diff --git a/doc/languages-frameworks/dhall.section.md b/doc/languages-frameworks/dhall.section.md
index d1adcbf736bf..4b49908b0b0c 100644
--- a/doc/languages-frameworks/dhall.section.md
+++ b/doc/languages-frameworks/dhall.section.md
@@ -50,7 +50,7 @@ expression does not protect the Prelude import with a semantic integrity
 check, so the first step is to freeze the expression using `dhall freeze`,
 like this:
 
-```bash
+```ShellSession
 $ dhall freeze --inplace ./true.dhall
 ```
 
@@ -113,7 +113,7 @@ in
 
 … which we can then build using this command:
 
-```bash
+```ShellSession
 $ nix build --file ./example.nix dhallPackages.true
 ```
 
@@ -121,7 +121,7 @@ $ nix build --file ./example.nix dhallPackages.true
 
 The above package produces the following directory tree:
 
-```bash
+```ShellSession
 $ tree -a ./result
 result
 ├── .cache
@@ -135,7 +135,7 @@ result
 
 * `source.dhall` contains the result of interpreting our Dhall package:
 
-  ```bash
+  ```ShellSession
   $ cat ./result/source.dhall
   True
   ```
@@ -143,7 +143,7 @@ result
 * The `.cache` subdirectory contains one binary cache product encoding the
   same result as `source.dhall`:
 
-  ```bash
+  ```ShellSession
   $ dhall decode < ./result/.cache/dhall/122027abdeddfe8503496adeb623466caa47da5f63abd2bc6fa19f6cfcb73ecfed70
   True
   ```
@@ -151,7 +151,7 @@ result
 * `binary.dhall` contains a Dhall expression which handles fetching and decoding
   the same cache product:
 
-  ```bash
+  ```ShellSession
   $ cat ./result/binary.dhall
   missing sha256:27abdeddfe8503496adeb623466caa47da5f63abd2bc6fa19f6cfcb73ecfed70
   $ cp -r ./result/.cache .cache
@@ -168,7 +168,7 @@ to conserve disk space when they are used exclusively as dependencies.  For
 example, if we build the Prelude package it will only contain the binary
 encoding of the expression:
 
-```bash
+```ShellSession
 $ nix build --file ./example.nix dhallPackages.Prelude
 
 $ tree -a result
@@ -199,7 +199,7 @@ Dhall overlay like this:
 … and now the Prelude will contain the fully decoded result of interpreting
 the Prelude:
 
-```bash
+```ShellSession
 $ nix build --file ./example.nix dhallPackages.Prelude
 
 $ tree -a result
@@ -302,7 +302,7 @@ Additionally, `buildDhallGitHubPackage` accepts the same arguments as
 You can use the `dhall-to-nixpkgs` command-line utility to automate
 packaging Dhall code.  For example:
 
-```bash
+```ShellSession
 $ nix-env --install --attr haskellPackages.dhall-nixpkgs
 
 $ nix-env --install --attr nix-prefetch-git  # Used by dhall-to-nixpkgs
@@ -329,12 +329,12 @@ The utility takes care of automatically detecting remote imports and converting
 them to package dependencies.  You can also use the utility on local
 Dhall directories, too:
 
-```bash
+```ShellSession
 $ dhall-to-nixpkgs directory ~/proj/dhall-semver
 { buildDhallDirectoryPackage, Prelude }:
   buildDhallDirectoryPackage {
     name = "proj";
-    src = /Users/gabriel/proj/dhall-semver;
+    src = ~/proj/dhall-semver;
     file = "package.dhall";
     source = false;
     document = false;
@@ -342,6 +342,37 @@ $ dhall-to-nixpkgs directory ~/proj/dhall-semver
     }
 ```
 
+### Remote imports as fixed-output derivations {#ssec-dhall-remote-imports-as-fod}
+
+`dhall-to-nixpkgs` has the ability to fetch and build remote imports as
+fixed-output derivations by using their Dhall integrity check. This is
+sometimes easier than manually packaging all remote imports.
+
+This can be used like the following:
+
+```ShellSession
+$ dhall-to-nixpkgs directory --fixed-output-derivations ~/proj/dhall-semver
+{ buildDhallDirectoryPackage, buildDhallUrl }:
+  buildDhallDirectoryPackage {
+    name = "proj";
+    src = ~/proj/dhall-semver;
+    file = "package.dhall";
+    source = false;
+    document = false;
+    dependencies = [
+      (buildDhallUrl {
+        url = "https://prelude.dhall-lang.org/v17.0.0/package.dhall";
+        hash = "sha256-ENs8kZwl6QRoM9+Jeo/+JwHcOQ+giT2VjDQwUkvlpD4=";
+        dhallHash = "sha256:10db3c919c25e9046833df897a8ffe2701dc390fa0893d958c3430524be5a43e";
+        })
+      ];
+    }
+```
+
+Here, `dhall-semver`'s `Prelude` dependency is fetched and built with the
+`buildDhallUrl` helper function, instead of being passed in as a function
+argument.
+
 ## Overriding dependency versions {#ssec-dhall-overriding-dependency-versions}
 
 Suppose that we change our `true.dhall` example expression to depend on an older
@@ -359,7 +390,7 @@ in  Prelude.Bool.not False
 
 If we try to rebuild that expression the build will fail:
 
-```
+```ShellSession
 $ nix build --file ./example.nix dhallPackages.true
 builder for '/nix/store/0f1hla7ff1wiaqyk1r2ky4wnhnw114fi-true.drv' failed with exit code 1; last 10 log lines:
 
@@ -385,7 +416,7 @@ importing the URL.
 However, we can override the default Prelude version by using `dhall-to-nixpkgs`
 to create a Dhall package for our desired Prelude:
 
-```bash
+```ShellSession
 $ dhall-to-nixpkgs github https://github.com/dhall-lang/dhall-lang.git \
     --name Prelude \
     --directory Prelude \
@@ -396,7 +427,7 @@ $ dhall-to-nixpkgs github https://github.com/dhall-lang/dhall-lang.git \
 … and then referencing that package in our Dhall overlay, by either overriding
 the Prelude globally for all packages, like this:
 
-```bash
+```nix
   dhallOverrides = self: super: {
     true = self.callPackage ./true.nix { };
 
@@ -407,7 +438,7 @@ the Prelude globally for all packages, like this:
 … or selectively overriding the Prelude dependency for just the `true` package,
 like this:
 
-```bash
+```nix
   dhallOverrides = self: super: {
     true = self.callPackage ./true.nix {
       Prelude = self.callPackage ./Prelude.nix { };
diff --git a/pkgs/applications/editors/kakoune/default.nix b/pkgs/applications/editors/kakoune/default.nix
index 1e7d38086b79..e8c2760973a6 100644
--- a/pkgs/applications/editors/kakoune/default.nix
+++ b/pkgs/applications/editors/kakoune/default.nix
@@ -4,12 +4,12 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "kakoune-unwrapped";
-  version = "2021.10.28";
+  version = "2021.11.08";
   src = fetchFromGitHub {
     repo = "kakoune";
     owner = "mawww";
     rev = "v${version}";
-    sha256 = "sha256-ph0063EHyFa7arXvCVD+tGhs8ShyCDYkFVd1w6MZ5Z8=";
+    sha256 = "sha256-lMGMt0H1G8EN/7zSVSvU1yU4BYPnSF1vWmozLdrRTQk=";
   };
   makeFlags = [ "debug=no" "PREFIX=${placeholder "out"}" ];
 
diff --git a/pkgs/applications/misc/numberstation/default.nix b/pkgs/applications/misc/numberstation/default.nix
index 9809a2a62058..76a583fc8fdf 100644
--- a/pkgs/applications/misc/numberstation/default.nix
+++ b/pkgs/applications/misc/numberstation/default.nix
@@ -15,7 +15,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "numberstation";
-  version = "0.5.0";
+  version = "1.0.0";
 
   format = "other";
 
@@ -23,7 +23,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "~martijnbraam";
     repo = "numberstation";
     rev = version;
-    sha256 = "1hh66i0rfm85a97iajxlh965wk68hn0kkfgi9cljjkqf98xiy0bb";
+    sha256 = "1mr0rmm7hcyn8qr485h1ihbb5f581sab4fgvs7lhwy9lxsqk0r0l";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/networking/cluster/kubebuilder/default.nix b/pkgs/applications/networking/cluster/kubebuilder/default.nix
index eb29cba7de88..02c1c834781a 100644
--- a/pkgs/applications/networking/cluster/kubebuilder/default.nix
+++ b/pkgs/applications/networking/cluster/kubebuilder/default.nix
@@ -4,19 +4,20 @@
 , makeWrapper
 , git
 , go
+, gnumake
 }:
 
 buildGoModule rec {
   pname = "kubebuilder";
-  version = "3.1.0";
+  version = "3.2.0";
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
     repo = "kubebuilder";
     rev = "v${version}";
-    sha256 = "0bl5ff2cplal6hg75800crhyviamk1ws85sq60h4zg21hzf21y68";
+    sha256 = "sha256-V/g2RHnZPa/9hkVG5WVXmbx6hnJAwUEyyUX/Q3OR2DM=";
   };
-  vendorSha256 = "0zxyd950ksjswja64rfri5v2yaalfg6qmq8215ildgrcavl9974n";
+  vendorSha256 = "sha256-bTCLuAo5xXNoafjGpjKLKlKVKB29PEFwdPu9+qjvufs=";
 
   subPackages = ["cmd"];
 
@@ -33,7 +34,7 @@ buildGoModule rec {
   postInstall = ''
     mv $out/bin/cmd $out/bin/kubebuilder
     wrapProgram $out/bin/kubebuilder \
-      --prefix PATH : ${lib.makeBinPath [ go ]}
+      --prefix PATH : ${lib.makeBinPath [ go gnumake ]}
   '';
 
   allowGoReference = true;
diff --git a/pkgs/applications/video/handbrake/default.nix b/pkgs/applications/video/handbrake/default.nix
index 38f85625bd05..ce64a702379c 100644
--- a/pkgs/applications/video/handbrake/default.nix
+++ b/pkgs/applications/video/handbrake/default.nix
@@ -228,5 +228,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Only;
     maintainers = with maintainers; [ Anton-Latukha wmertens ];
     platforms = with platforms; unix;
+    broken = stdenv.isDarwin && lib.versionOlder stdenv.hostPlatform.darwinMinVersion "10.13";
   };
 }
diff --git a/pkgs/data/icons/whitesur-icon-theme/default.nix b/pkgs/data/icons/whitesur-icon-theme/default.nix
index 157ff6d3eac9..27465b828a61 100644
--- a/pkgs/data/icons/whitesur-icon-theme/default.nix
+++ b/pkgs/data/icons/whitesur-icon-theme/default.nix
@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "Whitesur-icon-theme";
-  version = "2021-10-13";
+  version = "2021-11-08";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = pname;
     rev = version;
-    sha256 = "BP5hGi3G9zNUSfeCbwYUvd3jMcWhstXiDeZCJ6Hgey8=";
+    sha256 = "LZ0GLJFUUvzsPhU2sBkfy5mPpQHuPzYhbumwFKnogoA=";
   };
 
   nativeBuildInputs = [ gtk3 ];
diff --git a/pkgs/development/interpreters/dhall/build-dhall-url.nix b/pkgs/development/interpreters/dhall/build-dhall-url.nix
new file mode 100644
index 000000000000..766fe3c1c2e3
--- /dev/null
+++ b/pkgs/development/interpreters/dhall/build-dhall-url.nix
@@ -0,0 +1,96 @@
+{ cacert, dhall, dhall-docs, haskell, lib, runCommand }:
+
+# `buildDhallUrl` is similar to `buildDhallDirectoryPackage` or
+# `buildDhallGitHubPackage`, but instead builds a Nixpkgs Dhall package
+# based on a hashed URL.  This will generally be a URL that has an integrity
+# check in a Dhall file.
+#
+# Similar to `buildDhallDirectoryPackage` and `buildDhallGitHubPackage`, the output
+# of this function is a derivation that has a `binary.dhall` file, along with
+# a `.cache/` directory with the actual contents of the Dhall file from the
+# suppiled URL.
+#
+# This function is primarily used by `dhall-to-nixpkgs directory --fixed-output-derivations`.
+
+{ # URL of the input Dhall file.
+  # example: "https://raw.githubusercontent.com/cdepillabout/example-dhall-repo/c1b0d0327146648dcf8de997b2aa32758f2ed735/example1.dhall"
+  url
+
+  # Nix hash of the input Dhall file.
+  # example: "sha256-ZTSiQUXpPbPfPvS8OeK6dDQE6j6NbP27ho1cg9YfENI="
+, hash
+
+  # Dhall hash of the input Dhall file.
+  # example: "sha256:6534a24145e93db3df3ef4bc39e2ba743404ea3e8d6cfdbb868d5c83d61f10d2"
+, dhallHash
+
+  # Name for this derivation.
+, name ? (baseNameOf url + "-cache")
+
+  # `buildDhallUrl` can include both a "source distribution" in
+  # `source.dhall` and a "binary distribution" in `binary.dhall`:
+  #
+  # * `source.dhall` is a dependency-free αβ-normalized Dhall expression
+  #
+  # * `binary.dhall` is an expression of the form: `missing sha256:${HASH}`
+  #
+  #   This expression requires you to install the cache product located at
+  #   `.cache/dhall/1220${HASH}` to successfully resolve
+  #
+  # By default, `buildDhallUrl` only includes "binary.dhall" to conserve
+  # space within the Nix store, but if you set the following `source` option to
+  # `true` then the package will also include `source.dhall`.
+, source ? false
+}:
+
+let
+  # HTTP support is disabled in order to force that HTTP dependencies are built
+  # using Nix instead of using Dhall's support for HTTP imports.
+  dhallNoHTTP = haskell.lib.appendConfigureFlag dhall "-f-with-http";
+
+  # This uses Dhall's remote importing capabilities for downloading a Dhall file.
+  # The output Dhall file has all imports resolved, and then is
+  # alpha-normalized and binary-encoded.
+  downloadedEncodedFile =
+    runCommand
+      (baseNameOf url)
+      {
+        outputHashAlgo = null;
+        outputHash = hash;
+        name = baseNameOf url;
+        nativeBuildInputs = [ cacert ];
+      }
+      ''
+        echo "${url} ${dhallHash}" > in-dhall-file
+        ${dhall}/bin/dhall --alpha --plain --file in-dhall-file | ${dhallNoHTTP}/bin/dhall encode > $out
+      '';
+
+   cache = ".cache";
+
+   data = ".local/share";
+
+   cacheDhall = "${cache}/dhall";
+
+   dataDhall = "${data}/dhall";
+
+   sourceFile = "source.dhall";
+
+in
+  runCommand name { } (''
+    set -eu
+
+    mkdir -p ${cacheDhall} $out/${cacheDhall}
+
+    export XDG_CACHE_HOME=$PWD/${cache}
+
+    SHA_HASH="${dhallHash}"
+
+    HASH_FILE="''${SHA_HASH/sha256:/1220}"
+
+    cp ${downloadedEncodedFile} $out/${cacheDhall}/$HASH_FILE
+
+    echo "missing $SHA_HASH" > $out/binary.dhall
+  '' +
+  lib.optionalString source ''
+    ${dhallNoHTTP}/bin/dhall decode --file ${downloadedEncodedFile} > $out/${sourceFile}
+  '')
diff --git a/pkgs/development/php-packages/phpmd/default.nix b/pkgs/development/php-packages/phpmd/default.nix
index 764d56475c42..763fd857c357 100644
--- a/pkgs/development/php-packages/phpmd/default.nix
+++ b/pkgs/development/php-packages/phpmd/default.nix
@@ -27,6 +27,6 @@ mkDerivation {
     license = licenses.bsd3;
     homepage = "https://phpmd.org/";
     maintainers = teams.php.members;
-    broken = versionAtLeast php.version "7.4";
+    broken = versionOlder php.version "7.4";
   };
 }
diff --git a/pkgs/development/python-modules/slackclient/default.nix b/pkgs/development/python-modules/slackclient/default.nix
index c82eba66acae..1c02d592d679 100644
--- a/pkgs/development/python-modules/slackclient/default.nix
+++ b/pkgs/development/python-modules/slackclient/default.nix
@@ -1,4 +1,5 @@
 { lib
+, stdenv
 , aiohttp
 , buildPythonPackage
 , codecov
@@ -51,7 +52,18 @@ buildPythonPackage rec {
 
   # Exclude tests that requires network features
   pytestFlagsArray = [ "--ignore=integration_tests" ];
-  disabledTests = [ "test_start_raises_an_error_if_rtm_ws_url_is_not_returned" ];
+
+  disabledTests = [
+    "test_start_raises_an_error_if_rtm_ws_url_is_not_returned"
+  ] ++ lib.optionals stdenv.isDarwin [
+    # these fail with `ConnectionResetError: [Errno 54] Connection reset by peer`
+    "test_issue_690_oauth_access"
+    "test_issue_690_oauth_v2_access"
+    "test_send"
+    "test_send_attachments"
+    "test_send_blocks"
+    "test_send_dict"
+  ];
 
   pythonImportsCheck = [ "slack" ];
 
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index 268a0b09c261..703fe2387119 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -45,6 +45,10 @@ rec {
     url = "https://developer.nvidia.com/vulkan-beta-${lib.concatStrings (lib.splitString "." version)}-linux";
   };
 
+  # Update note:
+  # If you add a legacy driver here, also update `top-level/linux-kernels.nix`,
+  # adding to the `nvidia_x11_legacy*` entries.
+
   # Last one supporting Kepler architecture
   legacy_470 = generic {
       version = "470.82.00";
diff --git a/pkgs/test/default.nix b/pkgs/test/default.nix
index 80d82e5bee07..d1ec7169e170 100644
--- a/pkgs/test/default.nix
+++ b/pkgs/test/default.nix
@@ -58,4 +58,6 @@ with pkgs;
   };
 
   writers = callPackage ../build-support/writers/test.nix {};
+
+  dhall = callPackage ./dhall { };
 }
diff --git a/pkgs/test/dhall/buildDhallUrl/default.nix b/pkgs/test/dhall/buildDhallUrl/default.nix
new file mode 100644
index 000000000000..d2e214fb9770
--- /dev/null
+++ b/pkgs/test/dhall/buildDhallUrl/default.nix
@@ -0,0 +1,14 @@
+{ dhallPackages, lib }:
+
+# This file tests that dhallPackages.buildDhallUrl is able to successfully
+# build a Nix Dhall package for a given remote Dhall import.
+#
+# TODO: It would be nice to extend this test to make sure that the resulting
+# Nix Dhall package is has the expected contents.
+
+dhallPackages.buildDhallUrl {
+  url = "https://raw.githubusercontent.com/cdepillabout/example-dhall-nix/e6a675c72ecd4dd23d254a02aea8181fe875747f/mydhallfile.dhall";
+  hash = "sha256-434x+QjHRzuprBdw0h6wmwB1Zj6yZqQb533me8XdO4c=";
+  dhallHash = "sha256:e37e31f908c7473ba9ac1770d21eb09b0075663eb266a41be77de67bc5dd3b87";
+  source = true;
+}
diff --git a/pkgs/test/dhall/default.nix b/pkgs/test/dhall/default.nix
new file mode 100644
index 000000000000..bdb33acf0238
--- /dev/null
+++ b/pkgs/test/dhall/default.nix
@@ -0,0 +1,5 @@
+{ lib, callPackage }:
+
+lib.recurseIntoAttrs {
+  buildDhallUrl = callPackage ./buildDhallUrl { };
+}
diff --git a/pkgs/tools/backup/autorestic/default.nix b/pkgs/tools/backup/autorestic/default.nix
index ab299db1c675..164c609299d7 100644
--- a/pkgs/tools/backup/autorestic/default.nix
+++ b/pkgs/tools/backup/autorestic/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "autorestic";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "cupcakearmy";
     repo = pname;
     rev = "v${version}";
-    sha256 = "yQgSJ0SQNWPMyrYn8rep+1b549HP8sOERh+kOiAK3+c=";
+    sha256 = "sha256-kd4nhfqKbJM7w1Prqiy+UBaa2SmZDgeSZzZTXTZ30yA=";
   };
 
-  vendorSha256 = "7648gAguqeqLKFS9xRcx20wpSLb+ykZ7rOqR5PKe71o=";
+  vendorSha256 = "sha256-eKsPdmPJXiCwvb2A28tNxF4xStry3iA6aLb+XYFJYSg=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/tools/backup/kopia/default.nix b/pkgs/tools/backup/kopia/default.nix
index 512ec7b52590..0774d6e5483a 100644
--- a/pkgs/tools/backup/kopia/default.nix
+++ b/pkgs/tools/backup/kopia/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kopia";
-  version = "0.9.4";
+  version = "0.9.5";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-+zfkFusLoYITIStk3ZobeuN3MFeY5T6pbiUEc4IT1UA=";
+    sha256 = "sha256-1HCpUfK8y4BaBluThpRVeXTPgMUym6R+WXCO+2pRNjc=";
   };
 
-  vendorSha256 = "sha256-v81YkImg8GdI5locfsU4dg2JyO7XB24mfHRIZ+k8QBA=";
+  vendorSha256 = "sha256-tYu1T4oHkvj4QOS/e/6N9IjMlxrGKosQ78DVgAyh6/Q=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index db9b2c9465fa..7df444177c5e 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -77,17 +77,12 @@ common =
 
       propagatedBuildInputs = [ boehmgc ];
 
-      # Seems to be required when using std::atomic with 64-bit types
-      NIX_LDFLAGS =
-        # need to list libraries individually until
+      NIX_LDFLAGS = lib.optionals (!is24) [
         # https://github.com/NixOS/nix/commit/3e85c57a6cbf46d5f0fe8a89b368a43abd26daba
-        # is in a release
-          lib.optionalString enableStatic "-lssl -lbrotlicommon -lssh2 -lz -lnghttp2 -lcrypto"
-
-        # need to detect it here until
+        (lib.optionalString enableStatic "-lssl -lbrotlicommon -lssh2 -lz -lnghttp2 -lcrypto")
         # https://github.com/NixOS/nix/commits/74b4737d8f0e1922ef5314a158271acf81cd79f8
-        # is in a release
-        + lib.optionalString (stdenv.hostPlatform.system == "armv5tel-linux" || stdenv.hostPlatform.system == "armv6l-linux") "-latomic";
+        (lib.optionalString (stdenv.hostPlatform.system == "armv5tel-linux" || stdenv.hostPlatform.system == "armv6l-linux") "-latomic")
+      ];
 
       preConfigure =
         # Copy libboost_context so we don't get all of Boost in our closure.
@@ -152,7 +147,7 @@ common =
         export TMPDIR=$NIX_BUILD_TOP
       '';
 
-      separateDebugInfo = stdenv.isLinux;
+      separateDebugInfo = stdenv.isLinux && (is24 -> !enableStatic);
 
       enableParallelBuilding = true;
 
@@ -218,7 +213,9 @@ in rec {
 
   nix = nixStable;
 
-  nixStable = callPackage common (rec {
+  nixStable = nix_2_3;
+
+  nix_2_3 = callPackage common (rec {
     pname = "nix";
     version = "2.3.16";
     src = fetchurl {
@@ -233,13 +230,13 @@ in rec {
 
   nix_2_4 = callPackage common (rec {
     pname = "nix";
-    version = "2.4pre-rc1";
+    version = "2.4";
 
     src = fetchFromGitHub {
       owner = "NixOS";
       repo = "nix";
       rev = version;
-      sha256 = "sha256-KOb8etMm5LksvT2l+CkvqzMO1bgmo9tJmyaNh0LvaR8=";
+      sha256 = "sha256-op48CCDgLHK0qV1Batz4Ln5FqBiRjlE6qHTiZgt3b6k=";
     };
 
     boehmgc = boehmgc_nixUnstable;
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 388da7860a17..a320f6a29a29 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -590,7 +590,7 @@ mapAliases ({
   nginxUnstable = nginxMainline; # added 2018-04-25
   nilfs_utils = nilfs-utils; # added 2018-04-25
   nix-review = nixpkgs-review; # added 2019-12-22
-  nixFlakes = nixUnstable; # added 2021-05-21
+  nixFlakes = nix_2_4; # added 2021-05-21
   nmap_graphical = nmap-graphical;  # added 2017-01-19
   nmap-unfree = nmap; # added 2021-04-06
   nologin = shadow; # added 2018-04-25
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a1483ec9f725..ff20c562dc15 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -32252,6 +32252,7 @@ with pkgs;
       })
     nix
     nixStable
+    nix_2_3
     nix_2_4
     nixUnstable;
 
diff --git a/pkgs/top-level/dhall-packages.nix b/pkgs/top-level/dhall-packages.nix
index 1be67f2a4dea..1910cb372741 100644
--- a/pkgs/top-level/dhall-packages.nix
+++ b/pkgs/top-level/dhall-packages.nix
@@ -17,12 +17,16 @@ let
       buildDhallDirectoryPackage =
         callPackage ../development/interpreters/dhall/build-dhall-directory-package.nix { };
 
+      buildDhallUrl =
+        callPackage ../development/interpreters/dhall/build-dhall-url.nix { };
+
     in
       { inherit
           callPackage
           buildDhallPackage
           buildDhallGitHubPackage
           buildDhallDirectoryPackage
+          buildDhallUrl
         ;
 
         lib = import ../development/dhall-modules/lib.nix { inherit lib; };