs}
 
     runHook postInstall
diff --git a/pkgs/applications/networking/instant-messengers/franz/generic.nix b/pkgs/applications/networking/instant-messengers/franz/generic.nix
index 397f24b12965..4949707b42ef 100644
--- a/pkgs/applications/networking/instant-messengers/franz/generic.nix
+++ b/pkgs/applications/networking/instant-messengers/franz/generic.nix
@@ -89,7 +89,7 @@ in stdenv.mkDerivation (rec {
     wrapProgramShell $out/opt/${name}/${pname} \
       --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath runtimeDependencies}" \
       --suffix PATH : ${xdg-utils}/bin \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}" \
       "''${gappsWrapperArgs[@]}"
   '';
 } // cleanedArgs)
diff --git a/pkgs/applications/networking/instant-messengers/slack/default.nix b/pkgs/applications/networking/instant-messengers/slack/default.nix
index 7640d72c670d..34b61e994970 100644
--- a/pkgs/applications/networking/instant-messengers/slack/default.nix
+++ b/pkgs/applications/networking/instant-messengers/slack/default.nix
@@ -174,7 +174,7 @@ let
       makeWrapper $out/lib/slack/slack $out/bin/slack \
         --prefix XDG_DATA_DIRS : $GSETTINGS_SCHEMAS_PATH \
         --suffix PATH : ${lib.makeBinPath [xdg-utils]} \
-        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations,WebRTCPipeWireCapturer}}"
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations,WebRTCPipeWireCapturer --enable-wayland-ime}}"
 
       # Fix the desktop link
       substituteInPlace $out/share/applications/slack.desktop \
diff --git a/pkgs/applications/networking/mullvad-vpn/default.nix b/pkgs/applications/networking/mullvad-vpn/default.nix
index 4f927b6db49e..5a4d4b46198d 100644
--- a/pkgs/applications/networking/mullvad-vpn/default.nix
+++ b/pkgs/applications/networking/mullvad-vpn/default.nix
@@ -121,7 +121,7 @@ stdenv.mkDerivation {
         --set-default MULLVAD_RESOURCE_DIR "$out/share/mullvad/resources"
 
     wrapProgram $out/bin/mullvad-gui \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland}}"
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland --enable-wayland-ime}}"
 
     sed -i "s|Exec.*$|Exec=$out/bin/mullvad-vpn $U|" $out/share/applications/mullvad-vpn.desktop
 
diff --git a/pkgs/applications/office/micropad/default.nix b/pkgs/applications/office/micropad/default.nix
index 8fd6b2dd5228..7319d8ee547c 100644
--- a/pkgs/applications/office/micropad/default.nix
+++ b/pkgs/applications/office/micropad/default.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
     # executable wrapper
     makeWrapper '${electron}/bin/electron' "$out/bin/micropad" \
       --add-flags "$out/share/micropad" \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}"
 
     runHook postInstall
   '';
diff --git a/pkgs/applications/office/morgen/default.nix b/pkgs/applications/office/morgen/default.nix
index 61fb95b66a1e..88fd18abde0d 100644
--- a/pkgs/applications/office/morgen/default.nix
+++ b/pkgs/applications/office/morgen/default.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
       --replace '/opt/Morgen' $out/bin
 
     makeWrapper ${electron}/bin/electron $out/bin/morgen \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations,WebRTCPipeWireCapturer}} $out/opt/Morgen/resources/app.asar"
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations,WebRTCPipeWireCapturer --enable-wayland-ime}} $out/opt/Morgen/resources/app.asar"
 
     runHook postInstall
   '';
diff --git a/pkgs/applications/science/math/geogebra/geogebra6.nix b/pkgs/applications/science/math/geogebra/geogebra6.nix
index d57175daff93..38c549cffb85 100644
--- a/pkgs/applications/science/math/geogebra/geogebra6.nix
+++ b/pkgs/applications/science/math/geogebra/geogebra6.nix
@@ -63,7 +63,7 @@ let
       cp -r GeoGebra-linux-x64/{resources,locales} "$out/"
       makeWrapper ${lib.getBin electron}/bin/electron $out/bin/geogebra \
         --add-flags "$out/resources/app" \
-        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}"
       install -Dm644 "${desktopItem}/share/applications/"* \
         -t $out/share/applications/
 
diff --git a/pkgs/applications/video/anilibria-winmaclinux/default.nix b/pkgs/applications/video/anilibria-winmaclinux/default.nix
index cb65af545d9e..a814406a5c22 100644
--- a/pkgs/applications/video/anilibria-winmaclinux/default.nix
+++ b/pkgs/applications/video/anilibria-winmaclinux/default.nix
@@ -18,13 +18,13 @@
 
 mkDerivation rec {
   pname = "anilibria-winmaclinux";
-  version = "2.2.20";
+  version = "2.2.22";
 
   src = fetchFromGitHub {
     owner = "anilibria";
     repo = "anilibria-winmaclinux";
     rev = version;
-    hash = "sha256-Tdrs8WFv3ZoDL3U34l+NQp+oVJ6qxlVFg4YfwBSYlVg=";
+    hash = "sha256-dWjd+wf4yBX63+IsJwY49I/ofL9FSfbWZJ1IhyDc+Z0=";
   };
 
   sourceRoot = "${src.name}/src";
diff --git a/pkgs/applications/video/mpv/default.nix b/pkgs/applications/video/mpv/default.nix
index 30a3fa8be994..e66f19778605 100644
--- a/pkgs/applications/video/mpv/default.nix
+++ b/pkgs/applications/video/mpv/default.nix
@@ -282,7 +282,7 @@ stdenv.mkDerivation (finalAttrs: {
       ;
 
     wrapper = callPackage ./wrapper.nix { };
-    scripts = callPackage ./scripts { };
+    scripts = callPackage ./scripts.nix { };
 
     tests = {
       inherit (nixosTests) mpv;
diff --git a/pkgs/applications/video/mpv/scripts/default.nix b/pkgs/applications/video/mpv/scripts.nix
similarity index 51%
rename from pkgs/applications/video/mpv/scripts/default.nix
rename to pkgs/applications/video/mpv/scripts.nix
index 5e3d3aa4e3ab..151674c8a958 100644
--- a/pkgs/applications/video/mpv/scripts/default.nix
+++ b/pkgs/applications/video/mpv/scripts.nix
@@ -82,69 +82,31 @@ let
 
   scope =
     self:
-    let
-      inherit (self) callPackage;
-    in
-    lib.mapAttrsRecursiveCond (x: x.recurseForDerivations or false) addTests (
-      lib.recurseIntoAttrs {
-        inherit (callPackage ./mpv.nix { })
-          acompressor
-          autocrop
-          autodeint
-          autoload
-          ;
-        inherit (callPackage ./occivink.nix { })
-          blacklistExtensions
-          crop
-          encode
-          seekTo
-          ;
-
-        buildLua = callPackage ./buildLua.nix { };
-        autosub = callPackage ./autosub.nix { };
-        autosubsync-mpv = callPackage ./autosubsync-mpv.nix { };
-        chapterskip = callPackage ./chapterskip.nix { };
-        convert = callPackage ./convert.nix { };
-        cutter = callPackage ./cutter.nix { };
-        dynamic-crop = callPackage ./dynamic-crop.nix { };
-        evafast = callPackage ./evafast.nix { };
-        inhibit-gnome = callPackage ./inhibit-gnome.nix { };
-        memo = callPackage ./memo.nix { };
-        manga-reader = callPackage ./manga-reader.nix { };
-        modernx = callPackage ./modernx.nix { };
-        modernx-zydezu = callPackage ./modernx-zydezu.nix { };
-        mpris = callPackage ./mpris.nix { };
-        mpv-cheatsheet = callPackage ./mpv-cheatsheet.nix { };
-        mpv-discord = callPackage ./mpv-discord.nix { };
-        mpv-notify-send = callPackage ./mpv-notify-send.nix { };
-        mpv-osc-modern = callPackage ./mpv-osc-modern.nix { };
-        mpv-osc-tethys = callPackage ./mpv-osc-tethys.nix { };
-        mpv-playlistmanager = callPackage ./mpv-playlistmanager.nix { };
-        mpv-slicing = callPackage ./mpv-slicing.nix { };
-        mpv-subtitle-lines = callPackage ./mpv-subtitle-lines.nix { };
-        mpv-webm = callPackage ./mpv-webm.nix { };
-        mpvacious = callPackage ./mpvacious.nix { };
-        quack = callPackage ./quack.nix { };
-        quality-menu = callPackage ./quality-menu.nix { };
-        reload = callPackage ./reload.nix { };
-        simple-mpv-webui = callPackage ./simple-mpv-webui.nix { };
-        smart-copy-paste-2 = callPackage ./smart-copy-paste-2.nix { };
-        smartskip = callPackage ./smartskip.nix { };
-        sponsorblock = callPackage ./sponsorblock.nix { };
-        sponsorblock-minimal = callPackage ./sponsorblock-minimal.nix { };
-        thumbfast = callPackage ./thumbfast.nix { };
-        thumbnail = callPackage ./thumbnail.nix { };
-        uosc = callPackage ./uosc.nix { };
-        videoclip = callPackage ./videoclip.nix { };
-        visualizer = callPackage ./visualizer.nix { };
-        vr-reversal = callPackage ./vr-reversal.nix { };
-        webtorrent-mpv-hook = callPackage ./webtorrent-mpv-hook.nix { };
-        youtube-chat = callPackage ./youtube-chat.nix { };
-        youtube-upnext = callPackage ./youtube-upnext.nix { };
+    with lib;
+    pipe
+      {
+        inherit (self) callPackage;
+        directory = ./scripts;
       }
-    );
+      [
+        packagesFromDirectoryRecursive
+        recurseIntoAttrs
+        (mapAttrsRecursiveCond (x: x.recurseForDerivations or false) addTests)
+      ];
 
-  aliases = {
+  mkAliases = self: {
+    inherit (self.builtins)
+      acompressor
+      autocrop
+      autodeint
+      autoload
+      ; # added 2024-11-28
+    inherit (self.occivink)
+      blacklistExtensions
+      crop
+      encode
+      seekTo
+      ; # added 2024-11-28
     youtube-quality = throw "'youtube-quality' is no longer maintained, use 'quality-menu' instead"; # added 2023-07-14
   };
 in
@@ -153,6 +115,9 @@ lib.pipe scope [
   (lib.makeScope newScope)
   (
     self:
+    let
+      aliases = mkAliases self;
+    in
     assert builtins.intersectAttrs self aliases == { };
     self // lib.optionalAttrs config.allowAliases aliases
   )
diff --git a/pkgs/applications/video/mpv/scripts/builtins.nix b/pkgs/applications/video/mpv/scripts/builtins.nix
new file mode 100644
index 000000000000..5e0af3403fb2
--- /dev/null
+++ b/pkgs/applications/video/mpv/scripts/builtins.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  buildLua,
+  mpv-unwrapped,
+}:
+
+let
+  mkBuiltin =
+    name: args:
+    let
+      srcPath = "TOOLS/lua/${name}.lua";
+    in
+    buildLua (
+      lib.attrsets.recursiveUpdate rec {
+        inherit (mpv-unwrapped) src version;
+        pname = "mpv-${name}";
+
+        dontUnpack = true;
+        scriptPath = "${src}/${srcPath}";
+
+        meta = with lib; {
+          inherit (mpv-unwrapped.meta) license;
+          homepage = "https://github.com/mpv-player/mpv/blob/v${version}/${srcPath}";
+        };
+      } args
+    );
+in
+lib.recurseIntoAttrs (
+  lib.mapAttrs (name: lib.makeOverridable (mkBuiltin name)) {
+    acompressor.meta = {
+      description = "Script to toggle and control ffmpeg's dynamic range compression filter";
+      maintainers = with lib.maintainers; [ nicoo ];
+    };
+
+    autocrop.meta.description = "This script uses the lavfi cropdetect filter to automatically insert a crop filter with appropriate parameters for the currently playing video";
+
+    autodeint.meta.description = "This script uses the lavfi idet filter to automatically insert the appropriate deinterlacing filter based on a short section of the currently playing video";
+
+    autoload.meta = {
+      description = "This script automatically loads playlist entries before and after the currently played file";
+      maintainers = [ lib.maintainers.dawidsowa ];
+    };
+  }
+)
diff --git a/pkgs/applications/video/mpv/scripts/mpv.nix b/pkgs/applications/video/mpv/scripts/mpv.nix
deleted file mode 100644
index a81ac77686d5..000000000000
--- a/pkgs/applications/video/mpv/scripts/mpv.nix
+++ /dev/null
@@ -1,42 +0,0 @@
-{
-  lib,
-  buildLua,
-  mpv-unwrapped,
-}:
-
-let
-  mkBuiltin =
-    name: args:
-    let
-      srcPath = "TOOLS/lua/${name}.lua";
-    in
-    buildLua (
-      lib.attrsets.recursiveUpdate rec {
-        inherit (mpv-unwrapped) src version;
-        pname = "mpv-${name}";
-
-        dontUnpack = true;
-        scriptPath = "${src}/${srcPath}";
-
-        meta = with lib; {
-          inherit (mpv-unwrapped.meta) license;
-          homepage = "https://github.com/mpv-player/mpv/blob/v${version}/${srcPath}";
-        };
-      } args
-    );
-in
-lib.mapAttrs (name: lib.makeOverridable (mkBuiltin name)) {
-  acompressor.meta = {
-    description = "Script to toggle and control ffmpeg's dynamic range compression filter";
-    maintainers = with lib.maintainers; [ nicoo ];
-  };
-
-  autocrop.meta.description = "This script uses the lavfi cropdetect filter to automatically insert a crop filter with appropriate parameters for the currently playing video";
-
-  autodeint.meta.description = "This script uses the lavfi idet filter to automatically insert the appropriate deinterlacing filter based on a short section of the currently playing video";
-
-  autoload.meta = {
-    description = "This script automatically loads playlist entries before and after the currently played file";
-    maintainers = [ lib.maintainers.dawidsowa ];
-  };
-}
diff --git a/pkgs/applications/video/mpv/scripts/occivink.nix b/pkgs/applications/video/mpv/scripts/occivink.nix
index f9fe912a612f..cadb4933e9b5 100644
--- a/pkgs/applications/video/mpv/scripts/occivink.nix
+++ b/pkgs/applications/video/mpv/scripts/occivink.nix
@@ -42,19 +42,21 @@ let
     in
     buildLua (lib.attrsets.recursiveUpdate self args);
 in
-lib.mapAttrs (name: lib.makeOverridable (mkScript name)) {
+lib.recurseIntoAttrs (
+  lib.mapAttrs (name: lib.makeOverridable (mkScript name)) {
 
-  # Usage: `pkgs.mpv.override { scripts = [ pkgs.mpvScripts.seekTo ]; }`
-  crop.meta.description = "Crop the current video in a visual manner";
-  seekTo.meta.description = "Mpv script for seeking to a specific position";
-  blacklistExtensions.meta.description = "Automatically remove playlist entries based on their extension";
+    # Usage: `pkgs.mpv.override { scripts = [ pkgs.mpvScripts.seekTo ]; }`
+    crop.meta.description = "Crop the current video in a visual manner";
+    seekTo.meta.description = "Mpv script for seeking to a specific position";
+    blacklistExtensions.meta.description = "Automatically remove playlist entries based on their extension";
 
-  encode = {
-    meta.description = "Make an extract of the video currently playing using ffmpeg";
+    encode = {
+      meta.description = "Make an extract of the video currently playing using ffmpeg";
 
-    postPatch = ''
-      substituteInPlace scripts/encode.lua \
-          --replace-fail '"ffmpeg"' '"${lib.getExe ffmpeg}"'
-    '';
-  };
-}
+      postPatch = ''
+        substituteInPlace scripts/encode.lua \
+            --replace-fail '"ffmpeg"' '"${lib.getExe ffmpeg}"'
+      '';
+    };
+  }
+)
diff --git a/pkgs/applications/video/mpv/scripts/uosc.nix b/pkgs/applications/video/mpv/scripts/uosc.nix
index a65a1c86078a..2838dd5e4942 100644
--- a/pkgs/applications/video/mpv/scripts/uosc.nix
+++ b/pkgs/applications/video/mpv/scripts/uosc.nix
@@ -9,14 +9,14 @@
 
 buildLua (finalAttrs: {
   pname = "uosc";
-  version = "5.6.0";
+  version = "5.6.2";
   scriptPath = "src/uosc";
 
   src = fetchFromGitHub {
     owner = "tomasklaen";
     repo = "uosc";
     rev = finalAttrs.version;
-    hash = "sha256-oEU1mPDzaW5j6zMpnSn1baQ+qlr/MtErxRfiyVBWMHU=";
+    hash = "sha256-UbSEJGlLSX5wZpfj+Cb3LfWw17pnjxIJUNtP8dclKoU=";
   };
   passthru.updateScript = gitUpdater { };
 
diff --git a/pkgs/applications/video/openshot-qt/default.nix b/pkgs/applications/video/openshot-qt/default.nix
index ec6e309e9b82..1f1da89340c7 100644
--- a/pkgs/applications/video/openshot-qt/default.nix
+++ b/pkgs/applications/video/openshot-qt/default.nix
@@ -90,7 +90,7 @@ mkDerivationWith python3.pkgs.buildPythonApplication {
     '';
     license = with lib.licenses; [ gpl3Plus ];
     mainProgram = "openshot-qt";
-    maintainers = with lib.maintainers; [ AndersonTorres ];
+    maintainers = with lib.maintainers; [ ];
     platforms = lib.platforms.unix;
   };
 }
diff --git a/pkgs/applications/virtualization/podman-desktop/default.nix b/pkgs/applications/virtualization/podman-desktop/default.nix
index 947def308f7a..fc313496014d 100644
--- a/pkgs/applications/virtualization/podman-desktop/default.nix
+++ b/pkgs/applications/virtualization/podman-desktop/default.nix
@@ -86,7 +86,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     makeWrapper '${electron}/bin/electron' "$out/bin/podman-desktop" \
       --add-flags "$out/share/lib/podman-desktop/resources/app.asar" \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}" \
       --inherit-argv0
   '' + ''
 
diff --git a/pkgs/by-name/af/affine/package.nix b/pkgs/by-name/af/affine/package.nix
index 0dec9b5835b2..53b527ff9077 100644
--- a/pkgs/by-name/af/affine/package.nix
+++ b/pkgs/by-name/af/affine/package.nix
@@ -39,7 +39,7 @@ stdenvNoCC.mkDerivation (
       makeWrapper "${electron}/bin/electron" $out/bin/affine \
         --inherit-argv0 \
         --add-flags $out/lib/app.asar \
-        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}" \
         --add-flags ${lib.escapeShellArg commandLineArgs}
     '';
     desktopItems = [
diff --git a/pkgs/by-name/al/altair/package.nix b/pkgs/by-name/al/altair/package.nix
index ae2a7d30b9db..384ffd113a0c 100644
--- a/pkgs/by-name/al/altair/package.nix
+++ b/pkgs/by-name/al/altair/package.nix
@@ -18,7 +18,7 @@ appimageTools.wrapType2 {
 
   extraInstallCommands = ''
     wrapProgram $out/bin/${pname} \
-        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}"
 
     install -m 444 -D ${appimageContents}/${pname}.desktop -t $out/share/applications
     substituteInPlace $out/share/applications/${pname}.desktop \
diff --git a/pkgs/by-name/am/amazon-cloudwatch-agent/package.nix b/pkgs/by-name/am/amazon-cloudwatch-agent/package.nix
index 38d8136f127a..4ca8d31b1468 100644
--- a/pkgs/by-name/am/amazon-cloudwatch-agent/package.nix
+++ b/pkgs/by-name/am/amazon-cloudwatch-agent/package.nix
@@ -11,16 +11,16 @@
 
 buildGoModule rec {
   pname = "amazon-cloudwatch-agent";
-  version = "1.300049.1";
+  version = "1.300050.0";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "amazon-cloudwatch-agent";
     rev = "refs/tags/v${version}";
-    hash = "sha256-/VzLSHlBT40h7iErBisfSp7cTAm3L4vmZP03UiDmBaE=";
+    hash = "sha256-546qUeRwaJ4iROf6kw/lnv/c7jSESP9yn3dXc7G/plI=";
   };
 
-  vendorHash = "sha256-zsASHuTXL3brRlgLPNb4wFPHkYpUWbOdRDCXQUwZjIY=";
+  vendorHash = "sha256-de7F8tFv5C+lwUGrWHMK22Lynm0/4J0XH6mVryJtDjk=";
 
   # See the list in https://github.com/aws/amazon-cloudwatch-agent/blob/v1.300048.1/Makefile#L68-L77.
   subPackages = [
diff --git a/pkgs/by-name/an/ant/package.nix b/pkgs/by-name/an/ant/package.nix
new file mode 100644
index 000000000000..bedaa9b13949
--- /dev/null
+++ b/pkgs/by-name/an/ant/package.nix
@@ -0,0 +1,125 @@
+{
+  fetchurl,
+  lib,
+  stdenv,
+  coreutils,
+  makeWrapper,
+  gitUpdater,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "ant";
+  version = "1.10.15";
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  src = fetchurl {
+    url = "mirror://apache/ant/binaries/apache-ant-${finalAttrs.version}-bin.tar.bz2";
+    hash = "sha256-h/SNGLoRwRVojDfvl1g+xv+J6mAz+J2BimckjaRxDEs=";
+  };
+
+  contrib = fetchurl {
+    url = "mirror://sourceforge/ant-contrib/ant-contrib-1.0b3-bin.tar.bz2";
+    sha256 = "1l8say86bz9gxp4yy777z7nm4j6m905pg342li1aphc14p5grvwn";
+  };
+
+  installPhase = ''
+    mkdir -p $out/bin $out/lib/ant
+    mv * $out/lib/ant/
+
+    # Get rid of the manual (35 MiB).  Maybe we should put this in a
+    # separate output.  Keep the antRun script since it's vanilla sh
+    # and needed for the <exec/> task (but since we set ANT_HOME to
+    # a weird value, we have to move antRun to a weird location).
+    # Get rid of the other Ant scripts since we provide our own.
+    mv $out/lib/ant/bin/antRun $out/bin/
+    rm -rf $out/lib/ant/{manual,bin,WHATSNEW}
+    mkdir $out/lib/ant/bin
+    mv $out/bin/antRun $out/lib/ant/bin/
+
+    # Install ant-contrib.
+    unpackFile $contrib
+    cp -p ant-contrib/ant-contrib-*.jar $out/lib/ant/lib/
+
+    cat >> $out/bin/ant <<EOF
+    #! ${stdenv.shell} -e
+
+    ANT_HOME=$out/lib/ant
+
+    # Find the JDK by looking for javac.  As a fall-back, find the
+    # JRE by looking for java.  The latter allows just the JRE to be
+    # used with (say) ECJ as the compiler.  Finally, allow the GNU
+    # JVM.
+    if [ -z "\''${JAVA_HOME-}" ]; then
+        for i in javac java gij; do
+            if p="\$(type -p \$i)"; then
+                export JAVA_HOME="\$(${coreutils}/bin/dirname \$(${coreutils}/bin/dirname \$(${coreutils}/bin/readlink -f \$p)))"
+                break
+            fi
+        done
+        if [ -z "\''${JAVA_HOME-}" ]; then
+            echo "\$0: cannot find the JDK or JRE" >&2
+            exit 1
+        fi
+    fi
+
+    if [ -z \$NIX_JVM ]; then
+        if [ -e \$JAVA_HOME/bin/java ]; then
+            NIX_JVM=\$JAVA_HOME/bin/java
+        elif [ -e \$JAVA_HOME/bin/gij ]; then
+            NIX_JVM=\$JAVA_HOME/bin/gij
+        else
+            NIX_JVM=java
+        fi
+    fi
+
+    LOCALCLASSPATH="\$ANT_HOME/lib/ant-launcher.jar\''${LOCALCLASSPATH:+:}\$LOCALCLASSPATH"
+
+    exec \$NIX_JVM \$NIX_ANT_OPTS \$ANT_OPTS -classpath "\$LOCALCLASSPATH" \
+        -Dant.home=\$ANT_HOME -Dant.library.dir="\$ANT_LIB" \
+        org.apache.tools.ant.launch.Launcher \$NIX_ANT_ARGS \$ANT_ARGS \
+        -cp "\$CLASSPATH" "\$@"
+    EOF
+
+    chmod +x $out/bin/ant
+  '';
+
+  passthru = {
+    updateScript = gitUpdater {
+      rev-prefix = "rel/";
+      url = "https://gitbox.apache.org/repos/asf/ant";
+    };
+  };
+
+  meta = {
+    homepage = "https://ant.apache.org/";
+    description = "Java-based build tool";
+    mainProgram = "ant";
+
+    longDescription = ''
+      Apache Ant is a Java-based build tool.  In theory, it is kind of like
+      Make, but without Make's wrinkles.
+
+      Why another build tool when there is already make, gnumake, nmake, jam,
+      and others? Because all those tools have limitations that Ant's
+      original author couldn't live with when developing software across
+      multiple platforms.  Make-like tools are inherently shell-based -- they
+      evaluate a set of dependencies, then execute commands not unlike what
+      you would issue in a shell.  This means that you can easily extend
+      these tools by using or writing any program for the OS that you are
+      working on.  However, this also means that you limit yourself to the
+      OS, or at least the OS type such as Unix, that you are working on.
+
+      Ant is different.  Instead of a model where it is extended with
+      shell-based commands, Ant is extended using Java classes.  Instead of
+      writing shell commands, the configuration files are XML-based, calling
+      out a target tree where various tasks get executed.  Each task is run
+      by an object that implements a particular Task interface.
+    '';
+
+    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
+    license = lib.licenses.asl20;
+    maintainers = [ ] ++ lib.teams.java.members;
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/by-name/an/anytype/package.nix b/pkgs/by-name/an/anytype/package.nix
index 38590a9f868e..8d1f59cf747a 100644
--- a/pkgs/by-name/an/anytype/package.nix
+++ b/pkgs/by-name/an/anytype/package.nix
@@ -18,7 +18,7 @@ in appimageTools.wrapType2 {
 
   extraInstallCommands = ''
     wrapProgram $out/bin/${pname} \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}" \
       --add-flags ${lib.escapeShellArg commandLineArgs}
     install -m 444 -D ${appimageContents}/anytype.desktop -t $out/share/applications
     substituteInPlace $out/share/applications/anytype.desktop \
diff --git a/pkgs/by-name/ap/apacheAnt/package.nix b/pkgs/by-name/ap/apacheAnt/package.nix
deleted file mode 100644
index 785a518edd3b..000000000000
--- a/pkgs/by-name/ap/apacheAnt/package.nix
+++ /dev/null
@@ -1,119 +0,0 @@
-{ fetchurl, lib, stdenv, coreutils, makeWrapper, gitUpdater }:
-
-stdenv.mkDerivation rec {
-  pname = "ant";
-  version = "1.10.15";
-
-  nativeBuildInputs = [ makeWrapper ];
-
-  src = fetchurl {
-    url = "mirror://apache/ant/binaries/apache-ant-${version}-bin.tar.bz2";
-    hash = "sha256-h/SNGLoRwRVojDfvl1g+xv+J6mAz+J2BimckjaRxDEs=";
-  };
-
-  contrib = fetchurl {
-    url = "mirror://sourceforge/ant-contrib/ant-contrib-1.0b3-bin.tar.bz2";
-    sha256 = "1l8say86bz9gxp4yy777z7nm4j6m905pg342li1aphc14p5grvwn";
-  };
-
-  installPhase =
-    ''
-      mkdir -p $out/bin $out/lib/ant
-      mv * $out/lib/ant/
-
-      # Get rid of the manual (35 MiB).  Maybe we should put this in a
-      # separate output.  Keep the antRun script since it's vanilla sh
-      # and needed for the <exec/> task (but since we set ANT_HOME to
-      # a weird value, we have to move antRun to a weird location).
-      # Get rid of the other Ant scripts since we provide our own.
-      mv $out/lib/ant/bin/antRun $out/bin/
-      rm -rf $out/lib/ant/{manual,bin,WHATSNEW}
-      mkdir $out/lib/ant/bin
-      mv $out/bin/antRun $out/lib/ant/bin/
-
-      # Install ant-contrib.
-      unpackFile $contrib
-      cp -p ant-contrib/ant-contrib-*.jar $out/lib/ant/lib/
-
-      cat >> $out/bin/ant <<EOF
-      #! ${stdenv.shell} -e
-
-      ANT_HOME=$out/lib/ant
-
-      # Find the JDK by looking for javac.  As a fall-back, find the
-      # JRE by looking for java.  The latter allows just the JRE to be
-      # used with (say) ECJ as the compiler.  Finally, allow the GNU
-      # JVM.
-      if [ -z "\''${JAVA_HOME-}" ]; then
-          for i in javac java gij; do
-              if p="\$(type -p \$i)"; then
-                  export JAVA_HOME="\$(${coreutils}/bin/dirname \$(${coreutils}/bin/dirname \$(${coreutils}/bin/readlink -f \$p)))"
-                  break
-              fi
-          done
-          if [ -z "\''${JAVA_HOME-}" ]; then
-              echo "\$0: cannot find the JDK or JRE" >&2
-              exit 1
-          fi
-      fi
-
-      if [ -z \$NIX_JVM ]; then
-          if [ -e \$JAVA_HOME/bin/java ]; then
-              NIX_JVM=\$JAVA_HOME/bin/java
-          elif [ -e \$JAVA_HOME/bin/gij ]; then
-              NIX_JVM=\$JAVA_HOME/bin/gij
-          else
-              NIX_JVM=java
-          fi
-      fi
-
-      LOCALCLASSPATH="\$ANT_HOME/lib/ant-launcher.jar\''${LOCALCLASSPATH:+:}\$LOCALCLASSPATH"
-
-      exec \$NIX_JVM \$NIX_ANT_OPTS \$ANT_OPTS -classpath "\$LOCALCLASSPATH" \
-          -Dant.home=\$ANT_HOME -Dant.library.dir="\$ANT_LIB" \
-          org.apache.tools.ant.launch.Launcher \$NIX_ANT_ARGS \$ANT_ARGS \
-          -cp "\$CLASSPATH" "\$@"
-      EOF
-
-      chmod +x $out/bin/ant
-    ''; # */
-
-  passthru = {
-    updateScript = gitUpdater {
-      rev-prefix = "rel/";
-      url = "https://gitbox.apache.org/repos/asf/ant";
-    };
-  };
-
-  meta = {
-    homepage = "https://ant.apache.org/";
-    description = "Java-based build tool";
-    mainProgram = "ant";
-
-    longDescription = ''
-      Apache Ant is a Java-based build tool.  In theory, it is kind of like
-      Make, but without Make's wrinkles.
-
-      Why another build tool when there is already make, gnumake, nmake, jam,
-      and others? Because all those tools have limitations that Ant's
-      original author couldn't live with when developing software across
-      multiple platforms.  Make-like tools are inherently shell-based -- they
-      evaluate a set of dependencies, then execute commands not unlike what
-      you would issue in a shell.  This means that you can easily extend
-      these tools by using or writing any program for the OS that you are
-      working on.  However, this also means that you limit yourself to the
-      OS, or at least the OS type such as Unix, that you are working on.
-
-      Ant is different.  Instead of a model where it is extended with
-      shell-based commands, Ant is extended using Java classes.  Instead of
-      writing shell commands, the configuration files are XML-based, calling
-      out a target tree where various tasks get executed.  Each task is run
-      by an object that implements a particular Task interface.
-    '';
-
-    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
-    license = lib.licenses.asl20;
-    maintainers = [ ] ++ lib.teams.java.members;
-    platforms = lib.platforms.all;
-  };
-}
diff --git a/pkgs/by-name/ar/archipelago/package.nix b/pkgs/by-name/ar/archipelago/package.nix
index 0bd4d1b6f00a..a805c550e4c6 100644
--- a/pkgs/by-name/ar/archipelago/package.nix
+++ b/pkgs/by-name/ar/archipelago/package.nix
@@ -7,10 +7,10 @@
 }:
 let
   pname = "archipelago";
-  version = "0.5.0";
+  version = "0.5.1";
   src = fetchurl {
     url = "https://github.com/ArchipelagoMW/Archipelago/releases/download/${version}/Archipelago_${version}_linux-x86_64.AppImage";
-    hash = "sha256-Dw5BBfCthB9xUJXYmnmIwmqlT/L24QZnKyELLjPGNRA=";
+    hash = "sha256-/TwmTQtV/6bR95ZQNEcOFQ4t/0otNK8xx5N+yoYaiYk=";
   };
 
   appimageContents = appimageTools.extractType2 { inherit pname version src; };
diff --git a/pkgs/by-name/ba/bazecor/package.nix b/pkgs/by-name/ba/bazecor/package.nix
index d71334f03bbc..ecb0ccfe0de7 100644
--- a/pkgs/by-name/ba/bazecor/package.nix
+++ b/pkgs/by-name/ba/bazecor/package.nix
@@ -41,7 +41,7 @@ appimageTools.wrapAppImage {
 
   extraInstallCommands = ''
     wrapProgram $out/bin/bazecor \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}"
 
     install -m 444 -D ${src}/Bazecor.desktop -t $out/share/applications
     install -m 444 -D ${src}/bazecor.png -t $out/share/pixmaps
diff --git a/pkgs/by-name/be/bear/package.nix b/pkgs/by-name/be/bear/package.nix
index 61150d767882..d12fa91e31fe 100644
--- a/pkgs/by-name/be/bear/package.nix
+++ b/pkgs/by-name/be/bear/package.nix
@@ -31,10 +31,14 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-pwdjytP+kmTwozRl1Gd0jUqRs3wfvcYPqiQvVwa6s9c=";
   };
 
+  strictDeps = true;
+
   nativeBuildInputs = [
     cmake
     ninja
     pkg-config
+    grpc
+    protobuf
   ];
 
   buildInputs = [
@@ -70,10 +74,10 @@ stdenv.mkDerivation (finalAttrs: {
   cmakeFlags = [
     # Build system and generated files concatenate install prefix and
     # CMAKE_INSTALL_{BIN,LIB}DIR, which breaks if these are absolute paths.
-    "-DCMAKE_INSTALL_BINDIR=bin"
-    "-DCMAKE_INSTALL_LIBDIR=lib"
-    (lib.cmakeBool "ENABLE_UNIT_TESTS" finalAttrs.doCheck)
-    (lib.cmakeBool "ENABLE_FUNC_TESTS" finalAttrs.doCheck)
+    (lib.cmakeFeature "CMAKE_INSTALL_BINDIR" "bin")
+    (lib.cmakeFeature "CMAKE_INSTALL_LIBDIR" "lib")
+    (lib.cmakeBool "ENABLE_UNIT_TESTS" finalAttrs.finalPackage.doCheck)
+    (lib.cmakeBool "ENABLE_FUNC_TESTS" finalAttrs.finalPackage.doCheck)
   ];
 
   checkTarget = lib.concatStringsSep " " [
@@ -106,7 +110,7 @@ stdenv.mkDerivation (finalAttrs: {
   # Functional tests use loopback networking.
   __darwinAllowLocalNetworking = true;
 
-  meta = with lib; {
+  meta = {
     description = "Tool that generates a compilation database for clang tooling";
     mainProgram = "bear";
     longDescription = ''
@@ -115,8 +119,8 @@ stdenv.mkDerivation (finalAttrs: {
       and run `bear make`.  It's not perfect, but it gets a long way.
     '';
     homepage = "https://github.com/rizsotto/Bear";
-    license = licenses.gpl3Plus;
-    platforms = platforms.unix;
-    maintainers = with maintainers; [ DieracDelta ];
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ DieracDelta ];
   };
 })
diff --git a/pkgs/by-name/be/beekeeper-studio/package.nix b/pkgs/by-name/be/beekeeper-studio/package.nix
index 437d3b7e7e4c..004607f4e94a 100644
--- a/pkgs/by-name/be/beekeeper-studio/package.nix
+++ b/pkgs/by-name/be/beekeeper-studio/package.nix
@@ -33,7 +33,7 @@ appimageTools.wrapType2 {
 
   extraInstallCommands = ''
     wrapProgram $out/bin/${pname} \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}"
     install -Dm444 ${appimageContents}/${pname}.desktop -t $out/share/applications/
     install -Dm444 ${appimageContents}/${pname}.png -t $out/share/pixmaps/
     substituteInPlace $out/share/applications/${pname}.desktop \
diff --git a/pkgs/by-name/be/beeper/package.nix b/pkgs/by-name/be/beeper/package.nix
index 918d07863734..d7abefeba49f 100644
--- a/pkgs/by-name/be/beeper/package.nix
+++ b/pkgs/by-name/be/beeper/package.nix
@@ -45,7 +45,7 @@ stdenvNoCC.mkDerivation rec {
     substituteInPlace $out/share/applications/${pname}.desktop --replace "AppRun" "${pname}"
 
     wrapProgram $out/bin/${pname} \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}} --no-update"
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}} --no-update"
 
     runHook postInstall
   '';
diff --git a/pkgs/by-name/bi/bibata-cursors/package.nix b/pkgs/by-name/bi/bibata-cursors/package.nix
index dda08f8f8c8b..e450314cef1c 100644
--- a/pkgs/by-name/bi/bibata-cursors/package.nix
+++ b/pkgs/by-name/bi/bibata-cursors/package.nix
@@ -28,13 +28,21 @@ stdenvNoCC.mkDerivation rec {
   buildPhase = ''
     runHook preBuild
 
-    ctgen configs/right/x.build.toml -p x11 -d $bitmaps/Bibata-Modern-Amber -n 'Bibata-Modern-Amber' -c 'Yellowish and rounded edge bibata cursors.'
-    ctgen configs/right/x.build.toml -p x11 -d $bitmaps/Bibata-Modern-Classic -n 'Bibata-Modern-Classic' -c 'Black and rounded edge Bibata cursors.'
-    ctgen configs/right/x.build.toml -p x11 -d $bitmaps/Bibata-Modern-Ice -n 'Bibata-Modern-Ice' -c 'White and rounded edge Bibata cursors.'
+    ctgen configs/normal/x.build.toml -p x11 -d $bitmaps/Bibata-Modern-Amber -n 'Bibata-Modern-Amber' -c 'Yellowish and rounded edge Bibata XCursors'
+    ctgen configs/normal/x.build.toml -p x11 -d $bitmaps/Bibata-Modern-Classic -n 'Bibata-Modern-Classic' -c 'Black and rounded edge Bibata XCursors'
+    ctgen configs/normal/x.build.toml -p x11 -d $bitmaps/Bibata-Modern-Ice -n 'Bibata-Modern-Ice' -c 'White and rounded edge Bibata XCursors'
 
-    ctgen configs/right/x.build.toml -p x11 -d $bitmaps/Bibata-Original-Amber -n 'Bibata-Original-Amber' -c 'Yellowish and sharp edge Bibata cursors.'
-    ctgen configs/right/x.build.toml -p x11 -d $bitmaps/Bibata-Original-Classic -n 'Bibata-Original-Classic' -c 'Black and sharp edge Bibata cursors.'
-    ctgen configs/right/x.build.toml -p x11 -d $bitmaps/Bibata-Original-Ice -n 'Bibata-Original-Ice' -c 'White and sharp edge Bibata cursors.'
+    ctgen configs/right/x.build.toml -p x11 -d $bitmaps/Bibata-Modern-Amber-Right -n 'Bibata-Modern-Amber-Right' -c 'Yellowish and rounded edge right-hand Bibata XCursors'
+    ctgen configs/right/x.build.toml -p x11 -d $bitmaps/Bibata-Modern-Classic-Right -n 'Bibata-Modern-Classic-Right' -c 'Black and rounded edge right-hand Bibata XCursors'
+    ctgen configs/right/x.build.toml -p x11 -d $bitmaps/Bibata-Modern-Ice-Right -n 'Bibata-Modern-Ice-Right' -c 'White and rounded edge right-hand Bibata XCursors'
+
+    ctgen configs/normal/x.build.toml -p x11 -d $bitmaps/Bibata-Original-Amber -n 'Bibata-Original-Amber' -c 'Yellowish and sharp edge Bibata XCursors'
+    ctgen configs/normal/x.build.toml -p x11 -d $bitmaps/Bibata-Original-Classic -n 'Bibata-Original-Classic' -c 'Black and sharp edge Bibata XCursors'
+    ctgen configs/normal/x.build.toml -p x11 -d $bitmaps/Bibata-Original-Ice -n 'Bibata-Original-Ice' -c 'White and sharp edge Bibata XCursors'
+
+    ctgen configs/right/x.build.toml -p x11 -d $bitmaps/Bibata-Original-Amber-Right -n 'Bibata-Original-Amber-Right' -c 'Yellowish and sharp edge right-hand Bibata XCursors'
+    ctgen configs/right/x.build.toml -p x11 -d $bitmaps/Bibata-Original-Classic-Right -n 'Bibata-Original-Classic-Right' -c 'Black and sharp edge right-hand Bibata XCursors'
+    ctgen configs/right/x.build.toml -p x11 -d $bitmaps/Bibata-Original-Ice-Right -n 'Bibata-Original-Ice-Right' -c 'White and sharp edge right-hand Bibata XCursors'
 
     runHook postBuild
   '';
diff --git a/pkgs/by-name/bi/bitwarden-desktop/package.nix b/pkgs/by-name/bi/bitwarden-desktop/package.nix
index 3346353ef00f..c44f73e11599 100644
--- a/pkgs/by-name/bi/bitwarden-desktop/package.nix
+++ b/pkgs/by-name/bi/bitwarden-desktop/package.nix
@@ -161,7 +161,7 @@ in buildNpmPackage rec {
 
     makeWrapper '${lib.getExe electron}' "$out/bin/bitwarden" \
       --add-flags $out/opt/Bitwarden/resources/app.asar \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}" \
       --set-default ELECTRON_IS_DEV 0 \
       --inherit-argv0
 
diff --git a/pkgs/by-name/bl/bloat/package.nix b/pkgs/by-name/bl/bloat/package.nix
index 84004ef16e2d..e4181ceac575 100644
--- a/pkgs/by-name/bl/bloat/package.nix
+++ b/pkgs/by-name/bl/bloat/package.nix
@@ -6,12 +6,12 @@
 
 buildGoModule {
   pname = "bloat";
-  version = "0-unstable-2024-06-17";
+  version = "0-unstable-2024-10-28";
 
   src = fetchgit {
     url = "git://git.freesoftwareextremist.com/bloat";
-    rev = "51d6ff26fe224444b921b5b1f367f15782cf84d3";
-    hash = "sha256-g5CbX134o9aeFggsVYnPfbZ4bsRQUUNnAe1KhTlONuU=";
+    rev = "68d7acc2f7266c47001445229ff235546c8c71b4";
+    hash = "sha256-VLyL1tnb3/qsDFp8s84XTj1Ohl/ajD+tn7V8iBp3ppY=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/bl/blockbench/package.nix b/pkgs/by-name/bl/blockbench/package.nix
index 12dbf8d6331e..4aa7bc18a831 100644
--- a/pkgs/by-name/bl/blockbench/package.nix
+++ b/pkgs/by-name/bl/blockbench/package.nix
@@ -71,7 +71,7 @@ buildNpmPackage rec {
 
       makeWrapper ${lib.getExe electron} $out/bin/blockbench \
           --add-flags $out/share/blockbench/resources/app.asar \
-          --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+          --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}" \
           --inherit-argv0
     ''}
 
diff --git a/pkgs/by-name/br/brave/make-brave.nix b/pkgs/by-name/br/brave/make-brave.nix
index 61cdcdb08273..6f7f5d0687d8 100644
--- a/pkgs/by-name/br/brave/make-brave.nix
+++ b/pkgs/by-name/br/brave/make-brave.nix
@@ -262,7 +262,7 @@ stdenv.mkDerivation {
       }
       ${
         optionalString (enableFeatures != [ ]) ''
-          --add-flags "--enable-features=${strings.concatStringsSep "," enableFeatures}\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+,WaylandWindowDecorations}}"
+          --add-flags "--enable-features=${strings.concatStringsSep "," enableFeatures}\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+,WaylandWindowDecorations --enable-wayland-ime}}"
         ''
       }
       ${
diff --git a/pkgs/by-name/br/bruno/package.nix b/pkgs/by-name/br/bruno/package.nix
index 07e8516e308d..b4750534d43d 100644
--- a/pkgs/by-name/br/bruno/package.nix
+++ b/pkgs/by-name/br/bruno/package.nix
@@ -153,7 +153,7 @@ buildNpmPackage rec {
 
           makeWrapper ${lib.getExe electron} $out/bin/bruno \
             --add-flags $out/opt/bruno/resources/app.asar \
-            --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+            --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}" \
             --set-default ELECTRON_IS_DEV 0 \
             --inherit-argv0
 
diff --git a/pkgs/by-name/c2/c2fmzq/package.nix b/pkgs/by-name/c2/c2fmzq/package.nix
index a1245ac7b37a..69942a05fdd1 100644
--- a/pkgs/by-name/c2/c2fmzq/package.nix
+++ b/pkgs/by-name/c2/c2fmzq/package.nix
@@ -6,20 +6,20 @@
 
 buildGoModule rec {
   pname = "c2FmZQ";
-  version = "0.4.22";
+  version = "0.4.25";
 
   src = fetchFromGitHub {
     owner = "c2FmZQ";
     repo = "c2FmZQ";
     rev = "v${version}";
-    hash = "sha256-IqLG8dLi47Swp6YPxDXsM6LVDPvzcH5rWeqpgghbYsE=";
+    hash = "sha256-1c2C+BVgf7NumOoCCMfGFpn1qwQ2V4524aG5yZO98vI=";
   };
 
   ldflags = [ "-s" "-w" ];
 
   sourceRoot = "${src.name}/c2FmZQ";
 
-  vendorHash = "sha256-PTWi/M51cydmWoOj1JPyaI0wbjd0BMLlaSlQRIcmShg=";
+  vendorHash = "sha256-9eWLg0+HkpwUC+De62Izh3vadV3dnwPpf8ksH8KwGqQ=";
 
   subPackages = [ "c2FmZQ-client" "c2FmZQ-server" ];
 
diff --git a/pkgs/by-name/ca/caprine/package.nix b/pkgs/by-name/ca/caprine/package.nix
index fc75d8588cbf..c9a11ecc919c 100644
--- a/pkgs/by-name/ca/caprine/package.nix
+++ b/pkgs/by-name/ca/caprine/package.nix
@@ -46,7 +46,7 @@ buildNpmPackage rec {
 
       makeWrapper ${lib.getExe electron} $out/bin/caprine \
           --add-flags $out/share/caprine/resources/app.asar \
-          --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+          --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}" \
           --set-default ELECTRON_IS_DEV 0 \
           --inherit-argv0
 
diff --git a/pkgs/by-name/ca/cargo-component/package.nix b/pkgs/by-name/ca/cargo-component/package.nix
index 66f9356a6e20..fd0c1806e27d 100644
--- a/pkgs/by-name/ca/cargo-component/package.nix
+++ b/pkgs/by-name/ca/cargo-component/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-component";
-  version = "0.17.0";
+  version = "0.19.0";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = "cargo-component";
     rev = "v${version}";
-    hash = "sha256-j1gQgtse3DQWyR4D5BzQ0aAEGhNKoFT0ACRBVOqDdFE=";
+    hash = "sha256-HiDwFWEzzCmwlEKsVmKREtn5OfAziC+irgeh66fRWIQ=";
   };
 
-  cargoHash = "sha256-1YDnqopghS6MpQ2h8e5kQj0bxKAC2B6XzVeC60+M3MM=";
+  cargoHash = "sha256-AtOZGYH0ya5mza3QFTfaXvw9tcFDGuz72JUhfTdUml8=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/ca/cargo-feature/package.nix b/pkgs/by-name/ca/cargo-feature/package.nix
index 81f0a1c62bb6..469099900219 100644
--- a/pkgs/by-name/ca/cargo-feature/package.nix
+++ b/pkgs/by-name/ca/cargo-feature/package.nix
@@ -1,4 +1,10 @@
-{ lib, rustPlatform, fetchFromGitHub, stdenv, libiconv }:
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  stdenv,
+  libiconv,
+}:
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-feature";
@@ -15,13 +21,22 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = lib.optional stdenv.hostPlatform.isDarwin libiconv;
 
+  checkFlags = [
+    # The following tests require empty CARGO_BUILD_TARGET env variable, but we
+    # set it ever since https://github.com/NixOS/nixpkgs/pull/298108.
+    "--skip=add_target_feature"
+    "--skip=list_optional_deps_as_feature"
+  ];
+
   meta = with lib; {
     description = "Cargo plugin to manage dependency features";
     mainProgram = "cargo-feature";
     homepage = "https://github.com/Riey/cargo-feature";
     license = licenses.mit;
     platforms = platforms.unix;
-    maintainers = with maintainers; [ riey matthiasbeyer ];
+    maintainers = with maintainers; [
+      riey
+      matthiasbeyer
+    ];
   };
 }
-
diff --git a/pkgs/by-name/ch/chatzone-desktop/package.nix b/pkgs/by-name/ch/chatzone-desktop/package.nix
index 27a0aba212e3..93c412f560bb 100644
--- a/pkgs/by-name/ch/chatzone-desktop/package.nix
+++ b/pkgs/by-name/ch/chatzone-desktop/package.nix
@@ -56,7 +56,7 @@ stdenvNoCC.mkDerivation {
     cp -r ${appimageContents}/usr/share/icons $out/share
 
     wrapProgram $out/bin/chatzone-desktop \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}"
 
     runHook postInstall
   '';
diff --git a/pkgs/by-name/ci/cider-2/package.nix b/pkgs/by-name/ci/cider-2/package.nix
index 8cffc3a34ef9..b8140e1a05c8 100644
--- a/pkgs/by-name/ci/cider-2/package.nix
+++ b/pkgs/by-name/ci/cider-2/package.nix
@@ -27,7 +27,7 @@ appimageTools.wrapType2 rec {
     in
     ''
       wrapProgram $out/bin/${pname} \
-         --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+         --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}" \
          --add-flags "--no-sandbox --disable-gpu-sandbox" # Cider 2 does not start up properly without these from my preliminary testing
 
       install -m 444 -D ${contents}/cider.desktop $out/share/applications/${pname}.desktop
diff --git a/pkgs/by-name/ci/cider/package.nix b/pkgs/by-name/ci/cider/package.nix
index 48289d6d37d3..94e21715ed9c 100644
--- a/pkgs/by-name/ci/cider/package.nix
+++ b/pkgs/by-name/ci/cider/package.nix
@@ -15,7 +15,7 @@ appimageTools.wrapType2 rec {
     let contents = appimageTools.extract { inherit pname version src; };
     in ''
       wrapProgram $out/bin/${pname} \
-        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}"
 
       install -m 444 -D ${contents}/${pname}.desktop -t $out/share/applications
       substituteInPlace $out/share/applications/${pname}.desktop \
diff --git a/pkgs/by-name/ci/cifs-utils/package.nix b/pkgs/by-name/ci/cifs-utils/package.nix
index b96298aa2cd9..0deb89ea46bc 100644
--- a/pkgs/by-name/ci/cifs-utils/package.nix
+++ b/pkgs/by-name/ci/cifs-utils/package.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   version = "7.1";
 
   src = fetchurl {
-    url = "mirror://samba/pub/linux-cifs/cifs-utils/${pname}-${version}.tar.bz2";
+    url = "https://download.samba.org/pub/linux-cifs/cifs-utils/${pname}-${version}.tar.bz2";
     sha256 = "sha256-ohEj92pKajbJZTGJukkY6988/NP5CScwpH/zRQtbWyo=";
   };
 
diff --git a/pkgs/by-name/ci/cimg/package.nix b/pkgs/by-name/ci/cimg/package.nix
index 6b55ca755120..a5112b210720 100644
--- a/pkgs/by-name/ci/cimg/package.nix
+++ b/pkgs/by-name/ci/cimg/package.nix
@@ -45,9 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
       processing applications.
     '';
     license = lib.licenses.cecill-c;
-    maintainers = [
-      lib.maintainers.AndersonTorres
-    ];
+    maintainers = [ ];
     platforms = lib.platforms.unix;
   };
 })
diff --git a/pkgs/by-name/ci/ciscoPacketTracer7/package.nix b/pkgs/by-name/ci/ciscoPacketTracer7/package.nix
index a378940e5599..5b29306396c0 100644
--- a/pkgs/by-name/ci/ciscoPacketTracer7/package.nix
+++ b/pkgs/by-name/ci/ciscoPacketTracer7/package.nix
@@ -84,7 +84,7 @@ in stdenv.mkDerivation {
     homepage = "https://www.netacad.com/courses/packet-tracer";
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
-    maintainers = with maintainers; [ lucasew ];
+    maintainers = with maintainers; [ ];
     platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/by-name/ci/ciscoPacketTracer8/package.nix b/pkgs/by-name/ci/ciscoPacketTracer8/package.nix
index fca1924b087a..8c29081bf79e 100644
--- a/pkgs/by-name/ci/ciscoPacketTracer8/package.nix
+++ b/pkgs/by-name/ci/ciscoPacketTracer8/package.nix
@@ -106,7 +106,7 @@ stdenvNoCC.mkDerivation (args: {
     homepage = "https://www.netacad.com/courses/packet-tracer";
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
-    maintainers = with maintainers; [ lucasew ];
+    maintainers = with maintainers; [ ];
     platforms = [ "x86_64-linux" ];
     mainProgram = "packettracer8";
   };
diff --git a/pkgs/by-name/co/code-cursor/package.nix b/pkgs/by-name/co/code-cursor/package.nix
index 57264dba1359..3b1a62852430 100644
--- a/pkgs/by-name/co/code-cursor/package.nix
+++ b/pkgs/by-name/co/code-cursor/package.nix
@@ -38,7 +38,7 @@ stdenvNoCC.mkDerivation {
     substituteInPlace $out/share/applications/cursor.desktop --replace-fail "AppRun" "cursor"
 
     wrapProgram $out/bin/cursor \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}} --no-update"
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}} --no-update"
 
     runHook postInstall
   '';
diff --git a/pkgs/by-name/cr/crossplane-cli/package.nix b/pkgs/by-name/cr/crossplane-cli/package.nix
index f9391a02f620..66b0fd3e7592 100644
--- a/pkgs/by-name/cr/crossplane-cli/package.nix
+++ b/pkgs/by-name/cr/crossplane-cli/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "crossplane-cli";
-  version = "1.17.1";
+  version = "1.18.0";
 
   src = fetchFromGitHub {
     owner = "crossplane";
     repo = "crossplane";
     rev = "v${version}";
-    hash = "sha256-zcORVw+6QUucxJkHx/QWOHn50fd4+Jp+ZtiGuwfEQ6I=";
+    hash = "sha256-4EdYFrYh8bVCOXc7coq7WfZk0Be9rghdvNlOYFn6bm4=";
   };
 
-  vendorHash = "sha256-de9xt3aFmGDddwMO2GgKKKmSfvsfnpit3wUrBme//fI=";
+  vendorHash = "sha256-Am41aAV1AlKOIrC11byqshMDGjzzg7mGI4kARwLINl8=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/de/deltachat-desktop/package.nix b/pkgs/by-name/de/deltachat-desktop/package.nix
index 352765077dde..b51cff362f06 100644
--- a/pkgs/by-name/de/deltachat-desktop/package.nix
+++ b/pkgs/by-name/de/deltachat-desktop/package.nix
@@ -110,7 +110,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     makeWrapper ${lib.getExe electron} $out/bin/${finalAttrs.meta.mainProgram} \
       --add-flags $out/opt/DeltaChat/resources/app.asar \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}" \
       --inherit-argv0
 
     runHook postInstall
diff --git a/pkgs/by-name/el/elvish/package.nix b/pkgs/by-name/el/elvish/package.nix
index 77e8b949b4b4..36d2214a2a13 100644
--- a/pkgs/by-name/el/elvish/package.nix
+++ b/pkgs/by-name/el/elvish/package.nix
@@ -49,6 +49,6 @@ buildGoModule {
       status, it is already suitable for most daily interactive use.
     '';
     license = lib.licenses.bsd2;
-    maintainers = with lib.maintainers; [ AndersonTorres ];
+    maintainers = with lib.maintainers; [ ];
   };
 }
diff --git a/pkgs/by-name/er/ergo/package.nix b/pkgs/by-name/er/ergo/package.nix
index f44cadc785fe..075d4febe95a 100644
--- a/pkgs/by-name/er/ergo/package.nix
+++ b/pkgs/by-name/er/ergo/package.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ergo";
-  version = "5.0.23";
+  version = "5.0.24";
 
   src = fetchurl {
     url = "https://github.com/ergoplatform/ergo/releases/download/v${version}/ergo-${version}.jar";
-    sha256 = "sha256-bVvqsgfsIlAUwbTbFAYbI+Dtgbxv71cMlDpaReTE56Q=";
+    sha256 = "sha256-+dpSgqJGHUNzIBQBbfbeclB5t+NyaluGRTCZ4OESZu8=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/ex/exploitdb/package.nix b/pkgs/by-name/ex/exploitdb/package.nix
index 91ae39a73c64..7be657f58d96 100644
--- a/pkgs/by-name/ex/exploitdb/package.nix
+++ b/pkgs/by-name/ex/exploitdb/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2024-11-16";
+  version = "2024-11-26";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = "exploitdb";
     rev = "refs/tags/${version}";
-    hash = "sha256-49xG3mVh5M9MfK4WuU3rc9Q+QlZo7IyV3jwAdBUEmu0=";
+    hash = "sha256-o95B9zqKGlI1zpknw1yXhiaPIos3DoMCQXmSranf83c=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/fa/factoriolab/package.nix b/pkgs/by-name/fa/factoriolab/package.nix
index 22faaf4f3e63..5cc8c918000a 100644
--- a/pkgs/by-name/fa/factoriolab/package.nix
+++ b/pkgs/by-name/fa/factoriolab/package.nix
@@ -10,13 +10,13 @@
 }:
 buildNpmPackage rec {
   pname = "factoriolab";
-  version = "3.8.1";
+  version = "3.8.4";
 
   src = fetchFromGitHub {
     owner = "factoriolab";
     repo = "factoriolab";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ZI7nit+DBc1ULGDpGlee7v+NrHc5JhS7sgACGG5fB7I=";
+    hash = "sha256-zgRarlzTQr2HgiQdCvh6N2yM5FS66jFgQcOyaQUbAQY=";
   };
   buildInputs = [ vips ];
   nativeBuildInputs = [
diff --git a/pkgs/by-name/fe/feishin/package.nix b/pkgs/by-name/fe/feishin/package.nix
index db26c0d6105a..16c0be5b0956 100644
--- a/pkgs/by-name/fe/feishin/package.nix
+++ b/pkgs/by-name/fe/feishin/package.nix
@@ -115,7 +115,7 @@ buildNpmPackage {
       # https://github.com/electron/electron/issues/35153#issuecomment-1202718531
       makeWrapper ${lib.getExe electron} $out/bin/feishin \
         --add-flags $out/share/feishin/resources/app.asar \
-        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}" \
         --set ELECTRON_FORCE_IS_PACKAGED=1 \
         --inherit-argv0
 
diff --git a/pkgs/by-name/fi/figma-linux/package.nix b/pkgs/by-name/fi/figma-linux/package.nix
index 29fd84f2f338..54a1125c29d4 100644
--- a/pkgs/by-name/fi/figma-linux/package.nix
+++ b/pkgs/by-name/fi/figma-linux/package.nix
@@ -71,7 +71,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     wrapProgramShell $out/bin/figma-linux \
       "''${gappsWrapperArgs[@]}" \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland}}"
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland --enable-wayland-ime}}"
 
     runHook postInstall
   '';
diff --git a/pkgs/by-name/fi/firefox-sync-client/package.nix b/pkgs/by-name/fi/firefox-sync-client/package.nix
new file mode 100644
index 000000000000..a82b8adf701c
--- /dev/null
+++ b/pkgs/by-name/fi/firefox-sync-client/package.nix
@@ -0,0 +1,27 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "firefox-sync-client";
+  version = "1.8.0";
+
+  src = fetchFromGitHub {
+    owner = "Mikescher";
+    repo = "firefox-sync-client";
+    rev = "v${version}";
+    hash = "sha256-Ax+v4a8bVuym1bp9dliXX85PXJk2Qlik3ME+adGiL1s=";
+  };
+
+  vendorHash = "sha256-MYetPdnnvIBzrYrA+eM9z1P3+P5FumYKH+brvvlwkm4=";
+
+  meta = {
+    description = "Commandline-utility to list/view/edit/delete entries in a firefox-sync account.";
+    homepage = "https://github.com/Mikescher/firefox-sync-client";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ ambroisie ];
+    mainProgram = "ffsclient";
+  };
+}
diff --git a/pkgs/by-name/fl/flam3/package.nix b/pkgs/by-name/fl/flam3/package.nix
index 4eb0bc67c3f0..121485b081e8 100644
--- a/pkgs/by-name/fl/flam3/package.nix
+++ b/pkgs/by-name/fl/flam3/package.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
       is specified by a long string of numbers - a genetic code of sorts.
     '';
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ AndersonTorres ];
+    maintainers = with maintainers; [ ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/by-name/fl/fleng/package.nix b/pkgs/by-name/fl/fleng/package.nix
index 0c2c8359f65a..38cb24d4ea7c 100644
--- a/pkgs/by-name/fl/fleng/package.nix
+++ b/pkgs/by-name/fl/fleng/package.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "http://www.call-with-current-continuation.org/fleng/fleng.html";
     description = "Low level concurrent logic programming language descended from Prolog";
     license = lib.licenses.publicDomain;
-    maintainers = with lib.maintainers; [ AndersonTorres ];
+    maintainers = with lib.maintainers; [ ];
     platforms = lib.platforms.unix;
   };
 })
diff --git a/pkgs/by-name/fm/fm-go/package.nix b/pkgs/by-name/fm/fm-go/package.nix
index e0bda5a43b17..27c4867426fb 100644
--- a/pkgs/by-name/fm/fm-go/package.nix
+++ b/pkgs/by-name/fm/fm-go/package.nix
@@ -23,7 +23,7 @@ let
       changelog = "https://github.com/mistakenelf/fm/releases/tag/${finalAttrs.src.rev}";
       license = with lib.licenses; [ mit ];
       mainProgram = "fm";
-      maintainers = with lib.maintainers; [ AndersonTorres ];
+      maintainers = with lib.maintainers; [ ];
     };
   };
 in
diff --git a/pkgs/by-name/fr/framesh/package.nix b/pkgs/by-name/fr/framesh/package.nix
index b4673ca4cff9..ae29660ff347 100644
--- a/pkgs/by-name/fr/framesh/package.nix
+++ b/pkgs/by-name/fr/framesh/package.nix
@@ -21,7 +21,7 @@ appimageTools.wrapType2 {
     install -m 444 -D ${appimageContents}/frame.png \
       $out/share/icons/hicolor/512x512/apps/frame.png
     wrapProgram "$out/bin/${pname}" \
-       --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland --enable-features=WaylandWindowDecorations}}"
+       --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland --enable-features=WaylandWindowDecorations --enable-wayland-ime}}"
 
     substituteInPlace $out/share/applications/frame.desktop \
       --replace 'Exec=AppRun' 'Exec=${pname}'
diff --git a/pkgs/by-name/fr/freetube/package.nix b/pkgs/by-name/fr/freetube/package.nix
index 77959f42af41..cc00bc2077b3 100644
--- a/pkgs/by-name/fr/freetube/package.nix
+++ b/pkgs/by-name/fr/freetube/package.nix
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
   postFixup = ''
     makeWrapper ${electron}/bin/electron $out/bin/${pname} \
       --add-flags $out/share/${pname}/resources/app.asar \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland}}"
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland --enable-wayland-ime}}"
   '';
 
   meta = {
diff --git a/pkgs/by-name/gi/github-desktop/package.nix b/pkgs/by-name/gi/github-desktop/package.nix
index 88f8b5620b45..2d1868e254b8 100644
--- a/pkgs/by-name/gi/github-desktop/package.nix
+++ b/pkgs/by-name/gi/github-desktop/package.nix
@@ -83,7 +83,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   preFixup = ''
     gappsWrapperArgs+=(
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland}}"
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland --enable-wayland-ime}}"
       --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libglvnd ]}
     )
   '';
diff --git a/pkgs/by-name/gi/gitify/package.nix b/pkgs/by-name/gi/gitify/package.nix
index ae2d4cfdb7cc..f9fa4126eb50 100644
--- a/pkgs/by-name/gi/gitify/package.nix
+++ b/pkgs/by-name/gi/gitify/package.nix
@@ -80,7 +80,7 @@ stdenv.mkDerivation (finalAttrs: {
 
           makeWrapper ${lib.getExe electron} $out/bin/gitify \
               --add-flags $out/share/gitify/resources/app.asar \
-              --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+              --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}" \
               --inherit-argv0
         ''
     }
diff --git a/pkgs/by-name/gi/gitkraken/package.nix b/pkgs/by-name/gi/gitkraken/package.nix
index 77d20cdf65d3..3f462f132934 100644
--- a/pkgs/by-name/gi/gitkraken/package.nix
+++ b/pkgs/by-name/gi/gitkraken/package.nix
@@ -191,7 +191,7 @@ let
     '';
 
     preFixup = ''
-      gappsWrapperArgs+=(--add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}")
+      gappsWrapperArgs+=(--add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}")
     '';
 
     postFixup = ''
diff --git a/pkgs/by-name/gl/glamoroustoolkit/package.nix b/pkgs/by-name/gl/glamoroustoolkit/package.nix
index d09dec9a18aa..f28c82283722 100644
--- a/pkgs/by-name/gl/glamoroustoolkit/package.nix
+++ b/pkgs/by-name/gl/glamoroustoolkit/package.nix
@@ -28,12 +28,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "glamoroustoolkit";
-  version = "1.1.7";
+  version = "1.1.8";
 
   src = fetchzip {
     url = "https://github.com/feenkcom/gtoolkit-vm/releases/download/v${finalAttrs.version}/GlamorousToolkit-x86_64-unknown-linux-gnu.zip";
     stripRoot = false;
-    hash = "sha256-ji77uc7UnfiDVCERWwDpMnBiSJjDrr84yYrobLhKWlE=";
+    hash = "sha256-r7q8apszeiON3MPMSY7GHHTh+hSXlAl35pUTxFV78kk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/go/goofcord/package.nix b/pkgs/by-name/go/goofcord/package.nix
index 65160701b52a..44adb2b678fe 100644
--- a/pkgs/by-name/go/goofcord/package.nix
+++ b/pkgs/by-name/go/goofcord/package.nix
@@ -75,7 +75,7 @@ stdenv.mkDerivation (finalAttrs: {
     makeShellWrapper "${lib.getExe electron}" "$out/bin/goofcord" \
       --add-flags "$out/share/lib/goofcord/resources/app.asar" \
       "''${gappsWrapperArgs[@]}" \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=UseOzonePlatform,WaylandWindowDecorations,WebRTCPipeWireCapturer}}" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=UseOzonePlatform,WaylandWindowDecorations,WebRTCPipeWireCapturer --enable-wayland-ime}}" \
       --set-default ELECTRON_IS_DEV 0 \
       --inherit-argv0
 
diff --git a/pkgs/by-name/go/google-chrome/package.nix b/pkgs/by-name/go/google-chrome/package.nix
index 1113a014c9b7..487c6745079b 100644
--- a/pkgs/by-name/go/google-chrome/package.nix
+++ b/pkgs/by-name/go/google-chrome/package.nix
@@ -248,7 +248,7 @@ let
         --suffix PATH            : "${lib.makeBinPath [ xdg-utils ]}" \
         --prefix XDG_DATA_DIRS   : "$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH:${addDriverRunpath.driverLink}/share" \
         --set CHROME_WRAPPER  "google-chrome-$dist" \
-        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}" \
         --add-flags "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" \
         --add-flags ${lib.escapeShellArg commandLineArgs}
 
diff --git a/pkgs/by-name/gr/greenmask/package.nix b/pkgs/by-name/gr/greenmask/package.nix
index 53dadf66516d..8ecc7f25c3bd 100644
--- a/pkgs/by-name/gr/greenmask/package.nix
+++ b/pkgs/by-name/gr/greenmask/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "greenmask";
-  version = "0.2.3";
+  version = "0.2.5";
 
   src = fetchFromGitHub {
     owner = "GreenmaskIO";
     repo = "greenmask";
     rev = "refs/tags/v${version}";
-    hash = "sha256-wAYkr6vCqRQIfZaK31/NSluZZbZYGN5QJkLgdubEGoM=";
+    hash = "sha256-OysYBoS/y4vKoyYpRlbkTvDaSPIIEM7QGI3lNkvNSGA=";
   };
 
   vendorHash = "sha256-D4XMEFi0uk6ogdo6+G1k/g16QpHynB1OjdoGcY2fSds=";
diff --git a/pkgs/by-name/gr/grim/package.nix b/pkgs/by-name/gr/grim/package.nix
index 72abbb46c7b0..c728f5f19aa2 100644
--- a/pkgs/by-name/gr/grim/package.nix
+++ b/pkgs/by-name/gr/grim/package.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Grab images from a Wayland compositor";
     license = lib.licenses.mit;
     mainProgram = "grim";
-    maintainers = with lib.maintainers; [ AndersonTorres ];
+    maintainers = with lib.maintainers; [ ];
     platforms = lib.platforms.linux;
   };
 })
diff --git a/pkgs/by-name/gs/gswatcher/package.nix b/pkgs/by-name/gs/gswatcher/package.nix
new file mode 100644
index 000000000000..cfdae25a27f8
--- /dev/null
+++ b/pkgs/by-name/gs/gswatcher/package.nix
@@ -0,0 +1,71 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+
+  meson,
+  ninja,
+  vala,
+  wrapGAppsHook4,
+  desktop-file-utils,
+  pkg-config,
+  imagemagick,
+
+  gtk4,
+  libadwaita,
+  libgee,
+  lua5_4,
+  geoip,
+  geolite-legacy,
+
+  versionCheckHook,
+  nix-update-script,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "gswatcher";
+  version = "1.7.1";
+
+  src = fetchFromGitHub {
+    owner = "lxndr";
+    repo = "gswatcher";
+    rev = "refs/tags/v${finalAttrs.version}";
+    hash = "sha256-U09vovOanYmDl5ymFC3bXU8pi8aUq2tPUE5AEoqmfpc=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    vala
+    wrapGAppsHook4
+    desktop-file-utils
+    # Not packaged yet, optional
+    # appstream-util
+    pkg-config
+    imagemagick
+  ];
+
+  buildInputs = [
+    gtk4
+    libadwaita
+    libgee
+    lua5_4
+    geoip
+  ];
+
+  postInstall = ''
+    ln -s ${geolite-legacy}/share/GeoIP $out/share/GeoIP
+  '';
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Simple game server monitor and administrative tool";
+    homepage = "https://github.com/lxndr/gswatcher";
+    license = with lib.licenses; [ agpl3Plus ];
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ pluiedev ];
+  };
+})
diff --git a/pkgs/by-name/ht/httptoolkit/package.nix b/pkgs/by-name/ht/httptoolkit/package.nix
index 5b2acf02bb0d..ef050b87b9e5 100644
--- a/pkgs/by-name/ht/httptoolkit/package.nix
+++ b/pkgs/by-name/ht/httptoolkit/package.nix
@@ -62,7 +62,7 @@ buildNpmPackage rec {
 
       makeWrapper ${lib.getExe electron} $out/bin/httptoolkit \
           --add-flags $out/share/httptoolkit/resources/app.asar \
-          --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+          --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}" \
           --inherit-argv0
     ''}
 
diff --git a/pkgs/by-name/ip/ipfs-cluster/package.nix b/pkgs/by-name/ip/ipfs-cluster/package.nix
index ebdb19ee5b77..c31e56038412 100644
--- a/pkgs/by-name/ip/ipfs-cluster/package.nix
+++ b/pkgs/by-name/ip/ipfs-cluster/package.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "ipfs-cluster";
-  version = "1.1.1";
+  version = "1.1.2";
 
-  vendorHash = "sha256-pCp2ox08wWUdAnqBqoiMLy/qBQg1PsNnMl8nLCNifC8=";
+  vendorHash = "sha256-y8eE1GYFiHbLY5zeSSQO86I4buZZJROGp7KzXbKjMqI=";
 
   src = fetchFromGitHub {
     owner = "ipfs-cluster";
     repo = "ipfs-cluster";
     rev = "v${version}";
-    hash = "sha256-FnofI7IpG0hA9/60cILbQ7xnGKJ2zdYk/pRZPTyOmzA=";
+    hash = "sha256-CpMnhqRlikKdPT3/tsLpKdKm6icePDsmqEnUEBwvCT0=";
   };
 
   meta = with lib; {
diff --git a/pkgs/by-name/it/itch/package.nix b/pkgs/by-name/it/itch/package.nix
index 29558080375f..e6d0d939c269 100644
--- a/pkgs/by-name/it/itch/package.nix
+++ b/pkgs/by-name/it/itch/package.nix
@@ -91,7 +91,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     makeWrapper ${steam-run}/bin/steam-run $out/bin/itch \
       --add-flags ${electron}/bin/electron \
       --add-flags $out/share/itch/resources/app \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}" \
       --set BROTH_USE_LOCAL butler,itch-setup \
       --prefix PATH : ${butler}:${itch-setup}
   '';
diff --git a/pkgs/by-name/ji/jitsi-meet-electron/package.nix b/pkgs/by-name/ji/jitsi-meet-electron/package.nix
index 619759df2f00..f3350f1b29d8 100644
--- a/pkgs/by-name/ji/jitsi-meet-electron/package.nix
+++ b/pkgs/by-name/ji/jitsi-meet-electron/package.nix
@@ -90,7 +90,7 @@ buildNpmPackage rec {
 
       makeWrapper ${lib.getExe electron} $out/bin/jitsi-meet-electron \
           --add-flags $out/share/jitsi-meet-electron/resources/app.asar \
-          --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+          --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}" \
           --set-default ELECTRON_IS_DEV 0 \
           --inherit-argv0
 
diff --git a/pkgs/by-name/jo/joplin-desktop/package.nix b/pkgs/by-name/jo/joplin-desktop/package.nix
index 7f85685679e1..f5d81acc08d5 100644
--- a/pkgs/by-name/jo/joplin-desktop/package.nix
+++ b/pkgs/by-name/jo/joplin-desktop/package.nix
@@ -52,7 +52,7 @@ let
 
     extraInstallCommands = ''
       wrapProgram $out/bin/${pname} \
-        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland --enable-features=WaylandWindowDecorations}}"
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland --enable-features=WaylandWindowDecorations --enable-wayland-ime}}"
       install -Dm444 ${appimageContents}/@joplinapp-desktop.desktop -t $out/share/applications
       install -Dm444 ${appimageContents}/@joplinapp-desktop.png -t $out/share/pixmaps
       substituteInPlace $out/share/applications/@joplinapp-desktop.desktop \
diff --git a/pkgs/by-name/ju/jumppad/package.nix b/pkgs/by-name/ju/jumppad/package.nix
index 4ededb4c2832..837d0156018e 100644
--- a/pkgs/by-name/ju/jumppad/package.nix
+++ b/pkgs/by-name/ju/jumppad/package.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "jumppad";
-  version = "0.15.0";
+  version = "0.16.0";
 
   src = fetchFromGitHub {
     owner = "jumppad-labs";
     repo = "jumppad";
     rev = version;
-    hash = "sha256-UO1a8CoHLNoo74zJkzgSlTkB7XWWHWu2EUiqCvLOQj8=";
+    hash = "sha256-zJS27lguSHvJge/iRwFhm9GtK0t3VQUt+uFZdjgkaeU=";
   };
-  vendorHash = "sha256-S4SyuidH8sxJbuG7yHgSP/iHcuP1h5EHaW8X6gG4GNw=";
+  vendorHash = "sha256-kn7rI5XwpqHeK7mA4FT67tLo2edb+dyD+rveVrGIjIo=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/ka/kando/package.nix b/pkgs/by-name/ka/kando/package.nix
index d87760f9baf3..0a63064db81e 100644
--- a/pkgs/by-name/ka/kando/package.nix
+++ b/pkgs/by-name/ka/kando/package.nix
@@ -111,7 +111,7 @@ buildNpmPackage rec {
 
       makeWrapper ${lib.getExe electron} $out/bin/kando \
           --add-flags $out/share/kando/resources/app \
-          --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+          --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}" \
           --inherit-argv0
     ''}
 
diff --git a/pkgs/by-name/kc/kconfig-frontends/package.nix b/pkgs/by-name/kc/kconfig-frontends/package.nix
index 954ca475a75d..b2c74e330f87 100644
--- a/pkgs/by-name/kc/kconfig-frontends/package.nix
+++ b/pkgs/by-name/kc/kconfig-frontends/package.nix
@@ -60,7 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     homepage = "https://bitbucket.org/nuttx/tools/";
     license = lib.licenses.gpl2Plus;
-    maintainers = with lib.maintainers; [ AndersonTorres ];
+    maintainers = with lib.maintainers; [ ];
     platforms = lib.platforms.unix;
   };
 })
diff --git a/pkgs/by-name/ki/kid3/package.nix b/pkgs/by-name/ki/kid3/package.nix
index 7f314d6bb2e3..ca7416a60167 100644
--- a/pkgs/by-name/ki/kid3/package.nix
+++ b/pkgs/by-name/ki/kid3/package.nix
@@ -136,7 +136,7 @@ stdenv.mkDerivation (finalAttrs: {
         "kid3"
       else
         "kid3-cli";
-    maintainers = with lib.maintainers; [ AndersonTorres ];
+    maintainers = with lib.maintainers; [ ];
     platforms = lib.platforms.linux;
   };
 })
diff --git a/pkgs/by-name/ko/koodo-reader/package.nix b/pkgs/by-name/ko/koodo-reader/package.nix
index 2d5132fb4cbe..b66d8f13e0d7 100644
--- a/pkgs/by-name/ko/koodo-reader/package.nix
+++ b/pkgs/by-name/ko/koodo-reader/package.nix
@@ -81,7 +81,7 @@ stdenv.mkDerivation (finalAttrs: {
     makeShellWrapper ${lib.getExe electron} $out/bin/koodo-reader \
       --add-flags $out/share/lib/koodo-reader/resources/app.asar \
       "''${gappsWrapperArgs[@]}" \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}" \
       --set-default ELECTRON_IS_DEV 0 \
       --inherit-argv0
   '';
diff --git a/pkgs/by-name/ku/kuro/package.nix b/pkgs/by-name/ku/kuro/package.nix
index 95126d1ba1f1..ca0986e3c7a0 100644
--- a/pkgs/by-name/ku/kuro/package.nix
+++ b/pkgs/by-name/ku/kuro/package.nix
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
     # executable wrapper
     makeWrapper '${electron}/bin/electron' "$out/bin/kuro" \
       --add-flags "$out/share/lib/kuro/resources/app.asar" \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}" \
       --inherit-argv0
 
     runHook postInstall
diff --git a/pkgs/by-name/ld/ldeep/package.nix b/pkgs/by-name/ld/ldeep/package.nix
index 1a6c3ddd93fc..fecda9ef2c9f 100644
--- a/pkgs/by-name/ld/ldeep/package.nix
+++ b/pkgs/by-name/ld/ldeep/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "ldeep";
-  version = "1.0.75";
+  version = "1.0.76";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "franc-pentest";
     repo = "ldeep";
     rev = "refs/tags/${version}";
-    hash = "sha256-WdEOhyWZZRqBZQCNl2vqYiy+sT/gPk3xDpMFVILxmK4=";
+    hash = "sha256-NVUU1VFUojeQYBHNpOqDCDjuzSUw8j5+uFxaQL1pA2U=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/by-name/le/legcord/package.nix b/pkgs/by-name/le/legcord/package.nix
index e83bf3d254e2..d1b4c8e89369 100644
--- a/pkgs/by-name/le/legcord/package.nix
+++ b/pkgs/by-name/le/legcord/package.nix
@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
     makeShellWrapper "${lib.getExe electron_32}" "$out/bin/legcord" \
       --add-flags "$out/share/lib/legcord/resources/app.asar" \
       "''${gappsWrapperArgs[@]}" \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}" \
       --set-default ELECTRON_IS_DEV 0 \
       --inherit-argv0
 
diff --git a/pkgs/by-name/le/lens/linux.nix b/pkgs/by-name/le/lens/linux.nix
index 5b43a6c96210..d1dbf197bd51 100644
--- a/pkgs/by-name/le/lens/linux.nix
+++ b/pkgs/by-name/le/lens/linux.nix
@@ -14,7 +14,7 @@ appimageTools.wrapType2 {
   extraInstallCommands =
     ''
       wrapProgram $out/bin/${pname} \
-        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}"
       install -m 444 -D ${appimageContents}/${pname}.desktop $out/share/applications/${pname}.desktop
       install -m 444 -D ${appimageContents}/usr/share/icons/hicolor/512x512/apps/${pname}.png \
          $out/share/icons/hicolor/512x512/apps/${pname}.png
diff --git a/pkgs/by-name/li/libblake3/package.nix b/pkgs/by-name/li/libblake3/package.nix
index bd03de8f4956..6fcc0231d706 100644
--- a/pkgs/by-name/li/libblake3/package.nix
+++ b/pkgs/by-name/li/libblake3/package.nix
@@ -3,31 +3,21 @@
   stdenv,
   cmake,
   fetchFromGitHub,
-  fetchpatch,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libblake3";
-  version = "1.5.4";
+  version = "1.5.5";
 
   src = fetchFromGitHub {
     owner = "BLAKE3-team";
     repo = "BLAKE3";
     rev = "refs/tags/${finalAttrs.version}";
-    hash = "sha256-WatbhExS0j2neYsrfbNhYxrckLiXHwQBjctuowtQW+U=";
+    hash = "sha256-2M8OQNmtWwfDcbZYspaxpGz2clpfILru//4+P6dClNw=";
   };
 
   sourceRoot = finalAttrs.src.name + "/c";
 
-  patches = [
-    # Fix pkg-config for absolute CMAKE_INSTALL_*DIR
-    (fetchpatch {
-      url = "https://github.com/BLAKE3-team/BLAKE3/commit/aa3e8ec32a389461babde3789d6ac50ee3c38662.patch";
-      hash = "sha256-V8o85EnRoqYvatqYwdr7h2TBwSOSlKrqfJWPPkQhU+c=";
-      stripLen = 1;
-    })
-  ];
-
   nativeBuildInputs = [
     cmake
   ];
diff --git a/pkgs/by-name/lo/logseq/package.nix b/pkgs/by-name/lo/logseq/package.nix
index 0f56d5def56d..048d4119a47d 100644
--- a/pkgs/by-name/lo/logseq/package.nix
+++ b/pkgs/by-name/lo/logseq/package.nix
@@ -84,7 +84,7 @@ in
     makeWrapper ${electron_27}/bin/electron $out/bin/logseq \
       --set "LOCAL_GIT_DIRECTORY" ${git} \
       --add-flags $out/share/logseq/resources/app \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}"
   '';
 
   passthru.updateScript = nix-update-script { };
diff --git a/pkgs/by-name/lu/lunar-client/package.nix b/pkgs/by-name/lu/lunar-client/package.nix
index aef36fb6c8ef..b92d76fbb5e8 100644
--- a/pkgs/by-name/lu/lunar-client/package.nix
+++ b/pkgs/by-name/lu/lunar-client/package.nix
@@ -19,7 +19,7 @@ appimageTools.wrapType2 rec {
     let contents = appimageTools.extract { inherit pname version src; };
     in ''
       wrapProgram $out/bin/lunarclient \
-        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}"
       install -Dm444 ${contents}/lunarclient.desktop -t $out/share/applications/
       install -Dm444 ${contents}/lunarclient.png -t $out/share/pixmaps/
       substituteInPlace $out/share/applications/lunarclient.desktop \
diff --git a/pkgs/by-name/lx/lx-music-desktop/package.nix b/pkgs/by-name/lx/lx-music-desktop/package.nix
index e5f9fcafc412..05c56827edce 100644
--- a/pkgs/by-name/lx/lx-music-desktop/package.nix
+++ b/pkgs/by-name/lx/lx-music-desktop/package.nix
@@ -71,7 +71,7 @@ stdenv.mkDerivation {
     makeWrapper ${electron_30}/bin/electron $out/bin/lx-music-desktop \
         --add-flags $out/opt/lx-music-desktop/resources/app.asar \
         --prefix LD_LIBRARY_PATH : "${runtimeLibs}" \
-        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}" \
         --add-flags ${lib.escapeShellArg commandLineArgs} \
   '';
 
diff --git a/pkgs/by-name/ma/mackerel-agent/package.nix b/pkgs/by-name/ma/mackerel-agent/package.nix
index 69538107ad4f..4f62239bcbb7 100644
--- a/pkgs/by-name/ma/mackerel-agent/package.nix
+++ b/pkgs/by-name/ma/mackerel-agent/package.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "mackerel-agent";
-  version = "0.82.0";
+  version = "0.83.0";
 
   src = fetchFromGitHub {
     owner = "mackerelio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-zkwYYkI7oeOdJH/K9E8/ZkTOexEKyP1I2kOJlt7PcK4=";
+    sha256 = "sha256-hxABrgUdEQDj8NJxZgChGgB2/3J1/ChTdIYkFQtGsuY=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/ma/mattermost-desktop/package.nix b/pkgs/by-name/ma/mattermost-desktop/package.nix
index 41c27ed7c19c..7a95092811d4 100644
--- a/pkgs/by-name/ma/mattermost-desktop/package.nix
+++ b/pkgs/by-name/ma/mattermost-desktop/package.nix
@@ -55,7 +55,7 @@ stdenv.mkDerivation {
     makeWrapper '${lib.getExe electron}' $out/bin/${pname} \
       --set-default ELECTRON_IS_DEV 0 \
       --add-flags $out/share/${pname}/app.asar \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}"
 
     runHook postInstall
   '';
diff --git a/pkgs/by-name/mi/microsoft-edge/package.nix b/pkgs/by-name/mi/microsoft-edge/package.nix
index a2a8c69252ec..27b68f66fcb7 100644
--- a/pkgs/by-name/mi/microsoft-edge/package.nix
+++ b/pkgs/by-name/mi/microsoft-edge/package.nix
@@ -250,7 +250,7 @@ stdenv.mkDerivation (finalAttrs: {
       --suffix PATH            : "${lib.makeBinPath [ xdg-utils ]}" \
       --prefix XDG_DATA_DIRS   : "$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH:${addDriverRunpath.driverLink}/share" \
       --set CHROME_WRAPPER  "microsoft-edge-$dist" \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}" \
       --add-flags "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" \
       --add-flags ${lib.escapeShellArg commandLineArgs}
 
diff --git a/pkgs/by-name/mi/mill/package.nix b/pkgs/by-name/mi/mill/package.nix
index e5aa59546be2..c54a0fd1f76b 100644
--- a/pkgs/by-name/mi/mill/package.nix
+++ b/pkgs/by-name/mi/mill/package.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mill";
-  version = "0.12.2";
+  version = "0.12.3";
 
   src = fetchurl {
     url = "https://github.com/com-lihaoyi/mill/releases/download/${finalAttrs.version}/${finalAttrs.version}-assembly";
-    hash = "sha256-F2ZBywZOdrrDPgpBCXkMrelZEzzqceTQuH3ww8IH4Ns=";
+    hash = "sha256-hqzAuYadCciYPs/b6zloLUfrWF4rRtlBSMxSj7tLg7g=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/mi/minutor/package.nix b/pkgs/by-name/mi/minutor/package.nix
new file mode 100644
index 000000000000..1bf92d38431f
--- /dev/null
+++ b/pkgs/by-name/mi/minutor/package.nix
@@ -0,0 +1,43 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  qt5,
+  zlib,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "minutor";
+  version = "2.21.0";
+
+  src = fetchFromGitHub {
+    owner = "mrkite";
+    repo = finalAttrs.pname;
+    rev = "refs/tags/${finalAttrs.version}";
+    sha256 = "0ldjnrk429ywf8cxdpjkam5k73s6fq7lvksandfn3xn7gl9np5rk";
+  };
+
+  preConfigure = ''
+    substituteInPlace minutor.pro \
+      --replace-fail /usr "$out"
+  '';
+
+  nativeBuildInputs = [
+    qt5.qmake
+    qt5.wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    qt5.qtbase
+    zlib
+  ];
+
+  meta = {
+    description = "Easy to use mapping tool for Minecraft";
+    maintainers = [ lib.maintainers.sternenseemann ];
+    license = lib.licenses.bsd2;
+    homepage = "https://seancode.com/minutor/";
+    inherit (qt5.qtbase.meta) platforms;
+    mainProgram = "minutor";
+  };
+})
diff --git a/pkgs/by-name/mq/mqtt-explorer/package.nix b/pkgs/by-name/mq/mqtt-explorer/package.nix
index 2aa7a6ba6891..59e8ebe74b38 100644
--- a/pkgs/by-name/mq/mqtt-explorer/package.nix
+++ b/pkgs/by-name/mq/mqtt-explorer/package.nix
@@ -122,7 +122,7 @@ stdenv.mkDerivation rec {
 
       makeWrapper '${electron}/bin/electron' "$out/bin/mqtt-explorer" \
         --add-flags "$out/share/mqtt-explorer/app/resources/app.asar" \
-        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}" \
         --set-default ELECTRON_FORCE_IS_PACKAGED 1 \
         --set-default ELECTRON_IS_DEV 0 \
         --inherit-argv0
diff --git a/pkgs/by-name/mt/mtr-exporter/package.nix b/pkgs/by-name/mt/mtr-exporter/package.nix
index 9c7c9bec41ea..cc807181d12a 100644
--- a/pkgs/by-name/mt/mtr-exporter/package.nix
+++ b/pkgs/by-name/mt/mtr-exporter/package.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "mtr-exporter";
-  version = "0.3.0";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "mgumz";
     repo = "mtr-exporter";
     rev = version;
-    hash = "sha256-vVYdIfogXHixf1/7+uGKSxbqVmr9NeCUuNVYE07HoBw=";
+    hash = "sha256-dMlMUjbUg05Z8FFEPwMOiHzLiHSSjV1CzKqrt/qJ6Js=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/mu/muffon/package.nix b/pkgs/by-name/mu/muffon/package.nix
index f7c33bc22b98..7c86a6d6de1a 100644
--- a/pkgs/by-name/mu/muffon/package.nix
+++ b/pkgs/by-name/mu/muffon/package.nix
@@ -21,7 +21,7 @@ appimageTools.wrapType2 {
 
   extraInstallCommands = ''
     wrapProgram $out/bin/muffon \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}"
     install -m 444 -D ${appimageContents}/muffon.desktop -t $out/share/applications
     substituteInPlace $out/share/applications/muffon.desktop \
       --replace-fail 'Exec=AppRun' 'Exec=muffon'
diff --git a/pkgs/by-name/mu/multiviewer-for-f1/package.nix b/pkgs/by-name/mu/multiviewer-for-f1/package.nix
index 901286b4a799..5885f5f1e799 100644
--- a/pkgs/by-name/mu/multiviewer-for-f1/package.nix
+++ b/pkgs/by-name/mu/multiviewer-for-f1/package.nix
@@ -84,7 +84,7 @@ stdenvNoCC.mkDerivation rec {
     mv -t $out/share usr/share/* usr/lib/multiviewer-for-f1
 
     makeWrapper "$out/share/multiviewer-for-f1/MultiViewer for F1" $out/bin/multiviewer-for-f1 \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland --enable-features=WaylandWindowDecorations}}" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland --enable-features=WaylandWindowDecorations --enable-wayland-ime}}" \
       --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ libudev0-shim ]}:\"$out/share/Multiviewer for F1\""
 
     runHook postInstall
diff --git a/pkgs/by-name/mu/mupen64plus/package.nix b/pkgs/by-name/mu/mupen64plus/package.nix
index 81c86eeafecb..5206d4abc37d 100644
--- a/pkgs/by-name/mu/mupen64plus/package.nix
+++ b/pkgs/by-name/mu/mupen64plus/package.nix
@@ -1,29 +1,45 @@
-{lib, stdenv, fetchurl, fetchpatch, boost, dash, freetype, libpng, pkg-config, SDL, which, zlib, nasm }:
+{
+  lib,
+  stdenv,
+  fetchurl,
+  fetchpatch,
+  boost,
+  dash,
+  freetype,
+  libpng,
+  libGLU,
+  pkg-config,
+  SDL2,
+  which,
+  zlib,
+  nasm,
+  vulkan-loader,
+}:
 
 stdenv.mkDerivation rec {
   pname = "mupen64plus";
-  version = "2.5.9";
+  version = "2.6.0";
 
   src = fetchurl {
     url = "https://github.com/mupen64plus/mupen64plus-core/releases/download/${version}/mupen64plus-bundle-src-${version}.tar.gz";
-    sha256 = "1a21n4gqdvag6krwcjm5bnyw5phrlxw6m0mk73jy53iq03f3s96m";
+    sha256 = "sha256-KX4XGAzXanuOqAnRob4smO1cc1LccWllqA3rWYsh4TE=";
   };
 
-  patches = [
-    # Pull upstream fix for -fno-common toolchains:
-    #  https://github.com/mupen64plus/mupen64plus-core/pull/736
-    (fetchpatch {
-      name = "fno-common.patch";
-      url = "https://github.com/mupen64plus/mupen64plus-core/commit/39975200ad4926cfc79c96609b64696289065502.patch";
-      sha256 = "0kdshp9xdkharn3d1g1pvxhh761pa1v5w07iq0wf9l380r2m6gbv";
-      # a/something -> a/source/mupen64plus-core/something
-      stripLen = 1;
-      extraPrefix = "source/mupen64plus-core/";
-    })
+  nativeBuildInputs = [
+    pkg-config
+    nasm
+  ];
+  buildInputs = [
+    boost
+    dash
+    freetype
+    libpng
+    libGLU
+    SDL2
+    which
+    zlib
+    vulkan-loader
   ];
-
-  nativeBuildInputs = [ pkg-config nasm ];
-  buildInputs = [ boost dash freetype libpng SDL which zlib ];
 
   buildPhase = ''
     dash m64p_build.sh PREFIX="$out" COREDIR="$out/lib/" PLUGINDIR="$out/lib/mupen64plus" SHAREDIR="$out/share/mupen64plus"
diff --git a/pkgs/by-name/na/nagstamon/package.nix b/pkgs/by-name/na/nagstamon/package.nix
new file mode 100644
index 000000000000..f25d5e4d68a5
--- /dev/null
+++ b/pkgs/by-name/na/nagstamon/package.nix
@@ -0,0 +1,67 @@
+{
+  lib,
+  fetchFromGitHub,
+  python3Packages,
+  qt6Packages,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "nagstamon";
+  version = "3.16.2";
+
+  src = fetchFromGitHub {
+    owner = "HenriWahl";
+    repo = "Nagstamon";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-9w8ux+AeSg0vDhnk28/2eCE2zYLvAjD7mB0pJBMFs2I=";
+  };
+
+  build-system = with python3Packages; [ setuptools ];
+
+  nativeBuildInputs = [ qt6Packages.wrapQtAppsHook ];
+
+  buildInputs = [
+    qt6Packages.qtmultimedia
+    qt6Packages.qtsvg
+  ];
+
+  dontWrapQtApps = true;
+
+  preFixup = ''
+    makeWrapperArgs+=("''${qtWrapperArgs[@]}")
+  '';
+
+  dependencies = with python3Packages; [
+    arrow
+    beautifulsoup4
+    configparser
+    dbus-python
+    keyring
+    lxml
+    psutil
+    pyqt6
+    pysocks
+    python-dateutil
+    requests
+    requests-kerberos
+  ];
+
+  nativeCheckInputs = with python3Packages; [
+    pylint
+    pytestCheckHook
+  ];
+
+  meta = {
+    description = "Status monitor for the desktop";
+    homepage = "https://nagstamon.de/";
+    changelog = "https://github.com/HenriWahl/Nagstamon/releases/tag/v${version}";
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [
+      pSub
+      liberodark
+    ];
+    mainProgram = "nagstamon.py";
+    # NameError: name 'bdist_rpm_options' is not defined. Did you mean: 'bdist_mac_options'?
+    badPlatforms = [ lib.systems.inspect.patterns.isDarwin ];
+  };
+}
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/README.md b/pkgs/by-name/ni/nixos-rebuild-ng/README.md
index f023c949c1ef..a6199e873060 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/README.md
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/README.md
@@ -76,7 +76,7 @@ can run:
 # run program
 python -m nixos_rebuild
 # run tests
-python -m pytest
+pytest
 # check types
 mypy .
 # fix lint issues
@@ -119,7 +119,7 @@ ruff format .
 ## TODO
 
 - [ ] Remote host/builders (via SSH)
-- [ ] Improve nix arguments handling (e.g.: `nixFlags` vs `copyFlags` in the
+- [x] Improve nix arguments handling (e.g.: `nixFlags` vs `copyFlags` in the
   old `nixos-rebuild`)
 - [ ] `_NIXOS_REBUILD_EXEC`
 - [ ] Port `nixos-rebuild.passthru.tests`
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
index 777cf05a07dd..2aead64c5465 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
@@ -1,74 +1,149 @@
-from __future__ import annotations
-
 import argparse
+import atexit
 import json
 import os
 import sys
+from pathlib import Path
 from subprocess import run
+from tempfile import TemporaryDirectory
 from typing import assert_never
 
+from . import nix
 from .models import Action, Flake, NRError, Profile
-from .nix import (
-    edit,
-    find_file,
-    get_nixpkgs_rev,
-    list_generations,
-    nixos_build,
-    nixos_build_flake,
-    rollback,
-    rollback_temporary_profile,
-    set_profile,
-    switch_to_configuration,
-    upgrade_channels,
-)
+from .process import Remote, cleanup_ssh
 from .utils import info
 
-VERBOSE = False
+VERBOSE = 0
 
 
-def parse_args(argv: list[str]) -> tuple[argparse.Namespace, list[str]]:
-    parser = argparse.ArgumentParser(
+def get_parser() -> tuple[argparse.ArgumentParser, dict[str, argparse.ArgumentParser]]:
+    common_flags = argparse.ArgumentParser(add_help=False)
+    common_flags.add_argument("--verbose", "-v", action="count", default=0)
+    common_flags.add_argument("--max-jobs", "-j")
+    common_flags.add_argument("--cores")
+    common_flags.add_argument("--log-format")
+    common_flags.add_argument("--keep-going", "-k", action="store_true")
+    common_flags.add_argument("--keep-failed", "-K", action="store_true")
+    common_flags.add_argument("--fallback", action="store_true")
+    common_flags.add_argument("--repair", action="store_true")
+    common_flags.add_argument("--option", nargs=2)
+
+    common_build_flags = argparse.ArgumentParser(add_help=False)
+    common_build_flags.add_argument("--include", "-I")
+    common_build_flags.add_argument("--quiet", action="store_true")
+    common_build_flags.add_argument("--print-build-logs", "-L", action="store_true")
+    common_build_flags.add_argument("--show-trace", action="store_true")
+
+    flake_build_flags = argparse.ArgumentParser(add_help=False)
+    flake_build_flags.add_argument("--accept-flake-config", action="store_true")
+    flake_build_flags.add_argument("--refresh", action="store_true")
+    flake_build_flags.add_argument("--impure", action="store_true")
+    flake_build_flags.add_argument("--offline", action="store_true")
+    flake_build_flags.add_argument("--no-net", action="store_true")
+    flake_build_flags.add_argument("--recreate-lock-file", action="store_true")
+    flake_build_flags.add_argument("--no-update-lock-file", action="store_true")
+    flake_build_flags.add_argument("--no-write-lock-file", action="store_true")
+    flake_build_flags.add_argument("--no-registries", action="store_true")
+    flake_build_flags.add_argument("--commit-lock-file", action="store_true")
+    flake_build_flags.add_argument("--update-input")
+    flake_build_flags.add_argument("--override-input", nargs=2)
+
+    classic_build_flags = argparse.ArgumentParser(add_help=False)
+    classic_build_flags.add_argument("--no-build-output", "-Q", action="store_true")
+
+    copy_flags = argparse.ArgumentParser(add_help=False)
+    copy_flags.add_argument("--use-substitutes", "-s", action="store_true")
+
+    sub_parsers = {
+        "common_flags": common_flags,
+        "common_build_flags": common_build_flags,
+        "flake_build_flags": flake_build_flags,
+        "classic_build_flags": classic_build_flags,
+        "copy_flags": copy_flags,
+    }
+
+    main_parser = argparse.ArgumentParser(
         prog="nixos-rebuild",
+        parents=list(sub_parsers.values()),
         description="Reconfigure a NixOS machine",
         add_help=False,
         allow_abbrev=False,
     )
-    parser.add_argument("--help", action="store_true")
-    parser.add_argument("--file", "-f")
-    parser.add_argument("--attr", "-A")
-    parser.add_argument("--flake", nargs="?", const=True)
-    parser.add_argument("--no-flake", dest="flake", action="store_false")
-    parser.add_argument("--install-bootloader", action="store_true")
-    # TODO: add deprecated=True in Python >=3.13
-    parser.add_argument("--install-grub", action="store_true")
-    parser.add_argument("--profile-name", "-p", default="system")
-    parser.add_argument("--specialisation", "-c")
-    parser.add_argument("--rollback", action="store_true")
-    parser.add_argument("--upgrade", action="store_true")
-    parser.add_argument("--upgrade-all", action="store_true")
-    parser.add_argument("--json", action="store_true")
-    parser.add_argument("action", choices=Action.values(), nargs="?")
+    main_parser.add_argument("--help", "-h", action="store_true")
+    main_parser.add_argument("--file", "-f")
+    main_parser.add_argument("--attr", "-A")
+    main_parser.add_argument("--flake", nargs="?", const=True)
+    main_parser.add_argument("--no-flake", dest="flake", action="store_false")
+    main_parser.add_argument("--install-bootloader", action="store_true")
+    main_parser.add_argument("--install-grub", action="store_true")  # deprecated
+    main_parser.add_argument("--profile-name", "-p", default="system")
+    main_parser.add_argument("--specialisation", "-c")
+    main_parser.add_argument("--rollback", action="store_true")
+    main_parser.add_argument("--upgrade", action="store_true")
+    main_parser.add_argument("--upgrade-all", action="store_true")
+    main_parser.add_argument("--json", action="store_true")
+    main_parser.add_argument("--sudo", action="store_true")
+    main_parser.add_argument("--ask-sudo-password", action="store_true")
+    main_parser.add_argument("--use-remote-sudo", action="store_true")  # deprecated
+    main_parser.add_argument("--no-ssh-tty", action="store_true")  # deprecated
+    # parser.add_argument("--build-host")  # TODO
+    main_parser.add_argument("--target-host")
+    main_parser.add_argument("action", choices=Action.values(), nargs="?")
 
-    args, remainder = parser.parse_known_args(argv[1:])
+    return main_parser, sub_parsers
+
+
+def parse_args(
+    argv: list[str],
+) -> tuple[argparse.Namespace, dict[str, argparse.Namespace]]:
+    parser, sub_parsers = get_parser()
+    args = parser.parse_args(argv[1:])
+    args_groups = {
+        group: parser.parse_known_args(argv[1:])[0]
+        for group, parser in sub_parsers.items()
+    }
+
+    def parser_warn(msg: str) -> None:
+        info(f"{parser.prog}: warning: {msg}")
 
     global VERBOSE
-    # Manually parse verbose flag since this is a nix flag that also affect
-    # the script
-    VERBOSE = any(v == "--verbose" or v.startswith("-v") for v in remainder)
+    # This flag affects both nix and this script
+    VERBOSE = args.verbose
 
     # https://github.com/NixOS/nixpkgs/blob/master/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh#L56
     if args.action == Action.DRY_RUN.value:
         args.action = Action.DRY_BUILD.value
 
+    if args.ask_sudo_password:
+        args.sudo = True
+
+    # TODO: use deprecated=True in Python >=3.13
     if args.install_grub:
-        info(
-            f"{parser.prog}: warning: --install-grub deprecated, use --install-bootloader instead"
-        )
+        parser_warn("--install-grub deprecated, use --install-bootloader instead")
         args.install_bootloader = True
 
+    # TODO: use deprecated=True in Python >=3.13
+    if args.use_remote_sudo:
+        parser_warn("--use-remote-sudo deprecated, use --sudo instead")
+        args.sudo = True
+
+    # TODO: use deprecated=True in Python >=3.13
+    if args.no_ssh_tty:
+        parser_warn("--no-ssh-tty deprecated, SSH's TTY is never used anymore")
+
     if args.action == Action.EDIT.value and (args.file or args.attr):
         parser.error("--file and --attr are not supported with 'edit'")
 
+    if args.target_host and args.action not in (
+        Action.SWITCH.value,
+        Action.BOOT.value,
+        Action.TEST.value,
+        Action.BUILD.value,
+        Action.DRY_BUILD.value,
+        Action.DRY_ACTIVATE.value,
+    ):
+        parser.error(f"--target-host is not supported with '{args.action}'")
+
     if args.flake and (args.file or args.attr):
         parser.error("--flake cannot be used with --file or --attr")
 
@@ -76,17 +151,29 @@ def parse_args(argv: list[str]) -> tuple[argparse.Namespace, list[str]]:
         r = run(["man", "8", "nixos-rebuild"], check=False)
         parser.exit(r.returncode)
 
-    return args, remainder
+    return args, args_groups
 
 
 def execute(argv: list[str]) -> None:
-    args, nix_flags = parse_args(argv)
+    args, args_groups = parse_args(argv)
+
+    common_flags = vars(args_groups["common_flags"])
+    common_build_flags = common_flags | vars(args_groups["common_build_flags"])
+    build_flags = common_build_flags | vars(args_groups["classic_build_flags"])
+    flake_build_flags = common_build_flags | vars(args_groups["flake_build_flags"])
+    copy_flags = common_flags | vars(args_groups["copy_flags"])
+
+    # Will be cleaned up on exit automatically.
+    tmpdir = TemporaryDirectory(prefix="nixos-rebuild.")
+    tmpdir_path = Path(tmpdir.name)
+    atexit.register(cleanup_ssh, tmpdir_path)
 
     profile = Profile.from_name(args.profile_name)
-    flake = Flake.from_arg(args.flake)
+    target_host = Remote.from_arg(args.target_host, args.ask_sudo_password, tmpdir_path)
+    flake = Flake.from_arg(args.flake, target_host)
 
     if args.upgrade or args.upgrade_all:
-        upgrade_channels(bool(args.upgrade_all))
+        nix.upgrade_channels(bool(args.upgrade_all))
 
     action = Action(args.action)
     # Only run shell scripts from the Nixpkgs tree if the action is
@@ -96,8 +183,8 @@ def execute(argv: list[str]) -> None:
     # untrusted tree.
     can_run = action in (Action.SWITCH, Action.BOOT, Action.TEST)
     if can_run and not flake:
-        nixpkgs_path = find_file("nixpkgs", nix_flags)
-        rev = get_nixpkgs_rev(nixpkgs_path)
+        nixpkgs_path = nix.find_file("nixpkgs", **build_flags)
+        rev = nix.get_nixpkgs_rev(nixpkgs_path)
         if nixpkgs_path and rev:
             (nixpkgs_path / ".version-suffix").write_text(rev)
 
@@ -105,88 +192,99 @@ def execute(argv: list[str]) -> None:
         case Action.SWITCH | Action.BOOT:
             info("building the system configuration...")
             if args.rollback:
-                path_to_config = rollback(profile)
-            elif flake:
-                path_to_config = nixos_build_flake(
-                    "toplevel",
-                    flake,
-                    nix_flags,
-                    no_link=True,
-                )
-                set_profile(profile, path_to_config)
+                path_to_config = nix.rollback(profile, target_host, sudo=args.sudo)
             else:
-                path_to_config = nixos_build(
-                    "system",
-                    args.attr,
-                    args.file,
-                    nix_flags,
-                    no_out_link=True,
-                )
-                set_profile(profile, path_to_config)
-            switch_to_configuration(
+                if flake:
+                    path_to_config = nix.nixos_build_flake(
+                        "toplevel",
+                        flake,
+                        no_link=True,
+                        **flake_build_flags,
+                    )
+                else:
+                    path_to_config = nix.nixos_build(
+                        "system",
+                        args.attr,
+                        args.file,
+                        no_out_link=True,
+                        **build_flags,
+                    )
+                nix.copy_closure(path_to_config, target_host, **copy_flags)
+                nix.set_profile(profile, path_to_config, target_host, sudo=args.sudo)
+            nix.switch_to_configuration(
                 path_to_config,
                 action,
+                target_host,
+                sudo=args.sudo,
                 specialisation=args.specialisation,
                 install_bootloader=args.install_bootloader,
             )
         case Action.TEST | Action.BUILD | Action.DRY_BUILD | Action.DRY_ACTIVATE:
             info("building the system configuration...")
             dry_run = action == Action.DRY_BUILD
-            if args.rollback and action in (Action.TEST, Action.BUILD):
-                maybe_path_to_config = rollback_temporary_profile(profile)
+            if args.rollback:
+                if action not in (Action.TEST, Action.BUILD):
+                    raise NRError(f"--rollback is incompatible with '{action}'")
+                maybe_path_to_config = nix.rollback_temporary_profile(
+                    profile,
+                    target_host,
+                    sudo=args.sudo,
+                )
                 if maybe_path_to_config:  # kinda silly but this makes mypy happy
                     path_to_config = maybe_path_to_config
                 else:
                     raise NRError("could not find previous generation")
             elif flake:
-                path_to_config = nixos_build_flake(
+                path_to_config = nix.nixos_build_flake(
                     "toplevel",
                     flake,
-                    nix_flags,
                     keep_going=True,
                     dry_run=dry_run,
+                    **flake_build_flags,
                 )
             else:
-                path_to_config = nixos_build(
+                path_to_config = nix.nixos_build(
                     "system",
                     args.attr,
                     args.file,
-                    nix_flags,
                     keep_going=True,
                     dry_run=dry_run,
+                    **build_flags,
                 )
             if action in (Action.TEST, Action.DRY_ACTIVATE):
-                switch_to_configuration(
+                nix.switch_to_configuration(
                     path_to_config,
                     action,
+                    target_host,
+                    sudo=args.sudo,
                     specialisation=args.specialisation,
                 )
         case Action.BUILD_VM | Action.BUILD_VM_WITH_BOOTLOADER:
             info("building the system configuration...")
             attr = "vm" if action == Action.BUILD_VM else "vmWithBootLoader"
             if flake:
-                path_to_config = nixos_build_flake(
+                path_to_config = nix.nixos_build_flake(
                     attr,
                     flake,
-                    nix_flags,
                     keep_going=True,
+                    **flake_build_flags,
                 )
             else:
-                path_to_config = nixos_build(
+                path_to_config = nix.nixos_build(
                     attr,
                     args.attr,
                     args.file,
-                    nix_flags,
                     keep_going=True,
+                    **build_flags,
                 )
             vm_path = next(path_to_config.glob("bin/run-*-vm"), "./result/bin/run-*-vm")
             print(f"Done. The virtual machine can be started by running '{vm_path}'")
         case Action.EDIT:
-            edit(flake, nix_flags)
+            nix.edit(flake, **flake_build_flags)
         case Action.DRY_RUN:
             assert False, "DRY_RUN should be a DRY_BUILD alias"
         case Action.LIST_GENERATIONS:
-            generations = list_generations(profile)
+            generations = nix.list_generations(profile)
             if args.json:
                 print(json.dumps(generations, indent=2))
             else:
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/models.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/models.py
index 0de155cf7b6a..51cee3b7c517 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/models.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/models.py
@@ -2,10 +2,13 @@ from __future__ import annotations
 
 import platform
 import re
+import subprocess
 from dataclasses import dataclass
 from enum import Enum
 from pathlib import Path
-from typing import Any, ClassVar, TypedDict, override
+from typing import Any, Callable, ClassVar, Self, TypedDict, override
+
+from .process import Remote, run_wrapper
 
 
 class NRError(Exception):
@@ -53,21 +56,37 @@ class Flake:
         return f"{self.path}#{self.attr}"
 
     @classmethod
-    def parse(cls, flake_str: str, hostname: str | None = None) -> Flake:
+    def parse(
+        cls,
+        flake_str: str,
+        hostname_fn: Callable[[], str | None] = lambda: None,
+    ) -> Self:
         m = cls._re.match(flake_str)
         assert m is not None, f"got no matches for {flake_str}"
         attr = m.group("attr")
-        nixos_attr = f"nixosConfigurations.{attr or hostname or "default"}"
-        return Flake(Path(m.group("path")), nixos_attr)
+        nixos_attr = f"nixosConfigurations.{attr or hostname_fn() or "default"}"
+        return cls(Path(m.group("path")), nixos_attr)
 
     @classmethod
-    def from_arg(cls, flake_arg: Any) -> Flake | None:
-        hostname = platform.node()
+    def from_arg(cls, flake_arg: Any, target_host: Remote | None) -> Self | None:
+        def get_hostname() -> str | None:
+            if target_host:
+                try:
+                    return run_wrapper(
+                        ["uname", "-n"],
+                        capture_output=True,
+                        remote=target_host,
+                    ).stdout.strip()
+                except (AttributeError, subprocess.CalledProcessError):
+                    return None
+            else:
+                return platform.node()
+
         match flake_arg:
             case str(s):
-                return cls.parse(s, hostname)
+                return cls.parse(s, get_hostname)
             case True:
-                return cls.parse(".", hostname)
+                return cls.parse(".", get_hostname)
             case False:
                 return None
             case _:
@@ -77,7 +96,7 @@ class Flake:
                     # It can be a symlink to the actual flake.
                     if default_path.is_symlink():
                         default_path = default_path.readlink()
-                    return cls.parse(str(default_path.parent), hostname)
+                    return cls.parse(str(default_path.parent), get_hostname)
                 else:
                     return None
 
@@ -105,12 +124,12 @@ class Profile:
     name: str
     path: Path
 
-    @staticmethod
-    def from_name(name: str = "system") -> Profile:
+    @classmethod
+    def from_name(cls, name: str = "system") -> Self:
         match name:
             case "system":
-                return Profile(name, Path("/nix/var/nix/profiles/system"))
+                return cls(name, Path("/nix/var/nix/profiles/system"))
             case _:
                 path = Path("/nix/var/nix/profiles/system-profiles") / name
                 path.parent.mkdir(mode=0o755, parents=True, exist_ok=True)
-                return Profile(name, path)
+                return cls(name, path)
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
index fc2ba09dfffe..f0c328cff4c0 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
@@ -1,10 +1,7 @@
-from __future__ import annotations
-
 import os
-import shutil
 from datetime import datetime
 from pathlib import Path
-from subprocess import PIPE, CalledProcessError, run
+from subprocess import PIPE, CalledProcessError
 from typing import Final
 
 from .models import (
@@ -14,27 +11,56 @@ from .models import (
     GenerationJson,
     NRError,
     Profile,
+    Remote,
 )
-from .utils import dict_to_flags, info
+from .process import run_wrapper
+from .utils import Args, dict_to_flags, info
 
 FLAKE_FLAGS: Final = ["--extra-experimental-features", "nix-command flakes"]
 
 
-def edit(flake: Flake | None, nix_flags: list[str] | None = None) -> None:
+def copy_closure(
+    closure: Path,
+    target_host: Remote | None,
+    **copy_flags: Args,
+) -> None:
+    host = target_host
+    if not host:
+        return
+
+    run_wrapper(
+        [
+            "nix-copy-closure",
+            *dict_to_flags(copy_flags),
+            "--to",
+            host.host,
+            closure,
+        ],
+        extra_env={"NIX_SSHOPTS": " ".join(host.opts)},
+    )
+
+
+def edit(flake: Flake | None, **flake_flags: Args) -> None:
     "Try to find and open NixOS configuration file in editor."
     if flake:
-        run(
-            ["nix", *FLAKE_FLAGS, "edit", *(nix_flags or []), "--", str(flake)],
+        run_wrapper(
+            [
+                "nix",
+                *FLAKE_FLAGS,
+                "edit",
+                *dict_to_flags(flake_flags),
+                "--",
+                str(flake),
+            ],
             check=False,
         )
     else:
-        if nix_flags:
+        if flake_flags:
             raise NRError("'edit' does not support extra Nix flags")
         nixos_config = Path(
             os.getenv("NIXOS_CONFIG")
-            or run(
+            or run_wrapper(
                 ["nix-instantiate", "--find-file", "nixos-config"],
-                text=True,
                 stdout=PIPE,
                 check=False,
             ).stdout.strip()
@@ -44,18 +70,17 @@ def edit(flake: Flake | None, nix_flags: list[str] | None = None) -> None:
             nixos_config /= "default.nix"
 
         if nixos_config.exists():
-            run([os.getenv("EDITOR", "nano"), nixos_config], check=False)
+            run_wrapper([os.getenv("EDITOR", "nano"), nixos_config], check=False)
         else:
             raise NRError("cannot find NixOS config file")
 
 
-def find_file(file: str, nix_flags: list[str] | None = None) -> Path | None:
+def find_file(file: str, **nix_flags: Args) -> Path | None:
     "Find classic Nixpkgs location."
-    r = run(
-        ["nix-instantiate", "--find-file", file, *(nix_flags or [])],
+    r = run_wrapper(
+        ["nix-instantiate", "--find-file", file, *dict_to_flags(nix_flags)],
         stdout=PIPE,
         check=False,
-        text=True,
     )
     if r.returncode:
         return None
@@ -69,23 +94,24 @@ def get_nixpkgs_rev(nixpkgs_path: Path | None) -> str | None:
     if not nixpkgs_path:
         return None
 
-    # Git is not included in the closure for nixos-rebuild so we need to check
-    if not shutil.which("git"):
+    try:
+        # Get current revision
+        r = run_wrapper(
+            ["git", "-C", nixpkgs_path, "rev-parse", "--short", "HEAD"],
+            check=False,
+            stdout=PIPE,
+        )
+    except FileNotFoundError:
+        # Git is not included in the closure so we need to check
         info(f"warning: Git not found; cannot figure out revision of '{nixpkgs_path}'")
         return None
 
-    # Get current revision
-    r = run(
-        ["git", "-C", nixpkgs_path, "rev-parse", "--short", "HEAD"],
-        check=False,
-        stdout=PIPE,
-        text=True,
-    )
-    rev = r.stdout.strip()
-
-    if rev:
+    if rev := r.stdout.strip():
         # Check if repo is dirty
-        if run(["git", "-C", nixpkgs_path, "diff", "--quiet"], check=False).returncode:
+        if run_wrapper(
+            ["git", "-C", nixpkgs_path, "diff", "--quiet"],
+            check=False,
+        ).returncode:
             rev += "M"
         return f".git.{rev}"
     else:
@@ -120,7 +146,12 @@ def _parse_generation_from_nix_env(line: str) -> Generation:
     )
 
 
-def get_generations(profile: Profile, lock_profile: bool = False) -> list[Generation]:
+def get_generations(
+    profile: Profile,
+    target_host: Remote | None = None,
+    using_nix_env: bool = False,
+    sudo: bool = False,
+) -> list[Generation]:
     """Get all NixOS generations from profile.
 
     Includes generation ID (e.g.: 1, 2), timestamp (e.g.: when it was created)
@@ -132,19 +163,20 @@ def get_generations(profile: Profile, lock_profile: bool = False) -> list[Genera
         raise NRError(f"no profile '{profile.name}' found")
 
     result = []
-    if lock_profile:
+    if using_nix_env:
         # Using `nix-env --list-generations` needs root to lock the profile
         # TODO: do we actually need to lock profile for e.g.: rollback?
         # https://github.com/NixOS/nix/issues/5144
-        r = run(
+        r = run_wrapper(
             ["nix-env", "-p", profile.path, "--list-generations"],
-            text=True,
-            stdout=True,
-            check=True,
+            stdout=PIPE,
+            remote=target_host,
+            sudo=sudo,
         )
         for line in r.stdout.splitlines():
             result.append(_parse_generation_from_nix_env(line))
     else:
+        assert not target_host, "target_host is not supported when using_nix_env=False"
         for p in profile.path.parent.glob("system-*-link"):
             result.append(_parse_generation_from_nix_store(p, profile))
     return sorted(result, key=lambda d: d.id)
@@ -179,11 +211,9 @@ def list_generations(profile: Profile) -> list[GenerationJson]:
             s.name for s in (generation_path / "specialisation").glob("*") if s.is_dir()
         ]
         try:
-            configuration_revision = run(
+            configuration_revision = run_wrapper(
                 [generation_path / "sw/bin/nixos-version", "--configuration-revision"],
                 capture_output=True,
-                check=True,
-                text=True,
             ).stdout.strip()
         except (CalledProcessError, IOError):
             configuration_revision = "Unknown"
@@ -207,8 +237,7 @@ def nixos_build(
     attr: str,
     pre_attr: str | None,
     file: str | None,
-    nix_flags: list[str] | None = None,
-    **kwargs: bool | str,
+    **nix_flags: Args,
 ) -> Path:
     """Build NixOS attribute using classic Nix.
 
@@ -227,16 +256,15 @@ def nixos_build(
         ]
     else:
         run_args = ["nix-build", "<nixpkgs/nixos>", "--attr", attr]
-    run_args += dict_to_flags(kwargs) + (nix_flags or [])
-    r = run(run_args, check=True, text=True, stdout=PIPE)
+    run_args += dict_to_flags(nix_flags)
+    r = run_wrapper(run_args, stdout=PIPE)
     return Path(r.stdout.strip())
 
 
 def nixos_build_flake(
     attr: str,
     flake: Flake,
-    nix_flags: list[str] | None = None,
-    **kwargs: bool | str,
+    **flake_flags: Args,
 ) -> Path:
     """Build NixOS attribute using Flakes.
 
@@ -248,22 +276,35 @@ def nixos_build_flake(
         "build",
         "--print-out-paths",
         f"{flake}.config.system.build.{attr}",
+        *dict_to_flags(flake_flags),
     ]
-    run_args += dict_to_flags(kwargs) + (nix_flags or [])
-    r = run(run_args, check=True, text=True, stdout=PIPE)
+    r = run_wrapper(run_args, stdout=PIPE)
     return Path(r.stdout.strip())
 
 
-def rollback(profile: Profile) -> Path:
+def rollback(profile: Profile, target_host: Remote | None, sudo: bool) -> Path:
     "Rollback Nix profile, like one created by `nixos-rebuild switch`."
-    run(["nix-env", "--rollback", "-p", profile.path], check=True)
+    run_wrapper(
+        ["nix-env", "--rollback", "-p", profile.path],
+        remote=target_host,
+        sudo=sudo,
+    )
     # Rollback config PATH is the own profile
     return profile.path
 
 
-def rollback_temporary_profile(profile: Profile) -> Path | None:
+def rollback_temporary_profile(
+    profile: Profile,
+    target_host: Remote | None,
+    sudo: bool,
+) -> Path | None:
     "Rollback a temporary Nix profile, like one created by `nixos-rebuild test`."
-    generations = get_generations(profile, lock_profile=True)
+    generations = get_generations(
+        profile,
+        target_host=target_host,
+        using_nix_env=True,
+        sudo=sudo,
+    )
     previous_gen_id = None
     for generation in generations:
         if not generation.current:
@@ -275,14 +316,25 @@ def rollback_temporary_profile(profile: Profile) -> Path | None:
         return None
 
 
-def set_profile(profile: Profile, path_to_config: Path) -> None:
+def set_profile(
+    profile: Profile,
+    path_to_config: Path,
+    target_host: Remote | None,
+    sudo: bool,
+) -> None:
     "Set a path as the current active Nix profile."
-    run(["nix-env", "-p", profile.path, "--set", path_to_config], check=True)
+    run_wrapper(
+        ["nix-env", "-p", profile.path, "--set", path_to_config],
+        remote=target_host,
+        sudo=sudo,
+    )
 
 
 def switch_to_configuration(
     path_to_config: Path,
     action: Action,
+    target_host: Remote | None,
+    sudo: bool,
     install_bootloader: bool = False,
     specialisation: str | None = None,
 ) -> None:
@@ -301,13 +353,11 @@ def switch_to_configuration(
         if not path_to_config.exists():
             raise NRError(f"specialisation not found: {specialisation}")
 
-    run(
+    run_wrapper(
         [path_to_config / "bin/switch-to-configuration", str(action)],
-        env={
-            "NIXOS_INSTALL_BOOTLOADER": "1" if install_bootloader else "0",
-            "LOCALE_ARCHIVE": os.getenv("LOCALE_ARCHIVE", ""),
-        },
-        check=True,
+        extra_env={"NIXOS_INSTALL_BOOTLOADER": "1" if install_bootloader else "0"},
+        remote=target_host,
+        sudo=sudo,
     )
 
 
@@ -323,4 +373,4 @@ def upgrade_channels(all: bool = False) -> None:
             or channel_path.name == "nixos"
             or (channel_path / ".update-on-nixos-rebuild").exists()
         ):
-            run(["nix-channel", "--update", channel_path.name], check=False)
+            run_wrapper(["nix-channel", "--update", channel_path.name], check=False)
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py
new file mode 100644
index 000000000000..db470ee5753c
--- /dev/null
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py
@@ -0,0 +1,112 @@
+from __future__ import annotations
+
+import os
+import subprocess
+from dataclasses import dataclass
+from getpass import getpass
+from pathlib import Path
+from typing import Self, Sequence, TypedDict, Unpack
+
+from .utils import info
+
+
+@dataclass(frozen=True)
+class Remote:
+    host: str
+    opts: list[str]
+    sudo_password: str | None
+
+    @classmethod
+    def from_arg(
+        cls,
+        host: str | None,
+        ask_sudo_password: bool | None,
+        tmp_dir: Path,
+    ) -> Self | None:
+        if not host:
+            return None
+
+        opts = os.getenv("NIX_SSHOPTS", "").split()
+        cls._validate_opts(opts, ask_sudo_password)
+        opts += [
+            # SSH ControlMaster flags, allow for faster re-connection
+            "-o",
+            "ControlMaster=auto",
+            "-o",
+            f"ControlPath={tmp_dir / "ssh-%n"}",
+            "-o",
+            "ControlPersist=60",
+        ]
+        sudo_password = None
+        if ask_sudo_password:
+            sudo_password = getpass(f"[sudo] password for {host}: ")
+        return cls(host, opts, sudo_password)
+
+    @staticmethod
+    def _validate_opts(opts: list[str], ask_sudo_password: bool | None) -> None:
+        for o in opts:
+            if o in ["-t", "-tt", "RequestTTY=yes", "RequestTTY=force"]:
+                info(
+                    f"warning: detected option '{o}' in NIX_SSHOPTS. SSH's TTY "
+                    + "may cause issues, it is recommended to remove this option"
+                )
+                if not ask_sudo_password:
+                    info(
+                        "If you want to prompt for sudo password use "
+                        + "'--ask-sudo-password' option instead"
+                    )
+
+
+# Not exhaustive, but we can always extend it later.
+class RunKwargs(TypedDict, total=False):
+    capture_output: bool
+    stderr: int | None
+    stdout: int | None
+
+
+def cleanup_ssh(tmp_dir: Path) -> None:
+    "Close SSH ControlMaster connection."
+    for ctrl in tmp_dir.glob("ssh-*"):
+        subprocess.run(["ssh", "-o", f"ControlPath={ctrl}", "exit"], check=False)
+
+
+def run_wrapper(
+    args: Sequence[str | bytes | os.PathLike[str] | os.PathLike[bytes]],
+    *,
+    check: bool = True,
+    extra_env: dict[str, str] | None = None,
+    remote: Remote | None = None,
+    sudo: bool = False,
+    **kwargs: Unpack[RunKwargs],
+) -> subprocess.CompletedProcess[str]:
+    "Wrapper around `subprocess.run` that supports extra functionality."
+    env = None
+    input = None
+    if remote:
+        if extra_env:
+            extra_env_args = [f"{env}={value}" for env, value in extra_env.items()]
+            args = ["env", *extra_env_args, *args]
+        if sudo:
+            if remote.sudo_password:
+                args = ["sudo", "--prompt=", "--stdin", *args]
+                input = remote.sudo_password + "\n"
+            else:
+                args = ["sudo", *args]
+        args = ["ssh", *remote.opts, remote.host, "--", *args]
+    else:
+        if extra_env:
+            env = os.environ | extra_env
+        if sudo:
+            args = ["sudo", *args]
+
+    return subprocess.run(
+        args,
+        check=check,
+        env=env,
+        input=input,
+        # Hope nobody is using NixOS with non-UTF8 encodings, but "surrogateescape"
+        # should still work in those systems.
+        text=True,
+        errors="surrogateescape",
+        **kwargs,
+    )
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/utils.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/utils.py
index 1cc210c3005a..8d4f128075d4 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/utils.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/utils.py
@@ -1,19 +1,18 @@
-from __future__ import annotations
-
 import sys
 from functools import partial
-from typing import Any
+from typing import TypeAlias
 
 info = partial(print, file=sys.stderr)
+Args: TypeAlias = bool | str | list[str] | int | None
 
 
-def dict_to_flags(d: dict[str, Any]) -> list[str]:
+def dict_to_flags(d: dict[str, Args]) -> list[str]:
     flags = []
     for key, value in d.items():
         flag = f"--{'-'.join(key.split('_'))}"
         match value:
-            case None | False:
-                pass
+            case None | False | 0 | []:
+                continue
             case True:
                 flags.append(flag)
             case int():
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/pyproject.toml b/pkgs/by-name/ni/nixos-rebuild-ng/src/pyproject.toml
index 457bcfe011b6..f26b3cba7056 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/pyproject.toml
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/pyproject.toml
@@ -38,8 +38,6 @@ ignore_missing_imports = true
 extend-select = [
     # ensure imports are sorted
     "I",
-    # require 'from __future__ import annotations'
-    "FA102",
     # require `check` argument for `subprocess.run`
     "PLW1510",
 ]
@@ -48,4 +46,5 @@ extend-select = [
 "tests/" = ["FA102"]
 
 [tool.pytest.ini_options]
+pythonpath = ["."]
 addopts = ["--import-mode=importlib"]
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
index 3f4fcfe289d8..e3bb1ba8f6e7 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
@@ -2,7 +2,7 @@ import textwrap
 from pathlib import Path
 from subprocess import PIPE, CompletedProcess
 from typing import Any
-from unittest.mock import call, patch
+from unittest.mock import ANY, call, patch
 
 import pytest
 
@@ -10,10 +10,12 @@ import nixos_rebuild as nr
 
 from .helpers import get_qualified_name
 
-
-@pytest.fixture(autouse=True)
-def setup(monkeypatch: Any) -> None:
-    monkeypatch.setenv("LOCALE_ARCHIVE", "/locale")
+DEFAULT_RUN_KWARGS = {
+    "env": ANY,
+    "input": None,
+    "text": True,
+    "errors": "surrogateescape",
+}
 
 
 def test_parse_args() -> None:
@@ -29,25 +31,28 @@ def test_parse_args() -> None:
         nr.parse_args(["nixos-rebuild", "edit", "--attr", "attr"])
     assert e.value.code == 2
 
-    r1, remainder = nr.parse_args(
+    r1, g1 = nr.parse_args(
         [
             "nixos-rebuild",
             "switch",
             "--install-grub",
             "--flake",
             "/etc/nixos",
-            "--extra",
-            "flag",
+            "--option",
+            "foo",
+            "bar",
         ]
     )
-    assert remainder == ["--extra", "flag"]
+    assert nr.VERBOSE == 0
     assert r1.flake == "/etc/nixos"
     assert r1.install_bootloader is True
     assert r1.install_grub is True
     assert r1.profile_name == "system"
     assert r1.action == "switch"
+    assert r1.option == ["foo", "bar"]
+    assert g1["common_flags"].option == ["foo", "bar"]
 
-    r2, remainder = nr.parse_args(
+    r2, g2 = nr.parse_args(
         [
             "nixos-rebuild",
             "dry-run",
@@ -57,18 +62,21 @@ def test_parse_args() -> None:
             "foo",
             "--attr",
             "bar",
+            "-vvv",
         ]
     )
-    assert remainder == []
+    assert nr.VERBOSE == 3
+    assert r2.verbose == 3
     assert r2.flake is False
     assert r2.action == "dry-build"
     assert r2.file == "foo"
     assert r2.attr == "bar"
+    assert g2["common_flags"].verbose == 3
 
 
-@patch(get_qualified_name(nr.nix.run, nr.nix), autospec=True)
-@patch(get_qualified_name(nr.nix.shutil.which), autospec=True, return_value="/bin/git")
-def test_execute_nix_boot(mock_which: Any, mock_run: Any, tmp_path: Path) -> None:
+@patch.dict(nr.process.os.environ, {}, clear=True)
+@patch(get_qualified_name(nr.process.subprocess.run), autospec=True)
+def test_execute_nix_boot(mock_run: Any, tmp_path: Path) -> None:
     nixpkgs_path = tmp_path / "nixpkgs"
     nixpkgs_path.mkdir()
     config_path = tmp_path / "test"
@@ -88,7 +96,6 @@ def test_execute_nix_boot(mock_which: Any, mock_run: Any, tmp_path: Path) -> Non
 
     nr.execute(["nixos-rebuild", "boot", "--no-flake", "-vvv"])
 
-    assert nr.VERBOSE is True
     assert mock_run.call_count == 6
     mock_run.assert_has_calls(
         [
@@ -96,17 +103,18 @@ def test_execute_nix_boot(mock_which: Any, mock_run: Any, tmp_path: Path) -> Non
                 ["nix-instantiate", "--find-file", "nixpkgs", "-vvv"],
                 stdout=PIPE,
                 check=False,
-                text=True,
+                **DEFAULT_RUN_KWARGS,
             ),
             call(
                 ["git", "-C", nixpkgs_path, "rev-parse", "--short", "HEAD"],
                 check=False,
                 stdout=PIPE,
-                text=True,
+                **DEFAULT_RUN_KWARGS,
             ),
             call(
                 ["git", "-C", nixpkgs_path, "diff", "--quiet"],
                 check=False,
+                **DEFAULT_RUN_KWARGS,
             ),
             call(
                 [
@@ -118,8 +126,8 @@ def test_execute_nix_boot(mock_which: Any, mock_run: Any, tmp_path: Path) -> Non
                     "-vvv",
                 ],
                 check=True,
-                text=True,
                 stdout=PIPE,
+                **DEFAULT_RUN_KWARGS,
             ),
             call(
                 [
@@ -130,17 +138,19 @@ def test_execute_nix_boot(mock_which: Any, mock_run: Any, tmp_path: Path) -> Non
                     config_path,
                 ],
                 check=True,
+                **DEFAULT_RUN_KWARGS,
             ),
             call(
                 [config_path / "bin/switch-to-configuration", "boot"],
-                env={"NIXOS_INSTALL_BOOTLOADER": "0", "LOCALE_ARCHIVE": "/locale"},
                 check=True,
+                **(DEFAULT_RUN_KWARGS | {"env": {"NIXOS_INSTALL_BOOTLOADER": "0"}}),
             ),
         ]
     )
 
 
-@patch(get_qualified_name(nr.nix.run, nr.nix), autospec=True)
+@patch.dict(nr.process.os.environ, {}, clear=True)
+@patch(get_qualified_name(nr.process.subprocess.run), autospec=True)
 def test_execute_nix_switch_flake(mock_run: Any, tmp_path: Path) -> None:
     config_path = tmp_path / "test"
     config_path.touch()
@@ -160,11 +170,11 @@ def test_execute_nix_switch_flake(mock_run: Any, tmp_path: Path) -> None:
             "--flake",
             "/path/to/config#hostname",
             "--install-bootloader",
+            "--sudo",
             "--verbose",
         ]
     )
 
-    assert nr.VERBOSE is True
     assert mock_run.call_count == 3
     mock_run.assert_has_calls(
         [
@@ -177,14 +187,15 @@ def test_execute_nix_switch_flake(mock_run: Any, tmp_path: Path) -> None:
                     "--print-out-paths",
                     "/path/to/config#nixosConfigurations.hostname.config.system.build.toplevel",
                     "--no-link",
-                    "--verbose",
+                    "-v",
                 ],
                 check=True,
-                text=True,
                 stdout=PIPE,
+                **DEFAULT_RUN_KWARGS,
             ),
             call(
                 [
+                    "sudo",
                     "nix-env",
                     "-p",
                     Path("/nix/var/nix/profiles/system"),
@@ -192,25 +203,126 @@ def test_execute_nix_switch_flake(mock_run: Any, tmp_path: Path) -> None:
                     config_path,
                 ],
                 check=True,
+                **DEFAULT_RUN_KWARGS,
             ),
             call(
-                [config_path / "bin/switch-to-configuration", "switch"],
-                env={"NIXOS_INSTALL_BOOTLOADER": "1", "LOCALE_ARCHIVE": "/locale"},
+                ["sudo", config_path / "bin/switch-to-configuration", "switch"],
                 check=True,
+                **(DEFAULT_RUN_KWARGS | {"env": {"NIXOS_INSTALL_BOOTLOADER": "1"}}),
             ),
         ]
     )
 
 
-@patch(get_qualified_name(nr.nix.run, nr.nix), autospec=True)
+@patch.dict(nr.process.os.environ, {}, clear=True)
+@patch(get_qualified_name(nr.process.subprocess.run), autospec=True)
+@patch(get_qualified_name(nr.TemporaryDirectory, nr))  # can't autospec
+def test_execute_nix_switch_flake_remote(
+    mock_tmpdir: Any,
+    mock_run: Any,
+    tmp_path: Path,
+) -> None:
+    config_path = tmp_path / "test"
+    config_path.touch()
+    mock_run.side_effect = [
+        # nixos_build_flake
+        CompletedProcess([], 0, str(config_path)),
+        # set_profile
+        CompletedProcess([], 0),
+        # copy_closure
+        CompletedProcess([], 0),
+        # switch_to_configuration
+        CompletedProcess([], 0),
+    ]
+    mock_tmpdir.return_value.name = "/tmp/test"
+
+    nr.execute(
+        [
+            "nixos-rebuild",
+            "switch",
+            "--flake",
+            "/path/to/config#hostname",
+            "--use-remote-sudo",
+            "--target-host",
+            "user@localhost",
+        ]
+    )
+
+    assert mock_run.call_count == 4
+    mock_run.assert_has_calls(
+        [
+            call(
+                [
+                    "nix",
+                    "--extra-experimental-features",
+                    "nix-command flakes",
+                    "build",
+                    "--print-out-paths",
+                    "/path/to/config#nixosConfigurations.hostname.config.system.build.toplevel",
+                    "--no-link",
+                ],
+                check=True,
+                stdout=PIPE,
+                **DEFAULT_RUN_KWARGS,
+            ),
+            call(
+                ["nix-copy-closure", "--to", "user@localhost", config_path],
+                check=True,
+                **DEFAULT_RUN_KWARGS,
+            ),
+            call(
+                [
+                    "ssh",
+                    "-o",
+                    "ControlMaster=auto",
+                    "-o",
+                    "ControlPath=/tmp/test/ssh-%n",
+                    "-o",
+                    "ControlPersist=60",
+                    "user@localhost",
+                    "--",
+                    "sudo",
+                    "nix-env",
+                    "-p",
+                    Path("/nix/var/nix/profiles/system"),
+                    "--set",
+                    config_path,
+                ],
+                check=True,
+                **DEFAULT_RUN_KWARGS,
+            ),
+            call(
+                [
+                    "ssh",
+                    "-o",
+                    "ControlMaster=auto",
+                    "-o",
+                    "ControlPath=/tmp/test/ssh-%n",
+                    "-o",
+                    "ControlPersist=60",
+                    "user@localhost",
+                    "--",
+                    "sudo",
+                    "env",
+                    "NIXOS_INSTALL_BOOTLOADER=0",
+                    config_path / "bin/switch-to-configuration",
+                    "switch",
+                ],
+                check=True,
+                **DEFAULT_RUN_KWARGS,
+            ),
+        ]
+    )
+
+
+@patch(get_qualified_name(nr.process.subprocess.run), autospec=True)
 def test_execute_switch_rollback(mock_run: Any, tmp_path: Path) -> None:
     nixpkgs_path = tmp_path / "nixpkgs"
     nixpkgs_path.touch()
 
     nr.execute(["nixos-rebuild", "switch", "--rollback", "--install-bootloader"])
 
-    assert nr.VERBOSE is False
-    assert mock_run.call_count == 3
+    assert mock_run.call_count >= 2
     # ignoring update_nixpkgs_rev calls
     mock_run.assert_has_calls(
         [
@@ -222,20 +334,21 @@ def test_execute_switch_rollback(mock_run: Any, tmp_path: Path) -> None:
                     Path("/nix/var/nix/profiles/system"),
                 ],
                 check=True,
+                **DEFAULT_RUN_KWARGS,
             ),
             call(
                 [
                     Path("/nix/var/nix/profiles/system/bin/switch-to-configuration"),
                     "switch",
                 ],
-                env={"NIXOS_INSTALL_BOOTLOADER": "1", "LOCALE_ARCHIVE": "/locale"},
                 check=True,
+                **DEFAULT_RUN_KWARGS,
             ),
         ]
     )
 
 
-@patch(get_qualified_name(nr.nix.run, nr.nix), autospec=True)
+@patch(get_qualified_name(nr.process.subprocess.run), autospec=True)
 @patch(get_qualified_name(nr.nix.Path.exists, nr.nix), autospec=True, return_value=True)
 @patch(get_qualified_name(nr.nix.Path.mkdir, nr.nix), autospec=True)
 def test_execute_test_rollback(
@@ -268,7 +381,6 @@ def test_execute_test_rollback(
         ]
     )
 
-    assert nr.VERBOSE is False
     assert mock_run.call_count == 2
     mock_run.assert_has_calls(
         [
@@ -279,9 +391,9 @@ def test_execute_test_rollback(
                     Path("/nix/var/nix/profiles/system-profiles/foo"),
                     "--list-generations",
                 ],
-                text=True,
-                stdout=True,
                 check=True,
+                stdout=PIPE,
+                **DEFAULT_RUN_KWARGS,
             ),
             call(
                 [
@@ -290,8 +402,8 @@ def test_execute_test_rollback(
                     ),
                     "test",
                 ],
-                env={"NIXOS_INSTALL_BOOTLOADER": "0", "LOCALE_ARCHIVE": "/locale"},
                 check=True,
+                **DEFAULT_RUN_KWARGS,
             ),
         ]
     )
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_models.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_models.py
index cd3a19beb789..f30ef4059310 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_models.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_models.py
@@ -1,9 +1,10 @@
 import platform
+import subprocess
 from pathlib import Path
 from typing import Any
 from unittest.mock import patch
 
-from nixos_rebuild import models as m
+import nixos_rebuild.models as m
 
 from .helpers import get_qualified_name
 
@@ -12,16 +13,15 @@ def test_flake_parse() -> None:
     assert m.Flake.parse("/path/to/flake#attr") == m.Flake(
         Path("/path/to/flake"), "nixosConfigurations.attr"
     )
-    assert m.Flake.parse("/path/ to /flake", "hostname") == m.Flake(
+    assert m.Flake.parse("/path/ to /flake", lambda: "hostname") == m.Flake(
         Path("/path/ to /flake"), "nixosConfigurations.hostname"
     )
-    assert m.Flake.parse("/path/to/flake", "hostname") == m.Flake(
+    assert m.Flake.parse("/path/to/flake", lambda: "hostname") == m.Flake(
         Path("/path/to/flake"), "nixosConfigurations.hostname"
     )
     assert m.Flake.parse(".#attr") == m.Flake(Path("."), "nixosConfigurations.attr")
     assert m.Flake.parse("#attr") == m.Flake(Path("."), "nixosConfigurations.attr")
-    assert m.Flake.parse(".", None) == m.Flake(Path("."), "nixosConfigurations.default")
-    assert m.Flake.parse("", "") == m.Flake(Path("."), "nixosConfigurations.default")
+    assert m.Flake.parse(".") == m.Flake(Path("."), "nixosConfigurations.default")
 
 
 @patch(get_qualified_name(platform.node), autospec=True)
@@ -29,15 +29,17 @@ def test_flake_from_arg(mock_node: Any) -> None:
     mock_node.return_value = "hostname"
 
     # Flake string
-    assert m.Flake.from_arg("/path/to/flake#attr") == m.Flake(
+    assert m.Flake.from_arg("/path/to/flake#attr", None) == m.Flake(
         Path("/path/to/flake"), "nixosConfigurations.attr"
     )
 
     # False
-    assert m.Flake.from_arg(False) is None
+    assert m.Flake.from_arg(False, None) is None
 
     # True
-    assert m.Flake.from_arg(True) == m.Flake(Path("."), "nixosConfigurations.hostname")
+    assert m.Flake.from_arg(True, None) == m.Flake(
+        Path("."), "nixosConfigurations.hostname"
+    )
 
     # None when we do not have /etc/nixos/flake.nix
     with patch(
@@ -45,7 +47,7 @@ def test_flake_from_arg(mock_node: Any) -> None:
         autospec=True,
         return_value=False,
     ):
-        assert m.Flake.from_arg(None) is None
+        assert m.Flake.from_arg(None, None) is None
 
     # None when we have a file in /etc/nixos/flake.nix
     with (
@@ -60,7 +62,7 @@ def test_flake_from_arg(mock_node: Any) -> None:
             return_value=False,
         ),
     ):
-        assert m.Flake.from_arg(None) == m.Flake(
+        assert m.Flake.from_arg(None, None) == m.Flake(
             Path("/etc/nixos"), "nixosConfigurations.hostname"
         )
 
@@ -81,10 +83,21 @@ def test_flake_from_arg(mock_node: Any) -> None:
             return_value=Path("/path/to/flake.nix"),
         ),
     ):
-        assert m.Flake.from_arg(None) == m.Flake(
+        assert m.Flake.from_arg(None, None) == m.Flake(
             Path("/path/to"), "nixosConfigurations.hostname"
         )
 
+    with (
+        patch(
+            get_qualified_name(m.subprocess.run),
+            autospec=True,
+            return_value=subprocess.CompletedProcess([], 0, "remote-hostname\n"),
+        ),
+    ):
+        assert m.Flake.from_arg("/path/to", m.Remote("user@host", [], None)) == m.Flake(
+            Path("/path/to"), "nixosConfigurations.remote-hostname"
+        )
+
 
 @patch(get_qualified_name(m.Path.mkdir, m), autospec=True)
 def test_profile_from_name(mock_mkdir: Any) -> None:
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
index 367c55c55695..8234f0ff98f9 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
@@ -6,17 +6,31 @@ from unittest.mock import ANY, call, patch
 
 import pytest
 
+import nixos_rebuild.models as m
 import nixos_rebuild.nix as n
-from nixos_rebuild import models as m
 
 from .helpers import get_qualified_name
 
 
-@patch(get_qualified_name(n.run, n), autospec=True)
+@patch(get_qualified_name(n.run_wrapper, n), autospec=True)
+def test_copy_closure(mock_run: Any) -> None:
+    closure = Path("/path/to/closure")
+    n.copy_closure(closure, None)
+    mock_run.assert_not_called()
+
+    target_host = m.Remote("user@host", ["--ssh", "opt"], None)
+    n.copy_closure(closure, target_host)
+    mock_run.assert_called_with(
+        ["nix-copy-closure", "--to", "user@host", closure],
+        extra_env={"NIX_SSHOPTS": "--ssh opt"},
+    )
+
+
+@patch(get_qualified_name(n.run_wrapper, n), autospec=True)
 def test_edit(mock_run: Any, monkeypatch: Any, tmpdir: Any) -> None:
     # Flake
     flake = m.Flake.parse(".#attr")
-    n.edit(flake, ["--commit-lock-file"])
+    n.edit(flake, commit_lock_file=True)
     mock_run.assert_called_with(
         [
             "nix",
@@ -42,14 +56,13 @@ def test_edit(mock_run: Any, monkeypatch: Any, tmpdir: Any) -> None:
         mock_run.assert_called_with(["editor", default_nix], check=False)
 
 
-@patch(get_qualified_name(n.shutil.which), autospec=True, return_value="/bin/git")
-def test_get_nixpkgs_rev(mock_which: Any) -> None:
+def test_get_nixpkgs_rev() -> None:
     assert n.get_nixpkgs_rev(None) is None
 
     path = Path("/path/to/nix")
 
     with patch(
-        get_qualified_name(n.run, n),
+        get_qualified_name(n.run_wrapper, n),
         autospec=True,
         side_effect=[CompletedProcess([], 0, "")],
     ) as mock_run:
@@ -58,7 +71,6 @@ def test_get_nixpkgs_rev(mock_which: Any) -> None:
             ["git", "-C", path, "rev-parse", "--short", "HEAD"],
             check=False,
             stdout=PIPE,
-            text=True,
         )
 
     expected_calls = [
@@ -66,7 +78,6 @@ def test_get_nixpkgs_rev(mock_which: Any) -> None:
             ["git", "-C", path, "rev-parse", "--short", "HEAD"],
             check=False,
             stdout=PIPE,
-            text=True,
         ),
         call(
             ["git", "-C", path, "diff", "--quiet"],
@@ -75,7 +86,7 @@ def test_get_nixpkgs_rev(mock_which: Any) -> None:
     ]
 
     with patch(
-        get_qualified_name(n.run, n),
+        get_qualified_name(n.run_wrapper, n),
         autospec=True,
         side_effect=[
             CompletedProcess([], 0, "0f7c82403fd6"),
@@ -86,7 +97,7 @@ def test_get_nixpkgs_rev(mock_which: Any) -> None:
         mock_run.assert_has_calls(expected_calls)
 
     with patch(
-        get_qualified_name(n.run, n),
+        get_qualified_name(n.run_wrapper, n),
         autospec=True,
         side_effect=[
             CompletedProcess([], 0, "0f7c82403fd6"),
@@ -109,7 +120,7 @@ def test_get_generations_from_nix_store(tmp_path: Path) -> None:
 
     assert n.get_generations(
         m.Profile("system", tmp_path / "system"),
-        lock_profile=False,
+        using_nix_env=False,
     ) == [
         m.Generation(id=1, current=False, timestamp=ANY),
         m.Generation(id=2, current=True, timestamp=ANY),
@@ -118,7 +129,7 @@ def test_get_generations_from_nix_store(tmp_path: Path) -> None:
 
 
 @patch(
-    get_qualified_name(n.run, n),
+    get_qualified_name(n.run_wrapper, n),
     autospec=True,
     return_value=CompletedProcess(
         [],
@@ -134,7 +145,7 @@ def test_get_generations_from_nix_env(mock_run: Any, tmp_path: Path) -> None:
     path = tmp_path / "test"
     path.touch()
 
-    assert n.get_generations(m.Profile("system", path), lock_profile=True) == [
+    assert n.get_generations(m.Profile("system", path), using_nix_env=True) == [
         m.Generation(id=2082, current=False, timestamp="2024-11-07 22:58:56"),
         m.Generation(id=2083, current=False, timestamp="2024-11-07 22:59:41"),
         m.Generation(id=2084, current=True, timestamp="2024-11-07 23:54:17"),
@@ -183,7 +194,7 @@ def test_list_generations(mock_get_generations: Any, tmp_path: Path) -> None:
 
 
 @patch(
-    get_qualified_name(n.run, n),
+    get_qualified_name(n.run_wrapper, n),
     autospec=True,
     return_value=CompletedProcess([], 0, stdout=" \n/path/to/file\n "),
 )
@@ -193,8 +204,8 @@ def test_nixos_build_flake(mock_run: Any) -> None:
     assert n.nixos_build_flake(
         "toplevel",
         flake,
-        ["--nix-flag", "foo"],
         no_link=True,
+        nix_flag="foo",
     ) == Path("/path/to/file")
     mock_run.assert_called_with(
         [
@@ -208,62 +219,62 @@ def test_nixos_build_flake(mock_run: Any) -> None:
             "--nix-flag",
             "foo",
         ],
-        check=True,
-        text=True,
         stdout=PIPE,
     )
 
 
 @patch(
-    get_qualified_name(n.run, n),
+    get_qualified_name(n.run_wrapper, n),
     autospec=True,
     return_value=CompletedProcess([], 0, stdout=" \n/path/to/file\n "),
 )
 def test_nixos_build(mock_run: Any, monkeypatch: Any) -> None:
-    assert n.nixos_build("attr", None, None, ["--nix-flag", "foo"]) == Path(
-        "/path/to/file"
-    )
+    assert n.nixos_build("attr", None, None, nix_flag="foo") == Path("/path/to/file")
     mock_run.assert_called_with(
         ["nix-build", "<nixpkgs/nixos>", "--attr", "attr", "--nix-flag", "foo"],
-        check=True,
-        text=True,
         stdout=PIPE,
     )
 
     n.nixos_build("attr", "preAttr", "file")
     mock_run.assert_called_with(
         ["nix-build", "file", "--attr", "preAttr.attr"],
-        check=True,
-        text=True,
         stdout=PIPE,
     )
 
     n.nixos_build("attr", None, "file", no_out_link=True)
     mock_run.assert_called_with(
         ["nix-build", "file", "--attr", "attr", "--no-out-link"],
-        check=True,
-        text=True,
         stdout=PIPE,
     )
 
     n.nixos_build("attr", "preAttr", None, no_out_link=False, keep_going=True)
     mock_run.assert_called_with(
         ["nix-build", "default.nix", "--attr", "preAttr.attr", "--keep-going"],
-        check=True,
-        text=True,
         stdout=PIPE,
     )
 
 
-@patch(get_qualified_name(n.run, n), autospec=True)
+@patch(get_qualified_name(n.run_wrapper, n), autospec=True)
 def test_rollback(mock_run: Any, tmp_path: Path) -> None:
     path = tmp_path / "test"
     path.touch()
 
     profile = m.Profile("system", path)
 
-    assert n.rollback(profile) == profile.path
-    mock_run.assert_called_with(["nix-env", "--rollback", "-p", path], check=True)
+    assert n.rollback(profile, None, False) == profile.path
+    mock_run.assert_called_with(
+        ["nix-env", "--rollback", "-p", path],
+        remote=None,
+        sudo=False,
+    )
+
+    target_host = m.Remote("user@localhost", [], None)
+    assert n.rollback(profile, target_host, True) == profile.path
+    mock_run.assert_called_with(
+        ["nix-env", "--rollback", "-p", path],
+        remote=target_host,
+        sudo=True,
+    )
 
 
 def test_rollback_temporary_profile(tmp_path: Path) -> None:
@@ -271,7 +282,7 @@ def test_rollback_temporary_profile(tmp_path: Path) -> None:
     path.touch()
     profile = m.Profile("system", path)
 
-    with patch(get_qualified_name(n.run, n), autospec=True) as mock_run:
+    with patch(get_qualified_name(n.run_wrapper, n), autospec=True) as mock_run:
         mock_run.return_value = CompletedProcess(
             [],
             0,
@@ -282,31 +293,62 @@ def test_rollback_temporary_profile(tmp_path: Path) -> None:
                 """),
         )
         assert (
-            n.rollback_temporary_profile(m.Profile("system", path))
+            n.rollback_temporary_profile(m.Profile("system", path), None, False)
             == path.parent / "system-2083-link"
         )
-        assert (
-            n.rollback_temporary_profile(m.Profile("foo", path))
-            == path.parent / "foo-2083-link"
+        mock_run.assert_called_with(
+            [
+                "nix-env",
+                "-p",
+                path,
+                "--list-generations",
+            ],
+            stdout=PIPE,
+            remote=None,
+            sudo=False,
         )
 
-    with patch(get_qualified_name(n.run, n), autospec=True) as mock_run:
+        target_host = m.Remote("user@localhost", [], None)
+        assert (
+            n.rollback_temporary_profile(m.Profile("foo", path), target_host, True)
+            == path.parent / "foo-2083-link"
+        )
+        mock_run.assert_called_with(
+            [
+                "nix-env",
+                "-p",
+                path,
+                "--list-generations",
+            ],
+            stdout=PIPE,
+            remote=target_host,
+            sudo=True,
+        )
+
+    with patch(get_qualified_name(n.run_wrapper, n), autospec=True) as mock_run:
         mock_run.return_value = CompletedProcess([], 0, stdout="")
-        assert n.rollback_temporary_profile(profile) is None
+        assert n.rollback_temporary_profile(profile, None, False) is None
 
 
-@patch(get_qualified_name(n.run, n), autospec=True)
+@patch(get_qualified_name(n.run_wrapper, n), autospec=True)
 def test_set_profile(mock_run: Any) -> None:
     profile_path = Path("/path/to/profile")
     config_path = Path("/path/to/config")
-    n.set_profile(m.Profile("system", profile_path), config_path)
+    n.set_profile(
+        m.Profile("system", profile_path),
+        config_path,
+        target_host=None,
+        sudo=False,
+    )
 
     mock_run.assert_called_with(
-        ["nix-env", "-p", profile_path, "--set", config_path], check=True
+        ["nix-env", "-p", profile_path, "--set", config_path],
+        remote=None,
+        sudo=False,
     )
 
 
-@patch(get_qualified_name(n.run, n), autospec=True)
+@patch(get_qualified_name(n.run_wrapper, n), autospec=True)
 def test_switch_to_configuration(mock_run: Any, monkeypatch: Any) -> None:
     profile_path = Path("/path/to/profile")
     config_path = Path("/path/to/config")
@@ -317,19 +359,24 @@ def test_switch_to_configuration(mock_run: Any, monkeypatch: Any) -> None:
         n.switch_to_configuration(
             profile_path,
             m.Action.SWITCH,
+            sudo=False,
+            target_host=None,
             specialisation=None,
             install_bootloader=False,
         )
     mock_run.assert_called_with(
         [profile_path / "bin/switch-to-configuration", "switch"],
-        env={"NIXOS_INSTALL_BOOTLOADER": "0", "LOCALE_ARCHIVE": ""},
-        check=True,
+        extra_env={"NIXOS_INSTALL_BOOTLOADER": "0"},
+        sudo=False,
+        remote=None,
     )
 
     with pytest.raises(m.NRError) as e:
         n.switch_to_configuration(
             config_path,
             m.Action.BOOT,
+            sudo=False,
+            target_host=None,
             specialisation="special",
         )
     assert (
@@ -337,13 +384,17 @@ def test_switch_to_configuration(mock_run: Any, monkeypatch: Any) -> None:
         == "error: '--specialisation' can only be used with 'switch' and 'test'"
     )
 
+    target_host = m.Remote("user@localhost", [], None)
     with monkeypatch.context() as mp:
         mp.setenv("LOCALE_ARCHIVE", "/path/to/locale")
+        mp.setenv("PATH", "/path/to/bin")
         mp.setattr(Path, Path.exists.__name__, lambda self: True)
 
         n.switch_to_configuration(
             Path("/path/to/config"),
             m.Action.TEST,
+            sudo=True,
+            target_host=target_host,
             install_bootloader=True,
             specialisation="special",
         )
@@ -352,8 +403,9 @@ def test_switch_to_configuration(mock_run: Any, monkeypatch: Any) -> None:
             config_path / "specialisation/special/bin/switch-to-configuration",
             "test",
         ],
-        env={"NIXOS_INSTALL_BOOTLOADER": "1", "LOCALE_ARCHIVE": "/path/to/locale"},
-        check=True,
+        extra_env={"NIXOS_INSTALL_BOOTLOADER": "1"},
+        sudo=True,
+        remote=target_host,
     )
 
 
@@ -367,11 +419,11 @@ def test_switch_to_configuration(mock_run: Any, monkeypatch: Any) -> None:
     ],
 )
 def test_upgrade_channels(mock_glob: Any) -> None:
-    with patch(get_qualified_name(n.run, n), autospec=True) as mock_run:
+    with patch(get_qualified_name(n.run_wrapper, n), autospec=True) as mock_run:
         n.upgrade_channels(False)
     mock_run.assert_called_with(["nix-channel", "--update", "nixos"], check=False)
 
-    with patch(get_qualified_name(n.run, n), autospec=True) as mock_run:
+    with patch(get_qualified_name(n.run_wrapper, n), autospec=True) as mock_run:
         n.upgrade_channels(True)
     mock_run.assert_has_calls(
         [
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_process.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_process.py
new file mode 100644
index 000000000000..6987aac9283b
--- /dev/null
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_process.py
@@ -0,0 +1,121 @@
+from pathlib import Path
+from typing import Any
+from unittest.mock import patch
+
+import nixos_rebuild.models as m
+import nixos_rebuild.process as p
+
+from .helpers import get_qualified_name
+
+
+@patch(get_qualified_name(p.subprocess.run))
+def test_run(mock_run: Any) -> None:
+    p.run_wrapper(["test", "--with", "flags"], check=True)
+    mock_run.assert_called_with(
+        ["test", "--with", "flags"],
+        check=True,
+        text=True,
+        errors="surrogateescape",
+        env=None,
+        input=None,
+    )
+
+    with patch.dict(p.os.environ, {"PATH": "/path/to/bin"}, clear=True):
+        p.run_wrapper(
+            ["test", "--with", "flags"],
+            check=False,
+            sudo=True,
+            extra_env={"FOO": "bar"},
+        )
+    mock_run.assert_called_with(
+        ["sudo", "test", "--with", "flags"],
+        check=False,
+        text=True,
+        errors="surrogateescape",
+        env={
+            "PATH": "/path/to/bin",
+            "FOO": "bar",
+        },
+        input=None,
+    )
+
+    p.run_wrapper(
+        ["test", "--with", "flags"],
+        check=True,
+        remote=m.Remote("user@localhost", ["--ssh", "opt"], "password"),
+    )
+    mock_run.assert_called_with(
+        ["ssh", "--ssh", "opt", "user@localhost", "--", "test", "--with", "flags"],
+        check=True,
+        text=True,
+        errors="surrogateescape",
+        env=None,
+        input=None,
+    )
+
+    p.run_wrapper(
+        ["test", "--with", "flags"],
+        check=True,
+        sudo=True,
+        extra_env={"FOO": "bar"},
+        remote=m.Remote("user@localhost", ["--ssh", "opt"], "password"),
+    )
+    mock_run.assert_called_with(
+        [
+            "ssh",
+            "--ssh",
+            "opt",
+            "user@localhost",
+            "--",
+            "sudo",
+            "--prompt=",
+            "--stdin",
+            "env",
+            "FOO=bar",
+            "test",
+            "--with",
+            "flags",
+        ],
+        check=True,
+        env=None,
+        text=True,
+        errors="surrogateescape",
+        input="password\n",
+    )
+
+
+def test_remote_from_name(monkeypatch: Any, tmpdir: Path) -> None:
+    monkeypatch.setenv("NIX_SSHOPTS", "")
+    assert m.Remote.from_arg("user@localhost", None, tmpdir) == m.Remote(
+        "user@localhost",
+        opts=[
+            "-o",
+            "ControlMaster=auto",
+            "-o",
+            f"ControlPath={tmpdir / "ssh-%n"}",
+            "-o",
+            "ControlPersist=60",
+        ],
+        sudo_password=None,
+    )
+
+    # get_qualified_name doesn't work because getpass is aliased to another
+    # function
+    with patch(f"{p.__name__}.getpass", return_value="password"):
+        monkeypatch.setenv("NIX_SSHOPTS", "-f foo -b bar")
+        assert m.Remote.from_arg("user@localhost", True, tmpdir) == m.Remote(
+            "user@localhost",
+            opts=[
+                "-f",
+                "foo",
+                "-b",
+                "bar",
+                "-o",
+                "ControlMaster=auto",
+                "-o",
+                f"ControlPath={tmpdir / "ssh-%n"}",
+                "-o",
+                "ControlPersist=60",
+            ],
+            sudo_password="password",
+        )
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_utils.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_utils.py
index 98c0b798742c..0e5eb7437f65 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_utils.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_utils.py
@@ -1,8 +1,8 @@
-from nixos_rebuild import utils as u
+import nixos_rebuild.utils as u
 
 
 def test_dict_to_flags() -> None:
-    r = u.dict_to_flags(
+    r1 = u.dict_to_flags(
         {
             "test_flag_1": True,
             "test_flag_2": False,
@@ -12,7 +12,7 @@ def test_dict_to_flags() -> None:
             "verbose": 5,
         }
     )
-    assert r == [
+    assert r1 == [
         "--test-flag-1",
         "--test-flag-3",
         "value",
@@ -21,3 +21,5 @@ def test_dict_to_flags() -> None:
         "v2",
         "-vvvvv",
     ]
+    r2 = u.dict_to_flags({"verbose": 0, "empty_list": []})
+    assert r2 == []
diff --git a/pkgs/by-name/ni/nixos-render-docs-redirects/package.nix b/pkgs/by-name/ni/nixos-render-docs-redirects/package.nix
new file mode 100644
index 000000000000..a473fd1533ca
--- /dev/null
+++ b/pkgs/by-name/ni/nixos-render-docs-redirects/package.nix
@@ -0,0 +1,22 @@
+{ lib, python3 }:
+
+python3.pkgs.buildPythonApplication {
+  pname = "nixos-render-docs-redirects";
+  version = "0.0";
+  pyproject = true;
+
+  src = ./src;
+
+  build-system = with python3.pkgs; [ setuptools ];
+
+  nativeCheckInputs = with python3.pkgs; [
+    pytestCheckHook
+  ];
+
+  meta = {
+    description = "Redirects manipulation for nixos manuals";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ getpsyched ];
+    mainProgram = "redirects";
+  };
+}
diff --git a/pkgs/by-name/ni/nixos-render-docs-redirects/src/nixos_render_docs_redirects/__init__.py b/pkgs/by-name/ni/nixos-render-docs-redirects/src/nixos_render_docs_redirects/__init__.py
new file mode 100644
index 000000000000..d09849ac4866
--- /dev/null
+++ b/pkgs/by-name/ni/nixos-render-docs-redirects/src/nixos_render_docs_redirects/__init__.py
@@ -0,0 +1,130 @@
+import argparse
+import json
+import sys
+from pathlib import Path
+
+
+def add_content(redirects: dict[str, list[str]], identifier: str, path: str) -> dict[str, list[str]]:
+    if identifier in redirects:
+        raise IdentifierExists(identifier)
+
+    # Insert the new identifier in alphabetical order
+    new_redirects = list(redirects.items())
+    insertion_index = 0
+    for i, (key, _) in enumerate(new_redirects):
+        if identifier > key:
+            insertion_index = i + 1
+        else:
+            break
+    new_redirects.insert(insertion_index, (identifier, [f"{path}#{identifier}"]))
+    return dict(new_redirects)
+
+
+def move_content(redirects: dict[str, list[str]], identifier: str, path: str) -> dict[str, list[str]]:
+    if identifier not in redirects:
+        raise IdentifierNotFound(identifier)
+    redirects[identifier].insert(0, f"{path}#{identifier}")
+    return redirects
+
+
+def rename_identifier(
+    redirects: dict[str, list[str]],
+    old_identifier: str,
+    new_identifier: str
+) -> dict[str, list[str]]:
+    if old_identifier not in redirects:
+        raise IdentifierNotFound(old_identifier)
+    if new_identifier in redirects:
+        raise IdentifierExists(new_identifier)
+
+    # To minimise the diff, we recreate the redirects mapping allowing
+    # the new key to be updated in-place, preserving the index.
+    new_redirects = {}
+    current_path = ""
+    for key, value in redirects.items():
+        if key == old_identifier:
+            new_redirects[new_identifier] = value
+            current_path = value[0].split('#')[0]
+            continue
+        new_redirects[key] = value
+    new_redirects[new_identifier].insert(0, f"{current_path}#{new_identifier}")
+    return new_redirects
+
+
+def remove_and_redirect(
+    redirects: dict[str, list[str]],
+    old_identifier: str,
+    new_identifier: str
+) -> dict[str, list[str]]:
+    if old_identifier not in redirects:
+        raise IdentifierNotFound(old_identifier)
+    if new_identifier not in redirects:
+        raise IdentifierNotFound(new_identifier)
+    redirects[new_identifier].extend(redirects.pop(old_identifier))
+    return redirects
+
+
+def main():
+    parser = argparse.ArgumentParser(description="redirects manipulation for nixos manuals")
+    commands = parser.add_subparsers(dest="command", required=True)
+    parser.add_argument("-f", "--file", type=Path, required=True)
+
+    add_content_cmd = commands.add_parser("add-content")
+    add_content_cmd.add_argument("identifier", type=str)
+    add_content_cmd.add_argument("path", type=str)
+
+    move_content_cmd = commands.add_parser("move-content")
+    move_content_cmd.add_argument("identifier", type=str)
+    move_content_cmd.add_argument("path", type=str)
+
+    rename_id_cmd = commands.add_parser("rename-identifier")
+    rename_id_cmd.add_argument("old_identifier", type=str)
+    rename_id_cmd.add_argument("new_identifier", type=str)
+
+    remove_redirect_cmd = commands.add_parser("remove-and-redirect")
+    remove_redirect_cmd.add_argument("identifier", type=str)
+    remove_redirect_cmd.add_argument("target_identifier", type=str)
+
+    args = parser.parse_args()
+
+    with open(args.file) as file:
+        redirects = json.load(file)
+
+    try:
+        if args.command == "add-content":
+            redirects = add_content(redirects, args.identifier, args.path)
+            print(f"Added new identifier: {args.identifier}")
+
+        elif args.command == "move-content":
+            redirects = move_content(redirects, args.identifier, args.path)
+            print(f"Moved '{args.identifier}' to the new path: {args.path}")
+
+        elif args.command == "rename-identifier":
+            redirects = rename_identifier(redirects, args.old_identifier, args.new_identifier)
+            print(f"Renamed identifier from {args.old_identifier} to {args.new_identifier}")
+
+        elif args.command == "remove-and-redirect":
+            redirects = remove_and_redirect(redirects, args.identifier, args.target_identifier)
+            print(f"Redirect from '{args.identifier}' to '{args.target_identifier}' added.")
+    except Exception as error:
+        print(error, file=sys.stderr)
+    else:
+        with open(args.file, "w") as file:
+            json.dump(redirects, file, indent=2)
+            file.write("\n")
+
+
+class IdentifierExists(Exception):
+    def __init__(self, identifier: str):
+        self.identifier = identifier
+
+    def __str__(self):
+        return f"The identifier '{self.identifier}' already exists."
+
+
+class IdentifierNotFound(Exception):
+    def __init__(self, identifier: str):
+        self.identifier = identifier
+
+    def __str__(self):
+        return f"The identifier '{self.identifier}' does not exist in the redirect mapping."
diff --git a/pkgs/by-name/ni/nixos-render-docs-redirects/src/pyproject.toml b/pkgs/by-name/ni/nixos-render-docs-redirects/src/pyproject.toml
new file mode 100644
index 000000000000..50f7bcb95507
--- /dev/null
+++ b/pkgs/by-name/ni/nixos-render-docs-redirects/src/pyproject.toml
@@ -0,0 +1,16 @@
+[project]
+name = "nixos-render-docs-redirects"
+version = "0.0"
+description = "redirects manipulation for nixos manuals"
+classifiers = [
+    "Programming Language :: Python :: 3",
+    "License :: OSI Approved :: MIT License",
+    "Operating System :: OS Independent",
+]
+
+[project.scripts]
+redirects = "nixos_render_docs_redirects:main"
+
+[build-system]
+requires = ["setuptools"]
+build-backend = "setuptools.build_meta"
diff --git a/pkgs/by-name/ni/nixos-render-docs-redirects/src/tests/__init__.py b/pkgs/by-name/ni/nixos-render-docs-redirects/src/tests/__init__.py
new file mode 100644
index 000000000000..8b137891791f
--- /dev/null
+++ b/pkgs/by-name/ni/nixos-render-docs-redirects/src/tests/__init__.py
@@ -0,0 +1 @@
+
diff --git a/pkgs/by-name/ni/nixos-render-docs-redirects/src/tests/test_redirects.py b/pkgs/by-name/ni/nixos-render-docs-redirects/src/tests/test_redirects.py
new file mode 100644
index 000000000000..ae648d5e26c9
--- /dev/null
+++ b/pkgs/by-name/ni/nixos-render-docs-redirects/src/tests/test_redirects.py
@@ -0,0 +1,86 @@
+import unittest
+from nixos_render_docs_redirects import (
+    add_content,
+    move_content,
+    rename_identifier,
+    remove_and_redirect,
+    IdentifierExists,
+    IdentifierNotFound,
+)
+
+
+class RedirectsTestCase(unittest.TestCase):
+    def test_add_content(self):
+        initial_redirects = {
+            "bar": ["path/to/bar.html#bar"],
+            "foo": ["path/to/foo.html#foo"],
+        }
+        final_redirects = {
+            "bar": ["path/to/bar.html#bar"],
+            "baz": ["path/to/baz.html#baz"],
+            "foo": ["path/to/foo.html#foo"],
+        }
+
+        result = add_content(initial_redirects, "baz", "path/to/baz.html")
+        self.assertEqual(list(result.items()), list(final_redirects.items()))
+
+        with self.assertRaises(IdentifierExists):
+            add_content(result, "foo", "another/path.html")
+
+
+    def test_move_content(self):
+        initial_redirects = {
+            "foo": ["path/to/foo.html#foo"],
+            "bar": ["path/to/bar.html#bar"],
+        }
+        final_redirects = {
+            "foo": ["new/path.html#foo", "path/to/foo.html#foo"],
+            "bar": ["path/to/bar.html#bar"],
+        }
+
+        result = move_content(initial_redirects, "foo", "new/path.html")
+        self.assertEqual(list(result.items()), list(final_redirects.items()))
+
+        with self.assertRaises(IdentifierNotFound):
+            move_content(result, "baz", "path.html")
+
+
+    def test_rename_identifier(self):
+        initial_redirects = {
+            "foo": ["path/to/foo.html#foo"],
+            "bar": ["path/to/bar.html#bar"],
+            "baz": ["path/to/baz.html#baz"],
+        }
+        final_redirects = {
+            "foo": ["path/to/foo.html#foo"],
+            "boo": ["path/to/bar.html#boo", "path/to/bar.html#bar"],
+            "baz": ["path/to/baz.html#baz"],
+        }
+
+        result = rename_identifier(initial_redirects, "bar", "boo")
+        self.assertEqual(list(result.items()), list(final_redirects.items()))
+
+        with self.assertRaises(IdentifierNotFound):
+            rename_identifier(result, "bar", "boo")
+        with self.assertRaises(IdentifierExists):
+            rename_identifier(result, "boo", "boo")
+
+
+    def test_remove_and_redirect(self):
+        initial_redirects = {
+            "foo": ["new/path.html#foo", "path/to/foo.html#foo"],
+            "bar": ["path/to/bar.html#bar"],
+            "baz": ["path/to/baz.html#baz"],
+        }
+        final_redirects = {
+            "bar": ["path/to/bar.html#bar", "new/path.html#foo", "path/to/foo.html#foo"],
+            "baz": ["path/to/baz.html#baz"],
+        }
+
+        result = remove_and_redirect(initial_redirects, "foo", "bar")
+        self.assertEqual(list(result.items()), list(final_redirects.items()))
+
+        with self.assertRaises(IdentifierNotFound):
+            remove_and_redirect(result, "foo", "bar")
+        with self.assertRaises(IdentifierNotFound):
+            remove_and_redirect(initial_redirects, "foo", "baz")
diff --git a/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/redirects.py b/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/redirects.py
index 57a6d6bbb3aa..1a891a1af238 100644
--- a/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/redirects.py
+++ b/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/redirects.py
@@ -47,23 +47,49 @@ The first element of an identifier's redirects list must denote its current loca
 
     If you moved content, add its new location as the first element of the redirects mapping.
     Please update doc/redirects.json or nixos/doc/manual/redirects.json!
-""") # TODO: automatically detect if you just missed adding a new location, and make a tool to do that for you
+""")
         if self.identifiers_without_redirects:
             error_messages.append(f"""
 Identifiers present in the source must have a mapping in the redirects file.
     - {"\n    - ".join(self.identifiers_without_redirects)}
 
     This can happen when an identifier was added or renamed.
-    Please update doc/redirects.json or nixos/doc/manual/redirects.json!
-""") # TODO: add tooling in the development shell to do that automatically and point to that command
+
+    Added new content?
+        redirects add-content ❬identifier❭ ❬path❭
+
+    Moved existing content to a different output path?
+        redirects move-content ❬identifier❭ ❬path❭
+
+    Renamed existing identifiers?
+        redirects rename-identifier ❬old-identifier❭ ❬new-identifier❭
+
+    Removed content? Redirect to alternatives or relevant release notes.
+        redirects remove-and-redirect ❬identifier❭ ❬target-identifier❭
+
+    Note that you need to run `nix-shell doc` or `nix-shell nixos/doc/manual` to be able to run this command.
+""")
         if self.orphan_identifiers:
             error_messages.append(f"""
 Keys of the redirects mapping must correspond to some identifier in the source.
     - {"\n    - ".join(self.orphan_identifiers)}
 
     This can happen when an identifier was removed or renamed.
-    Please update doc/redirects.json or nixos/doc/manual/redirects.json!
-""") # TODO: add tooling in the development shell to do that automatically and point to that command
+
+    Added new content?
+        redirects add-content ❬identifier❭ ❬path❭
+
+    Moved existing content to a different output path?
+        redirects move-content ❬identifier❭ ❬path❭
+
+    Renamed existing identifiers?
+        redirects rename-identifier ❬old-identifier❭ ❬new-identifier❭
+
+    Removed content? (good for redirecting deprecations to new content or release notes)
+        redirects remove-and-redirect ❬identifier❭ ❬target-identifier❭
+
+    Note that you need to run `nix-shell doc` or `nix-shell nixos/doc/manual` to be able to run this command.
+""")
 
         error_messages.append("NOTE: If your Manual build passes locally and you see this message in CI, you probably need a rebase.")
         return "\n".join(error_messages)
diff --git a/pkgs/by-name/no/node-red/package-lock.json b/pkgs/by-name/no/node-red/package-lock.json
index 9dc012ff7f4e..31124ba8a95d 100644
--- a/pkgs/by-name/no/node-red/package-lock.json
+++ b/pkgs/by-name/no/node-red/package-lock.json
@@ -1,12 +1,12 @@
 {
     "name": "node-red",
-    "version": "4.0.4",
+    "version": "4.0.5",
     "lockfileVersion": 3,
     "requires": true,
     "packages": {
         "": {
             "name": "node-red",
-            "version": "4.0.4",
+            "version": "4.0.5",
             "license": "Apache-2.0",
             "dependencies": {
                 "acorn": "8.12.1",
@@ -134,13 +134,14 @@
             }
         },
         "node_modules/@babel/code-frame": {
-            "version": "7.25.7",
-            "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.25.7.tgz",
-            "integrity": "sha512-0xZJFNE5XMpENsgfHYTw8FbX4kv53mFLn2i3XPoq69LyhYSCBJtitaHx9QnsVTrsogI4Z3+HtEfZ2/GFPOtf5g==",
+            "version": "7.26.2",
+            "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.26.2.tgz",
+            "integrity": "sha512-RJlIHRueQgwWitWgF8OdFYGZX328Ax5BCemNGlqHfplnRT9ESi8JkFlvaVYbS+UubVY6dpv87Fs2u5M29iNFVQ==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
-                "@babel/highlight": "^7.25.7",
+                "@babel/helper-validator-identifier": "^7.25.9",
+                "js-tokens": "^4.0.0",
                 "picocolors": "^1.0.0"
             },
             "engines": {
@@ -148,13 +149,14 @@
             }
         },
         "node_modules/@babel/generator": {
-            "version": "7.25.7",
-            "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.25.7.tgz",
-            "integrity": "sha512-5Dqpl5fyV9pIAD62yK9P7fcA768uVPUyrQmqpqstHWgMma4feF1x/oFysBCVZLY5wJ2GkMUCdsNDnGZrPoR6rA==",
+            "version": "7.26.2",
+            "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.26.2.tgz",
+            "integrity": "sha512-zevQbhbau95nkoxSq3f/DC/SC+EEOUZd3DYqfSkMhY2/wfSeaHV1Ew4vk8e+x8lja31IbyuUa2uQ3JONqKbysw==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
-                "@babel/types": "^7.25.7",
+                "@babel/parser": "^7.26.2",
+                "@babel/types": "^7.26.0",
                 "@jridgewell/gen-mapping": "^0.3.5",
                 "@jridgewell/trace-mapping": "^0.3.25",
                 "jsesc": "^3.0.2"
@@ -164,9 +166,9 @@
             }
         },
         "node_modules/@babel/helper-string-parser": {
-            "version": "7.25.7",
-            "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.25.7.tgz",
-            "integrity": "sha512-CbkjYdsJNHFk8uqpEkpCvRs3YRp9tY6FmFY7wLMSYuGYkrdUi7r2lc4/wqsvlHoMznX3WJ9IP8giGPq68T/Y6g==",
+            "version": "7.25.9",
+            "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.25.9.tgz",
+            "integrity": "sha512-4A/SCr/2KLd5jrtOMFzaKjVtAei3+2r/NChoBNoZ3EyP/+GlhoaEGoWOZUmFmoITP7zOJyHIMm+DYRd8o3PvHA==",
             "dev": true,
             "license": "MIT",
             "engines": {
@@ -174,117 +176,23 @@
             }
         },
         "node_modules/@babel/helper-validator-identifier": {
-            "version": "7.25.7",
-            "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.25.7.tgz",
-            "integrity": "sha512-AM6TzwYqGChO45oiuPqwL2t20/HdMC1rTPAesnBCgPCSF1x3oN9MVUwQV2iyz4xqWrctwK5RNC8LV22kaQCNYg==",
+            "version": "7.25.9",
+            "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.25.9.tgz",
+            "integrity": "sha512-Ed61U6XJc3CVRfkERJWDz4dJwKe7iLmmJsbOGu9wSloNSFttHV0I8g6UAgb7qnK5ly5bGLPd4oXZlxCdANBOWQ==",
             "dev": true,
             "license": "MIT",
             "engines": {
                 "node": ">=6.9.0"
             }
         },
-        "node_modules/@babel/highlight": {
-            "version": "7.25.7",
-            "resolved": "https://registry.npmjs.org/@babel/highlight/-/highlight-7.25.7.tgz",
-            "integrity": "sha512-iYyACpW3iW8Fw+ZybQK+drQre+ns/tKpXbNESfrhNnPLIklLbXr7MYJ6gPEd0iETGLOK+SxMjVvKb/ffmk+FEw==",
-            "dev": true,
-            "license": "MIT",
-            "dependencies": {
-                "@babel/helper-validator-identifier": "^7.25.7",
-                "chalk": "^2.4.2",
-                "js-tokens": "^4.0.0",
-                "picocolors": "^1.0.0"
-            },
-            "engines": {
-                "node": ">=6.9.0"
-            }
-        },
-        "node_modules/@babel/highlight/node_modules/ansi-styles": {
-            "version": "3.2.1",
-            "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-3.2.1.tgz",
-            "integrity": "sha512-VT0ZI6kZRdTh8YyJw3SMbYm/u+NqfsAxEpWO0Pf9sq8/e94WxxOpPKx9FR1FlyCtOVDNOQ+8ntlqFxiRc+r5qA==",
-            "dev": true,
-            "license": "MIT",
-            "dependencies": {
-                "color-convert": "^1.9.0"
-            },
-            "engines": {
-                "node": ">=4"
-            }
-        },
-        "node_modules/@babel/highlight/node_modules/chalk": {
-            "version": "2.4.2",
-            "resolved": "https://registry.npmjs.org/chalk/-/chalk-2.4.2.tgz",
-            "integrity": "sha512-Mti+f9lpJNcwF4tWV8/OrTTtF1gZi+f8FqlyAdouralcFWFQWF2+NgCHShjkCb+IFBLq9buZwE1xckQU4peSuQ==",
-            "dev": true,
-            "license": "MIT",
-            "dependencies": {
-                "ansi-styles": "^3.2.1",
-                "escape-string-regexp": "^1.0.5",
-                "supports-color": "^5.3.0"
-            },
-            "engines": {
-                "node": ">=4"
-            }
-        },
-        "node_modules/@babel/highlight/node_modules/color-convert": {
-            "version": "1.9.3",
-            "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-1.9.3.tgz",
-            "integrity": "sha512-QfAUtd+vFdAtFQcC8CCyYt1fYWxSqAiK2cSD6zDB8N3cpsEBAvRxp9zOGg6G/SHHJYAT88/az/IuDGALsNVbGg==",
-            "dev": true,
-            "license": "MIT",
-            "dependencies": {
-                "color-name": "1.1.3"
-            }
-        },
-        "node_modules/@babel/highlight/node_modules/color-name": {
-            "version": "1.1.3",
-            "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.3.tgz",
-            "integrity": "sha512-72fSenhMw2HZMTVHeCA9KCmpEIbzWiQsjN+BHcBbS9vr1mtt+vJjPdksIBNUmKAW8TFUDPJK5SUU3QhE9NEXDw==",
-            "dev": true,
-            "license": "MIT"
-        },
-        "node_modules/@babel/highlight/node_modules/escape-string-regexp": {
-            "version": "1.0.5",
-            "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-1.0.5.tgz",
-            "integrity": "sha512-vbRorB5FUQWvla16U8R/qgaFIya2qGzwDrNmCZuYKrbdSUMG6I1ZCGQRefkRVhuOkIGVne7BQ35DSfo1qvJqFg==",
-            "dev": true,
-            "license": "MIT",
-            "engines": {
-                "node": ">=0.8.0"
-            }
-        },
-        "node_modules/@babel/highlight/node_modules/has-flag": {
-            "version": "3.0.0",
-            "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-3.0.0.tgz",
-            "integrity": "sha512-sKJf1+ceQBr4SMkvQnBDNDtf4TXpVhVGateu0t918bl30FnbE2m4vNLX+VWe/dpjlb+HugGYzW7uQXH98HPEYw==",
-            "dev": true,
-            "license": "MIT",
-            "engines": {
-                "node": ">=4"
-            }
-        },
-        "node_modules/@babel/highlight/node_modules/supports-color": {
-            "version": "5.5.0",
-            "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-5.5.0.tgz",
-            "integrity": "sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==",
-            "dev": true,
-            "license": "MIT",
-            "dependencies": {
-                "has-flag": "^3.0.0"
-            },
-            "engines": {
-                "node": ">=4"
-            }
-        },
         "node_modules/@babel/parser": {
-            "version": "7.25.7",
-            "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.25.7.tgz",
-            "integrity": "sha512-aZn7ETtQsjjGG5HruveUK06cU3Hljuhd9Iojm4M8WWv3wLE6OkE5PWbDUkItmMgegmccaITudyuW5RPYrYlgWw==",
+            "version": "7.26.2",
+            "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.26.2.tgz",
+            "integrity": "sha512-DWMCZH9WA4Maitz2q21SRKHo9QXZxkDsbNZoVD62gusNtNBBqDg9i7uOhASfTfIGNzW+O+r7+jAlM8dwphcJKQ==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
-                "@babel/types": "^7.25.7"
+                "@babel/types": "^7.26.0"
             },
             "bin": {
                 "parser": "bin/babel-parser.js"
@@ -294,9 +202,9 @@
             }
         },
         "node_modules/@babel/runtime": {
-            "version": "7.25.7",
-            "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.25.7.tgz",
-            "integrity": "sha512-FjoyLe754PMiYsFaN5C94ttGiOmBNYTf6pLr4xXHAT5uctHb092PBszndLDR5XA/jghQvn4n7JMHl7dmTgbm9w==",
+            "version": "7.26.0",
+            "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.26.0.tgz",
+            "integrity": "sha512-FDSOghenHTiToteC/QRlv2q3DhPZ/oOXTBoirfWNx1Cx3TMVcGWQtMMmQcSvb/JjpNeGzx8Pq/b4fKEJuWm1sw==",
             "license": "MIT",
             "dependencies": {
                 "regenerator-runtime": "^0.14.0"
@@ -306,32 +214,32 @@
             }
         },
         "node_modules/@babel/template": {
-            "version": "7.25.7",
-            "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.25.7.tgz",
-            "integrity": "sha512-wRwtAgI3bAS+JGU2upWNL9lSlDcRCqD05BZ1n3X2ONLH1WilFP6O1otQjeMK/1g0pvYcXC7b/qVUB1keofjtZA==",
+            "version": "7.25.9",
+            "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.25.9.tgz",
+            "integrity": "sha512-9DGttpmPvIxBb/2uwpVo3dqJ+O6RooAFOS+lB+xDqoE2PVCE8nfoHMdZLpfCQRLwvohzXISPZcgxt80xLfsuwg==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
-                "@babel/code-frame": "^7.25.7",
-                "@babel/parser": "^7.25.7",
-                "@babel/types": "^7.25.7"
+                "@babel/code-frame": "^7.25.9",
+                "@babel/parser": "^7.25.9",
+                "@babel/types": "^7.25.9"
             },
             "engines": {
                 "node": ">=6.9.0"
             }
         },
         "node_modules/@babel/traverse": {
-            "version": "7.25.7",
-            "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.25.7.tgz",
-            "integrity": "sha512-jatJPT1Zjqvh/1FyJs6qAHL+Dzb7sTb+xr7Q+gM1b+1oBsMsQQ4FkVKb6dFlJvLlVssqkRzV05Jzervt9yhnzg==",
+            "version": "7.25.9",
+            "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.25.9.tgz",
+            "integrity": "sha512-ZCuvfwOwlz/bawvAuvcj8rrithP2/N55Tzz342AkTvq4qaWbGfmCk/tKhNaV2cthijKrPAA8SRJV5WWe7IBMJw==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
-                "@babel/code-frame": "^7.25.7",
-                "@babel/generator": "^7.25.7",
-                "@babel/parser": "^7.25.7",
-                "@babel/template": "^7.25.7",
-                "@babel/types": "^7.25.7",
+                "@babel/code-frame": "^7.25.9",
+                "@babel/generator": "^7.25.9",
+                "@babel/parser": "^7.25.9",
+                "@babel/template": "^7.25.9",
+                "@babel/types": "^7.25.9",
                 "debug": "^4.3.1",
                 "globals": "^11.1.0"
             },
@@ -365,15 +273,14 @@
             "license": "MIT"
         },
         "node_modules/@babel/types": {
-            "version": "7.25.7",
-            "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.25.7.tgz",
-            "integrity": "sha512-vwIVdXG+j+FOpkwqHRcBgHLYNL7XMkufrlaFvL9o6Ai9sJn9+PdyIL5qa0XzTZw084c+u9LOls53eoZWP/W5WQ==",
+            "version": "7.26.0",
+            "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.26.0.tgz",
+            "integrity": "sha512-Z/yiTPj+lDVnF7lWeKCIJzaIkI0vYO87dMpZ4bg4TDrFe4XXLFWL1TbXU27gBP3QccxV9mZICCrnjnYlJjXHOA==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
-                "@babel/helper-string-parser": "^7.25.7",
-                "@babel/helper-validator-identifier": "^7.25.7",
-                "to-fast-properties": "^2.0.0"
+                "@babel/helper-string-parser": "^7.25.9",
+                "@babel/helper-validator-identifier": "^7.25.9"
             },
             "engines": {
                 "node": ">=6.9.0"
@@ -431,9 +338,9 @@
             "license": "Apache-2.0"
         },
         "node_modules/@emnapi/core": {
-            "version": "1.3.0",
-            "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.3.0.tgz",
-            "integrity": "sha512-9hRqVlhwqBqCoToZ3hFcNVqL+uyHV06Y47ax4UB8L6XgVRqYz7MFnfessojo6+5TK89pKwJnpophwjTMOeKI9Q==",
+            "version": "1.3.1",
+            "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.3.1.tgz",
+            "integrity": "sha512-pVGjBIt1Y6gg3EJN8jTcfpP/+uuRksIo055oE/OBkDNcjZqVbfkWCksG1Jp4yZnj3iKWyWX8fdG/j6UDYPbFog==",
             "license": "MIT",
             "optional": true,
             "dependencies": {
@@ -442,9 +349,9 @@
             }
         },
         "node_modules/@emnapi/runtime": {
-            "version": "1.3.0",
-            "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.3.0.tgz",
-            "integrity": "sha512-XMBySMuNZs3DM96xcJmLW4EfGnf+uGmFNjzpehMjuX5PLB5j87ar2Zc4e3PVeZ3I5g3tYtAqskB28manlF69Zw==",
+            "version": "1.3.1",
+            "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.3.1.tgz",
+            "integrity": "sha512-kEBmG8KyqtxJZv+ygbEim+KCGtIq1fC22Ms3S4ziXmYKm8uyoLX0MHONVKwp+9opg390VaKRNt4a7A9NwmpNhw==",
             "license": "MIT",
             "optional": true,
             "dependencies": {
@@ -1132,18 +1039,18 @@
             "license": "MIT"
         },
         "node_modules/@types/node": {
-            "version": "22.7.5",
-            "resolved": "https://registry.npmjs.org/@types/node/-/node-22.7.5.tgz",
-            "integrity": "sha512-jML7s2NAzMWc//QSJ1a3prpk78cOPchGvXJsC3C6R6PSMoooztvRVQEz89gmBTBY1SPMaqo5teB4uNHPdetShQ==",
+            "version": "22.10.1",
+            "resolved": "https://registry.npmjs.org/@types/node/-/node-22.10.1.tgz",
+            "integrity": "sha512-qKgsUwfHZV2WCWLAnVP1JqnpE6Im6h3Y0+fYgMTasNQ7V++CBX5OT1as0g0f+OyubbFqhf6XVNIsmN4IIhEgGQ==",
             "license": "MIT",
             "dependencies": {
-                "undici-types": "~6.19.2"
+                "undici-types": "~6.20.0"
             }
         },
         "node_modules/@types/readable-stream": {
-            "version": "4.0.15",
-            "resolved": "https://registry.npmjs.org/@types/readable-stream/-/readable-stream-4.0.15.tgz",
-            "integrity": "sha512-oAZ3kw+kJFkEqyh7xORZOku1YAKvsFTogRY8kVl4vHpEKiDkfnSA/My8haRE7fvmix5Zyy+1pwzOi7yycGLBJw==",
+            "version": "4.0.18",
+            "resolved": "https://registry.npmjs.org/@types/readable-stream/-/readable-stream-4.0.18.tgz",
+            "integrity": "sha512-21jK/1j+Wg+7jVw1xnSwy/2Q1VgVjWuFssbYGTREPUBeZ+rqVFl2udq0IkxzPC0ZhOzVceUbyIACFZKLqKEBlA==",
             "license": "MIT",
             "dependencies": {
                 "@types/node": "*",
@@ -1151,9 +1058,9 @@
             }
         },
         "node_modules/@types/ws": {
-            "version": "8.5.12",
-            "resolved": "https://registry.npmjs.org/@types/ws/-/ws-8.5.12.tgz",
-            "integrity": "sha512-3tPRkv1EtkDpzlgyKyI8pGsGZAGPEaXeu0DOj5DI25Ja91bdAYddYHbADRYVrZMRbfW+1l5YwXVDKohDJNQxkQ==",
+            "version": "8.5.13",
+            "resolved": "https://registry.npmjs.org/@types/ws/-/ws-8.5.13.tgz",
+            "integrity": "sha512-osM/gWBTPKgHV8XkTunnegTRIsvF6owmf5w+JtAfOw472dptdm0dlGv4xCt6GwQRcC2XVOvvRE/0bAoQcL2QkA==",
             "license": "MIT",
             "dependencies": {
                 "@types/node": "*"
@@ -1636,9 +1543,9 @@
             "license": "MIT"
         },
         "node_modules/axios": {
-            "version": "1.7.7",
-            "resolved": "https://registry.npmjs.org/axios/-/axios-1.7.7.tgz",
-            "integrity": "sha512-S4kL7XrjgBmvdGut0sN3yJxqYzrDOnivkBiN0OFs6hLiUam3UPvswUo0kqGyhqUZGEOytHyumEdXsAkgCOUf3Q==",
+            "version": "1.7.8",
+            "resolved": "https://registry.npmjs.org/axios/-/axios-1.7.8.tgz",
+            "integrity": "sha512-Uu0wb7KNqK2t5K+YQyVCLM76prD5sRFjKHbJYCP1J7JFGEQ6nN7HWn9+04LAeiJ3ji54lgS/gZCH1oxyrf1SPw==",
             "license": "MIT",
             "dependencies": {
                 "follow-redirects": "^1.15.6",
@@ -2700,9 +2607,9 @@
             }
         },
         "node_modules/cross-spawn": {
-            "version": "7.0.3",
-            "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.3.tgz",
-            "integrity": "sha512-iRDPJKUPVEND7dHPO8rkbOnPpyDygcDFtWjpeWNCgy8WP2rXcxXL8TskReQl6OrB2G7+UJrags1q15Fudc7G6w==",
+            "version": "7.0.6",
+            "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
+            "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
             "license": "MIT",
             "dependencies": {
                 "path-key": "^3.1.0",
@@ -2742,9 +2649,9 @@
             }
         },
         "node_modules/cytoscape": {
-            "version": "3.30.2",
-            "resolved": "https://registry.npmjs.org/cytoscape/-/cytoscape-3.30.2.tgz",
-            "integrity": "sha512-oICxQsjW8uSaRmn4UK/jkczKOqTrVqt5/1WL0POiJUT2EKNc9STM4hYFHv917yu55aTBMFNRzymlJhVAiWPCxw==",
+            "version": "3.30.4",
+            "resolved": "https://registry.npmjs.org/cytoscape/-/cytoscape-3.30.4.tgz",
+            "integrity": "sha512-OxtlZwQl1WbwMmLiyPSEBuzeTIQnwZhJYYWFzZ2PhEHVFwpeaqNIkUzSiso00D98qk60l8Gwon2RP304d3BJ1A==",
             "dev": true,
             "license": "MIT",
             "engines": {
@@ -3992,10 +3899,10 @@
             }
         },
         "node_modules/fast-uri": {
-            "version": "3.0.2",
-            "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.0.2.tgz",
-            "integrity": "sha512-GR6f0hD7XXyNJa25Tb9BuIdN0tdr+0BMi6/CJPH3wJO1JjNG3n/VsSw38AwRdKZABm8lGbPfakLRkYzx2V9row==",
-            "license": "MIT"
+            "version": "3.0.3",
+            "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.0.3.tgz",
+            "integrity": "sha512-aLrHthzCjH5He4Z2H9YZ+v6Ujb9ocRuW6ZzkJQOrTxleEijANq4v1TsaPaVG1PZcuurEzrLcWRyYBYXD5cEiaw==",
+            "license": "BSD-3-Clause"
         },
         "node_modules/fastq": {
             "version": "1.17.1",
@@ -6146,9 +6053,9 @@
             }
         },
         "node_modules/jsdoc-api/node_modules/jsdoc": {
-            "version": "4.0.3",
-            "resolved": "https://registry.npmjs.org/jsdoc/-/jsdoc-4.0.3.tgz",
-            "integrity": "sha512-Nu7Sf35kXJ1MWDZIMAuATRQTg1iIPdzh7tqJ6jjvaU/GfDf+qi5UV8zJR3Mo+/pYFvm8mzay4+6O5EWigaQBQw==",
+            "version": "4.0.4",
+            "resolved": "https://registry.npmjs.org/jsdoc/-/jsdoc-4.0.4.tgz",
+            "integrity": "sha512-zeFezwyXeG4syyYHbvh1A967IAqq/67yXtXvuL5wnqCkFZe8I0vKfm+EO+YEvLguo6w9CDUbrAXVtJSHh2E8rw==",
             "dev": true,
             "license": "Apache-2.0",
             "dependencies": {
@@ -6741,14 +6648,14 @@
             }
         },
         "node_modules/local-pkg": {
-            "version": "0.5.0",
-            "resolved": "https://registry.npmjs.org/local-pkg/-/local-pkg-0.5.0.tgz",
-            "integrity": "sha512-ok6z3qlYyCDS4ZEU27HaU6x/xZa9Whf8jD4ptH5UZTQYZVYeb9bnZ3ojVhiJNLiXK1Hfc0GNbLXcmZ5plLDDBg==",
+            "version": "0.5.1",
+            "resolved": "https://registry.npmjs.org/local-pkg/-/local-pkg-0.5.1.tgz",
+            "integrity": "sha512-9rrA30MRRP3gBD3HTGnC6cDFpaE1kVDWxWgqWJUN0RvDNAo+Nz/9GxB+nHOH0ifbVFy0hSA1V6vFDvnx54lTEQ==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
-                "mlly": "^1.4.2",
-                "pkg-types": "^1.0.3"
+                "mlly": "^1.7.3",
+                "pkg-types": "^1.2.1"
             },
             "engines": {
                 "node": ">=14"
@@ -7384,18 +7291,31 @@
             "license": "MIT"
         },
         "node_modules/mlly": {
-            "version": "1.7.2",
-            "resolved": "https://registry.npmjs.org/mlly/-/mlly-1.7.2.tgz",
-            "integrity": "sha512-tN3dvVHYVz4DhSXinXIk7u9syPYaJvio118uomkovAtWBT+RdbP6Lfh/5Lvo519YMmwBafwlh20IPTXIStscpA==",
+            "version": "1.7.3",
+            "resolved": "https://registry.npmjs.org/mlly/-/mlly-1.7.3.tgz",
+            "integrity": "sha512-xUsx5n/mN0uQf4V548PKQ+YShA4/IW0KI1dZhrNrPCLG+xizETbHTkOa1f8/xut9JRPp8kQuMnz0oqwkTiLo/A==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
-                "acorn": "^8.12.1",
+                "acorn": "^8.14.0",
                 "pathe": "^1.1.2",
-                "pkg-types": "^1.2.0",
+                "pkg-types": "^1.2.1",
                 "ufo": "^1.5.4"
             }
         },
+        "node_modules/mlly/node_modules/acorn": {
+            "version": "8.14.0",
+            "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.14.0.tgz",
+            "integrity": "sha512-cl669nCJTZBsL97OF4kUQm5g5hC2uihk0NxY3WENAC0TYdILVkAyHymAntgxGkl7K+t0cXIrH5siy5S4XkFycA==",
+            "dev": true,
+            "license": "MIT",
+            "bin": {
+                "acorn": "bin/acorn"
+            },
+            "engines": {
+                "node": ">=0.4.0"
+            }
+        },
         "node_modules/mocha": {
             "version": "9.2.2",
             "resolved": "https://registry.npmjs.org/mocha/-/mocha-9.2.2.tgz",
@@ -7614,9 +7534,9 @@
             }
         },
         "node_modules/mqtt-packet": {
-            "version": "9.0.0",
-            "resolved": "https://registry.npmjs.org/mqtt-packet/-/mqtt-packet-9.0.0.tgz",
-            "integrity": "sha512-8v+HkX+fwbodsWAZIZTI074XIoxVBOmPeggQuDFCGg1SqNcC+uoRMWu7J6QlJPqIUIJXmjNYYHxBBLr1Y/Df4w==",
+            "version": "9.0.1",
+            "resolved": "https://registry.npmjs.org/mqtt-packet/-/mqtt-packet-9.0.1.tgz",
+            "integrity": "sha512-koZF1V/X2RZUI6uD9wN5OK1JxxcG1ofAR4H3LjCw1FkeKzruZQ26aAA6v2m1lZyWONZIR5wMMJFrZJDRNzbiQw==",
             "license": "MIT",
             "dependencies": {
                 "bl": "^6.0.8",
@@ -7987,20 +7907,30 @@
             }
         },
         "node_modules/node-red-node-test-helper/node_modules/formidable": {
-            "version": "3.5.1",
-            "resolved": "https://registry.npmjs.org/formidable/-/formidable-3.5.1.tgz",
-            "integrity": "sha512-WJWKelbRHN41m5dumb0/k8TeAx7Id/y3a+Z7QfhxP/htI9Js5zYaEDtG8uMgG0vM0lOlqnmjE99/kfpOYi/0Og==",
+            "version": "3.5.2",
+            "resolved": "https://registry.npmjs.org/formidable/-/formidable-3.5.2.tgz",
+            "integrity": "sha512-Jqc1btCy3QzRbJaICGwKcBfGWuLADRerLzDqi2NwSt/UkXLsHJw2TVResiaoBufHVHy9aSgClOHCeJsSsFLTbg==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
                 "dezalgo": "^1.0.4",
-                "hexoid": "^1.0.0",
+                "hexoid": "^2.0.0",
                 "once": "^1.4.0"
             },
             "funding": {
                 "url": "https://ko-fi.com/tunnckoCore/commissions"
             }
         },
+        "node_modules/node-red-node-test-helper/node_modules/hexoid": {
+            "version": "2.0.0",
+            "resolved": "https://registry.npmjs.org/hexoid/-/hexoid-2.0.0.tgz",
+            "integrity": "sha512-qlspKUK7IlSQv2o+5I7yhUd7TxlOG2Vr5LTa3ve2XSNVKAL/n/u/7KLvKmFNimomDIKvZFXWHv0T12mv7rT8Aw==",
+            "dev": true,
+            "license": "MIT",
+            "engines": {
+                "node": ">=8"
+            }
+        },
         "node_modules/node-red-node-test-helper/node_modules/mime": {
             "version": "2.6.0",
             "resolved": "https://registry.npmjs.org/mime/-/mime-2.6.0.tgz",
@@ -8602,9 +8532,9 @@
             "license": "MIT"
         },
         "node_modules/object-inspect": {
-            "version": "1.13.2",
-            "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.2.tgz",
-            "integrity": "sha512-IRZSRuzJiynemAXPYtPe5BoI/RESNYR7TYm50MC5Mqbd3Jmw5y790sErYw3V6SryFJD64b74qQQs9wn5Bg/k3g==",
+            "version": "1.13.3",
+            "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.3.tgz",
+            "integrity": "sha512-kDCGIbxkDSXE3euJZZXzc6to7fCrKHNI/hSRQnRuQ+BWjFNzZwiFF8fj/6o2t2G9/jTj8PSIYTfCLelLZEeRpA==",
             "license": "MIT",
             "engines": {
                 "node": ">= 0.4"
@@ -8816,9 +8746,9 @@
             "license": "BlueOak-1.0.0"
         },
         "node_modules/package-manager-detector": {
-            "version": "0.2.2",
-            "resolved": "https://registry.npmjs.org/package-manager-detector/-/package-manager-detector-0.2.2.tgz",
-            "integrity": "sha512-VgXbyrSNsml4eHWIvxxG/nTL4wgybMTXCV2Un/+yEc3aDKKU6nQBZjbeP3Pl3qm9Qg92X/1ng4ffvCeD/zwHgg==",
+            "version": "0.2.5",
+            "resolved": "https://registry.npmjs.org/package-manager-detector/-/package-manager-detector-0.2.5.tgz",
+            "integrity": "sha512-3dS7y28uua+UDbRCLBqltMBrbI+A5U2mI9YuxHRxIWYmLj3DwntEBmERYzIAQ4DMeuCUOBSak7dBHHoXKpOTYQ==",
             "dev": true,
             "license": "MIT"
         },
@@ -9106,9 +9036,9 @@
             "integrity": "sha512-KG8UEiEVkR3wGEb4m5yZkVCzigAD+cVEJck2CzYZO37ZGJfctvVptVO192MwrtPhzONn6go8ylnOdMhKqi4nfg=="
         },
         "node_modules/picocolors": {
-            "version": "1.1.0",
-            "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.0.tgz",
-            "integrity": "sha512-TQ92mBOW0l3LeMeyLV6mzy/kWr8lkd/hp3mTg7wYK7zJhuBStmGMBG0BdeDZS/dZx1IukaX6Bk11zcln25o1Aw==",
+            "version": "1.1.1",
+            "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
+            "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
             "dev": true,
             "license": "ISC"
         },
@@ -10352,9 +10282,9 @@
             }
         },
         "node_modules/sort-array/node_modules/typical": {
-            "version": "7.2.0",
-            "resolved": "https://registry.npmjs.org/typical/-/typical-7.2.0.tgz",
-            "integrity": "sha512-W1+HdVRUl8fS3MZ9ogD51GOb46xMmhAZzR0WPw5jcgIZQJVvkddYzAl4YTU6g5w33Y1iRQLdIi2/1jhi2RNL0g==",
+            "version": "7.3.0",
+            "resolved": "https://registry.npmjs.org/typical/-/typical-7.3.0.tgz",
+            "integrity": "sha512-ya4mg/30vm+DOWfBg4YK3j2WD6TWtRkCbasOJr40CseYENzCUby/7rIvXA99JGsQHeNxLbnXdyLLxKSv3tauFw==",
             "dev": true,
             "license": "MIT",
             "engines": {
@@ -11027,40 +10957,30 @@
             "license": "MIT"
         },
         "node_modules/tinyexec": {
-            "version": "0.3.0",
-            "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-0.3.0.tgz",
-            "integrity": "sha512-tVGE0mVJPGb0chKhqmsoosjsS+qUnJVGJpZgsHYQcGoPlG3B51R3PouqTgEGH2Dc9jjFyOqOpix6ZHNMXp1FZg==",
+            "version": "0.3.1",
+            "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-0.3.1.tgz",
+            "integrity": "sha512-WiCJLEECkO18gwqIp6+hJg0//p23HXp4S+gGtAKu3mI2F2/sXC4FvHvXvB0zJVVaTPhx1/tOwdbRsa1sOBIKqQ==",
             "dev": true,
             "license": "MIT"
         },
         "node_modules/tldts": {
-            "version": "6.1.50",
-            "resolved": "https://registry.npmjs.org/tldts/-/tldts-6.1.50.tgz",
-            "integrity": "sha512-q9GOap6q3KCsLMdOjXhWU5jVZ8/1dIib898JBRLsN+tBhENpBDcAVQbE0epADOjw11FhQQy9AcbqKGBQPUfTQA==",
+            "version": "6.1.64",
+            "resolved": "https://registry.npmjs.org/tldts/-/tldts-6.1.64.tgz",
+            "integrity": "sha512-ph4AE5BXWIOsSy9stpoeo7bYe/Cy7VfpciIH4RhVZUPItCJmhqWCN0EVzxd8BOHiyNb42vuJc6NWTjJkg91Tuw==",
             "license": "MIT",
             "dependencies": {
-                "tldts-core": "^6.1.50"
+                "tldts-core": "^6.1.64"
             },
             "bin": {
                 "tldts": "bin/cli.js"
             }
         },
         "node_modules/tldts-core": {
-            "version": "6.1.50",
-            "resolved": "https://registry.npmjs.org/tldts-core/-/tldts-core-6.1.50.tgz",
-            "integrity": "sha512-na2EcZqmdA2iV9zHV7OHQDxxdciEpxrjbkp+aHmZgnZKHzoElLajP59np5/4+sare9fQBfixgvXKx8ev1d7ytw==",
+            "version": "6.1.64",
+            "resolved": "https://registry.npmjs.org/tldts-core/-/tldts-core-6.1.64.tgz",
+            "integrity": "sha512-uqnl8vGV16KsyflHOzqrYjjArjfXaU6rMPXYy2/ZWoRKCkXtghgB4VwTDXUG+t0OTGeSewNAG31/x1gCTfLt+Q==",
             "license": "MIT"
         },
-        "node_modules/to-fast-properties": {
-            "version": "2.0.0",
-            "resolved": "https://registry.npmjs.org/to-fast-properties/-/to-fast-properties-2.0.0.tgz",
-            "integrity": "sha512-/OaKK0xYrs3DmxRYqL/yDc+FxFUVYhDlXMhRmv3z915w2HF1tnN1omB354j8VUGO/hbRzyD6Y3sA7v7GS/ceog==",
-            "dev": true,
-            "license": "MIT",
-            "engines": {
-                "node": ">=4"
-            }
-        },
         "node_modules/to-regex-range": {
             "version": "5.0.1",
             "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
@@ -11123,9 +11043,9 @@
             }
         },
         "node_modules/tslib": {
-            "version": "2.7.0",
-            "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.7.0.tgz",
-            "integrity": "sha512-gLXCKdN1/j47AiHiOkJN69hJmcbGTHI0ImLmbYLHykhgeN0jVGola9yVjFgzCUklsZQMW55o+dW7IXv3RCXDzA==",
+            "version": "2.8.1",
+            "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
+            "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
             "license": "0BSD"
         },
         "node_modules/type-detect": {
@@ -11256,9 +11176,9 @@
             }
         },
         "node_modules/undici-types": {
-            "version": "6.19.8",
-            "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.19.8.tgz",
-            "integrity": "sha512-ve2KP6f/JnbPBFyobGHuerC9g1FYGn/F8n1LWTwNxCEzd6IfqTwUQcNXgEtmmQ6DlRrC1hrSrBnCZPokRrDHjw==",
+            "version": "6.20.0",
+            "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.20.0.tgz",
+            "integrity": "sha512-Ny6QZ2Nju20vw1SRHe3d9jVu6gJ+4e3+MMpqu7pqE5HT6WsTSlce++GQmK5UXS8mzV8DSYHrQH+Xrf2jVcuKNg==",
             "license": "MIT"
         },
         "node_modules/universalify": {
diff --git a/pkgs/by-name/no/node-red/package.nix b/pkgs/by-name/no/node-red/package.nix
index 91df4684ba47..6d6465e13d32 100644
--- a/pkgs/by-name/no/node-red/package.nix
+++ b/pkgs/by-name/no/node-red/package.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "node-red";
-  version = "4.0.4";
+  version = "4.0.5";
 
   src = fetchFromGitHub {
     owner = "node-red";
     repo = "node-red";
     rev = "refs/tags/${version}";
-    hash = "sha256-s+3OrTj/VwjnK6Ml+4aSlLo/GcpC6BWmGmxAaj1SsMI=";
+    hash = "sha256-vasI72dVHarQcLLNypabRQUL/WdcERYWD8PTue5v/DM=";
   };
 
-  npmDepsHash = "sha256-y3agiGh5qApyjFUkxjgEG+Ztx1FL4IOMaJsS4WwZY/c=";
+  npmDepsHash = "sha256-f/lh/nA7Ycrqdf0kwOTNTVkjcifh+bzbQNgdqXTfF1Q=";
 
   postPatch =
     let
diff --git a/pkgs/by-name/nv/nv-codec-headers/package.nix b/pkgs/by-name/nv/nv-codec-headers/package.nix
index c1183935b91c..39179db9034f 100644
--- a/pkgs/by-name/nv/nv-codec-headers/package.nix
+++ b/pkgs/by-name/nv/nv-codec-headers/package.nix
@@ -32,7 +32,7 @@ stdenvNoCC.mkDerivation {
     homepage = "https://ffmpeg.org/";
     downloadPage = "https://git.videolan.org/?p=ffmpeg/nv-codec-headers.git";
     license = with lib.licenses; [ mit ];
-    maintainers = with lib.maintainers; [ AndersonTorres ];
+    maintainers = with lib.maintainers; [ ];
     platforms = lib.platforms.all;
   };
 }
diff --git a/pkgs/by-name/ob/obsidian/package.nix b/pkgs/by-name/ob/obsidian/package.nix
index 8da1346e426a..fe6a4c4833a6 100644
--- a/pkgs/by-name/ob/obsidian/package.nix
+++ b/pkgs/by-name/ob/obsidian/package.nix
@@ -53,7 +53,7 @@ let
       mkdir -p $out/bin
       makeWrapper ${electron}/bin/electron $out/bin/obsidian \
         --add-flags $out/share/obsidian/app.asar \
-        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland}}" \
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland --enable-wayland-ime}}" \
         --add-flags ${lib.escapeShellArg commandLineArgs}
       install -m 444 -D resources/app.asar $out/share/obsidian/app.asar
       install -m 444 -D resources/obsidian.asar $out/share/obsidian/obsidian.asar
diff --git a/pkgs/by-name/pa/passky-desktop/package.nix b/pkgs/by-name/pa/passky-desktop/package.nix
index b668ba94bfaf..48a51b4ac8da 100644
--- a/pkgs/by-name/pa/passky-desktop/package.nix
+++ b/pkgs/by-name/pa/passky-desktop/package.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
     mkdir "$out/share/applications"
     makeWrapper ${electron}/bin/electron "$out/bin/passky" \
       --add-flags "$out/share/passky/electron/" \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}"
 
     runHook postInstall
   '';
diff --git a/pkgs/by-name/ph/phraze/package.nix b/pkgs/by-name/ph/phraze/package.nix
index aba0a4013b40..e03be9e7f442 100644
--- a/pkgs/by-name/ph/phraze/package.nix
+++ b/pkgs/by-name/ph/phraze/package.nix
@@ -10,18 +10,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "phraze";
-  version = "0.3.15";
+  version = "0.3.17";
 
   src = fetchFromGitHub {
     owner = "sts10";
     repo = "phraze";
     rev = "v${version}";
-    hash = "sha256-gpdXgR7TK3xJHHXcZdfMZApA3SvtNmCroi/5ChfrQOs=";
+    hash = "sha256-r+d2npf9qtAiAuqDhw0sZm6aIcGdsppWXLEJctZsyEg=";
   };
 
   doCheck = true;
 
-  cargoHash = "sha256-tYQ/kcwCNAcgEUmwrrdogLd1AugBnVfqaLX9fjjpOUE=";
+  cargoHash = "sha256-OFD3wSKQ3BCQfTCy5fjVxRJufvTVO97qLhKq6jwatfQ=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/po/podman/package.nix b/pkgs/by-name/po/podman/package.nix
index c9c205b618a3..93ad4f71bb98 100644
--- a/pkgs/by-name/po/podman/package.nix
+++ b/pkgs/by-name/po/podman/package.nix
@@ -66,13 +66,13 @@ let
 in
 buildGoModule rec {
   pname = "podman";
-  version = "5.3.0";
+  version = "5.3.1";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "podman";
     rev = "v${version}";
-    hash = "sha256-v7srZ1S4qnEOgXvhj+61tSWqzx9qFv0m3iBEUoMu7+U=";
+    hash = "sha256-kABP10QX4r11UDUcd6Sukb+9+LRm/ba3iATz6DTOJYw=";
   };
 
   patches = [
diff --git a/pkgs/by-name/po/postman/linux.nix b/pkgs/by-name/po/postman/linux.nix
index 4ef52b253205..34e631e2241e 100644
--- a/pkgs/by-name/po/postman/linux.nix
+++ b/pkgs/by-name/po/postman/linux.nix
@@ -139,7 +139,7 @@ stdenv.mkDerivation rec {
 
     source "${makeWrapper}/nix-support/setup-hook"
     wrapProgram $out/bin/${pname} \
-        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland}}"
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland --enable-wayland-ime}}"
 
     mkdir -p $out/share/icons/hicolor/128x128/apps
     ln -s $out/share/postman/resources/app/assets/icon.png $out/share/icons/postman.png
diff --git a/pkgs/by-name/pr/proton-pass/package.nix b/pkgs/by-name/pr/proton-pass/package.nix
index 8869d038d435..2ef7500aca8d 100644
--- a/pkgs/by-name/pr/proton-pass/package.nix
+++ b/pkgs/by-name/pr/proton-pass/package.nix
@@ -46,7 +46,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   preFixup = ''
     makeWrapper ${lib.getExe electron} $out/bin/proton-pass \
       --add-flags $out/share/proton-pass/app.asar \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}" \
       --set-default ELECTRON_FORCE_IS_PACKAGED 1 \
       --set-default ELECTRON_IS_DEV 0 \
       --inherit-argv0
diff --git a/pkgs/by-name/pr/protonmail-desktop/package.nix b/pkgs/by-name/pr/protonmail-desktop/package.nix
index 81866b4fd3a1..645b7f7e34c5 100644
--- a/pkgs/by-name/pr/protonmail-desktop/package.nix
+++ b/pkgs/by-name/pr/protonmail-desktop/package.nix
@@ -75,7 +75,7 @@ stdenv.mkDerivation rec {
   preFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
     makeWrapper ${lib.getExe electron} $out/bin/${mainProgram} \
       --add-flags $out/share/app.asar \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}" \
       --set-default ELECTRON_FORCE_IS_PACKAGED 1 \
       --set-default ELECTRON_IS_DEV 0 \
       --inherit-argv0
diff --git a/pkgs/by-name/pt/pt2-clone/package.nix b/pkgs/by-name/pt/pt2-clone/package.nix
index 0cbb64e6dcad..c04c51554328 100644
--- a/pkgs/by-name/pt/pt2-clone/package.nix
+++ b/pkgs/by-name/pt/pt2-clone/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pt2-clone";
-  version = "1.70";
+  version = "1.71";
 
   src = fetchFromGitHub {
     owner = "8bitbubsy";
     repo = "pt2-clone";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-oGdgvyVIqM4YVxyr5DFBJ+YLtH95vqbNv0arD9yskdo=";
+    sha256 = "sha256-wyiY4qiWnisWKjBmkZSbmndJMMtogAQ+MWu4VLHROY0=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/qa/qadwaitadecorations/package.nix b/pkgs/by-name/qa/qadwaitadecorations/package.nix
index 1949373f2d1c..bbfeec06f27d 100644
--- a/pkgs/by-name/qa/qadwaitadecorations/package.nix
+++ b/pkgs/by-name/qa/qadwaitadecorations/package.nix
@@ -19,13 +19,13 @@ let
 
 in stdenv.mkDerivation (finalAttrs: {
   pname = "qadwaitadecorations";
-  version = "0.1.5";
+  version = "0.1.6";
 
   src = fetchFromGitHub {
     owner = "FedoraQt";
     repo = "QAdwaitaDecorations";
     rev = finalAttrs.version;
-    hash = "sha256-aqjm93tmBfDkmce1WG5xx8MCDCvo6AOrRHArj/+Ko9E=";
+    hash = "sha256-ZU3cwFwQECh4Z6YcTzD2WooZmJ2nSUABYft3dfakSuY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/r2/r2modman/package.nix b/pkgs/by-name/r2/r2modman/package.nix
index f2a157af151c..54c1448e4a31 100644
--- a/pkgs/by-name/r2/r2modman/package.nix
+++ b/pkgs/by-name/r2/r2modman/package.nix
@@ -86,7 +86,7 @@ stdenv.mkDerivation (finalAttrs: {
     makeWrapper '${lib.getExe electron}' "$out/bin/r2modman" \
       --inherit-argv0 \
       --add-flags "$out/share/r2modman" \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}"
 
     runHook postInstall
   '';
diff --git a/pkgs/by-name/re/redact/package.nix b/pkgs/by-name/re/redact/package.nix
index d922ce7e26c1..28987aa91d12 100644
--- a/pkgs/by-name/re/redact/package.nix
+++ b/pkgs/by-name/re/redact/package.nix
@@ -21,7 +21,7 @@ appimageTools.wrapType2 {
 
   extraInstallCommands = ''
     wrapProgram $out/bin/${pname} \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland --enable-features=WaylandWindowDecorations}}"
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland --enable-features=WaylandWindowDecorations --enable-wayland-ime}}"
     install -Dm444 ${appimageContents}/redact.desktop -t $out/share/applications
     install -Dm444 ${appimageContents}/redact.png -t $out/share/icons/hicolor/512x512/apps/redact.png
     substituteInPlace $out/share/applications/redact.desktop \
diff --git a/pkgs/by-name/re/redisinsight/package.nix b/pkgs/by-name/re/redisinsight/package.nix
index 3889022daf97..be2f639e2c80 100644
--- a/pkgs/by-name/re/redisinsight/package.nix
+++ b/pkgs/by-name/re/redisinsight/package.nix
@@ -138,7 +138,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     makeWrapper '${electron}/bin/electron' "$out/bin/redisinsight" \
       --add-flags "$out/share/redisinsight/app/resources/app.asar" \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}" \
       --set-default ELECTRON_FORCE_IS_PACKAGED 1 \
       --inherit-argv0
 
diff --git a/pkgs/by-name/re/refind/package.nix b/pkgs/by-name/re/refind/package.nix
index 2958d3be85fd..0b011096fdf1 100644
--- a/pkgs/by-name/re/refind/package.nix
+++ b/pkgs/by-name/re/refind/package.nix
@@ -146,7 +146,7 @@ stdenv.mkDerivation rec {
       Linux kernels that provide EFI stub support.
     '';
     homepage = "http://refind.sourceforge.net/";
-    maintainers = with maintainers; [ AndersonTorres chewblacka ];
+    maintainers = with maintainers; [ chewblacka ];
     platforms = [ "i686-linux" "x86_64-linux" "aarch64-linux" ];
     license = licenses.gpl3Plus;
   };
diff --git a/pkgs/by-name/re/revolt-desktop/package.nix b/pkgs/by-name/re/revolt-desktop/package.nix
index f941225770b2..d4cd6c298bd2 100644
--- a/pkgs/by-name/re/revolt-desktop/package.nix
+++ b/pkgs/by-name/re/revolt-desktop/package.nix
@@ -60,7 +60,7 @@
         postFixup = ''
           makeWrapper ${electron}/bin/electron $out/bin/revolt-desktop \
             --add-flags $out/share/revolt-desktop/resources/app.asar \
-            --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland --enable-features=WaylandWindowDecorations}}"
+            --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland --enable-features=WaylandWindowDecorations --enable-wayland-ime}}"
         '';
       }
     else
diff --git a/pkgs/by-name/re/revup/package.nix b/pkgs/by-name/re/revup/package.nix
index 4fb1e309b201..fe47f2c58437 100644
--- a/pkgs/by-name/re/revup/package.nix
+++ b/pkgs/by-name/re/revup/package.nix
@@ -70,7 +70,7 @@ let
       '';
       license = lib.licenses.mit;
       mainProgram = "revup";
-      maintainers = with lib.maintainers; [ AndersonTorres ];
+      maintainers = with lib.maintainers; [ ];
     };
   };
 in
diff --git a/pkgs/by-name/ri/ride/package.nix b/pkgs/by-name/ri/ride/package.nix
index f2f8ca1a978a..31691bc7cdb7 100644
--- a/pkgs/by-name/ri/ride/package.nix
+++ b/pkgs/by-name/ri/ride/package.nix
@@ -108,7 +108,7 @@ buildNpmPackage rec {
       cp -r locales resources{,.pak} $out/share/ride
       makeShellWrapper ${lib.getExe electron} $out/bin/ride \
           --add-flags $out/share/ride/resources/app.asar \
-          --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+          --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}" \
           --inherit-argv0
     ''}
 
diff --git a/pkgs/by-name/sc/scons/package.nix b/pkgs/by-name/sc/scons/package.nix
index f2b6790d1aad..06d97f81b185 100644
--- a/pkgs/by-name/sc/scons/package.nix
+++ b/pkgs/by-name/sc/scons/package.nix
@@ -45,6 +45,6 @@ python3Packages.buildPythonApplication rec {
     '';
     homepage = "https://scons.org/";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ AndersonTorres ];
+    maintainers = with lib.maintainers; [ ];
   };
 }
diff --git a/pkgs/by-name/sd/SDL2_mixer/package.nix b/pkgs/by-name/sd/SDL2_mixer/package.nix
index bd2894f5583d..27f9bc993371 100644
--- a/pkgs/by-name/sd/SDL2_mixer/package.nix
+++ b/pkgs/by-name/sd/SDL2_mixer/package.nix
@@ -80,7 +80,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "SDL multi-channel audio mixer library";
     license = lib.licenses.zlib;
     maintainers = lib.teams.sdl.members
-                  ++ (with lib.maintainers; [ AndersonTorres ]);
+                  ++ (with lib.maintainers; [ ]);
     platforms = lib.platforms.unix;
   };
 })
diff --git a/pkgs/by-name/se/session-desktop/package.nix b/pkgs/by-name/se/session-desktop/package.nix
index 7eafae046a5e..49a981d403ca 100644
--- a/pkgs/by-name/se/session-desktop/package.nix
+++ b/pkgs/by-name/se/session-desktop/package.nix
@@ -48,7 +48,7 @@ stdenvNoCC.mkDerivation {
     cp -r bin $out/bin
 
     wrapProgram $out/bin/session-desktop \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}"
 
     runHook postInstall
   '';
diff --git a/pkgs/by-name/sh/shadershark/package.nix b/pkgs/by-name/sh/shadershark/package.nix
index e27036575be7..8585dd8c015a 100644
--- a/pkgs/by-name/sh/shadershark/package.nix
+++ b/pkgs/by-name/sh/shadershark/package.nix
@@ -9,6 +9,8 @@
 , imagemagick
 , makeWrapper
 , installShellFiles
+, genericUpdater
+, writeShellScript
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -50,7 +52,13 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
-  passthru.updateScript = [ ./update.sh finalAttrs.src.url ];
+  passthru.updateScript = genericUpdater {
+    inherit (finalAttrs) pname version;
+    versionLister = writeShellScript "shadershark-tags" ''
+      repo_url=${finalAttrs.src.url}
+      curl "$repo_url/tags" | grep '/rev/v' | sed 's;.*/rev/v\([^"]*\)[^$]*;\1; #'
+    '';
+  };
 
   meta = with lib; {
     mainProgram = "shader-shark";
diff --git a/pkgs/by-name/sh/shadershark/update.sh b/pkgs/by-name/sh/shadershark/update.sh
deleted file mode 100755
index 0bd125caac95..000000000000
--- a/pkgs/by-name/sh/shadershark/update.sh
+++ /dev/null
@@ -1,14 +0,0 @@
-#!/usr/bin/env nix-shell
-#! nix-shell -i bash -p curl common-updater-scripts
-
-set -e
-
-repo_url="$1"; shift
-
-data="$(curl "$repo_url/tags")"
-
-rev="$(echo "$data" | grep '/rev/v' | sed 's;.*/rev/v\([^"]*\)[^$]*;\1;' | head -n 1)"
-echo "new rev: $rev"
-
-update-source-version shadershark "$rev" \
-  --print-changes
diff --git a/pkgs/by-name/si/sidequest/package.nix b/pkgs/by-name/si/sidequest/package.nix
index ef8e0a20560b..2bf49bad8e31 100644
--- a/pkgs/by-name/si/sidequest/package.nix
+++ b/pkgs/by-name/si/sidequest/package.nix
@@ -93,7 +93,8 @@
       '';
     };
   in buildFHSEnv {
-    name = "SideQuest";
+    pname = "SideQuest";
+    inherit version;
 
     passthru = {
       inherit pname version;
diff --git a/pkgs/by-name/si/signal-desktop/generic.nix b/pkgs/by-name/si/signal-desktop/generic.nix
index 27e871aeb548..22794ab1c561 100644
--- a/pkgs/by-name/si/signal-desktop/generic.nix
+++ b/pkgs/by-name/si/signal-desktop/generic.nix
@@ -234,7 +234,7 @@ stdenv.mkDerivation rec {
 
   preFixup = ''
     gappsWrapperArgs+=(
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}"
       --suffix PATH : ${lib.makeBinPath [ xdg-utils ]}
     )
 
diff --git a/pkgs/by-name/so/so/package.nix b/pkgs/by-name/so/so/package.nix
index 12c978a9b3aa..a5493b3c76b3 100644
--- a/pkgs/by-name/so/so/package.nix
+++ b/pkgs/by-name/so/so/package.nix
@@ -59,7 +59,6 @@ let
       mainProgram = "so";
       license = lib.licenses.mit;
       maintainers = with lib.maintainers; [
-        AndersonTorres
         unsolvedcypher
       ];
     };
diff --git a/pkgs/by-name/so/sov/package.nix b/pkgs/by-name/so/sov/package.nix
index e01b1c8f9446..747c39e7cadb 100644
--- a/pkgs/by-name/so/sov/package.nix
+++ b/pkgs/by-name/so/sov/package.nix
@@ -61,7 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Workspace overview app for sway";
     license = lib.licenses.gpl3Only;
     mainProgram = "sov";
-    maintainers = with lib.maintainers; [ AndersonTorres ];
+    maintainers = with lib.maintainers; [ ];
     inherit (wayland.meta) platforms;
     # sys/timerfd.h header inexistent
     broken = stdenv.isDarwin;
diff --git a/pkgs/by-name/sp/spotify/linux.nix b/pkgs/by-name/sp/spotify/linux.nix
index b295d6fa5083..5d638876d2da 100644
--- a/pkgs/by-name/sp/spotify/linux.nix
+++ b/pkgs/by-name/sp/spotify/linux.nix
@@ -179,7 +179,7 @@ stdenv.mkDerivation {
         ''} \
         --prefix LD_LIBRARY_PATH : "$librarypath" \
         --prefix PATH : "${zenity}/bin" \
-        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland}}"
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland --enable-wayland-ime}}"
 
       runHook postFixup
     '';
diff --git a/pkgs/by-name/te/teams-for-linux/package.nix b/pkgs/by-name/te/teams-for-linux/package.nix
index 77f8cf6e5f8b..17f93c7ca963 100644
--- a/pkgs/by-name/te/teams-for-linux/package.nix
+++ b/pkgs/by-name/te/teams-for-linux/package.nix
@@ -80,7 +80,7 @@ buildNpmPackage rec {
           ]
         } \
         --add-flags "$out/share/teams-for-linux/app.asar" \
-        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}"
     ''
     + lib.optionalString stdenv.hostPlatform.isDarwin ''
       mkdir -p $out/Applications
diff --git a/pkgs/by-name/te/tenv/package.nix b/pkgs/by-name/te/tenv/package.nix
index 480f5b46ab97..8e76ac0c2408 100644
--- a/pkgs/by-name/te/tenv/package.nix
+++ b/pkgs/by-name/te/tenv/package.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "tenv";
-  version = "3.1.0";
+  version = "3.2.10";
 
   src = fetchFromGitHub {
     owner = "tofuutils";
     repo = "tenv";
     rev = "v${version}";
-    hash = "sha256-nZhJgkXP4ZdVp244bdOswwEOTeH/HopFrQN/A0L+W/k=";
+    hash = "sha256-EiWajXUQTK8xJoehpq+LWdjy84+lB7oilFM1v59F/30=";
   };
 
-  vendorHash = "sha256-yhGqKuHHiSW6exPuKGFzeDO9GEc/S8XGkGNhPM1gXgQ=";
+  vendorHash = "sha256-YC6LCrrxw9gZMc/ow628lL9KbePM8RhiAjLZ7HG2FY8=";
 
   # Tests disabled for requiring network access to release.hashicorp.com
   doCheck = false;
diff --git a/pkgs/by-name/ti/tidal-hifi/package.nix b/pkgs/by-name/ti/tidal-hifi/package.nix
index de6fb5b0b2de..15e2cf2a3a6c 100644
--- a/pkgs/by-name/ti/tidal-hifi/package.nix
+++ b/pkgs/by-name/ti/tidal-hifi/package.nix
@@ -106,7 +106,7 @@ stdenv.mkDerivation (finalAttrs: {
   postFixup = ''
     makeWrapper $out/opt/tidal-hifi/tidal-hifi $out/bin/tidal-hifi \
       --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath finalAttrs.buildInputs}" \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}" \
       "''${gappsWrapperArgs[@]}"
     substituteInPlace $out/share/applications/tidal-hifi.desktop \
       --replace "/opt/tidal-hifi/tidal-hifi" "tidal-hifi"
diff --git a/pkgs/by-name/ti/tigerbeetle/package.nix b/pkgs/by-name/ti/tigerbeetle/package.nix
index 4199b7c1a967..ff0f9606cea7 100644
--- a/pkgs/by-name/ti/tigerbeetle/package.nix
+++ b/pkgs/by-name/ti/tigerbeetle/package.nix
@@ -10,14 +10,14 @@ let
   platform =
     if stdenvNoCC.hostPlatform.isDarwin then "universal-macos" else stdenvNoCC.hostPlatform.system;
   hash = builtins.getAttr platform {
-    "universal-macos" = "sha256-crTcTPbP4+YqeCnrk4qFGsBiPCgsQc32HK6jyb4+FOU=";
-    "x86_64-linux" = "sha256-92Qg2kVuT7RRQzcEuduETcFhI7oiIiCXPyAbAj4MhVg=";
-    "aarch64-linux" = "sha256-jztdl3gLJarUBxIAl1yzLd7cMJQEYrcjERJwRlsmxqs=";
+    "universal-macos" = "sha256-glxTuuSfRkkBZE3OMflv2FM1yqamJXpRz3DnMt8baRU=";
+    "x86_64-linux" = "sha256-xirnZUQxhvaJ0OpDF57rZ3Di7q0JfH3TXlAe2Ej9bwU=";
+    "aarch64-linux" = "sha256-0lOpYlSOaX9CfQO9CdJ7xIanhf8G3KoUuGNbbPXmmow=";
   };
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tigerbeetle";
-  version = "0.16.12";
+  version = "0.16.14";
 
   src = fetchzip {
     url = "https://github.com/tigerbeetle/tigerbeetle/releases/download/${finalAttrs.version}/tigerbeetle-${platform}.zip";
diff --git a/pkgs/by-name/tr/treefmt2/package.nix b/pkgs/by-name/tr/treefmt2/package.nix
index 1a6c4d0049a2..46a3913cbadc 100644
--- a/pkgs/by-name/tr/treefmt2/package.nix
+++ b/pkgs/by-name/tr/treefmt2/package.nix
@@ -1,16 +1,16 @@
 { lib, buildGoModule, fetchFromGitHub }:
 buildGoModule rec {
   pname = "treefmt";
-  version = "2.1.0";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "numtide";
     repo = "treefmt";
     rev = "v${version}";
-    hash = "sha256-I97mCxQMPq6fV0GD9gVbtQ/i/Sju9/+ZazbkbGqy9Qw=";
+    hash = "sha256-XD61nZhdXYrFzprv/YuazjXK/NWP5a9oCF6WBO2XTY0=";
   };
 
-  vendorHash = "sha256-PiH+FMSPeTFwS6cMgZX8Uy2bjZnQ+APqL5d7FMnqR9U=";
+  vendorHash = "sha256-0qCOpLMuuiYNCX2Lqa/DUlkmDoPIyUzUHIsghoIaG1s=";
 
   subPackages = [ "." ];
 
@@ -19,8 +19,8 @@ buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-X github.com/numtide/treefmt/build.Name=treefmt"
-    "-X github.com/numtide/treefmt/build.Version=v${version}"
+    "-X github.com/numtide/treefmt/v2/build.Name=treefmt"
+    "-X github.com/numtide/treefmt/v2/build.Version=v${version}"
   ];
 
   meta = {
diff --git a/pkgs/by-name/uh/uhk-agent/package.nix b/pkgs/by-name/uh/uhk-agent/package.nix
index 8e32d33660ab..fa86e0e44e36 100644
--- a/pkgs/by-name/uh/uhk-agent/package.nix
+++ b/pkgs/by-name/uh/uhk-agent/package.nix
@@ -61,7 +61,7 @@ stdenvNoCC.mkDerivation {
 
     makeWrapper "${electron}/bin/electron" "$out/bin/${pname}" \
       --add-flags "$out/opt/${pname}/app.asar.unpacked" \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}" \
       --set-default ELECTRON_IS_DEV 0 \
       --inherit-argv0
 
diff --git a/pkgs/by-name/up/upscayl/package.nix b/pkgs/by-name/up/upscayl/package.nix
index 414a2eb1456b..eb48ac50a56b 100644
--- a/pkgs/by-name/up/upscayl/package.nix
+++ b/pkgs/by-name/up/upscayl/package.nix
@@ -40,7 +40,7 @@ appimageTools.wrapType2 {
       --replace-fail 'Exec=AppRun --no-sandbox %U' 'Exec=${pname}'
 
     wrapProgram $out/bin/${pname} \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}"
   '';
 
   meta = with lib; {
diff --git a/pkgs/by-name/vk/vkdt/package.nix b/pkgs/by-name/vk/vkdt/package.nix
index 41380271dd7d..acaf09e43977 100644
--- a/pkgs/by-name/vk/vkdt/package.nix
+++ b/pkgs/by-name/vk/vkdt/package.nix
@@ -29,11 +29,11 @@
 
 stdenv.mkDerivation rec {
   pname = "vkdt";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchurl {
     url = "https://github.com/hanatos/${pname}/releases/download/${version}/${pname}-${version}.tar.xz";
-    hash = "sha256-LXUTDwUjlfyhtXkYW4Zivqt8vyctoz+ID5AQ7gg+d9A=";
+    hash = "sha256-+oVPZRI01IxMSPXOjvUXJutYXftQM7GxwVLG8wqoaY4=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/vu/vunnel/package.nix b/pkgs/by-name/vu/vunnel/package.nix
index fff20fecc568..70ae55a56075 100644
--- a/pkgs/by-name/vu/vunnel/package.nix
+++ b/pkgs/by-name/vu/vunnel/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "vunnel";
-  version = "0.28.0";
+  version = "0.29.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = "vunnel";
     rev = "refs/tags/v${version}";
-    hash = "sha256-KemiM+dCLSU3a6IIbI9VKtaIeY4SVcHsuE9QwZtzNxU=";
+    hash = "sha256-oHK855EQglFZrjW30n/z0vgf/NtaXVOcntEWQMcAbDw=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/by-name/wa/wasm-tools/package.nix b/pkgs/by-name/wa/wasm-tools/package.nix
index 601b10ea5527..05bd322aa24a 100644
--- a/pkgs/by-name/wa/wasm-tools/package.nix
+++ b/pkgs/by-name/wa/wasm-tools/package.nix
@@ -5,19 +5,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wasm-tools";
-  version = "1.220.0";
+  version = "1.221.0";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-gXwdY75tTx57khF52LfNTIbacP53uxr/+YSc2zFiGSk=";
+    hash = "sha256-tb2WHY0UMGPURQ1l8gPQK52TothUhmM8pSbtGumQz9Q=";
     fetchSubmodules = true;
   };
 
   # Disable cargo-auditable until https://github.com/rust-secure-code/cargo-auditable/issues/124 is solved.
   auditable = false;
-  cargoHash = "sha256-bnFkeIzn8hHU7ABli8CVs+HeECqgc28nCKvdGN0Hr8s=";
+  cargoHash = "sha256-KvI+KexELxqeT1luyCHjOSVxNRv+p1nDW4/nlVoxsZ4=";
   cargoBuildFlags = [ "--package" "wasm-tools" ];
   cargoTestFlags = [ "--all" ] ++
     # Due to https://github.com/bytecodealliance/wasm-tools/issues/1820
diff --git a/pkgs/by-name/wa/wavebox/package.nix b/pkgs/by-name/wa/wavebox/package.nix
index 305f78db06ef..01b0f0eb7205 100644
--- a/pkgs/by-name/wa/wavebox/package.nix
+++ b/pkgs/by-name/wa/wavebox/package.nix
@@ -214,7 +214,7 @@ stdenv.mkDerivation (finalAttrs: {
       --suffix PATH            : "${lib.makeBinPath [ xdg-utils ]}" \
       --prefix XDG_DATA_DIRS   : "$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH:${addDriverRunpath.driverLink}/share" \
       --set CHROME_WRAPPER "wavebox" \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}" \
       --add-flags ${lib.escapeShellArg commandLineArgs}
 
     for elf in $out/share/wavebox.io/wavebox/{wavebox,chrome-sandbox,chrome_crashpad_handler}; do
diff --git a/pkgs/by-name/we/websurfx/package.nix b/pkgs/by-name/we/websurfx/package.nix
new file mode 100644
index 000000000000..724b41098867
--- /dev/null
+++ b/pkgs/by-name/we/websurfx/package.nix
@@ -0,0 +1,60 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  openssl,
+  pkg-config,
+}:
+let
+  version = "1.20.7";
+in
+rustPlatform.buildRustPackage {
+  pname = "websurfx";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "neon-mmd";
+    repo = "websurfx";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-fpyelpzskwuVrQB1SZ3llnenox7MiOeF+sSJONSdEf0=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+  ];
+
+  useFetchCargoVendor = true;
+
+  cargoHash = "sha256-LnMVfsKb1oTsEKmD/dDnABbWyrYC52e9ASbcMY7qXMw=";
+
+  postPatch = ''
+    substituteInPlace src/handler/mod.rs \
+      --replace-fail "/etc/xdg" "$out/etc/xdg" \
+      --replace-fail "/opt/websurfx" "$out/opt/websurfx"
+  '';
+
+  postInstall = ''
+    mkdir -p $out/etc/xdg
+    mkdir -p $out/opt/websurfx
+
+    cp -r websurfx $out/etc/xdg/
+    cp -r public $out/opt/websurfx/
+  '';
+
+  meta = {
+    description = "Open source alternative to searx";
+    longDescription = ''
+      An open source alternative to searx which provides a modern-looking,
+      lightning-fast, privacy respecting, secure meta search engine.
+    '';
+    homepage = "https://github.com/neon-mmd/websurfx";
+    changelog = "https://github.com/neon-mmd/websurfx/releases";
+    license = lib.licenses.agpl3Plus;
+    maintainers = with lib.maintainers; [ theobori ];
+    mainProgram = "websurfx";
+  };
+}
diff --git a/pkgs/by-name/wi/wire-desktop/package.nix b/pkgs/by-name/wi/wire-desktop/package.nix
index 9c6ab2a0b60e..1f0c5f95c6ad 100644
--- a/pkgs/by-name/wi/wire-desktop/package.nix
+++ b/pkgs/by-name/wi/wire-desktop/package.nix
@@ -130,7 +130,7 @@ let
     ];
 
     preFixup = ''
-      gappsWrapperArgs+=(--add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}")
+      gappsWrapperArgs+=(--add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}")
     '';
 
     postFixup = ''
diff --git a/pkgs/by-name/wo/wootility/package.nix b/pkgs/by-name/wo/wootility/package.nix
index 265f7f9c35ce..3c1b3af0743f 100644
--- a/pkgs/by-name/wo/wootility/package.nix
+++ b/pkgs/by-name/wo/wootility/package.nix
@@ -22,7 +22,7 @@ appimageTools.wrapType2 {
     let contents = appimageTools.extract { inherit pname version src; };
     in ''
       wrapProgram $out/bin/wootility \
-        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}"
 
       install -Dm444 ${contents}/wootility-lekker.desktop -t $out/share/applications
       install -Dm444 ${contents}/wootility-lekker.png -t $out/share/pixmaps
diff --git a/pkgs/by-name/wt/wtfis/package.nix b/pkgs/by-name/wt/wtfis/package.nix
index a4ab234b1b53..80e500ba726e 100644
--- a/pkgs/by-name/wt/wtfis/package.nix
+++ b/pkgs/by-name/wt/wtfis/package.nix
@@ -39,6 +39,6 @@ in python3.pkgs.buildPythonApplication {
     description = "Passive hostname, domain and IP lookup tool for non-robots";
     mainProgram = "wtfis";
     license = lib.licenses.mit;
-    maintainers = [ lib.maintainers.AndersonTorres ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/by-name/xp/xpointerbarrier/package.nix b/pkgs/by-name/xp/xpointerbarrier/package.nix
index 06dc1c64b790..425018ceb1b1 100644
--- a/pkgs/by-name/xp/xpointerbarrier/package.nix
+++ b/pkgs/by-name/xp/xpointerbarrier/package.nix
@@ -38,7 +38,6 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Create X11 pointer barriers around your working area";
     license = licenses.mit;
     maintainers = with maintainers; [
-      AndersonTorres
       xzfc
     ];
     platforms = platforms.linux;
diff --git a/pkgs/by-name/yt/ytmdesktop/package.nix b/pkgs/by-name/yt/ytmdesktop/package.nix
index f6e04c930b7b..a402502ca1b2 100644
--- a/pkgs/by-name/yt/ytmdesktop/package.nix
+++ b/pkgs/by-name/yt/ytmdesktop/package.nix
@@ -82,7 +82,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     makeWrapper ${lib.getExe electron_33} $out/bin/ytmdesktop \
       --add-flags $out/lib/resources/app.asar \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}" \
       --add-flags ${lib.escapeShellArg commandLineArgs}
 
     runHook preFixup
diff --git a/pkgs/by-name/zu/zulip/package.nix b/pkgs/by-name/zu/zulip/package.nix
index 877eb833de8c..6b6ffb4b0e85 100644
--- a/pkgs/by-name/zu/zulip/package.nix
+++ b/pkgs/by-name/zu/zulip/package.nix
@@ -20,7 +20,7 @@ let
 in appimageTools.wrapType2 {
   inherit pname version src;
 
-  runScript = "appimage-exec.sh -w ${appimageContents} -- \${NIXOS_OZONE_WL:+\${WAYLAND_DISPLAY:+--ozone-platform-hint=auto}}";
+  runScript = "appimage-exec.sh -w ${appimageContents} -- \${NIXOS_OZONE_WL:+\${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-wayland-ime}}";
 
   extraInstallCommands = ''
     install -m 444 -D ${appimageContents}/zulip.desktop $out/share/applications/zulip.desktop
diff --git a/pkgs/development/libraries/gettext/default.nix b/pkgs/development/libraries/gettext/default.nix
index c29b2857c59f..86bbd26ed459 100644
--- a/pkgs/development/libraries/gettext/default.nix
+++ b/pkgs/development/libraries/gettext/default.nix
@@ -19,16 +19,7 @@ stdenv.mkDerivation rec {
     # fix reproducibile output, in particular in the grub2 build
     # https://savannah.gnu.org/bugs/index.php?59658
     ./0001-msginit-Do-not-use-POT-Creation-Date.patch
-  ]
-    # An accidental inclusion in https://marc.info/?l=glibc-alpha&m=150511271003225&w=2
-    # resulted in a getcwd prototype to be added in when it isn't needed.
-    # Clang does not like this unless the "overridable" attribute was appied.
-    # Since we don't need to redeclare getcwd, we can just remove it.
-    #
-    # Issue: https://github.com/NixOS/nixpkgs/issues/348658
-    # Fixed in https://github.com/autotools-mirror/gettext/commit/cb2c1486336462c8180f487221181ee798b0e73e
-    # Remove in 0.22.5 upgrade.
-    ++ lib.optional (stdenv.cc.isClang && !stdenv.targetPlatform.isDarwin) ./fix-getcwd-clang.patch;
+  ];
 
   outputs = [ "out" "man" "doc" "info" ];
 
diff --git a/pkgs/development/libraries/gettext/fix-getcwd-clang.patch b/pkgs/development/libraries/gettext/fix-getcwd-clang.patch
deleted file mode 100644
index ae253b3cd0ec..000000000000
--- a/pkgs/development/libraries/gettext/fix-getcwd-clang.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-From cb2c1486336462c8180f487221181ee798b0e73e Mon Sep 17 00:00:00 2001
-From: Bruno Haible <bruno@clisp.org>
-Date: Thu, 9 Feb 2023 16:58:20 +0100
-Subject: [PATCH] Fix compilation errors with ISO C 23 compilers.
-
-* gettext-runtime/intl/dcigettext.c (getwd, getcwd): Assume a declaration in the
-system header files.
-* gettext-runtime/intl/gettextP.h (SWAP): Drop K&C compatibility.
----
- gettext-runtime/intl/dcigettext.c | 5 +----
- gettext-runtime/intl/gettextP.h   | 7 +------
- 2 files changed, 2 insertions(+), 10 deletions(-)
-
-diff --git a/gettext-runtime/intl/dcigettext.c b/gettext-runtime/intl/dcigettext.c
-index e7cb9b962..666a624b0 100644
---- a/gettext-runtime/intl/dcigettext.c
-+++ b/gettext-runtime/intl/dcigettext.c
-@@ -1,5 +1,5 @@
- /* Implementation of the internal dcigettext function.
--   Copyright (C) 1995-2020 Free Software Foundation, Inc.
-+   Copyright (C) 1995-2023 Free Software Foundation, Inc.
- 
-    This program is free software: you can redistribute it and/or modify
-    it under the terms of the GNU Lesser General Public License as published by
-@@ -139,13 +139,10 @@ extern int errno;
- # define tfind __tfind
- #else
- # if !defined HAVE_GETCWD
--char *getwd ();
- #  define getcwd(buf, max) getwd (buf)
- # else
- #  if VMS
- #   define getcwd(buf, max) (getcwd) (buf, max, 0)
--#  else
--char *getcwd ();
- #  endif
- # endif
- # ifndef HAVE_STPCPY
-diff --git a/gettext-runtime/intl/gettextP.h b/gettext-runtime/intl/gettextP.h
-index bb00555ee..536e8bd43 100644
---- a/gettext-runtime/intl/gettextP.h
-+++ b/gettext-runtime/intl/gettextP.h
-@@ -1,5 +1,5 @@
- /* Header describing internals of libintl library.
--   Copyright (C) 1995-2020 Free Software Foundation, Inc.
-+   Copyright (C) 1995-2023 Free Software Foundation, Inc.
-    Written by Ulrich Drepper <drepper@cygnus.com>, 1995.
- 
-    This program is free software: you can redistribute it and/or modify
-@@ -113,12 +113,7 @@ extern char *libintl_dcigettext (const char *__domainname,
- # define SWAP(i) bswap_32 (i)
- #else
- static inline nls_uint32
--# ifdef __cplusplus
- SWAP (nls_uint32 i)
--# else
--SWAP (i)
--     nls_uint32 i;
--# endif
- {
-   return (i << 24) | ((i & 0xff00) << 8) | ((i >> 8) & 0xff00) | (i >> 24);
- }
-
diff --git a/pkgs/development/libraries/libopenshot-audio/default.nix b/pkgs/development/libraries/libopenshot-audio/default.nix
index 2d8cec21b189..9dfa5e09eddb 100644
--- a/pkgs/development/libraries/libopenshot-audio/default.nix
+++ b/pkgs/development/libraries/libopenshot-audio/default.nix
@@ -71,7 +71,7 @@ stdenv.mkDerivation (finalAttrs: {
       JUCE library.
     '';
     license = with lib.licenses; [ gpl3Plus ];
-    maintainers = with lib.maintainers; [ AndersonTorres ];
+    maintainers = with lib.maintainers; [ ];
     platforms = lib.platforms.unix;
   };
 })
diff --git a/pkgs/development/libraries/libopenshot/default.nix b/pkgs/development/libraries/libopenshot/default.nix
index 231b0cd109aa..564ad3ac911a 100644
--- a/pkgs/development/libraries/libopenshot/default.nix
+++ b/pkgs/development/libraries/libopenshot/default.nix
@@ -81,7 +81,7 @@ stdenv.mkDerivation (finalAttrs: {
       to the world. API currently supports C++, Python, and Ruby.
     '';
     license = with lib.licenses; [ gpl3Plus ];
-    maintainers = with lib.maintainers; [ AndersonTorres ];
+    maintainers = with lib.maintainers; [ ];
     platforms = lib.platforms.unix;
   };
 })
diff --git a/pkgs/development/libraries/mongoc/default.nix b/pkgs/development/libraries/mongoc/default.nix
index fc967445d01c..577ca980cbf2 100644
--- a/pkgs/development/libraries/mongoc/default.nix
+++ b/pkgs/development/libraries/mongoc/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mongoc";
-  version = "1.28.0";
+  version = "1.29.0";
 
   src = fetchFromGitHub {
     owner = "mongodb";
     repo = "mongo-c-driver";
     rev = "refs/tags/${version}";
-    hash = "sha256-cfet+A2i33iHbVRouPS4Ul8TmHolrcIMTRba6Olqfeg=";
+    hash = "sha256-367qk0u81jnNA/9ruCo9wUWnCPrNjLhp9x62iEpCmE4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/ocaml-modules/sedlex/default.nix b/pkgs/development/ocaml-modules/sedlex/default.nix
index 53a3c718ed6e..480083d6253a 100644
--- a/pkgs/development/ocaml-modules/sedlex/default.nix
+++ b/pkgs/development/ocaml-modules/sedlex/default.nix
@@ -11,8 +11,8 @@
 let param =
   if lib.versionAtLeast ppxlib.version "0.26.0" then
     {
-      version = "3.2";
-      sha256 = "sha256-5Vf1LRhSotNpTPzHmRgCMRYtrpgaspLlyzv1XdGt+u8=";
+      version = "3.3";
+      sha256 = "sha256-33eJKVdoR4mlWdPZUdjQ26w+kuQWoUN68+bxy2o+Pjs=";
     }
   else {
     version = "2.5";
@@ -21,20 +21,20 @@ let param =
 ; in
 
 let
-  unicodeVersion = "15.0.0";
+  unicodeVersion = "16.0.0";
   baseUrl = "https://www.unicode.org/Public/${unicodeVersion}";
 
   DerivedCoreProperties = fetchurl {
     url = "${baseUrl}/ucd/DerivedCoreProperties.txt";
-    sha256 = "sha256-02cpC8CGfmtITGg3BTC90aCLazJARgG4x6zK+D4FYo0=";
+    sha256 = "sha256-OdNRYfKVRJf2ngi9uecBST9Haj0wIi3iACj+2jbB2r0=";
   };
   DerivedGeneralCategory = fetchurl {
     url = "${baseUrl}/ucd/extracted/DerivedGeneralCategory.txt";
-    sha256 = "sha256-/imkXAiCUA5ZEUCqpcT1Bn5qXXRoBhSK80QAxIucBvk=";
+    sha256 = "sha256-dnardVpB74IQhGAjhWnmCtZcGR3a/mGzbGdl7BNT8pM=";
   };
   PropList = fetchurl {
     url = "${baseUrl}/ucd/PropList.txt";
-    sha256 = "sha256-4FwKKBHRE9rkq9gyiEGZo+qNGH7huHLYJAp4ipZUC/0=";
+    sha256 = "sha256-U9YUUI4qCyMFqKohzWDZk96TJs32WZNmDfzORQNUhYM=";
   };
   atLeast31 = lib.versionAtLeast param.version "3.1";
 in
@@ -43,7 +43,6 @@ buildDunePackage rec {
   inherit (param) version;
 
   minimalOCamlVersion = "4.08";
-  duneVersion = "3";
 
   src = fetchFromGitHub {
     owner = "ocaml-community";
diff --git a/pkgs/development/python-modules/aiomisc/default.nix b/pkgs/development/python-modules/aiomisc/default.nix
index a9dabfd3ee2a..629cf183e8a2 100644
--- a/pkgs/development/python-modules/aiomisc/default.nix
+++ b/pkgs/development/python-modules/aiomisc/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "aiomisc";
-  version = "17.5.26";
+  version = "17.5.29";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-78N8SBzgUB0Lnbj79r3jfhx6ZwlsP9Eq7gTIPkZSPzM=";
+    hash = "sha256-DjOl4eymyD2n1bbDUI+s3iGiWjT/AhRqmTmiZpufLNU=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/asteroid-filterbanks/default.nix b/pkgs/development/python-modules/asteroid-filterbanks/default.nix
index e7dc0cba9798..f70a5bfe40f1 100644
--- a/pkgs/development/python-modules/asteroid-filterbanks/default.nix
+++ b/pkgs/development/python-modules/asteroid-filterbanks/default.nix
@@ -1,17 +1,20 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
+
+  # build-system
   setuptools,
-  wheel,
-  black,
-  coverage,
-  librosa,
+
+  # dependencies
   numpy,
-  pre-commit,
-  pytest,
-  scipy,
   torch,
+  typing-extensions,
+
+  # tests
+  pytestCheckHook,
+  scipy,
 }:
 
 buildPythonPackage rec {
@@ -22,32 +25,58 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "asteroid-team";
     repo = "asteroid-filterbanks";
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-Z5M2Xgj83lzqov9kCw/rkjJ5KXbjuP+FHYCjhi5nYFE=";
   };
 
-  nativeBuildInputs = [
-    setuptools
-    wheel
-  ];
+  # np.float is deprecated
+  postPatch = ''
+    substituteInPlace asteroid_filterbanks/multiphase_gammatone_fb.py \
+      --replace-fail "np.float(" "float("
+  '';
 
-  propagatedBuildInputs = [
-    black
-    coverage
-    librosa
+  build-system = [ setuptools ];
+
+  dependencies = [
     numpy
-    pre-commit
-    pytest
-    scipy
     torch
+    typing-extensions
   ];
 
   pythonImportsCheck = [ "asteroid_filterbanks" ];
 
-  meta = with lib; {
+  nativeCheckInputs = [
+    pytestCheckHook
+    scipy
+  ];
+
+  disabledTests =
+    [
+      # RuntimeError: cannot cache function '__o_fold': no locator available for file
+      # '/nix/store/d1znhn1n48z2raj0j9zbz80hhg4k2shw-python3.12-librosa-0.10.2.post1/lib/python3.12/site-packages/librosa/core/notation.py'
+      "test_melgram_encoder"
+      "test_melscale"
+
+      # AssertionError: The values for attribute 'shape' do not match
+      "test_torch_stft"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      # Issue with JIT on darwin:
+      # RuntimeError: required keyword attribute 'value' has the wrong type
+      "test_jit_filterbanks"
+      "test_jit_filterbanks_enc"
+      "test_pcen_jit"
+      "test_stateful_pcen_jit"
+    ]
+    ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
+      # Flaky: AssertionError: Tensor-likes are not close!
+      "test_fb_def_and_forward_lowdim"
+    ];
+
+  meta = {
     description = "PyTorch-based audio source separation toolkit for researchers";
     homepage = "https://github.com/asteroid-team/asteroid-filterbanks";
-    license = licenses.mit;
-    maintainers = with maintainers; [ matthewcroughan ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ matthewcroughan ];
   };
 }
diff --git a/pkgs/development/python-modules/authcaptureproxy/default.nix b/pkgs/development/python-modules/authcaptureproxy/default.nix
index 7aa705244501..98540b643186 100644
--- a/pkgs/development/python-modules/authcaptureproxy/default.nix
+++ b/pkgs/development/python-modules/authcaptureproxy/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "authcaptureproxy";
-  version = "1.3.2";
+  version = "1.3.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "alandtse";
     repo = "auth_capture_proxy";
     rev = "refs/tags/v${version}";
-    hash = "sha256-gdu0Ror/epu6huTEpBrqHD62O9uaL6273pKnpqPKskc=";
+    hash = "sha256-H5Dl1incS5+lmZaLZXMCOqEIGTcTr4A5J3r3ngpDGtY=";
   };
 
   nativeBuildInputs = [ poetry-core ];
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index d9c249fef4ad..5cecd18abbbd 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -359,7 +359,7 @@
 
 buildPythonPackage rec {
   pname = "boto3-stubs";
-  version = "1.35.29";
+  version = "1.35.71";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -367,7 +367,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit version;
-    hash = "sha256-bl8IL3zQKL3zv8V8nbO3hOD27CIysQSChZqRnWzWv8k=";
+    hash = "sha256-UOIPp0JIyWs+NJiy2BOIWFWD44ufBgnS+lglfknJhqU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/botocore-stubs/default.nix b/pkgs/development/python-modules/botocore-stubs/default.nix
index 119c5345ef93..6ac1816a9919 100644
--- a/pkgs/development/python-modules/botocore-stubs/default.nix
+++ b/pkgs/development/python-modules/botocore-stubs/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "botocore-stubs";
-  version = "1.35.29";
+  version = "1.35.71";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "botocore_stubs";
     inherit version;
-    hash = "sha256-QNTPX8Un+604G+GM+DdADW8WiogOJu55TIwE+go+YsU=";
+    hash = "sha256-xfcgiyCuGUAPpz61aQF/HjcpkPelUFpyEW7WQgkE9mY=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/checkdmarc/default.nix b/pkgs/development/python-modules/checkdmarc/default.nix
index 7a1e122b737d..cbc15b287faa 100644
--- a/pkgs/development/python-modules/checkdmarc/default.nix
+++ b/pkgs/development/python-modules/checkdmarc/default.nix
@@ -6,17 +6,20 @@
   expiringdict,
   fetchFromGitHub,
   hatchling,
+  pem,
   publicsuffixlist,
   pyleri,
+  pyopenssl,
   pytestCheckHook,
   pythonOlder,
   requests,
   timeout-decorator,
+  xmltodict,
 }:
 
 buildPythonPackage rec {
   pname = "checkdmarc";
-  version = "5.5.0";
+  version = "5.7.8";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -25,19 +28,24 @@ buildPythonPackage rec {
     owner = "domainaware";
     repo = "checkdmarc";
     rev = "refs/tags/${version}";
-    hash = "sha256-skQqLWBEmfyiW2DsRRbj3Lfj52QZca0zKenFC7LltjM=";
+    hash = "sha256-fqSRqiakwFk1Cfb79oOEBbPF/fbtumuV7M6Mjl09Vmw=";
   };
 
-  nativeBuildInputs = [ hatchling ];
+  pythonRelaxDeps = [ "xmltodict" ];
 
-  propagatedBuildInputs = [
+  build-system = [ hatchling ];
+
+  dependencies = [
     cryptography
     dnspython
     expiringdict
+    pem
     publicsuffixlist
     pyleri
+    pyopenssl
     requests
     timeout-decorator
+    xmltodict
   ];
 
   nativeCheckInputs = [ pytestCheckHook ];
@@ -48,6 +56,7 @@ buildPythonPackage rec {
 
   disabledTests = [
     # Tests require network access
+    "testBIMI"
     "testDMARCPctLessThan100Warning"
     "testSPFMissingARecord"
     "testSPFMissingMXRecord"
diff --git a/pkgs/development/python-modules/click-odoo-contrib/default.nix b/pkgs/development/python-modules/click-odoo-contrib/default.nix
index 03263e7fed21..0e1cc65445bb 100644
--- a/pkgs/development/python-modules/click-odoo-contrib/default.nix
+++ b/pkgs/development/python-modules/click-odoo-contrib/default.nix
@@ -12,13 +12,13 @@
 
 buildPythonPackage rec {
   pname = "click-odoo-contrib";
-  version = "1.19";
+  version = "1.20";
   format = "pyproject";
 
   src = fetchPypi {
     pname = "click_odoo_contrib";
     inherit version;
-    hash = "sha256-Tg3C/mdgkB1TtQZaUOX4ZjpD3InI8CxoNUSfotRqbg0=";
+    hash = "sha256-TRh7ffdW7ZBDlj7RPgEbtzEuHkTe99L6GYuOLgeEumg=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/datasette/default.nix b/pkgs/development/python-modules/datasette/default.nix
index dbc9828c5803..92959241988e 100644
--- a/pkgs/development/python-modules/datasette/default.nix
+++ b/pkgs/development/python-modules/datasette/default.nix
@@ -32,7 +32,7 @@
 
 buildPythonPackage rec {
   pname = "datasette";
-  version = "0.65";
+  version = "0.65.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -41,7 +41,7 @@ buildPythonPackage rec {
     owner = "simonw";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-POdw2vB0D2B5SyrC/HkFqlsMlWtbdC3cRM/cfDhv7Z4=";
+    hash = "sha256-kVtldBuDy19DmyxEQLtAjs1qiNIjaT8+rnHlFfGNHec=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/django-rest-registration/default.nix b/pkgs/development/python-modules/django-rest-registration/default.nix
index b62c60d70372..2644da1d606f 100644
--- a/pkgs/development/python-modules/django-rest-registration/default.nix
+++ b/pkgs/development/python-modules/django-rest-registration/default.nix
@@ -7,23 +7,27 @@
   pytest-django,
   pytestCheckHook,
   pythonOlder,
+  jwt,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "django-rest-registration";
   version = "0.9.0";
-  format = "setuptools";
+  pyproject = true;
+
+  build-system = [ setuptools ];
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "apragacz";
-    repo = pname;
+    repo = "django-rest-registration";
     rev = "refs/tags/v${version}";
     hash = "sha256-EaS1qN7GpfPPeSLwwQdVWSRO2dv0DG5LD7vnXckz4Bg=";
   };
 
-  propagatedBuildInputs = [
+  dependencies = [
     django
     djangorestframework
   ];
@@ -31,6 +35,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     pytestCheckHook
     pytest-django
+    jwt
   ];
 
   pythonImportsCheck = [ "rest_registration" ];
@@ -42,11 +47,11 @@ buildPythonPackage rec {
     "test_coreapi_autoschema_success"
   ];
 
-  meta = with lib; {
+  meta = {
     description = "User-related REST API based on the awesome Django REST Framework";
     homepage = "https://github.com/apragacz/django-rest-registration/";
     changelog = "https://github.com/apragacz/django-rest-registration/releases/tag/${version}";
-    license = licenses.mit;
-    maintainers = with maintainers; [ sephi ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ sephi ];
   };
 }
diff --git a/pkgs/development/python-modules/garminconnect/default.nix b/pkgs/development/python-modules/garminconnect/default.nix
index e4d5c3fba533..d5e646a89fa9 100644
--- a/pkgs/development/python-modules/garminconnect/default.nix
+++ b/pkgs/development/python-modules/garminconnect/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "garminconnect";
-  version = "0.2.21";
+  version = "0.2.23";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "cyberjunky";
     repo = "python-garminconnect";
     rev = "refs/tags/${version}";
-    hash = "sha256-sSprHu6VCa+VRipmSX/YcfyTe5dKHhNkxmbO9hzNYq8=";
+    hash = "sha256-rY3jIrCl5y2Pyw7qakUuMtdPTR7e61n5pScPavvBtbM=";
   };
 
   build-system = [ pdm-backend ];
diff --git a/pkgs/development/python-modules/growattserver/default.nix b/pkgs/development/python-modules/growattserver/default.nix
index ba873ae059da..ad142b6c6cae 100644
--- a/pkgs/development/python-modules/growattserver/default.nix
+++ b/pkgs/development/python-modules/growattserver/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "growattserver";
-  version = "1.5.0";
+  version = "1.6.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "indykoning";
     repo = "PyPi_GrowattServer";
     rev = "refs/tags/${version}";
-    hash = "sha256-ATxXjIF5QRsdLuXZCOWMwvbBzawrhlYZ+wodITz36sE=";
+    hash = "sha256-P7HZPmDUQM3DuaGSkAHc0jQBGeurS+KgtdwT7ZJ/8q8=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/halohome/default.nix b/pkgs/development/python-modules/halohome/default.nix
index bbb445b4eb5f..1308fe4658d4 100644
--- a/pkgs/development/python-modules/halohome/default.nix
+++ b/pkgs/development/python-modules/halohome/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "halohome";
-  version = "0.6.0";
+  version = "0.7.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "nayaverdier";
     repo = "halohome";
     rev = "refs/tags/${version}";
-    hash = "sha256-oGwg9frE5LaUxmXjwaD0ZtY6D8D7f8tH0knZDaSm+XI=";
+    hash = "sha256-JOQ2q5lbdVTerXPt6QHBiTG9PzN9LiuLcN+XnOoyYjA=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/haversine/default.nix b/pkgs/development/python-modules/haversine/default.nix
index 5264545cca5a..a406988c52f1 100644
--- a/pkgs/development/python-modules/haversine/default.nix
+++ b/pkgs/development/python-modules/haversine/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "haversine";
-  version = "2.8.1";
+  version = "2.9.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "mapado";
     repo = "haversine";
     rev = "refs/tags/v${version}";
-    hash = "sha256-MKOg2awpamupvuXstiH7VoIY4ax+hy2h2cFXDFKJ2mA=";
+    hash = "sha256-KqcDDQdAOnrmiq+kf8rLHy85rNnhatZTOzCCU91lOrU=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/imgcat/default.nix b/pkgs/development/python-modules/imgcat/default.nix
index e17c249670e2..0f190463c444 100644
--- a/pkgs/development/python-modules/imgcat/default.nix
+++ b/pkgs/development/python-modules/imgcat/default.nix
@@ -2,29 +2,26 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+
   matplotlib,
   numpy,
   pillow,
   pytestCheckHook,
-  pythonOlder,
   setuptools,
   tensorflow,
   torch,
-  torchvision,
 }:
 
 buildPythonPackage rec {
   pname = "imgcat";
-  version = "0.5.0";
+  version = "0.6.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
-
   src = fetchFromGitHub {
     owner = "wookayin";
     repo = "python-imgcat";
     rev = "refs/tags/v${version}";
-    hash = "sha256-LFXfCMWMdOjFYhXba9PCCIYnqR7gTRG63NAoC/nD2wk=";
+    hash = "sha256-FsLa8Z4aKuj3E5twC2LTXZDM0apmyYfgeyZQu/wLdAo=";
   };
 
   postPatch = ''
@@ -41,16 +38,15 @@ buildPythonPackage rec {
     pytestCheckHook
     tensorflow
     torch
-    torchvision
   ];
 
   pythonImportsCheck = [ "imgcat" ];
 
-  meta = with lib; {
+  meta = {
     description = "Imgcat in Python";
     homepage = "https://github.com/wookayin/python-imgcat";
     changelog = "https://github.com/wookayin/python-imgcat/releases/tag/v${version}";
-    license = licenses.mit;
-    maintainers = with maintainers; [ fab ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/inform/default.nix b/pkgs/development/python-modules/inform/default.nix
index ab08f740e674..57340099310f 100644
--- a/pkgs/development/python-modules/inform/default.nix
+++ b/pkgs/development/python-modules/inform/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "inform";
-  version = "1.31";
+  version = "1.32";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "KenKundert";
     repo = "inform";
     rev = "refs/tags/v${version}";
-    hash = "sha256-o7yH7jCNn9gbcr7NMJVaYQOJ7hvwaY2ur1FyEP40Cco=";
+    hash = "sha256-RWcplWgGaIoiOZ28oPU4LtXQhwaTImc4bGHokHM5Kpg=";
   };
 
   nativeBuildInputs = [ flit-core ];
diff --git a/pkgs/development/python-modules/jupyter-ydoc/default.nix b/pkgs/development/python-modules/jupyter-ydoc/default.nix
index 5fa69f424fbd..7a5c9d6aaa02 100644
--- a/pkgs/development/python-modules/jupyter-ydoc/default.nix
+++ b/pkgs/development/python-modules/jupyter-ydoc/default.nix
@@ -18,13 +18,13 @@
 
 buildPythonPackage rec {
   pname = "jupyter-ydoc";
-  version = "3.0.0";
+  version = "3.0.1";
   pyproject = true;
 
   src = fetchPypi {
     pname = "jupyter_ydoc";
     inherit version;
-    hash = "sha256-nPOU7nxpVSh+6tERJq2DYIOpyjze8uJyIdxN/gW7arE=";
+    hash = "sha256-ztrp8+4KdyiDF/IbuBhI7WFnTRukaLDDlsFgomSiEGs=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/kafka-python-ng/default.nix b/pkgs/development/python-modules/kafka-python-ng/default.nix
index 79d253cacc8e..6252e1a5044a 100644
--- a/pkgs/development/python-modules/kafka-python-ng/default.nix
+++ b/pkgs/development/python-modules/kafka-python-ng/default.nix
@@ -15,7 +15,7 @@
 }:
 
 buildPythonPackage rec {
-  version = "2.2.2";
+  version = "2.2.3";
   pname = "kafka-python-ng";
   pyproject = true;
 
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "wbarnha";
     repo = "kafka-python-ng";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ELJvcj91MQ2RTjT1dwgnTGSSG5lP6B6/45dFgtNY2Cc=";
+    hash = "sha256-a2RFiBRh3S2YQBekpwEK74ow8bGlgWCGqSf2vcgYPYk=";
   };
 
   build-system = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/markdownify/default.nix b/pkgs/development/python-modules/markdownify/default.nix
index 12a3fcac60c6..aa69e9835c95 100644
--- a/pkgs/development/python-modules/markdownify/default.nix
+++ b/pkgs/development/python-modules/markdownify/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "markdownify";
-  version = "0.13.1";
+  version = "0.14.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "matthewwithanm";
     repo = "python-markdownify";
     rev = "refs/tags/${version}";
-    hash = "sha256-EqQ4DKIGaMNivw9cWCSP/Mh+1YxyTaHGPYRjGxPFOnA=";
+    hash = "sha256-YJdR1wV72f9/tWQhuhGwScuRcE243fCP+wnYAzBOoV8=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/neo4j/default.nix b/pkgs/development/python-modules/neo4j/default.nix
index 0aa2309df04b..958df3c078b1 100644
--- a/pkgs/development/python-modules/neo4j/default.nix
+++ b/pkgs/development/python-modules/neo4j/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "neo4j";
-  version = "5.26.0";
+  version = "5.27.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "neo4j";
     repo = "neo4j-python-driver";
     rev = "refs/tags/${version}";
-    hash = "sha256-4rvs313MU4EXqpnxRZPKy5Z64OJmQnsWRq9T0MIoaOo=";
+    hash = "sha256-tocgH2LuZ56Yej0lRWYHUkR6aqviQwJqG5P2g4P1+uk=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/publicsuffixlist/default.nix b/pkgs/development/python-modules/publicsuffixlist/default.nix
index 9259bd24e752..d1fa42772f6f 100644
--- a/pkgs/development/python-modules/publicsuffixlist/default.nix
+++ b/pkgs/development/python-modules/publicsuffixlist/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "publicsuffixlist";
-  version = "1.0.2.20241127";
+  version = "1.0.2.20241129";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-RoBtvaWAu9VRNSzbYkFZFEPvbUUu0tc/Z16bxm+ELas=";
+    hash = "sha256-MPeNx0jW1RLO1HwJqvFKuR4oEjmELA/bGHGDKn93rag=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pylint-django/default.nix b/pkgs/development/python-modules/pylint-django/default.nix
index 170fb0af1d60..9b080c52e730 100644
--- a/pkgs/development/python-modules/pylint-django/default.nix
+++ b/pkgs/development/python-modules/pylint-django/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "pylint-django";
-  version = "2.6.0";
+  version = "2.6.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "PyCQA";
     repo = "pylint-django";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Rnty8ryKd5PxFFVYcvB8p9VS3qlHCprxR8+/ySY5qC8=";
+    hash = "sha256-9b0Sbo6E036UmUmP/CVPrS9cxxKtkMMZtqJsI53g4sU=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/python-arango/default.nix b/pkgs/development/python-modules/python-arango/default.nix
index 2242b0b7c891..ed8ded65d5bc 100644
--- a/pkgs/development/python-modules/python-arango/default.nix
+++ b/pkgs/development/python-modules/python-arango/default.nix
@@ -33,7 +33,7 @@ in
 
 buildPythonPackage rec {
   pname = "python-arango";
-  version = "8.1.2";
+  version = "8.1.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -42,7 +42,7 @@ buildPythonPackage rec {
     owner = "arangodb";
     repo = "python-arango";
     rev = "refs/tags/${version}";
-    hash = "sha256-EK1jZajACdc5IWF/Tgg3albUAH566G0IwUsHk4dZpoQ=";
+    hash = "sha256-DNcKmjlolku0BiV+4G0TClIMAeBRWg96OZgv601V/LA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/python-can/default.nix b/pkgs/development/python-modules/python-can/default.nix
index d762c5f0ed69..4272950862f3 100644
--- a/pkgs/development/python-modules/python-can/default.nix
+++ b/pkgs/development/python-modules/python-can/default.nix
@@ -14,6 +14,7 @@
   pytestCheckHook,
   pythonOlder,
   setuptools,
+  setuptools-scm,
   typing-extensions,
   wrapt,
   uptime,
@@ -21,21 +22,22 @@
 
 buildPythonPackage rec {
   pname = "python-can";
-  version = "4.4.2";
+  version = "4.5.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "hardbyte";
     repo = "python-can";
     rev = "refs/tags/v${version}";
-    hash = "sha256-p3B1LWSygDX0UhIx4XhXv15H7Hwn9UB20jFIPDZnuNs=";
+    hash = "sha256-XCv2oOkGq8c2gTo+8UcZbuBYXyhhQstWLyddk3db38s=";
   };
 
-  pythonRelaxDeps = [ "msgpack" ];
-
-  build-system = [ setuptools ];
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
 
   dependencies = [
     msgpack
diff --git a/pkgs/development/python-modules/spotifyaio/default.nix b/pkgs/development/python-modules/spotifyaio/default.nix
index a94b02cfbf8c..c61848e4a5b0 100644
--- a/pkgs/development/python-modules/spotifyaio/default.nix
+++ b/pkgs/development/python-modules/spotifyaio/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "spotifyaio";
-  version = "0.8.8";
+  version = "0.8.10";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "joostlek";
     repo = "python-spotify";
     rev = "refs/tags/v${version}";
-    hash = "sha256-4u6YVkFeUF8jHrReFLnQGeC5qxfVyL8tuSHR8Ta74Hw=";
+    hash = "sha256-+DsJAhSY9gkW5wcVPlwiheDmZYT09y/YkU6Z470nKz0=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index 3e621c2a2a6d..02d532fa9072 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1273";
+  version = "3.0.1274";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-VuclFe6Msa4vll2X82a1LeKnq28H6xy+HYV3mLKu/jQ=";
+    hash = "sha256-TVslzZzLzs1B3WBoJVlyNbBj03c5q0YdtGIfxZ25Z2c=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/tskit/default.nix b/pkgs/development/python-modules/tskit/default.nix
index e91fba90dc77..a1b1edcf15af 100644
--- a/pkgs/development/python-modules/tskit/default.nix
+++ b/pkgs/development/python-modules/tskit/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "tskit";
-  version = "0.5.8";
+  version = "0.6.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Wq7ar96w5hdAyKMMvK4zjYln74RmX1l/VhvS++CN+Xk=";
+    hash = "sha256-ndoqzISujas0hN/ty3IYB6Tv5I4Vn3TySwd4lAS1QQY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/types-awscrt/default.nix b/pkgs/development/python-modules/types-awscrt/default.nix
index a783600fc5de..ff987b2deb25 100644
--- a/pkgs/development/python-modules/types-awscrt/default.nix
+++ b/pkgs/development/python-modules/types-awscrt/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "types-awscrt";
-  version = "0.23.0";
+  version = "0.23.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "types_awscrt";
     inherit version;
-    hash = "sha256-P9Ht6skj0ZVsDpB8lz+4O9pGW+rn8FRxazcbKT+bX9w=";
+    hash = "sha256-ogtCXauyWLw9B6Xn3lA/2VWN0VQtct55bnTkAsbUk7I=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/withings-sync/default.nix b/pkgs/development/python-modules/withings-sync/default.nix
index 8f1468ab3993..928403789a33 100644
--- a/pkgs/development/python-modules/withings-sync/default.nix
+++ b/pkgs/development/python-modules/withings-sync/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "withings-sync";
-  version = "4.2.5";
+  version = "4.2.6";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -21,9 +21,14 @@ buildPythonPackage rec {
     owner = "jaroslawhartman";
     repo = "withings-sync";
     rev = "refs/tags/v${version}";
-    hash = "sha256-4gxJwe8v4trTysGBNORX7C54EUzFIPwpVLfKSNxJ8y4=";
+    hash = "sha256-rljzE/sEVBqG2vWcKmoC2fm9I06onMmDkf60rkq9k3g=";
   };
 
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace-fail 'read(".VERSION")' '"${version}"'
+  '';
+
   build-system = [ setuptools ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/yapf/default.nix b/pkgs/development/python-modules/yapf/default.nix
index 38e62c57eef8..dfe624106627 100644
--- a/pkgs/development/python-modules/yapf/default.nix
+++ b/pkgs/development/python-modules/yapf/default.nix
@@ -59,7 +59,6 @@ buildPythonPackage rec {
     license = lib.licenses.asl20;
     mainProgram = "yapf";
     maintainers = with lib.maintainers; [
-      AndersonTorres
       siddharthist
     ];
   };
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index 8c246c084ff8..9982f82da591 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "checkov";
-  version = "3.2.316";
+  version = "3.2.322";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     rev = "refs/tags/${version}";
-    hash = "sha256-dPjeKMDRPuT0zh7VXeTvw42YRElorJPEQHjrEllKgfA=";
+    hash = "sha256-75KNuTCTk5eohTg0M2wrcS9xySDqN1LR6UomF3ZEQmM=";
   };
 
   patches = [ ./flake8-compat-5.x.patch ];
diff --git a/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix b/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
index aa29308798c3..ba2a84127703 100644
--- a/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
@@ -159,7 +159,8 @@ let
   };
 
   bazelFhs = buildFHSEnv {
-    name = "bazel";
+    pname = "bazel";
+    inherit version;
     targetPkgs = _: [ bazelBootstrap ];
     runScript = "bazel";
   };
diff --git a/pkgs/development/tools/misc/blackfire/default.nix b/pkgs/development/tools/misc/blackfire/default.nix
index af4f83d54bae..bf8d7c818667 100644
--- a/pkgs/development/tools/misc/blackfire/default.nix
+++ b/pkgs/development/tools/misc/blackfire/default.nix
@@ -10,7 +10,7 @@
 
 stdenv.mkDerivation rec {
   pname = "blackfire";
-  version = "2.28.13";
+  version = "2.28.20";
 
   src = passthru.sources.${stdenv.hostPlatform.system} or (throw "Unsupported platform for blackfire: ${stdenv.hostPlatform.system}");
 
@@ -57,23 +57,23 @@ stdenv.mkDerivation rec {
     sources = {
       "x86_64-linux" = fetchurl {
         url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire/blackfire_${version}_amd64.deb";
-        sha256 = "cNzmvdsFkDj2W4KG8ZxVY2mfRHTAgq+XOTQtnl3UwvU=";
+        sha256 = "Xr7LILxFVUMq37rHHbzjqgjlnC/XHVTtnyCIBVwOwW8=";
       };
       "i686-linux" = fetchurl {
         url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire/blackfire_${version}_i386.deb";
-        sha256 = "ZJ2fNJ2W66u0E48wgUO/XlsHSfifhcikb0LG2JncWJ0=";
+        sha256 = "fnyz1+lsLJQb42Oh17/dFfaSp1FFfr1k/EzpOGTZdRs=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire/blackfire_${version}_arm64.deb";
-        sha256 = "PculxxgMBMpUCsKB2YCQKZ7s8SrT2rIY7La1s8mCQ4g=";
+        sha256 = "17iHlezCAG1lnN+YYEXIeX9TkJ+7eDPgA0p0byIVlZE=";
       };
       "aarch64-darwin" = fetchurl {
         url = "https://packages.blackfire.io/blackfire/${version}/blackfire-darwin_arm64.pkg.tar.gz";
-        sha256 = "FVQrzZr0LBSLmcK8k3QIWQiCk9WMVXOJY2MNW+w/1g8=";
+        sha256 = "5bMOk02OY60LR9QMMXuiUP5mJvJBkxPHT+n5QUN41dQ=";
       };
       "x86_64-darwin" = fetchurl {
         url = "https://packages.blackfire.io/blackfire/${version}/blackfire-darwin_amd64.pkg.tar.gz";
-        sha256 = "/MCihH97/W8iMsW10EMdSaj+ZWBigaWDF3GR2WYnh+A=";
+        sha256 = "QB+Ie6oArBnNQ3AtQV46/ZXcuH1WLGZQb7U0pv/K+Sw=";
       };
     };
 
diff --git a/pkgs/development/tools/misc/blackfire/php-probe.nix b/pkgs/development/tools/misc/blackfire/php-probe.nix
index fe07298b47f3..eee55e34faeb 100644
--- a/pkgs/development/tools/misc/blackfire/php-probe.nix
+++ b/pkgs/development/tools/misc/blackfire/php-probe.nix
@@ -15,47 +15,47 @@ let
   phpMajor = lib.versions.majorMinor php.version;
   inherit (stdenv.hostPlatform) system;
 
-  version = "1.92.25";
+  version = "1.92.28";
 
   hashes = {
     "x86_64-linux" = {
       system = "amd64";
       hash = {
-        "8.1" = "sha256-owV7Eo/2Qszm5alNppm6DHS7YLZyFDHnQ//jRfM+m1s=";
-        "8.2" = "sha256-1eECdIo+eET5tZz9neuC8WRtuJpNbJz+A2i0J9lqnms=";
-        "8.3" = "sha256-rfY849xL5AjWNtzzLIud+8+JWuOpmhNM7pdpR1tnNmo=";
+        "8.1" = "sha256-zJ6SOBGLzu3C47P9BrQCQjPVSpZq3PPLPfhXjL7Rnns=";
+        "8.2" = "sha256-jiHmAs2O047sjOzOTk/k2VQXBz6OT+kBlTElW3TSZjU=";
+        "8.3" = "sha256-yop48pyCT/904Sh9hQTCVagc38giLDDZJebtdTRQV3w=";
       };
     };
     "i686-linux" = {
       system = "i386";
       hash = {
-        "8.1" = "sha256-b3Dy18FawjtuiASwYCdS1Q5gOv1WSx6f3ESwow8wj4E=";
-        "8.2" = "sha256-vFNT/KR1RkxsYwjxLZewSYv2MbG1P7qdcxwzGZho7as=";
-        "8.3" = "sha256-TtsWgvrw4orrOFTuWPaPlS3LT9d101HiCGIrBKz4MaI=";
+        "8.1" = "sha256-wK/P+4K0fmyzIsrp360TaNSxiols5KVIvMY6ABdXN+s=";
+        "8.2" = "sha256-jJId/K7+27UbCMeWwT1Z0sMOe6Uj2Gw6FgBTv794rwQ=";
+        "8.3" = "sha256-Am8UKQCxAn2up4laZ/u55vVKIJSdunuc85amSWQg8wI=";
       };
     };
     "aarch64-linux" = {
       system = "arm64";
       hash = {
-        "8.1" = "sha256-bCS3gfUDr68KKmWy73G9ripYlCTAZuMssThyEDCGDgM=";
-        "8.2" = "sha256-FQlfdsVeClSLLCJqQPp0fo1CqpshkTo1iUw/9QI9JBc=";
-        "8.3" = "sha256-cThRmDf1HTaCT/KuvT3TMcmsCMky407p9u3hwtGtWDQ=";
+        "8.1" = "sha256-JtEKfZnPqWCBUUHrhlnc/My+zllVySiJlsgdSYP3s5A=";
+        "8.2" = "sha256-FMd17GarNGlCO5a9X4I1SVo0qKIjsBaJMtLCcoi/uvk=";
+        "8.3" = "sha256-ZFckNiN0cAQEoc7m53MH/fiTNrWTLzIDzjpvsSbd0Xo=";
       };
     };
     "aarch64-darwin" = {
       system = "arm64";
       hash = {
-        "8.1" = "sha256-ZbUUtljjvQ0dcly/eTovTECTZn9OOcx3VDe1gKEICyA=";
-        "8.2" = "sha256-8xjs5IrsdbcjmTfni/hbtN+qFmnUgFK3KG8ntbNgBeI=";
-        "8.3" = "sha256-kDf+5rATt6/DMH5zZoom2Y5j/6CFFj8claJHlMq285o=";
+        "8.1" = "sha256-fI1ACatqdKQJqh5fBWC1ikLUEsXfqegJlJWUDQYiI2w=";
+        "8.2" = "sha256-BhSL2ee1viVKoS3R1F/kuHgzyojDk3Pxrvor/xQ3b+4=";
+        "8.3" = "sha256-fZk0n/nUSOyQNXhUObGwZj0n7MBM7RS86ShKkEfRDws=";
       };
     };
     "x86_64-darwin" = {
       system = "amd64";
       hash = {
-        "8.1" = "sha256-i1QxRGump5G3eMKjXFokqRr9FD6wsdPoUbjE7w3/a0A=";
-        "8.2" = "sha256-O7L4LgAbLRsz/F+esGwwnxAdD1gT30QEy3FEOQxTNu0=";
-        "8.3" = "sha256-a5oCtzCb8T/bA5GOOfyN7dMzeK29ZUBZceEnlqme41I=";
+        "8.1" = "sha256-YglriIPnixhsg1wlLHyu17CUETVEPOenu41Gq7maewU=";
+        "8.2" = "sha256-zvucvA2w1gQMApud2ozIK5BY4noSUooruRXjevELeBw=";
+        "8.3" = "sha256-hMRZHO4sVZCVHBifyVAD2b59Be8teqx+/QKH+ytQKuI=";
       };
     };
   };
diff --git a/pkgs/development/tools/nwjs/default.nix b/pkgs/development/tools/nwjs/default.nix
index 408584de712e..240b1e067fc2 100644
--- a/pkgs/development/tools/nwjs/default.nix
+++ b/pkgs/development/tools/nwjs/default.nix
@@ -117,7 +117,7 @@ stdenv.mkDerivation {
 
   preFixup = ''
     gappsWrapperArgs+=(
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}"
     )
   '';
 
diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix
index 36b5e8d7a5e2..860fcb1cc0a4 100644
--- a/pkgs/development/tools/pnpm/default.nix
+++ b/pkgs/development/tools/pnpm/default.nix
@@ -12,8 +12,8 @@ let
       hash = "sha256-2qJ6C1QbxjUyP/lsLe2ZVGf/n+bWn/ZwIVWKqa2dzDY=";
     };
     "9" = {
-      version = "9.14.2";
-      hash = "sha256-BuZaSWW6/21gl/nI91w19tQgl028A9d1AJBWpp7f0nE=";
+      version = "9.14.4";
+      hash = "sha256-JqcmtjO2KaP6vaAG9pauQmCVSjYyyAVBEteuiXeeX5o=";
     };
   };
 
diff --git a/pkgs/games/anki/sync-server.nix b/pkgs/games/anki/sync-server.nix
index 0b351ae3ffad..a312887f5d27 100644
--- a/pkgs/games/anki/sync-server.nix
+++ b/pkgs/games/anki/sync-server.nix
@@ -1,12 +1,11 @@
-{ lib
-, stdenv
-, rustPlatform
-, anki
-, darwin
+{
+  lib,
+  rustPlatform,
+  anki,
 
-, openssl
-, pkg-config
-, protobuf
+  openssl,
+  pkg-config,
+  buildPackages,
 }:
 
 rustPlatform.buildRustPackage {
@@ -30,22 +29,21 @@ rustPlatform.buildRustPackage {
     "--skip=scheduler::answering::test::state_application"
   ];
 
-  nativeBuildInputs = [ protobuf pkg-config ];
+  nativeBuildInputs = [
+    pkg-config
+  ];
 
   buildInputs = [
     openssl
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-    darwin.apple_sdk.frameworks.SystemConfiguration
   ];
 
-  env.PROTOC = lib.getExe protobuf;
+  env.PROTOC = lib.getExe buildPackages.protobuf;
 
-  meta = with lib; {
+  meta = {
     description = "Standalone official anki sync server";
     homepage = "https://apps.ankiweb.net";
-    license = with licenses; [ agpl3Plus ];
-    maintainers = with maintainers; [ martinetd ];
+    license = with lib.licenses; [ agpl3Plus ];
+    maintainers = with lib.maintainers; [ martinetd ];
     mainProgram = "anki-sync-server";
   };
 }
diff --git a/pkgs/misc/fastly/default.nix b/pkgs/misc/fastly/default.nix
index ed499cddd0e6..75ad66776bf5 100644
--- a/pkgs/misc/fastly/default.nix
+++ b/pkgs/misc/fastly/default.nix
@@ -10,13 +10,13 @@
 
 buildGoModule rec {
   pname = "fastly";
-  version = "10.16.0";
+  version = "10.17.0";
 
   src = fetchFromGitHub {
     owner = "fastly";
     repo = "cli";
     rev = "refs/tags/v${version}";
-    hash = "sha256-CDqv0umkG7VVhP6M3uuxIhifgHA4UDWtCUJZsXCLGfc=";
+    hash = "sha256-auCKY8dpA9MPzDN3laTLP6rwNxSHuAlTxjEWErLBJMs=";
     # The git commit is part of the `fastly version` original output;
     # leave that output the same in nixpkgs. Use the `.git` directory
     # to retrieve the commit SHA, and remove the directory afterwards,
diff --git a/pkgs/servers/nextcloud/packages/28.json b/pkgs/servers/nextcloud/packages/28.json
index b48b3c64342d..0d570221cc1c 100644
--- a/pkgs/servers/nextcloud/packages/28.json
+++ b/pkgs/servers/nextcloud/packages/28.json
@@ -50,9 +50,9 @@
     ]
   },
   "deck": {
-    "hash": "sha256-XzflNdPCNfOYJkZopxBR6es0Fv9x0kpxtMqOxLthG6o=",
-    "url": "https://github.com/nextcloud-releases/deck/releases/download/v1.12.5/deck-v1.12.5.tar.gz",
-    "version": "1.12.5",
+    "hash": "sha256-63yeX5w8nOdZuzbICJ6hJCjIHzigBKJToTPoEVPm/EE=",
+    "url": "https://github.com/nextcloud-releases/deck/releases/download/v1.12.6/deck-v1.12.6.tar.gz",
+    "version": "1.12.6",
     "description": "Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud.\n\n\n- 📥 Add your tasks to cards and put them in order\n- 📄 Write down additional notes in Markdown\n- 🔖 Assign labels for even better organization\n- 👥 Share with your team, friends or family\n- 📎 Attach files and embed them in your Markdown description\n- 💬 Discuss with your team using comments\n- ⚡ Keep track of changes in the activity stream\n- 🚀 Get your project organized",
     "homepage": "https://github.com/nextcloud/deck",
     "licenses": [
@@ -70,9 +70,9 @@
     ]
   },
   "files_mindmap": {
-    "hash": "sha256-VsaJT3lsPqnCmgLYkkdLhyIRmi/CumEdezsvhra2NQk=",
-    "url": "https://github.com/ACTom/files_mindmap/releases/download/v0.0.30/files_mindmap-0.0.30.tar.gz",
-    "version": "0.0.30",
+    "hash": "sha256-USwTVkcEDzmaJMMaztf86yag5t7b79sQW8OOHEw0hec=",
+    "url": "https://github.com/ACTom/files_mindmap/releases/download/v0.0.31/files_mindmap-0.0.31.tar.gz",
+    "version": "0.0.31",
     "description": "This application enables Nextcloud users to open, save and edit mind map files in the web browser. If enabled, an entry in the New button at the top of the web browser the Mindmap file entry appears. When clicked, a new mindmap file opens in the browser and the file can be saved into the current Nextcloud directory.",
     "homepage": "https://github.com/ACTom/files_mindmap",
     "licenses": [
@@ -80,9 +80,9 @@
     ]
   },
   "forms": {
-    "hash": "sha256-iU2bqojO+pvMvKDiw+ANMvsH71Ul+8yQ+uNvJfa1ngc=",
-    "url": "https://github.com/nextcloud-releases/forms/releases/download/v4.3.2/forms-v4.3.2.tar.gz",
-    "version": "4.3.2",
+    "hash": "sha256-NW57bhZiNqKfUhMvGN9Ncy21Y0GucC/CFCmHTf8kJ2I=",
+    "url": "https://github.com/nextcloud-releases/forms/releases/download/v4.3.4/forms-v4.3.4.tar.gz",
+    "version": "4.3.4",
     "description": "**Simple surveys and questionnaires, self-hosted!**\n\n- **📝 Simple design:** No mass of options, only the essentials. Works well on mobile of course.\n- **📊 View & export results:** Results are visualized and can also be exported as CSV in the same format used by Google Forms.\n- **🔒 Data under your control!** Unlike in Google Forms, Typeform, Doodle and others, the survey info and responses are kept private on your instance.\n- **🧑‍💻 Connect to your software:** Easily integrate Forms into your service with our full-fledged [REST-API](https://github.com/nextcloud/forms/blob/main/docs/API.md).\n- **🙋 Get involved!** We have lots of stuff planned like more question types, collaboration on forms, [and much more](https://github.com/nextcloud/forms/milestones)!",
     "homepage": "https://github.com/nextcloud/forms",
     "licenses": [
@@ -103,7 +103,7 @@
     "hash": "sha256-Plgmnp3fIzvHVcy8+wEmjNHegHqBeUtcbsRA/PHEAlc=",
     "url": "https://github.com/nextcloud-releases/groupfolders/releases/download/v16.0.11/groupfolders-v16.0.11.tar.gz",
     "version": "16.0.11",
-    "description": "Admin configured folders shared with everyone in a group.\n\nFolders can be configured from *Group folders* in the admin settings.\n\nAfter a folder is created, the admin can give access to the folder to one or more groups, control their write/sharing permissions and assign a quota for the folder.",
+    "description": "Admin configured folders shared with everyone in a group.\n\nFolders can be configured from *Group folders* in the admin settings.\n\nAfter a folder is created, the admin can give access to the folder to one or more groups, control their write/sharing permissions and assign a quota for the folder.\n\nNote: Encrypting the contents of group folders is currently not supported.",
     "homepage": "https://github.com/nextcloud/groupfolders",
     "licenses": [
       "agpl"
@@ -123,7 +123,7 @@
     "hash": "sha256-qU86h6DHNetWOmt7yXCknQ3MBB9KdQ15UDJggqZgWMk=",
     "url": "https://github.com/nextcloud-releases/integration_openai/releases/download/v2.0.3/integration_openai-v2.0.3.tar.gz",
     "version": "2.0.3",
-    "description": "⚠️ The smart pickers have been removed from this app\nas they are now included in the [Assistant app](https://apps.nextcloud.com/apps/assistant).\n\nThis app implements:\n\n* Text generation providers: Free prompt, Summarize, Headline, Context write, Chat, and Reformulate (using any available large language model)\n* A Translation provider (using any available language model)\n* A SpeechToText provider (using Whisper)\n* An image generation provider\n\nInstead of connecting to the OpenAI API for these, you can also connect to a self-hosted [LocalAI](https://localai.io) instance\nor to any service that implements an API similar to the OpenAI one, for example: [Plusserver](https://www.plusserver.com/en/ai-platform/) or [MistralAI](https://mistral.ai).\n\n## Ethical AI Rating\n### Rating for Text generation using ChatGPT via the OpenAI API: 🔴\n\nNegative:\n* The software for training and inference of this model is proprietary, limiting running it locally or training by yourself\n* The trained model is not freely available, so the model can not be run on-premises\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model's performance and CO2 usage.\n\n\n### Rating for Translation using ChatGPT via the OpenAI API: 🔴\n\nNegative:\n* The software for training and inference of this model is proprietary, limiting running it locally or training by yourself\n* The trained model is not freely available, so the model can not be run on-premises\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model's performance and CO2 usage.\n\n### Rating for Image generation using DALL·E via the OpenAI API: 🔴\n\nNegative:\n* The software for training and inferencing of this model is proprietary, limiting running it locally or training by yourself\n* The trained model is not freely available, so the model can not be ran on-premises\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model’s performance and CO2 usage.\n\n\n### Rating for Speech-To-Text using Whisper via the OpenAI API: 🟡\n\nPositive:\n* The software for training and inferencing of this model is open source\n* The trained model is freely available, and thus can run on-premise\n\nNegative:\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model’s performance and CO2 usage.\n\n### Rating for Text generation via LocalAI: 🟢\n\nPositive:\n* The software for training and inferencing of this model is open source\n* The trained model is freely available, and thus can be ran on-premises\n* The training data is freely available, making it possible to check or correct for bias or optimise the performance and CO2 usage.\n\n\n### Rating for Image generation using Stable Diffusion via LocalAI : 🟡\n\nPositive:\n* The software for training and inferencing of this model is open source\n* The trained model is freely available, and thus can be ran on-premises\n\nNegative:\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model’s performance and CO2 usage.\n\n\n### Rating for Speech-To-Text using Whisper via LocalAI: 🟡\n\nPositive:\n* The software for training and inferencing of this model is open source\n* The trained model is freely available, and thus can be ran on-premises\n\nNegative:\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model’s performance and CO2 usage.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
+    "description": "⚠️ The smart pickers have been removed from this app\nas they are now included in the [Assistant app](https://apps.nextcloud.com/apps/assistant).\n\nThis app implements:\n\n* Text generation providers: Free prompt, Summarize, Headline, Context Write, Chat, and Reformulate (using any available large language model)\n* A Translation provider (using any available language model)\n* A SpeechToText provider (using Whisper)\n* An image generation provider\n\n⚠️ Context Write, Summarize, Headline and Reformulate have mainly been tested with OpenAI.\nThey might work when connecting to other services, without any guarantee.\n\nInstead of connecting to the OpenAI API for these, you can also connect to a self-hosted [LocalAI](https://localai.io) instance or [Ollama](https://ollama.com/) instance\nor to any service that implements an API similar to the OpenAI one, for example: [Plusserver](https://www.plusserver.com/en/ai-platform/) or [MistralAI](https://mistral.ai).\n\n⚠️ This app is mainly tested with OpenAI. We do not guarantee it works perfectly\nwith other services that implement OpenAI-compatible APIs with slight differences.\n\n## Improve AI task pickup speed\n\nTo avoid task processing execution delay, setup at 4 background job workers in the main server (where Nextcloud is installed). The setup process is documented here: https://docs.nextcloud.com/server/latest/admin_manual/ai/overview.html#improve-ai-task-pickup-speed\n\n## Ethical AI Rating\n### Rating for Text generation using ChatGPT via the OpenAI API: 🔴\n\nNegative:\n* The software for training and inference of this model is proprietary, limiting running it locally or training by yourself\n* The trained model is not freely available, so the model can not be run on-premises\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model's performance and CO2 usage.\n\n\n### Rating for Translation using ChatGPT via the OpenAI API: 🔴\n\nNegative:\n* The software for training and inference of this model is proprietary, limiting running it locally or training by yourself\n* The trained model is not freely available, so the model can not be run on-premises\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model's performance and CO2 usage.\n\n### Rating for Image generation using DALL·E via the OpenAI API: 🔴\n\nNegative:\n* The software for training and inferencing of this model is proprietary, limiting running it locally or training by yourself\n* The trained model is not freely available, so the model can not be ran on-premises\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model’s performance and CO2 usage.\n\n\n### Rating for Speech-To-Text using Whisper via the OpenAI API: 🟡\n\nPositive:\n* The software for training and inferencing of this model is open source\n* The trained model is freely available, and thus can run on-premise\n\nNegative:\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model’s performance and CO2 usage.\n\n### Rating for Text generation via LocalAI: 🟢\n\nPositive:\n* The software for training and inferencing of this model is open source\n* The trained model is freely available, and thus can be ran on-premises\n* The training data is freely available, making it possible to check or correct for bias or optimise the performance and CO2 usage.\n\n\n### Rating for Image generation using Stable Diffusion via LocalAI : 🟡\n\nPositive:\n* The software for training and inferencing of this model is open source\n* The trained model is freely available, and thus can be ran on-premises\n\nNegative:\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model’s performance and CO2 usage.\n\n\n### Rating for Speech-To-Text using Whisper via LocalAI: 🟡\n\nPositive:\n* The software for training and inferencing of this model is open source\n* The trained model is freely available, and thus can be ran on-premises\n\nNegative:\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model’s performance and CO2 usage.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
     "homepage": "https://github.com/nextcloud/integration_openai",
     "licenses": [
       "agpl"
@@ -140,9 +140,9 @@
     ]
   },
   "mail": {
-    "hash": "sha256-Y591RR3m4k8G0+sNU+hRN013LikCFJ/41SbrILEfp8A=",
-    "url": "https://github.com/nextcloud-releases/mail/releases/download/v3.7.9/mail-v3.7.9.tar.gz",
-    "version": "3.7.9",
+    "hash": "sha256-cgwXyqxeZggsd6RhrSPbwim2Yzg7ztWcrEgo3ocFO44=",
+    "url": "https://github.com/nextcloud-releases/mail/releases/download/v3.7.13/mail-v3.7.13.tar.gz",
+    "version": "3.7.13",
     "description": "**💌 A mail app for Nextcloud**\n\n- **🚀 Integration with other Nextcloud apps!** Currently Contacts, Calendar & Files – more to come.\n- **📥 Multiple mail accounts!** Personal and company account? No problem, and a nice unified inbox. Connect any IMAP account.\n- **🔒 Send & receive encrypted mails!** Using the great [Mailvelope](https://mailvelope.com) browser extension.\n- **🙈 We’re not reinventing the wheel!** Based on the great [Horde](https://horde.org) libraries.\n- **📬 Want to host your own mail server?** We do not have to reimplement this as you could set up [Mail-in-a-Box](https://mailinabox.email)!\n\n## Ethical AI Rating\n\n### Priority Inbox\n\nPositive:\n* The software for training and inferencing of this model is open source.\n* The model is created and trained on-premises based on the user's own data.\n* The training data is accessible to the user, making it possible to check or correct for bias or optimise the performance and CO2 usage.\n\n### Thread Summaries (opt-in)\n\n**Rating:** 🟢/🟡/🟠/🔴\n\nThe rating depends on the installed text processing backend. See [the rating overview](https://docs.nextcloud.com/server/latest/admin_manual/ai/index.html) for details.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
     "homepage": "https://github.com/nextcloud/mail#readme",
     "licenses": [
@@ -220,9 +220,9 @@
     ]
   },
   "polls": {
-    "hash": "sha256-rLNB0idaKoL4e5O5NYXyhIyFpYguDG4Hg5OkHUEaQUM=",
-    "url": "https://github.com/nextcloud-releases/polls/releases/download/v7.2.4/polls-v7.2.4.tar.gz",
-    "version": "7.2.4",
+    "hash": "sha256-7KSQDY2LXMWEbo3PFH3VMfq819swNnxCT5kiFvHI83s=",
+    "url": "https://github.com/nextcloud-releases/polls/releases/download/v7.2.5/polls-v7.2.5.tar.gz",
+    "version": "7.2.5",
     "description": "A polls app, similar to Doodle/Dudle with the possibility to restrict access (members, certain groups/users, hidden and public).",
     "homepage": "https://github.com/nextcloud/polls",
     "licenses": [
@@ -230,9 +230,9 @@
     ]
   },
   "previewgenerator": {
-    "hash": "sha256-hjlwZfgfoH3iqbtJrPovgBC0Tu/vBhFqC752DZvndFY=",
-    "url": "https://github.com/nextcloud-releases/previewgenerator/releases/download/v5.6.0/previewgenerator-v5.6.0.tar.gz",
-    "version": "5.6.0",
+    "hash": "sha256-kTYmN/tAJwjj2KwnrKVIZa5DhyXHjuNWNskqJZxs4sY=",
+    "url": "https://github.com/nextcloud-releases/previewgenerator/releases/download/v5.7.0/previewgenerator-v5.7.0.tar.gz",
+    "version": "5.7.0",
     "description": "The Preview Generator app allows admins to pre-generate previews. The app listens to edit events and stores this information. Once a cron job is triggered it will generate start preview generation. This means that you can better utilize your system by pre-generating previews when your system is normally idle and thus putting less load on your machine when the requests are actually served.\n\nThe app does not replace on demand preview generation so if a preview is requested before it is pre-generated it will still be shown.\nThe first time you install this app, before using a cron job, you properly want to generate all previews via:\n**./occ preview:generate-all -vvv**\n\n**Important**: To enable pre-generation of previews you must add **php /var/www/nextcloud/occ preview:pre-generate** to a system cron job that runs at times of your choosing.",
     "homepage": "https://github.com/nextcloud/previewgenerator",
     "licenses": [
@@ -240,9 +240,9 @@
     ]
   },
   "qownnotesapi": {
-    "hash": "sha256-jnKtJrzW5FzrluO5S+2Qdrune6TfWDOXlOh9xNm8h1M=",
-    "url": "https://github.com/pbek/qownnotesapi/releases/download/v24.9.0/qownnotesapi-nc.tar.gz",
-    "version": "24.9.0",
+    "hash": "sha256-ydz8e8ZOLOT60yt55DI0gGpSaLz9sCz5Zyt1jhMYIv0=",
+    "url": "https://github.com/pbek/qownnotesapi/releases/download/v24.11.0/qownnotesapi-nc.tar.gz",
+    "version": "24.11.0",
     "description": "QOwnNotesAPI is the Nextcloud/ownCloud API for [QOwnNotes](http://www.qownnotes.org), the open source notepad for Linux, macOS and Windows, that works together with the notes application of Nextcloud/ownCloud.\n\nThe only purpose of this App is to provide API access to your Nextcloud/ownCloud server for your QOwnNotes desktop installation, you cannot use this App for anything else, if you don't have QOwnNotes installed on your desktop computer!",
     "homepage": "https://github.com/pbek/qownnotesapi",
     "licenses": [
@@ -320,9 +320,9 @@
     ]
   },
   "unsplash": {
-    "hash": "sha256-kNDQk4HYkrBA+o+5/bNYj65ZJbViBjhnbSA87tsu6YE=",
-    "url": "https://github.com/nextcloud/unsplash/releases/download/v3.0.2/unsplash.tar.gz",
-    "version": "3.0.1",
+    "hash": "sha256-hUKpIGvu7aX45Pz/xCssOuyZ7E+kJ4cmqhhycX5DG6A=",
+    "url": "https://github.com/nextcloud/unsplash/releases/download/v3.0.3/unsplash.tar.gz",
+    "version": "3.0.3",
     "description": "Show a new random featured nature photo in your nextcloud. Now with choosable motives!",
     "homepage": "https://github.com/nextcloud/unsplash/",
     "licenses": [
diff --git a/pkgs/servers/nextcloud/packages/29.json b/pkgs/servers/nextcloud/packages/29.json
index 7254d237e70d..33995969a6ee 100644
--- a/pkgs/servers/nextcloud/packages/29.json
+++ b/pkgs/servers/nextcloud/packages/29.json
@@ -20,9 +20,9 @@
     ]
   },
   "contacts": {
-    "hash": "sha256-48ERJ9DQ9w71encT2XVvcVaV+EbthgExQliKO1sQ+1A=",
-    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v6.0.0/contacts-v6.0.0.tar.gz",
-    "version": "6.0.0",
+    "hash": "sha256-gOOb++cylFsD7dSe5ZOBgTxLgO6Aa3om4q3Y79ElcfI=",
+    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v6.0.1/contacts-v6.0.1.tar.gz",
+    "version": "6.0.1",
     "description": "The Nextcloud contacts app is a user interface for Nextcloud's CardDAV server. Easily sync contacts from various devices with your Nextcloud and edit them online.\n\n* 🚀 **Integration with other Nextcloud apps!** Currently Mail and Calendar – more to come.\n* 🎉 **Never forget a birthday!** You can sync birthdays and other recurring events with your Nextcloud Calendar.\n* 👥 **Sharing of Adressbooks!** You want to share your contacts with your friends or coworkers? No problem!\n* 🙈 **We’re not reinventing the wheel!** Based on the great and open SabreDAV library.",
     "homepage": "https://github.com/nextcloud/contacts#readme",
     "licenses": [
@@ -50,9 +50,9 @@
     ]
   },
   "deck": {
-    "hash": "sha256-3vwl+KxYQTDAANdR3XKLU/jv5TbhDZBktKpITJaaGBo=",
-    "url": "https://github.com/nextcloud-releases/deck/releases/download/v1.13.2/deck-v1.13.2.tar.gz",
-    "version": "1.13.2",
+    "hash": "sha256-yhUkB1IodvWOg2fl+gJW3x68YrG0+eyIrrlpXTFVAwE=",
+    "url": "https://github.com/nextcloud-releases/deck/releases/download/v1.13.3/deck-v1.13.3.tar.gz",
+    "version": "1.13.3",
     "description": "Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud.\n\n\n- 📥 Add your tasks to cards and put them in order\n- 📄 Write down additional notes in Markdown\n- 🔖 Assign labels for even better organization\n- 👥 Share with your team, friends or family\n- 📎 Attach files and embed them in your Markdown description\n- 💬 Discuss with your team using comments\n- ⚡ Keep track of changes in the activity stream\n- 🚀 Get your project organized",
     "homepage": "https://github.com/nextcloud/deck",
     "licenses": [
@@ -69,10 +69,20 @@
       "agpl"
     ]
   },
+  "files_mindmap": {
+    "hash": "sha256-USwTVkcEDzmaJMMaztf86yag5t7b79sQW8OOHEw0hec=",
+    "url": "https://github.com/ACTom/files_mindmap/releases/download/v0.0.31/files_mindmap-0.0.31.tar.gz",
+    "version": "0.0.31",
+    "description": "This application enables Nextcloud users to open, save and edit mind map files in the web browser. If enabled, an entry in the New button at the top of the web browser the Mindmap file entry appears. When clicked, a new mindmap file opens in the browser and the file can be saved into the current Nextcloud directory.",
+    "homepage": "https://github.com/ACTom/files_mindmap",
+    "licenses": [
+      "agpl"
+    ]
+  },
   "forms": {
-    "hash": "sha256-iU2bqojO+pvMvKDiw+ANMvsH71Ul+8yQ+uNvJfa1ngc=",
-    "url": "https://github.com/nextcloud-releases/forms/releases/download/v4.3.2/forms-v4.3.2.tar.gz",
-    "version": "4.3.2",
+    "hash": "sha256-NW57bhZiNqKfUhMvGN9Ncy21Y0GucC/CFCmHTf8kJ2I=",
+    "url": "https://github.com/nextcloud-releases/forms/releases/download/v4.3.4/forms-v4.3.4.tar.gz",
+    "version": "4.3.4",
     "description": "**Simple surveys and questionnaires, self-hosted!**\n\n- **📝 Simple design:** No mass of options, only the essentials. Works well on mobile of course.\n- **📊 View & export results:** Results are visualized and can also be exported as CSV in the same format used by Google Forms.\n- **🔒 Data under your control!** Unlike in Google Forms, Typeform, Doodle and others, the survey info and responses are kept private on your instance.\n- **🧑‍💻 Connect to your software:** Easily integrate Forms into your service with our full-fledged [REST-API](https://github.com/nextcloud/forms/blob/main/docs/API.md).\n- **🙋 Get involved!** We have lots of stuff planned like more question types, collaboration on forms, [and much more](https://github.com/nextcloud/forms/milestones)!",
     "homepage": "https://github.com/nextcloud/forms",
     "licenses": [
@@ -90,10 +100,10 @@
     ]
   },
   "groupfolders": {
-    "hash": "sha256-/pREdGW7kM2imVx6Jk5iZ9odQpk/93AwkFECVPJhyuI=",
-    "url": "https://github.com/nextcloud-releases/groupfolders/releases/download/v17.0.5/groupfolders-v17.0.5.tar.gz",
-    "version": "17.0.5",
-    "description": "Admin configured folders shared with everyone in a group.\n\nFolders can be configured from *Group folders* in the admin settings.\n\nAfter a folder is created, the admin can give access to the folder to one or more groups, control their write/sharing permissions and assign a quota for the folder.",
+    "hash": "sha256-Mkt6rp/cFSQE6WnSE1Xds57qcuEfEQj3Y//2E6gVI4o=",
+    "url": "https://github.com/nextcloud-releases/groupfolders/releases/download/v17.0.6/groupfolders-v17.0.6.tar.gz",
+    "version": "17.0.6",
+    "description": "Admin configured folders shared with everyone in a group.\n\nFolders can be configured from *Group folders* in the admin settings.\n\nAfter a folder is created, the admin can give access to the folder to one or more groups, control their write/sharing permissions and assign a quota for the folder.\n\nNote: Encrypting the contents of group folders is currently not supported.",
     "homepage": "https://github.com/nextcloud/groupfolders",
     "licenses": [
       "agpl"
@@ -113,7 +123,7 @@
     "hash": "sha256-qU86h6DHNetWOmt7yXCknQ3MBB9KdQ15UDJggqZgWMk=",
     "url": "https://github.com/nextcloud-releases/integration_openai/releases/download/v2.0.3/integration_openai-v2.0.3.tar.gz",
     "version": "2.0.3",
-    "description": "⚠️ The smart pickers have been removed from this app\nas they are now included in the [Assistant app](https://apps.nextcloud.com/apps/assistant).\n\nThis app implements:\n\n* Text generation providers: Free prompt, Summarize, Headline, Context write, Chat, and Reformulate (using any available large language model)\n* A Translation provider (using any available language model)\n* A SpeechToText provider (using Whisper)\n* An image generation provider\n\nInstead of connecting to the OpenAI API for these, you can also connect to a self-hosted [LocalAI](https://localai.io) instance\nor to any service that implements an API similar to the OpenAI one, for example: [Plusserver](https://www.plusserver.com/en/ai-platform/) or [MistralAI](https://mistral.ai).\n\n## Ethical AI Rating\n### Rating for Text generation using ChatGPT via the OpenAI API: 🔴\n\nNegative:\n* The software for training and inference of this model is proprietary, limiting running it locally or training by yourself\n* The trained model is not freely available, so the model can not be run on-premises\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model's performance and CO2 usage.\n\n\n### Rating for Translation using ChatGPT via the OpenAI API: 🔴\n\nNegative:\n* The software for training and inference of this model is proprietary, limiting running it locally or training by yourself\n* The trained model is not freely available, so the model can not be run on-premises\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model's performance and CO2 usage.\n\n### Rating for Image generation using DALL·E via the OpenAI API: 🔴\n\nNegative:\n* The software for training and inferencing of this model is proprietary, limiting running it locally or training by yourself\n* The trained model is not freely available, so the model can not be ran on-premises\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model’s performance and CO2 usage.\n\n\n### Rating for Speech-To-Text using Whisper via the OpenAI API: 🟡\n\nPositive:\n* The software for training and inferencing of this model is open source\n* The trained model is freely available, and thus can run on-premise\n\nNegative:\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model’s performance and CO2 usage.\n\n### Rating for Text generation via LocalAI: 🟢\n\nPositive:\n* The software for training and inferencing of this model is open source\n* The trained model is freely available, and thus can be ran on-premises\n* The training data is freely available, making it possible to check or correct for bias or optimise the performance and CO2 usage.\n\n\n### Rating for Image generation using Stable Diffusion via LocalAI : 🟡\n\nPositive:\n* The software for training and inferencing of this model is open source\n* The trained model is freely available, and thus can be ran on-premises\n\nNegative:\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model’s performance and CO2 usage.\n\n\n### Rating for Speech-To-Text using Whisper via LocalAI: 🟡\n\nPositive:\n* The software for training and inferencing of this model is open source\n* The trained model is freely available, and thus can be ran on-premises\n\nNegative:\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model’s performance and CO2 usage.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
+    "description": "⚠️ The smart pickers have been removed from this app\nas they are now included in the [Assistant app](https://apps.nextcloud.com/apps/assistant).\n\nThis app implements:\n\n* Text generation providers: Free prompt, Summarize, Headline, Context Write, Chat, and Reformulate (using any available large language model)\n* A Translation provider (using any available language model)\n* A SpeechToText provider (using Whisper)\n* An image generation provider\n\n⚠️ Context Write, Summarize, Headline and Reformulate have mainly been tested with OpenAI.\nThey might work when connecting to other services, without any guarantee.\n\nInstead of connecting to the OpenAI API for these, you can also connect to a self-hosted [LocalAI](https://localai.io) instance or [Ollama](https://ollama.com/) instance\nor to any service that implements an API similar to the OpenAI one, for example: [Plusserver](https://www.plusserver.com/en/ai-platform/) or [MistralAI](https://mistral.ai).\n\n⚠️ This app is mainly tested with OpenAI. We do not guarantee it works perfectly\nwith other services that implement OpenAI-compatible APIs with slight differences.\n\n## Improve AI task pickup speed\n\nTo avoid task processing execution delay, setup at 4 background job workers in the main server (where Nextcloud is installed). The setup process is documented here: https://docs.nextcloud.com/server/latest/admin_manual/ai/overview.html#improve-ai-task-pickup-speed\n\n## Ethical AI Rating\n### Rating for Text generation using ChatGPT via the OpenAI API: 🔴\n\nNegative:\n* The software for training and inference of this model is proprietary, limiting running it locally or training by yourself\n* The trained model is not freely available, so the model can not be run on-premises\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model's performance and CO2 usage.\n\n\n### Rating for Translation using ChatGPT via the OpenAI API: 🔴\n\nNegative:\n* The software for training and inference of this model is proprietary, limiting running it locally or training by yourself\n* The trained model is not freely available, so the model can not be run on-premises\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model's performance and CO2 usage.\n\n### Rating for Image generation using DALL·E via the OpenAI API: 🔴\n\nNegative:\n* The software for training and inferencing of this model is proprietary, limiting running it locally or training by yourself\n* The trained model is not freely available, so the model can not be ran on-premises\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model’s performance and CO2 usage.\n\n\n### Rating for Speech-To-Text using Whisper via the OpenAI API: 🟡\n\nPositive:\n* The software for training and inferencing of this model is open source\n* The trained model is freely available, and thus can run on-premise\n\nNegative:\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model’s performance and CO2 usage.\n\n### Rating for Text generation via LocalAI: 🟢\n\nPositive:\n* The software for training and inferencing of this model is open source\n* The trained model is freely available, and thus can be ran on-premises\n* The training data is freely available, making it possible to check or correct for bias or optimise the performance and CO2 usage.\n\n\n### Rating for Image generation using Stable Diffusion via LocalAI : 🟡\n\nPositive:\n* The software for training and inferencing of this model is open source\n* The trained model is freely available, and thus can be ran on-premises\n\nNegative:\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model’s performance and CO2 usage.\n\n\n### Rating for Speech-To-Text using Whisper via LocalAI: 🟡\n\nPositive:\n* The software for training and inferencing of this model is open source\n* The trained model is freely available, and thus can be ran on-premises\n\nNegative:\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model’s performance and CO2 usage.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
     "homepage": "https://github.com/nextcloud/integration_openai",
     "licenses": [
       "agpl"
@@ -130,9 +140,9 @@
     ]
   },
   "mail": {
-    "hash": "sha256-Y591RR3m4k8G0+sNU+hRN013LikCFJ/41SbrILEfp8A=",
-    "url": "https://github.com/nextcloud-releases/mail/releases/download/v3.7.9/mail-v3.7.9.tar.gz",
-    "version": "3.7.9",
+    "hash": "sha256-cgwXyqxeZggsd6RhrSPbwim2Yzg7ztWcrEgo3ocFO44=",
+    "url": "https://github.com/nextcloud-releases/mail/releases/download/v3.7.13/mail-v3.7.13.tar.gz",
+    "version": "3.7.13",
     "description": "**💌 A mail app for Nextcloud**\n\n- **🚀 Integration with other Nextcloud apps!** Currently Contacts, Calendar & Files – more to come.\n- **📥 Multiple mail accounts!** Personal and company account? No problem, and a nice unified inbox. Connect any IMAP account.\n- **🔒 Send & receive encrypted mails!** Using the great [Mailvelope](https://mailvelope.com) browser extension.\n- **🙈 We’re not reinventing the wheel!** Based on the great [Horde](https://horde.org) libraries.\n- **📬 Want to host your own mail server?** We do not have to reimplement this as you could set up [Mail-in-a-Box](https://mailinabox.email)!\n\n## Ethical AI Rating\n\n### Priority Inbox\n\nPositive:\n* The software for training and inferencing of this model is open source.\n* The model is created and trained on-premises based on the user's own data.\n* The training data is accessible to the user, making it possible to check or correct for bias or optimise the performance and CO2 usage.\n\n### Thread Summaries (opt-in)\n\n**Rating:** 🟢/🟡/🟠/🔴\n\nThe rating depends on the installed text processing backend. See [the rating overview](https://docs.nextcloud.com/server/latest/admin_manual/ai/index.html) for details.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
     "homepage": "https://github.com/nextcloud/mail#readme",
     "licenses": [
@@ -170,9 +180,9 @@
     ]
   },
   "news": {
-    "hash": "sha256-m2Q+vq7G5oPr9fwIX+65NReaxzcxXehQBQ52T4VrYfw=",
-    "url": "https://github.com/nextcloud/news/releases/download/25.0.0/news.tar.gz",
-    "version": "25.0.0",
+    "hash": "sha256-iQvgyXqOwZrWDoZgXNivxqnSLjNeWm9MLJ9R/Wx/jOg=",
+    "url": "https://github.com/nextcloud/news/releases/download/25.0.3/news.tar.gz",
+    "version": "25.0.3",
     "description": "📰 A RSS/Atom Feed reader App for Nextcloud\n\n- 📲 Synchronize your feeds with multiple mobile or desktop [clients](https://nextcloud.github.io/news/clients/)\n- 🔄 Automatic updates of your news feeds\n- 🆓 Free and open source under AGPLv3, no ads or premium functions\n\n**System Cron is currently required for this app to work**\n\nRequirements can be found [here](https://nextcloud.github.io/news/install/#dependencies)\n\nThe Changelog is available [here](https://github.com/nextcloud/news/blob/master/CHANGELOG.md)\n\nCreate a [bug report](https://github.com/nextcloud/news/issues/new/choose)\n\nCreate a [feature request](https://github.com/nextcloud/news/discussions/new)\n\nReport a [feed issue](https://github.com/nextcloud/news/discussions/new)",
     "homepage": "https://github.com/nextcloud/news",
     "licenses": [
@@ -220,9 +230,9 @@
     ]
   },
   "polls": {
-    "hash": "sha256-rLNB0idaKoL4e5O5NYXyhIyFpYguDG4Hg5OkHUEaQUM=",
-    "url": "https://github.com/nextcloud-releases/polls/releases/download/v7.2.4/polls-v7.2.4.tar.gz",
-    "version": "7.2.4",
+    "hash": "sha256-7KSQDY2LXMWEbo3PFH3VMfq819swNnxCT5kiFvHI83s=",
+    "url": "https://github.com/nextcloud-releases/polls/releases/download/v7.2.5/polls-v7.2.5.tar.gz",
+    "version": "7.2.5",
     "description": "A polls app, similar to Doodle/Dudle with the possibility to restrict access (members, certain groups/users, hidden and public).",
     "homepage": "https://github.com/nextcloud/polls",
     "licenses": [
@@ -230,9 +240,9 @@
     ]
   },
   "previewgenerator": {
-    "hash": "sha256-hjlwZfgfoH3iqbtJrPovgBC0Tu/vBhFqC752DZvndFY=",
-    "url": "https://github.com/nextcloud-releases/previewgenerator/releases/download/v5.6.0/previewgenerator-v5.6.0.tar.gz",
-    "version": "5.6.0",
+    "hash": "sha256-kTYmN/tAJwjj2KwnrKVIZa5DhyXHjuNWNskqJZxs4sY=",
+    "url": "https://github.com/nextcloud-releases/previewgenerator/releases/download/v5.7.0/previewgenerator-v5.7.0.tar.gz",
+    "version": "5.7.0",
     "description": "The Preview Generator app allows admins to pre-generate previews. The app listens to edit events and stores this information. Once a cron job is triggered it will generate start preview generation. This means that you can better utilize your system by pre-generating previews when your system is normally idle and thus putting less load on your machine when the requests are actually served.\n\nThe app does not replace on demand preview generation so if a preview is requested before it is pre-generated it will still be shown.\nThe first time you install this app, before using a cron job, you properly want to generate all previews via:\n**./occ preview:generate-all -vvv**\n\n**Important**: To enable pre-generation of previews you must add **php /var/www/nextcloud/occ preview:pre-generate** to a system cron job that runs at times of your choosing.",
     "homepage": "https://github.com/nextcloud/previewgenerator",
     "licenses": [
@@ -240,9 +250,9 @@
     ]
   },
   "qownnotesapi": {
-    "hash": "sha256-jnKtJrzW5FzrluO5S+2Qdrune6TfWDOXlOh9xNm8h1M=",
-    "url": "https://github.com/pbek/qownnotesapi/releases/download/v24.9.0/qownnotesapi-nc.tar.gz",
-    "version": "24.9.0",
+    "hash": "sha256-ydz8e8ZOLOT60yt55DI0gGpSaLz9sCz5Zyt1jhMYIv0=",
+    "url": "https://github.com/pbek/qownnotesapi/releases/download/v24.11.0/qownnotesapi-nc.tar.gz",
+    "version": "24.11.0",
     "description": "QOwnNotesAPI is the Nextcloud/ownCloud API for [QOwnNotes](http://www.qownnotes.org), the open source notepad for Linux, macOS and Windows, that works together with the notes application of Nextcloud/ownCloud.\n\nThe only purpose of this App is to provide API access to your Nextcloud/ownCloud server for your QOwnNotes desktop installation, you cannot use this App for anything else, if you don't have QOwnNotes installed on your desktop computer!",
     "homepage": "https://github.com/pbek/qownnotesapi",
     "licenses": [
@@ -320,9 +330,9 @@
     ]
   },
   "unsplash": {
-    "hash": "sha256-kNDQk4HYkrBA+o+5/bNYj65ZJbViBjhnbSA87tsu6YE=",
-    "url": "https://github.com/nextcloud/unsplash/releases/download/v3.0.2/unsplash.tar.gz",
-    "version": "3.0.1",
+    "hash": "sha256-hUKpIGvu7aX45Pz/xCssOuyZ7E+kJ4cmqhhycX5DG6A=",
+    "url": "https://github.com/nextcloud/unsplash/releases/download/v3.0.3/unsplash.tar.gz",
+    "version": "3.0.3",
     "description": "Show a new random featured nature photo in your nextcloud. Now with choosable motives!",
     "homepage": "https://github.com/nextcloud/unsplash/",
     "licenses": [
diff --git a/pkgs/servers/nextcloud/packages/30.json b/pkgs/servers/nextcloud/packages/30.json
index d9af7fd32824..f75be5c1dabb 100644
--- a/pkgs/servers/nextcloud/packages/30.json
+++ b/pkgs/servers/nextcloud/packages/30.json
@@ -10,9 +10,9 @@
     ]
   },
   "calendar": {
-    "hash": "sha256-v9qjcyc2UBZK7QeO1XBZu11coPI92PRZcTipzBEMm3c=",
-    "url": "https://github.com/nextcloud-releases/calendar/releases/download/v5.0.1/calendar-v5.0.1.tar.gz",
-    "version": "5.0.1",
+    "hash": "sha256-HWe9YFSJuV6AFvLy+QO8kioK+VnUESaHUwxdfNPNue8=",
+    "url": "https://github.com/nextcloud-releases/calendar/releases/download/v5.0.6/calendar-v5.0.6.tar.gz",
+    "version": "5.0.6",
     "description": "The Calendar app is a user interface for Nextcloud's CalDAV server. Easily sync events from various devices with your Nextcloud and edit them online.\n\n* 🚀 **Integration with other Nextcloud apps!** Currently Contacts - more to come.\n* 🌐 **WebCal Support!** Want to see your favorite team’s matchdays in your calendar? No problem!\n* 🙋 **Attendees!** Invite people to your events\n* ⌚️ **Free/Busy!** See when your attendees are available to meet\n* ⏰ **Reminders!** Get alarms for events inside your browser and via email\n* 🔍 Search! Find your events at ease\n* ☑️ Tasks! See tasks with a due date directly in the calendar\n* 🙈 **We’re not reinventing the wheel!** Based on the great [c-dav library](https://github.com/nextcloud/cdav-library), [ical.js](https://github.com/mozilla-comm/ical.js) and [fullcalendar](https://github.com/fullcalendar/fullcalendar) libraries.",
     "homepage": "https://github.com/nextcloud/calendar/",
     "licenses": [
@@ -20,9 +20,9 @@
     ]
   },
   "contacts": {
-    "hash": "sha256-/vikmy5phOK1OhFu6w5A1BYiNfbYaU7Js2+jiurM2ug=",
-    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v6.1.0/contacts-v6.1.0.tar.gz",
-    "version": "6.1.0",
+    "hash": "sha256-M3AC9KT3aMpDYeGgfqVWdI4Lngg/yw/36HSBS3N+G5c=",
+    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v6.1.2/contacts-v6.1.2.tar.gz",
+    "version": "6.1.1",
     "description": "The Nextcloud contacts app is a user interface for Nextcloud's CardDAV server. Easily sync contacts from various devices with your Nextcloud and edit them online.\n\n* 🚀 **Integration with other Nextcloud apps!** Currently Mail and Calendar – more to come.\n* 🎉 **Never forget a birthday!** You can sync birthdays and other recurring events with your Nextcloud Calendar.\n* 👥 **Sharing of Adressbooks!** You want to share your contacts with your friends or coworkers? No problem!\n* 🙈 **We’re not reinventing the wheel!** Based on the great and open SabreDAV library.",
     "homepage": "https://github.com/nextcloud/contacts#readme",
     "licenses": [
@@ -50,9 +50,9 @@
     ]
   },
   "deck": {
-    "hash": "sha256-X64B6l7h8MglBW5apC21G8jkg7WfnRYroczguI58V9g=",
-    "url": "https://github.com/nextcloud-releases/deck/releases/download/v1.14.1/deck-v1.14.1.tar.gz",
-    "version": "1.14.1",
+    "hash": "sha256-BiUu//ouJiQt/BhrDBH16yGHoH4Kzb260A7ALIqSyEk=",
+    "url": "https://github.com/nextcloud-releases/deck/releases/download/v1.14.2/deck-v1.14.2.tar.gz",
+    "version": "1.14.2",
     "description": "Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud.\n\n\n- 📥 Add your tasks to cards and put them in order\n- 📄 Write down additional notes in Markdown\n- 🔖 Assign labels for even better organization\n- 👥 Share with your team, friends or family\n- 📎 Attach files and embed them in your Markdown description\n- 💬 Discuss with your team using comments\n- ⚡ Keep track of changes in the activity stream\n- 🚀 Get your project organized",
     "homepage": "https://github.com/nextcloud/deck",
     "licenses": [
@@ -69,10 +69,20 @@
       "agpl"
     ]
   },
+  "files_mindmap": {
+    "hash": "sha256-USwTVkcEDzmaJMMaztf86yag5t7b79sQW8OOHEw0hec=",
+    "url": "https://github.com/ACTom/files_mindmap/releases/download/v0.0.31/files_mindmap-0.0.31.tar.gz",
+    "version": "0.0.31",
+    "description": "This application enables Nextcloud users to open, save and edit mind map files in the web browser. If enabled, an entry in the New button at the top of the web browser the Mindmap file entry appears. When clicked, a new mindmap file opens in the browser and the file can be saved into the current Nextcloud directory.",
+    "homepage": "https://github.com/ACTom/files_mindmap",
+    "licenses": [
+      "agpl"
+    ]
+  },
   "forms": {
-    "hash": "sha256-iU2bqojO+pvMvKDiw+ANMvsH71Ul+8yQ+uNvJfa1ngc=",
-    "url": "https://github.com/nextcloud-releases/forms/releases/download/v4.3.2/forms-v4.3.2.tar.gz",
-    "version": "4.3.2",
+    "hash": "sha256-NW57bhZiNqKfUhMvGN9Ncy21Y0GucC/CFCmHTf8kJ2I=",
+    "url": "https://github.com/nextcloud-releases/forms/releases/download/v4.3.4/forms-v4.3.4.tar.gz",
+    "version": "4.3.4",
     "description": "**Simple surveys and questionnaires, self-hosted!**\n\n- **📝 Simple design:** No mass of options, only the essentials. Works well on mobile of course.\n- **📊 View & export results:** Results are visualized and can also be exported as CSV in the same format used by Google Forms.\n- **🔒 Data under your control!** Unlike in Google Forms, Typeform, Doodle and others, the survey info and responses are kept private on your instance.\n- **🧑‍💻 Connect to your software:** Easily integrate Forms into your service with our full-fledged [REST-API](https://github.com/nextcloud/forms/blob/main/docs/API.md).\n- **🙋 Get involved!** We have lots of stuff planned like more question types, collaboration on forms, [and much more](https://github.com/nextcloud/forms/milestones)!",
     "homepage": "https://github.com/nextcloud/forms",
     "licenses": [
@@ -90,10 +100,10 @@
     ]
   },
   "groupfolders": {
-    "hash": "sha256-IrxzWjxqsA6prPn/gKj9MAw0R/1Qi3kHsddNU5E9sVk=",
-    "url": "https://github.com/nextcloud-releases/groupfolders/releases/download/v18.0.3/groupfolders-v18.0.3.tar.gz",
-    "version": "18.0.3",
-    "description": "Admin configured folders shared with everyone in a group.\n\nFolders can be configured from *Group folders* in the admin settings.\n\nAfter a folder is created, the admin can give access to the folder to one or more groups, control their write/sharing permissions and assign a quota for the folder.",
+    "hash": "sha256-m4hKIo96MYhkOtyeu6Sh5yPFKQdwFtuX2rSzElfC8rs=",
+    "url": "https://github.com/nextcloud-releases/groupfolders/releases/download/v18.0.6/groupfolders-v18.0.6.tar.gz",
+    "version": "18.0.6",
+    "description": "Admin configured folders shared with everyone in a group.\n\nFolders can be configured from *Group folders* in the admin settings.\n\nAfter a folder is created, the admin can give access to the folder to one or more groups, control their write/sharing permissions and assign a quota for the folder.\n\nNote: Encrypting the contents of group folders is currently not supported.",
     "homepage": "https://github.com/nextcloud/groupfolders",
     "licenses": [
       "agpl"
@@ -110,10 +120,10 @@
     ]
   },
   "integration_openai": {
-    "hash": "sha256-J7ePjQlYy5gxVK6AmERWCo0aOFf9OP6KyYVZm8y82ek=",
-    "url": "https://github.com/nextcloud-releases/integration_openai/releases/download/v3.1.2/integration_openai-v3.1.2.tar.gz",
-    "version": "3.1.2",
-    "description": "⚠️ The smart pickers have been removed from this app\nas they are now included in the [Assistant app](https://apps.nextcloud.com/apps/assistant).\n\nThis app implements:\n\n* Text generation providers: Free prompt, Summarize, Headline, Context write, Chat, and Reformulate (using any available large language model)\n* A Translation provider (using any available language model)\n* A SpeechToText provider (using Whisper)\n* An image generation provider\n\nInstead of connecting to the OpenAI API for these, you can also connect to a self-hosted [LocalAI](https://localai.io) instance\nor to any service that implements an API similar to the OpenAI one, for example: [Plusserver](https://www.plusserver.com/en/ai-platform/) or [MistralAI](https://mistral.ai).\n\n## Ethical AI Rating\n### Rating for Text generation using ChatGPT via the OpenAI API: 🔴\n\nNegative:\n* The software for training and inference of this model is proprietary, limiting running it locally or training by yourself\n* The trained model is not freely available, so the model can not be run on-premises\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model's performance and CO2 usage.\n\n\n### Rating for Translation using ChatGPT via the OpenAI API: 🔴\n\nNegative:\n* The software for training and inference of this model is proprietary, limiting running it locally or training by yourself\n* The trained model is not freely available, so the model can not be run on-premises\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model's performance and CO2 usage.\n\n### Rating for Image generation using DALL·E via the OpenAI API: 🔴\n\nNegative:\n* The software for training and inferencing of this model is proprietary, limiting running it locally or training by yourself\n* The trained model is not freely available, so the model can not be ran on-premises\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model’s performance and CO2 usage.\n\n\n### Rating for Speech-To-Text using Whisper via the OpenAI API: 🟡\n\nPositive:\n* The software for training and inferencing of this model is open source\n* The trained model is freely available, and thus can run on-premise\n\nNegative:\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model’s performance and CO2 usage.\n\n### Rating for Text generation via LocalAI: 🟢\n\nPositive:\n* The software for training and inferencing of this model is open source\n* The trained model is freely available, and thus can be ran on-premises\n* The training data is freely available, making it possible to check or correct for bias or optimise the performance and CO2 usage.\n\n\n### Rating for Image generation using Stable Diffusion via LocalAI : 🟡\n\nPositive:\n* The software for training and inferencing of this model is open source\n* The trained model is freely available, and thus can be ran on-premises\n\nNegative:\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model’s performance and CO2 usage.\n\n\n### Rating for Speech-To-Text using Whisper via LocalAI: 🟡\n\nPositive:\n* The software for training and inferencing of this model is open source\n* The trained model is freely available, and thus can be ran on-premises\n\nNegative:\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model’s performance and CO2 usage.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
+    "hash": "sha256-jAAsX9NA09rM5kWBrlfZXIdkF5Go2CIYAtxzKvYd4nM=",
+    "url": "https://github.com/nextcloud-releases/integration_openai/releases/download/v3.2.0/integration_openai-v3.2.0.tar.gz",
+    "version": "3.2.0",
+    "description": "⚠️ The smart pickers have been removed from this app\nas they are now included in the [Assistant app](https://apps.nextcloud.com/apps/assistant).\n\nThis app implements:\n\n* Text generation providers: Free prompt, Summarize, Headline, Context Write, Chat, and Reformulate (using any available large language model)\n* A Translation provider (using any available language model)\n* A SpeechToText provider (using Whisper)\n* An image generation provider\n\n⚠️ Context Write, Summarize, Headline and Reformulate have mainly been tested with OpenAI.\nThey might work when connecting to other services, without any guarantee.\n\nInstead of connecting to the OpenAI API for these, you can also connect to a self-hosted [LocalAI](https://localai.io) instance or [Ollama](https://ollama.com/) instance\nor to any service that implements an API similar to the OpenAI one, for example: [Plusserver](https://www.plusserver.com/en/ai-platform/) or [MistralAI](https://mistral.ai).\n\n⚠️ This app is mainly tested with OpenAI. We do not guarantee it works perfectly\nwith other services that implement OpenAI-compatible APIs with slight differences.\n\n## Improve AI task pickup speed\n\nTo avoid task processing execution delay, setup at 4 background job workers in the main server (where Nextcloud is installed). The setup process is documented here: https://docs.nextcloud.com/server/latest/admin_manual/ai/overview.html#improve-ai-task-pickup-speed\n\n## Ethical AI Rating\n### Rating for Text generation using ChatGPT via the OpenAI API: 🔴\n\nNegative:\n* The software for training and inference of this model is proprietary, limiting running it locally or training by yourself\n* The trained model is not freely available, so the model can not be run on-premises\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model's performance and CO2 usage.\n\n\n### Rating for Translation using ChatGPT via the OpenAI API: 🔴\n\nNegative:\n* The software for training and inference of this model is proprietary, limiting running it locally or training by yourself\n* The trained model is not freely available, so the model can not be run on-premises\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model's performance and CO2 usage.\n\n### Rating for Image generation using DALL·E via the OpenAI API: 🔴\n\nNegative:\n* The software for training and inferencing of this model is proprietary, limiting running it locally or training by yourself\n* The trained model is not freely available, so the model can not be ran on-premises\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model’s performance and CO2 usage.\n\n\n### Rating for Speech-To-Text using Whisper via the OpenAI API: 🟡\n\nPositive:\n* The software for training and inferencing of this model is open source\n* The trained model is freely available, and thus can run on-premise\n\nNegative:\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model’s performance and CO2 usage.\n\n### Rating for Text generation via LocalAI: 🟢\n\nPositive:\n* The software for training and inferencing of this model is open source\n* The trained model is freely available, and thus can be ran on-premises\n* The training data is freely available, making it possible to check or correct for bias or optimise the performance and CO2 usage.\n\n\n### Rating for Image generation using Stable Diffusion via LocalAI : 🟡\n\nPositive:\n* The software for training and inferencing of this model is open source\n* The trained model is freely available, and thus can be ran on-premises\n\nNegative:\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model’s performance and CO2 usage.\n\n\n### Rating for Speech-To-Text using Whisper via LocalAI: 🟡\n\nPositive:\n* The software for training and inferencing of this model is open source\n* The trained model is freely available, and thus can be ran on-premises\n\nNegative:\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model’s performance and CO2 usage.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
     "homepage": "https://github.com/nextcloud/integration_openai",
     "licenses": [
       "agpl"
@@ -130,9 +140,9 @@
     ]
   },
   "mail": {
-    "hash": "sha256-iCK+B/BP4fCzaELNxL/A9OJ6Y34gZl9KIgh7lmSgtSA=",
-    "url": "https://github.com/nextcloud-releases/mail/releases/download/v4.0.2/mail-v4.0.2.tar.gz",
-    "version": "4.0.2",
+    "hash": "sha256-fiG9smhCztmoBfkXcbrXLjfREMYHPOF1JD8u2HUCnhk=",
+    "url": "https://github.com/nextcloud-releases/mail/releases/download/v4.0.5/mail-stable4.0.tar.gz",
+    "version": "4.0.5",
     "description": "**💌 A mail app for Nextcloud**\n\n- **🚀 Integration with other Nextcloud apps!** Currently Contacts, Calendar & Files – more to come.\n- **📥 Multiple mail accounts!** Personal and company account? No problem, and a nice unified inbox. Connect any IMAP account.\n- **🔒 Send & receive encrypted mails!** Using the great [Mailvelope](https://mailvelope.com) browser extension.\n- **🙈 We’re not reinventing the wheel!** Based on the great [Horde](https://horde.org) libraries.\n- **📬 Want to host your own mail server?** We do not have to reimplement this as you could set up [Mail-in-a-Box](https://mailinabox.email)!\n\n## Ethical AI Rating\n\n### Priority Inbox\n\nPositive:\n* The software for training and inferencing of this model is open source.\n* The model is created and trained on-premises based on the user's own data.\n* The training data is accessible to the user, making it possible to check or correct for bias or optimise the performance and CO2 usage.\n\n### Thread Summaries (opt-in)\n\n**Rating:** 🟢/🟡/🟠/🔴\n\nThe rating depends on the installed text processing backend. See [the rating overview](https://docs.nextcloud.com/server/latest/admin_manual/ai/index.html) for details.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
     "homepage": "https://github.com/nextcloud/mail#readme",
     "licenses": [
@@ -170,9 +180,9 @@
     ]
   },
   "news": {
-    "hash": "sha256-m2Q+vq7G5oPr9fwIX+65NReaxzcxXehQBQ52T4VrYfw=",
-    "url": "https://github.com/nextcloud/news/releases/download/25.0.0/news.tar.gz",
-    "version": "25.0.0",
+    "hash": "sha256-iQvgyXqOwZrWDoZgXNivxqnSLjNeWm9MLJ9R/Wx/jOg=",
+    "url": "https://github.com/nextcloud/news/releases/download/25.0.3/news.tar.gz",
+    "version": "25.0.3",
     "description": "📰 A RSS/Atom Feed reader App for Nextcloud\n\n- 📲 Synchronize your feeds with multiple mobile or desktop [clients](https://nextcloud.github.io/news/clients/)\n- 🔄 Automatic updates of your news feeds\n- 🆓 Free and open source under AGPLv3, no ads or premium functions\n\n**System Cron is currently required for this app to work**\n\nRequirements can be found [here](https://nextcloud.github.io/news/install/#dependencies)\n\nThe Changelog is available [here](https://github.com/nextcloud/news/blob/master/CHANGELOG.md)\n\nCreate a [bug report](https://github.com/nextcloud/news/issues/new/choose)\n\nCreate a [feature request](https://github.com/nextcloud/news/discussions/new)\n\nReport a [feed issue](https://github.com/nextcloud/news/discussions/new)",
     "homepage": "https://github.com/nextcloud/news",
     "licenses": [
@@ -220,9 +230,9 @@
     ]
   },
   "polls": {
-    "hash": "sha256-rLNB0idaKoL4e5O5NYXyhIyFpYguDG4Hg5OkHUEaQUM=",
-    "url": "https://github.com/nextcloud-releases/polls/releases/download/v7.2.4/polls-v7.2.4.tar.gz",
-    "version": "7.2.4",
+    "hash": "sha256-7KSQDY2LXMWEbo3PFH3VMfq819swNnxCT5kiFvHI83s=",
+    "url": "https://github.com/nextcloud-releases/polls/releases/download/v7.2.5/polls-v7.2.5.tar.gz",
+    "version": "7.2.5",
     "description": "A polls app, similar to Doodle/Dudle with the possibility to restrict access (members, certain groups/users, hidden and public).",
     "homepage": "https://github.com/nextcloud/polls",
     "licenses": [
@@ -230,9 +240,9 @@
     ]
   },
   "previewgenerator": {
-    "hash": "sha256-hjlwZfgfoH3iqbtJrPovgBC0Tu/vBhFqC752DZvndFY=",
-    "url": "https://github.com/nextcloud-releases/previewgenerator/releases/download/v5.6.0/previewgenerator-v5.6.0.tar.gz",
-    "version": "5.6.0",
+    "hash": "sha256-kTYmN/tAJwjj2KwnrKVIZa5DhyXHjuNWNskqJZxs4sY=",
+    "url": "https://github.com/nextcloud-releases/previewgenerator/releases/download/v5.7.0/previewgenerator-v5.7.0.tar.gz",
+    "version": "5.7.0",
     "description": "The Preview Generator app allows admins to pre-generate previews. The app listens to edit events and stores this information. Once a cron job is triggered it will generate start preview generation. This means that you can better utilize your system by pre-generating previews when your system is normally idle and thus putting less load on your machine when the requests are actually served.\n\nThe app does not replace on demand preview generation so if a preview is requested before it is pre-generated it will still be shown.\nThe first time you install this app, before using a cron job, you properly want to generate all previews via:\n**./occ preview:generate-all -vvv**\n\n**Important**: To enable pre-generation of previews you must add **php /var/www/nextcloud/occ preview:pre-generate** to a system cron job that runs at times of your choosing.",
     "homepage": "https://github.com/nextcloud/previewgenerator",
     "licenses": [
@@ -240,9 +250,9 @@
     ]
   },
   "qownnotesapi": {
-    "hash": "sha256-jnKtJrzW5FzrluO5S+2Qdrune6TfWDOXlOh9xNm8h1M=",
-    "url": "https://github.com/pbek/qownnotesapi/releases/download/v24.9.0/qownnotesapi-nc.tar.gz",
-    "version": "24.9.0",
+    "hash": "sha256-ydz8e8ZOLOT60yt55DI0gGpSaLz9sCz5Zyt1jhMYIv0=",
+    "url": "https://github.com/pbek/qownnotesapi/releases/download/v24.11.0/qownnotesapi-nc.tar.gz",
+    "version": "24.11.0",
     "description": "QOwnNotesAPI is the Nextcloud/ownCloud API for [QOwnNotes](http://www.qownnotes.org), the open source notepad for Linux, macOS and Windows, that works together with the notes application of Nextcloud/ownCloud.\n\nThe only purpose of this App is to provide API access to your Nextcloud/ownCloud server for your QOwnNotes desktop installation, you cannot use this App for anything else, if you don't have QOwnNotes installed on your desktop computer!",
     "homepage": "https://github.com/pbek/qownnotesapi",
     "licenses": [
@@ -309,6 +319,16 @@
       "agpl"
     ]
   },
+  "unsplash": {
+    "hash": "sha256-hUKpIGvu7aX45Pz/xCssOuyZ7E+kJ4cmqhhycX5DG6A=",
+    "url": "https://github.com/nextcloud/unsplash/releases/download/v3.0.3/unsplash.tar.gz",
+    "version": "3.0.3",
+    "description": "Show a new random featured nature photo in your nextcloud. Now with choosable motives!",
+    "homepage": "https://github.com/nextcloud/unsplash/",
+    "licenses": [
+      "agpl"
+    ]
+  },
   "user_oidc": {
     "hash": "sha256-hdFEruRfEFL5PQykOpHHb19NOKh+p5hGOMo0tPVg0eE=",
     "url": "https://github.com/nextcloud-releases/user_oidc/releases/download/v6.1.2/user_oidc-v6.1.2.tar.gz",
diff --git a/pkgs/servers/samba/4.x.nix b/pkgs/servers/samba/4.x.nix
index 8158c3d2d32b..2b06fb9175a0 100644
--- a/pkgs/servers/samba/4.x.nix
+++ b/pkgs/servers/samba/4.x.nix
@@ -68,7 +68,7 @@ stdenv.mkDerivation (finalAttrs: {
   version = "4.20.4";
 
   src = fetchurl {
-    url = "mirror://samba/pub/samba/stable/samba-${finalAttrs.version}.tar.gz";
+    url = "https://download.samba.org/pub/samba/stable/samba-${finalAttrs.version}.tar.gz";
     hash = "sha256-OpLpfq6zRbazIjL1A+FNNPA6eqZMRR/owlihG72pCOU=";
   };
 
diff --git a/pkgs/tools/misc/archi/default.nix b/pkgs/tools/misc/archi/default.nix
index b5328e7fab28..500edebad94c 100644
--- a/pkgs/tools/misc/archi/default.nix
+++ b/pkgs/tools/misc/archi/default.nix
@@ -13,20 +13,20 @@
 
 stdenv.mkDerivation rec {
   pname = "Archi";
-  version = "5.3.0";
+  version = "5.4.3";
 
   src = {
     "x86_64-linux" = fetchurl {
       url = "https://www.archimatetool.com/downloads/archi/${version}/Archi-Linux64-${version}.tgz";
-      hash = "sha256-ngO3YFCChsnefxdxtR00Dy736K2GYnTEYI4vKWLnPsw=";
+      hash = "sha256-95pm7WMzc25Gbtc73k+z8AJywJg6i6+/YTsx1DaA7sc=";
     };
     "x86_64-darwin" = fetchurl {
       url = "https://www.archimatetool.com/downloads/archi/${version}/Archi-Mac-${version}.dmg";
-      hash = "sha256-dL1c7IrbDMY/WbijQh1dCmCrRQQhj4fjGN+6m19OjO0=";
+      hash = "sha256-Y97wMwza0jR6cxWqnUIjQBvstLtz78QhRA84eQKqk4c=";
     };
     "aarch64-darwin" = fetchurl {
       url = "https://www.archimatetool.com/downloads/archi/${version}/Archi-Mac-Silicon-${version}.dmg";
-      hash = "sha256-iczIUm1LCAjYKOyHXbFCgb+zoUxxATSOVkB8Ldk7pxQ=";
+      hash = "sha256-Wd3OXMWufs03RyhUkkvoMKG2wI1q40MWaTTkrzio4Is=";
     };
   }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
diff --git a/pkgs/tools/misc/nagstamon/default.nix b/pkgs/tools/misc/nagstamon/default.nix
deleted file mode 100644
index f004ad9b42fd..000000000000
--- a/pkgs/tools/misc/nagstamon/default.nix
+++ /dev/null
@@ -1,25 +0,0 @@
-{ lib, fetchurl, pythonPackages }:
-
-pythonPackages.buildPythonApplication rec {
-  pname = "nagstamon";
-  version = "3.14.0";
-
-  src = fetchurl {
-    url = "https://github.com/HenriWahl/Nagstamon/archive/refs/tags/v${version}.tar.gz";
-    sha256 = "sha256-9RxQ/rfvoyjSUsY4tmAkBdVQqZYi3X6PBzQYFIeenzA=";
-  };
-
-  # Test assumes darwin
-  doCheck = false;
-
-  build-system = with pythonPackages; [ setuptools ];
-  dependencies = with pythonPackages; [ configparser pyqt6 psutil requests
-     beautifulsoup4 keyring requests-kerberos lxml dbus-python python-dateutil pysocks ];
-
-  meta = with lib; {
-    description = "Status monitor for the desktop";
-    homepage = "https://nagstamon.de/";
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ pSub liberodark ];
-  };
-}
diff --git a/pkgs/tools/security/bitwarden-directory-connector/default.nix b/pkgs/tools/security/bitwarden-directory-connector/default.nix
index b2d9bb4393b7..b7dc6f512597 100644
--- a/pkgs/tools/security/bitwarden-directory-connector/default.nix
+++ b/pkgs/tools/security/bitwarden-directory-connector/default.nix
@@ -75,7 +75,7 @@ in {
 
       makeWrapper ${lib.getExe electron} $out/bin/bitwarden-directory-connector \
         --add-flags $out/share/bitwarden-directory-connector/resources/app.asar \
-        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}}" \
         --set-default ELECTRON_IS_DEV 0 \
         --inherit-argv0
 
diff --git a/pkgs/tools/security/cnspec/default.nix b/pkgs/tools/security/cnspec/default.nix
index d0a3624b46bb..cdf66385c103 100644
--- a/pkgs/tools/security/cnspec/default.nix
+++ b/pkgs/tools/security/cnspec/default.nix
@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "cnspec";
-  version = "11.31.1";
+  version = "11.32.0";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnspec";
     rev = "refs/tags/v${version}";
-    hash = "sha256-xdnyW9nZSQrTSA6B2dFcKanNVJRcZXgpxLJHsLsL6LQ=";
+    hash = "sha256-Jret8LFSswdbb6MUEn2RlytWBcARAvk+Sm2EmjCmSig=";
   };
 
   proxyVendor = true;
 
-  vendorHash = "sha256-9/N76JWnzR6/k2yeLR49hpxNfKHgrV7lXVb9pnV/tn8=";
+  vendorHash = "sha256-+EhNEHLt337G0UAuXvlpz19YQ+q9J8TMv0j9TI8FsxM=";
 
   subPackages = [ "apps/cnspec" ];
 
diff --git a/pkgs/tools/security/keybase/gui.nix b/pkgs/tools/security/keybase/gui.nix
index 3beeaac77b28..6dfc50d2608b 100644
--- a/pkgs/tools/security/keybase/gui.nix
+++ b/pkgs/tools/security/keybase/gui.nix
@@ -98,7 +98,7 @@ stdenv.mkDerivation rec {
       checkFailed
     fi
 
-    exec $out/share/keybase/Keybase \''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}} "\$@"
+    exec $out/share/keybase/Keybase \''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime}} "\$@"
     EOF
     chmod +x $out/bin/keybase-gui
 
diff --git a/pkgs/tools/security/trufflehog/default.nix b/pkgs/tools/security/trufflehog/default.nix
index 49cfbb338f30..b268cfd0207d 100644
--- a/pkgs/tools/security/trufflehog/default.nix
+++ b/pkgs/tools/security/trufflehog/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "trufflehog";
-  version = "3.84.0";
+  version = "3.84.1";
 
   src = fetchFromGitHub {
     owner = "trufflesecurity";
     repo = "trufflehog";
     rev = "refs/tags/v${version}";
-    hash = "sha256-r/7mpq5yQCcPoNr4d/3ShR6V+cyX8p2vFcGkiza1WLk=";
+    hash = "sha256-wwNef5cP9f+kSHkCFYaB5y6sMqVPRqijnzj4gzU2J/E=";
   };
 
-  vendorHash = "sha256-SNhWDGvLAT2vP43x0chvzyjvpku7YGDvA7P+V175gIg=";
+  vendorHash = "sha256-awfnzRN6px+DnCU2/8bN1gX4JFJOXgAwsDSlHNb22oU=";
 
   proxyVendor = true;
 
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 0c0c35ccaab6..ccaa35bd0f5e 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -111,6 +111,7 @@ mapAliases {
   ao = libfive; # Added 2024-10-11
   apacheKafka_3_5 = throw "apacheKafka_2_8 through _3_5 have been removed from nixpkgs as outdated"; # Added 2024-06-13
   antimicroX = throw "'antimicroX' has been renamed to/replaced by 'antimicrox'"; # Converted to throw 2024-10-17
+  apacheAnt = ant; # Added 2024-11-28
   apple-sdk_10_12 = throw "apple-sdk_10_12 was removed as Nixpkgs no longer supports macOS 10.12; see the 25.05 release notes"; # Added 2024-10-27
   apple-sdk_10_13 = throw "apple-sdk_10_13 was removed as Nixpkgs no longer supports macOS 10.13; see the 25.05 release notes"; # Added 2024-10-27
   apple-sdk_10_14 = throw "apple-sdk_10_14 was removed as Nixpkgs no longer supprots macOS 10.14; see the 25.05 release notes"; # Added 2024-10-27
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c1dacc16ad6a..2d26d6a5d201 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2144,7 +2144,7 @@ with pkgs;
   cloudflared = callPackage ../applications/networking/cloudflared {
     # https://github.com/cloudflare/cloudflared/issues/1151#issuecomment-1888819250
     buildGoModule = buildGoModule.override {
-      go = go_1_22.overrideAttrs {
+      go = buildPackages.go_1_22.overrideAttrs {
         pname = "cloudflare-go";
         version = "1.22.2-devel-cf";
         src = fetchFromGitHub {
@@ -4196,10 +4196,6 @@ with pkgs;
 
   mx-puppet-discord = callPackage ../servers/mx-puppet-discord { };
 
-  nagstamon = callPackage ../tools/misc/nagstamon {
-    pythonPackages = python3Packages;
-  };
-
   nanoemoji = with python3Packages; toPythonApplication nanoemoji;
 
   nbtscanner = callPackage ../tools/security/nbtscanner {
@@ -7782,8 +7778,6 @@ with pkgs;
 
   antlr = antlr4;
 
-  ant = apacheAnt;
-
   inherit (callPackages ../servers/apache-kafka { })
     apacheKafka_3_6
     apacheKafka_3_7
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 4658ed1bc52d..91140c9dc1f5 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -5975,7 +5975,7 @@ with self; {
       description = "Hexadecial Dumper";
       homepage = "https://github.com/neilb/Data-HexDump";
       license = with lib.licenses; [ artistic1 gpl1Plus ];
-      maintainers = with maintainers; [ AndersonTorres ];
+      maintainers = with maintainers; [ ];
       mainProgram = "hexdump";
     };
   };