diff --git a/lib/modules.nix b/lib/modules.nix
index c67ea2247ca7..ff286ad7c4b2 100644
--- a/lib/modules.nix
+++ b/lib/modules.nix
@@ -1246,6 +1246,8 @@ let
             allInvalid = filter (def: !type.check def.value) defsFinal;
           in
           throw "A definition for option `${showOption loc}' is not of type `${type.description}'. Definition values:${showDefs allInvalid}"
+      else if type.emptyValue ? value then
+        type.emptyValue.value
       else
         # (nixos-option detects this specific error message and gives it special
         # handling.  If changed here, please change it there too.)
diff --git a/lib/options.nix b/lib/options.nix
index c348491f0457..0cda30fc3544 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -589,11 +589,16 @@ rec {
             renderOptionValue opt.example
           );
         }
-        // optionalAttrs (opt ? defaultText || opt ? default) {
-          default = builtins.addErrorContext "while evaluating the ${
-            if opt ? defaultText then "defaultText" else "default value"
-          } of option `${name}`" (renderOptionValue (opt.defaultText or opt.default));
-        }
+        //
+          optionalAttrs (opt ? defaultText || opt ? default || ((opt.type or { }).emptyValue or { }) ? value)
+            {
+              default =
+                builtins.addErrorContext
+                  "while evaluating the ${
+                    if opt ? defaultText then "defaultText" else "default value"
+                  } of option `${name}`"
+                  (renderOptionValue (opt.defaultText or opt.default or opt.type.emptyValue.value));
+            }
         // optionalAttrs (opt ? relatedPackages && opt.relatedPackages != null) {
           inherit (opt) relatedPackages;
         };
diff --git a/lib/tests/misc.nix b/lib/tests/misc.nix
index 1a69d7dfb484..da0979756720 100644
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@@ -3393,6 +3393,44 @@ runTests {
     ];
   };
 
+  testEmptyValueOption = {
+    expr =
+      let
+        module =
+          { lib, ... }:
+          {
+            options = {
+              "empty-value" = lib.mkOption {
+                type = lib.mkOptionType {
+                  name = "propagate-empty-value-to-default";
+                  emptyValue.value = 2;
+                };
+              };
+            };
+          };
+        eval = evalModules {
+          modules = [ module ];
+        };
+      in
+      filter (o: o.name == "empty-value") (optionAttrSetToDocList eval.options);
+    expected = [
+      {
+        declarations = [ ];
+        default = {
+          _type = "literalExpression";
+          text = "2";
+        };
+        description = null;
+        internal = false;
+        loc = [ "empty-value" ];
+        name = "empty-value";
+        readOnly = false;
+        type = "propagate-empty-value-to-default";
+        visible = true;
+      }
+    ];
+  };
+
   testDocOptionVisiblity = {
     expr =
       let
diff --git a/lib/tests/modules.sh b/lib/tests/modules.sh
index aa9d3443fb6a..bc89d4c20851 100755
--- a/lib/tests/modules.sh
+++ b/lib/tests/modules.sh
@@ -674,6 +674,17 @@ checkConfigOutput "{}" config.submodule.a ./emptyValues.nix
 checkConfigError 'The option .int.a. was accessed but has no value defined. Try setting the option.' config.int.a ./emptyValues.nix
 checkConfigError 'The option .nonEmptyList.a. was accessed but has no value defined. Try setting the option.' config.nonEmptyList.a ./emptyValues.nix
 
+## defaults
+checkConfigOutput "\[\]" config.list ./defaults.nix
+checkConfigOutput "{}" config.attrs ./defaults.nix
+checkConfigOutput "{}" config.attrsOf ./defaults.nix
+checkConfigOutput "null" config.null ./defaults.nix
+checkConfigOutput "{}" config.submodule ./defaults.nix
+checkConfigOutput "\[\]" config.unique ./defaults.nix
+checkConfigOutput "\[\]" config.coercedTo ./defaults.nix
+# These types don't have empty values
+checkConfigError 'The option .int. was accessed but has no value defined. Try setting the option.' config.int ./defaults.nix
+
 # types.unique
 #   requires a single definition
 checkConfigError 'The option .examples\.merged. is defined multiple times while it.s expected to be unique' config.examples.merged.a ./types-unique.nix
diff --git a/lib/tests/modules/defaults.nix b/lib/tests/modules/defaults.nix
new file mode 100644
index 000000000000..56eee2c9c286
--- /dev/null
+++ b/lib/tests/modules/defaults.nix
@@ -0,0 +1,33 @@
+{ lib, ... }:
+let
+  inherit (lib) types;
+in
+{
+  options = {
+    list = lib.mkOption {
+      type = types.listOf types.int;
+    };
+    attrs = lib.mkOption {
+      type = types.attrs;
+    };
+    attrsOf = lib.mkOption {
+      type = types.attrsOf types.int;
+    };
+    null = lib.mkOption {
+      type = types.nullOr types.int;
+    };
+    submodule = lib.mkOption {
+      type = types.submodule { };
+    };
+    unique = lib.mkOption {
+      type = types.unique { message = "hi"; } (types.listOf types.int);
+    };
+    coercedTo = lib.mkOption {
+      type = types.coercedTo (types.attrsOf types.int) builtins.attrNames (types.listOf types.str);
+    };
+    # no empty value
+    int = lib.mkOption {
+      type = types.int;
+    };
+  };
+}
diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
index 44054818178c..9ff21dd0b162 100644
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -4,6 +4,32 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
+- The system.nix file has been added has an alternative entry point to configuration.nix (and flake.nix) that allows to configure NixOS without using `nix-channel`.
+  This file must evaluate to a NixOS system derivation or an attribute set of such derivations, in which case the attribute to build has to be selected with the `--attr` option of `nixos-rebuild` or `nixos-install`.
+  For example,
+  ```nix
+  # system.nix
+  let
+    # Pinned Nixpkgs archive
+    #
+    # Use `curl -I https://channels.nixos.org/nixos-26.05` to get the
+    # latest commit of the stable channel and `nix-prefetch-url --unpack`
+    # to compute its sha256 hash.
+    nixpkgs = builtins.fetchTarball {
+      url = "https://github.com/NixOS/nixpkgs/archive/c217913993d6.tar.gz";
+      sha256 = "026mprs324330pfazlgbw987qmsa8ligglarvqbcxzig2kgw0lqg";
+    };
+  in
+  import "${nixpkgs}/nixos" {
+    # Build NixOS using an external configuration.nix file,
+    # or directly set your options here
+    configuration = ./configuration.nix;
+  }
+  ```
+
+  The default location of system.nix is `/etc/nixos/system.nix` and can be changed by setting the `<nixos-system>` search path.
+  `nixos-rebuild` and `nixos-install` can now also load a system.nix file in the current directory (only if `--attr` is used) or from a directory specified with `--file`.
+
 - The default kernel package has been updated from 6.12 to 6.18. All supported kernels remain available.
 
 ## New Modules {#sec-release-26.05-new-modules}
diff --git a/nixos/modules/installer/sd-card/sd-image.nix b/nixos/modules/installer/sd-card/sd-image.nix
index b3251f9c6e1d..237a96f4e3c6 100644
--- a/nixos/modules/installer/sd-card/sd-image.nix
+++ b/nixos/modules/installer/sd-card/sd-image.nix
@@ -179,12 +179,44 @@ in
       '';
     };
 
+    preBuildCommands = mkOption {
+      type = types.lines;
+      example = literalExpression ''
+        '''
+          if [ ! -w "$root_fs" ]; then
+            cp --no-preserve=mode "$root_fs" ./root-fs.img
+            root_fs=./root-fs.img
+          fi
+          resize2fs $root_fs 15G
+        '''
+      '';
+      default = "";
+      description = ''
+        Shell commands to run after the root filesystem image has been
+        prepared, but before the final SD image is assembled.
+
+        The path to the root filesystem image is available in the
+        {var}`root_fs` shell variable. This hook can be used to modify
+        the rootfs, for example to resize it or inject additional files.
+
+        Note that when {option}`sdImage.compressImage` is disabled,
+        {var}`root_fs` points to a read-only store path. To modify it,
+        first copy it to a writable location and update {var}`root_fs`
+        to point to the copy.
+      '';
+    };
+
     postBuildCommands = mkOption {
+      type = types.lines;
       example = literalExpression "'' dd if=\${pkgs.myBootLoader}/SPL of=$img bs=1024 seek=1 conv=notrunc ''";
       default = "";
       description = ''
-        Shell commands to run after the image is built.
-        Can be used for boards requiring to dd u-boot SPL before actual partitions.
+        Shell commands to run after the SD image has been assembled.
+
+        The path to the image is available in the {var}`img` shell
+        variable. This hook is typically used for boards that require
+        writing a bootloader (such as u-boot SPL) to a fixed offset
+        before the first partition.
       '';
     };
 
@@ -284,6 +316,8 @@ in
             zstd -d --no-progress "${config.sdImage.rootFilesystemImage}" -o $root_fs
           ''}
 
+          ${config.sdImage.preBuildCommands}
+
           # Gap in front of the first partition, in MiB
           gap=${toString config.sdImage.firmwarePartitionOffset}
 
diff --git a/nixos/modules/services/torrent/qbittorrent.nix b/nixos/modules/services/torrent/qbittorrent.nix
index 8ecfd98fde65..8c17fafc74b5 100644
--- a/nixos/modules/services/torrent/qbittorrent.nix
+++ b/nixos/modules/services/torrent/qbittorrent.nix
@@ -154,11 +154,6 @@ in
             mode = "755";
             inherit (cfg) user group;
           };
-          "${cfg.profileDir}/qBittorrent/config/qBittorrent.conf"."C+" = mkIf (cfg.serverConfig != { }) {
-            mode = "600";
-            inherit (cfg) user group;
-            argument = toString configFile;
-          };
         };
       };
       services.qbittorrent = {
@@ -176,6 +171,12 @@ in
           Type = "simple";
           User = cfg.user;
           Group = cfg.group;
+
+          # the config file has to be writable, so we have to do this weird dance
+          ExecStartPre = lib.mkIf (cfg.serverConfig != { }) ''
+            ${pkgs.coreutils}/bin/install -Dm600 ${configFile} "${cfg.profileDir}/qBittorrent/config/qBittorrent.conf"
+          '';
+
           ExecStart = utils.escapeSystemdExecArgs (
             [
               (getExe cfg.package)
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 638afcb5f721..2086f7045b56 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1126,7 +1126,6 @@ in
   nixpkgs-config-allow-unfree-packages-and-predicate =
     pkgs.callPackage ../../pkgs/stdenv/generic/check-meta-test.nix
       { };
-  nixseparatedebuginfod = runTest ./nixseparatedebuginfod.nix;
   nixseparatedebuginfod2 = runTest ./nixseparatedebuginfod2.nix;
   node-red = runTest ./node-red.nix;
   nohang = runTest ./nohang.nix;
diff --git a/pkgs/applications/editors/vscode/extensions/prettier.prettier-vscode/default.nix b/pkgs/applications/editors/vscode/extensions/prettier.prettier-vscode/default.nix
index 0a25104eb2b0..37535f13c86e 100644
--- a/pkgs/applications/editors/vscode/extensions/prettier.prettier-vscode/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/prettier.prettier-vscode/default.nix
@@ -16,19 +16,19 @@ let
   vsix = stdenv.mkDerivation (finalAttrs: {
     name = "prettier-vscode-${finalAttrs.version}.vsix";
     pname = "prettier-vscode-vsix";
-    version = "12.3.0";
+    version = "12.4.0";
 
     src = fetchFromGitHub {
       owner = "prettier";
       repo = "prettier-vscode";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-a6BBWd+K8boLw+0j6etT/KHmdScLr6mBG7T5pslilTo=";
+      hash = "sha256-N++WB0CvqYQTRg3SQFf9QJrwSJXtUd7z/kvWXQqOSC4=";
     };
 
     npmDeps = fetchNpmDeps {
       name = "${finalAttrs.pname}-npm-deps";
       inherit (finalAttrs) src;
-      hash = "sha256-itl/OXjL6co3smccRwRbuGM427YzBsYh2BvkEc+oX5Y=";
+      hash = "sha256-vktxhQA2a+D9Nr4vhbmGCnNdGzt0U89K50g0SgiV5SE=";
     };
 
     buildInputs = lib.optionals stdenv.isLinux [
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 264dfab916fb..431c939caefc 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1229,13 +1229,13 @@
     "vendorHash": "sha256-skswuFKhN4FFpIunbom9rM/FVRJVOFb1WwHeAIaEjn8="
   },
   "spacelift-io_spacelift": {
-    "hash": "sha256-W05b6v8OEPLRUzh0w5Wu7bySuaCkrD3Rl9CkomgEyEE=",
+    "hash": "sha256-HPryfdykq6m9L66z4gC8tb1F4tTHLk9H4UN2/lnNpu4=",
     "homepage": "https://registry.terraform.io/providers/spacelift-io/spacelift",
     "owner": "spacelift-io",
     "repo": "terraform-provider-spacelift",
-    "rev": "v1.44.0",
+    "rev": "v1.45.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-E9e4+n12uSc12F428D8Oqe0iquTMywAY4DYWhSC+hmk="
+    "vendorHash": "sha256-Ub0lqMdCu44UX3LkcjErsxfWdL9C6CxhVKPOn1AAdEc="
   },
   "splunk-terraform_signalfx": {
     "hash": "sha256-N9vAa6/FAGQaLFv2GUz4P8vKXR1F8QPFJ+sIaFoNFpw=",
diff --git a/pkgs/by-name/_1/_1password-cli/package.nix b/pkgs/by-name/_1/_1password-cli/package.nix
index c0a7115c1db8..cb9899f940ef 100644
--- a/pkgs/by-name/_1/_1password-cli/package.nix
+++ b/pkgs/by-name/_1/_1password-cli/package.nix
@@ -92,6 +92,7 @@ stdenv.mkDerivation {
     maintainers = with lib.maintainers; [
       joelburget
       khaneliman
+      savtrip
     ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;
diff --git a/pkgs/by-name/ao/aocl-utils/package.nix b/pkgs/by-name/ao/aocl-utils/package.nix
index 61c990f59b23..5e4c827ecfda 100644
--- a/pkgs/by-name/ao/aocl-utils/package.nix
+++ b/pkgs/by-name/ao/aocl-utils/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "aocl-utils";
-  version = "5.2";
+  version = "5.2.2";
 
   src = fetchFromGitHub {
     owner = "amd";
     repo = "aocl-utils";
     tag = finalAttrs.version;
-    hash = "sha256-wPnKfPbkW9ILu1YgyymKmg5gZj0l0cWio3/JTXtbylA=";
+    hash = "sha256-grEuYM+Ss4pQQ12S5uOV27ocVHzYuLK+e70Jm5u8fuI=";
   };
 
   patches = [ ./pkg-config.patch ];
diff --git a/pkgs/by-name/ba/backblaze-b2/package.nix b/pkgs/by-name/ba/backblaze-b2/package.nix
index 2bd1ddf273a4..beb32465cae5 100644
--- a/pkgs/by-name/ba/backblaze-b2/package.nix
+++ b/pkgs/by-name/ba/backblaze-b2/package.nix
@@ -42,7 +42,10 @@ python3Packages.buildPythonApplication (finalAttrs: {
     tqdm
   ];
 
-  pythonRelaxDeps = [ "docutils" ];
+  pythonRelaxDeps = [
+    "docutils"
+    "tabulate"
+  ];
 
   nativeCheckInputs = with python3Packages; [
     backoff
@@ -101,6 +104,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
   meta = {
     description = "Command-line tool for accessing the Backblaze B2 storage service";
     homepage = "https://github.com/Backblaze/B2_Command_Line_Tool";
+    maintainers = with lib.maintainers; [ phaer ];
     changelog = "https://github.com/Backblaze/B2_Command_Line_Tool/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     mainProgram = "backblaze-b2";
diff --git a/pkgs/by-name/bt/btrfs-progs/package.nix b/pkgs/by-name/bt/btrfs-progs/package.nix
index cd96b73dfb07..80f500c9ad30 100644
--- a/pkgs/by-name/bt/btrfs-progs/package.nix
+++ b/pkgs/by-name/bt/btrfs-progs/package.nix
@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "btrfs-progs";
-  version = "6.19";
+  version = "6.19.1";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${finalAttrs.version}.tar.xz";
-    hash = "sha256-rWt5GmDrVj0zFLwY48R/awU6AyY5SItbCbnV55Id5rY=";
+    hash = "sha256-uyfh7FTnw8C3suWW+FOnPAej1y8hvJQEIHPCTb8EV5Y=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ca/cargo-lock/package.nix b/pkgs/by-name/ca/cargo-lock/package.nix
index 4057181239de..7a242d8a4b47 100644
--- a/pkgs/by-name/ca/cargo-lock/package.nix
+++ b/pkgs/by-name/ca/cargo-lock/package.nix
@@ -6,14 +6,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-lock";
-  version = "11.0.0";
+  version = "11.0.1";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-Gz459c2IWD19RGBg2TyHbI/VNCelha+R0FeNkAaHksU=";
+    hash = "sha256-l8B98ycfC17vUY29BbFoucGeAn8mapchCvjdMCNhKqc=";
   };
 
-  cargoHash = "sha256-Kw1LWu/DYfeuf5aMaNslnDyEoaRj0J+yxWs7sKHyWlU=";
+  cargoHash = "sha256-l76udCsgloW5tZ8TgNMOT47un2Epun0B3UjaHCWdZjE=";
 
   buildFeatures = [ "cli" ];
 
diff --git a/pkgs/by-name/cl/cliamp/package.nix b/pkgs/by-name/cl/cliamp/package.nix
index a9315a5e65c9..6c5257e0e203 100644
--- a/pkgs/by-name/cl/cliamp/package.nix
+++ b/pkgs/by-name/cl/cliamp/package.nix
@@ -1,7 +1,9 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
+  nix-update-script,
   pkg-config,
   makeWrapper,
   alsa-lib,
@@ -14,13 +16,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "cliamp";
-  version = "1.21.5";
+  version = "1.25.0";
 
   src = fetchFromGitHub {
     owner = "bjarneo";
     repo = "cliamp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xqiFtMw5kFRAnc4CSkc7/RcAejWxlJAoGFkQ2f5Z3bc=";
+    hash = "sha256-SE8uUdA3u+bm3A65J2nMyG+17NCaq5mQgji7eYUQKd8=";
   };
 
   vendorHash = "sha256-UMDCpfSGfvJmI+sImaFzgZpLNaLMgEnmGCqERwPokHM=";
@@ -31,10 +33,12 @@ buildGoModule (finalAttrs: {
   ];
 
   buildInputs = [
-    alsa-lib
     libogg
     libvorbis
     flac
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    alsa-lib
   ];
 
   postInstall = ''
@@ -47,6 +51,11 @@ buildGoModule (finalAttrs: {
       }
   '';
 
+  # this is set due to failure of testset `net/http/httptest` on darwin
+  __darwinAllowLocalNetworking = true;
+
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Terminal Winamp - a retro terminal music player inspired by Winamp 2.x";
     homepage = "https://github.com/bjarneo/cliamp";
diff --git a/pkgs/by-name/cr/crc/package.nix b/pkgs/by-name/cr/crc/package.nix
index 425afb4db9f3..e3497b0cd54a 100644
--- a/pkgs/by-name/cr/crc/package.nix
+++ b/pkgs/by-name/cr/crc/package.nix
@@ -8,16 +8,16 @@
 }:
 
 let
-  openShiftVersion = "4.21.0";
-  okdVersion = "4.20.0-okd-scos.11";
+  openShiftVersion = "4.21.4";
+  okdVersion = "4.21.0-okd-scos.5";
   microshiftVersion = "4.21.0";
   writeKey = "$(MODULEPATH)/pkg/crc/segment.WriteKey=cvpHsNcmGCJqVzf6YxrSnVlwFSAZaYtp";
-  gitCommit = "275f36851d44a1dba8407f960f763b546ba8fc32";
-  gitHash = "sha256-M622rTWsz35EVmMm/EyIAYbRFFBvpXYjcNp4HrcFl3o=";
+  gitCommit = "e90757a62cf73025d22e2bcdc7b04bf5e5e9a0e0";
+  gitHash = "sha256-0Rs+kpuiCQzgLKpZ4fkspZEiH/cnkkN3jdObgAK9hGw=";
 in
 buildGoModule (finalAttrs: {
   pname = "crc";
-  version = "2.58.0";
+  version = "2.59.0";
 
   src = fetchFromGitHub {
     owner = "crc-org";
diff --git a/pkgs/by-name/er/ersatztv/nuget-deps.json b/pkgs/by-name/er/ersatztv/nuget-deps.json
index 41929470955a..7cdcbf90ba7f 100644
--- a/pkgs/by-name/er/ersatztv/nuget-deps.json
+++ b/pkgs/by-name/er/ersatztv/nuget-deps.json
@@ -126,13 +126,13 @@
   },
   {
     "pname": "Elastic.Clients.Elasticsearch",
-    "version": "9.2.2",
-    "hash": "sha256-5wzN9SoLH/zU3WScLryzfVmk078TpO/5EY2iUflB5IY="
+    "version": "9.3.0",
+    "hash": "sha256-h2ExrklcO6tVFV2ecxnGXA4uY9D1tiQ3sqmmN7wrRoM="
   },
   {
     "pname": "Elastic.Transport",
-    "version": "0.10.1",
-    "hash": "sha256-eX9H+arnuPnIzOFQvle4pdDTTpZ0Rw+t7rJ1ohlxbh0="
+    "version": "0.10.3",
+    "hash": "sha256-9AcJAN3uP3wywsm52caPg6Qgt4iZS0nhjIl2bb0hlx8="
   },
   {
     "pname": "ExtendedNumerics.BigDecimal",
@@ -161,8 +161,13 @@
   },
   {
     "pname": "Hardware.Info",
-    "version": "101.1.0.1",
-    "hash": "sha256-R2kxac5rNQ9mEsD3OR5LmXiBP4uakmcRBrHazzs+EMU="
+    "version": "101.1.1.1",
+    "hash": "sha256-JPd8B7bvz8jMtVXsJH9mwW+wd71cTtC7O3RyRbrR0X4="
+  },
+  {
+    "pname": "Hardware.Info.Core",
+    "version": "101.1.1.1",
+    "hash": "sha256-NHPzZZ286Wtj4Fv53gLUf5duqSx6GhXtyufbwe49nyM="
   },
   {
     "pname": "HarfBuzzSharp",
@@ -191,8 +196,8 @@
   },
   {
     "pname": "HtmlSanitizer",
-    "version": "9.0.889",
-    "hash": "sha256-0U6K39KkovhpFujGNhjUCv5/JCbESCiiAJbvHCYi9f0="
+    "version": "9.0.892",
+    "hash": "sha256-8ZVGH6RJ3QjgmwSGdVadS2pd3Tgq9IHXW7VHOX0slH0="
   },
   {
     "pname": "Humanizer.Core",
@@ -216,18 +221,18 @@
   },
   {
     "pname": "Json.More.Net",
-    "version": "2.2.0",
-    "hash": "sha256-Hb4ylcT/6bLHVADpnjoBJKyTR3cU+WjYlblO79A+SSU="
+    "version": "3.0.0",
+    "hash": "sha256-zlJb9Wi9ErFqN8FYphzog9paPxI3DBVnoTL0c12Bfks="
   },
   {
     "pname": "JsonPointer.Net",
-    "version": "6.0.1",
-    "hash": "sha256-iIvOHz6jjTsGnXyxOK71z2F8gh21TmQS4A9SLB4u93A="
+    "version": "7.0.0",
+    "hash": "sha256-/1GemlLhmYnz/HDQTpEEaGxaofoFkFUMNNPInKhAvM4="
   },
   {
     "pname": "JsonSchema.Net",
-    "version": "8.0.5",
-    "hash": "sha256-zFSEmqckius1fa/vxhJEMoNC/RU25kF3AStyMwxHCPM="
+    "version": "9.0.0",
+    "hash": "sha256-N5bp2OswdoQI5fe/ZaKmk7LwL9woJ5cV4D43IUeFJ3E="
   },
   {
     "pname": "LanguageExt.Core",
@@ -1046,8 +1051,8 @@
   },
   {
     "pname": "Scalar.AspNetCore",
-    "version": "2.12.10",
-    "hash": "sha256-KBFz5usTX/6AZnzMwkcEA7TbMksEmR9K7g9a/t0AKXs="
+    "version": "2.12.32",
+    "hash": "sha256-0EZAD43NpMpX3P8quuctTLSGBxwjxxbyfQodo0e+nII="
   },
   {
     "pname": "Scriban.Signed",
diff --git a/pkgs/by-name/er/ersatztv/package.nix b/pkgs/by-name/er/ersatztv/package.nix
index 3687ea3e6e3a..8022bb8c3932 100644
--- a/pkgs/by-name/er/ersatztv/package.nix
+++ b/pkgs/by-name/er/ersatztv/package.nix
@@ -9,13 +9,13 @@
 
 buildDotnetModule rec {
   pname = "ersatztv";
-  version = "26.2.0";
+  version = "26.3.0";
 
   src = fetchFromGitHub {
     owner = "ErsatzTV";
     repo = "ErsatzTV";
     rev = "v${version}";
-    sha256 = "sha256-Ld0IdPMfkEdNfEy75bFzAUNhGdG/B8CSUVZKokcxReg=";
+    sha256 = "sha256-yFGMkTI+IQs3WTOQzxhqj3ownENsIzLqrDr3nWurzfA=";
   };
   postPatch = ''
     # Remove config of development tools that don't end up in
diff --git a/pkgs/by-name/fi/filebeat8/package.nix b/pkgs/by-name/fi/filebeat8/package.nix
index 5e7bcbff49c5..72db913dcf73 100644
--- a/pkgs/by-name/fi/filebeat8/package.nix
+++ b/pkgs/by-name/fi/filebeat8/package.nix
@@ -8,18 +8,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "filebeat";
-  version = "8.19.10";
+  version = "8.19.13";
 
   src = fetchFromGitHub {
     owner = "elastic";
     repo = "beats";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Ky1oWqQXIjno14ZBfxR1FoXEkSn1kScdQQTyGDRvMTo=";
+    hash = "sha256-KUbGtQW0GsMmEQPQA5DJtxMt+5pNs0LdQHr66e8sW/I=";
   };
 
   proxyVendor = true; # darwin/linux hash mismatch
 
-  vendorHash = "sha256-b4W10tGAoxW1oAfmQqM8x0JOi0BD1WBYB2sUVl/hLHY=";
+  vendorHash = "sha256-eZuqIOLNMnFBkZocYP1OCtny5DOPl+k2Hym51rqVQPA=";
 
   subPackages = [ "filebeat" ];
 
diff --git a/pkgs/by-name/gh/gh/package.nix b/pkgs/by-name/gh/gh/package.nix
index e66bc2b85a03..af8512eaaf00 100644
--- a/pkgs/by-name/gh/gh/package.nix
+++ b/pkgs/by-name/gh/gh/package.nix
@@ -63,6 +63,7 @@ buildGo126Module (finalAttrs: {
     maintainers = with lib.maintainers; [
       mdaniels5757
       zowoq
+      savtrip
     ];
   };
 })
diff --git a/pkgs/by-name/gi/git-lfs/package.nix b/pkgs/by-name/gi/git-lfs/package.nix
index 67aa8173cd55..345aa81d8370 100644
--- a/pkgs/by-name/gi/git-lfs/package.nix
+++ b/pkgs/by-name/gi/git-lfs/package.nix
@@ -107,7 +107,10 @@ buildGoModule (finalAttrs: {
     homepage = "https://git-lfs.github.com/";
     changelog = "https://github.com/git-lfs/git-lfs/raw/v${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ twey ];
+    maintainers = with lib.maintainers; [
+      twey
+      savtrip
+    ];
     mainProgram = "git-lfs";
   };
 })
diff --git a/pkgs/by-name/gi/gitaly/package.nix b/pkgs/by-name/gi/gitaly/package.nix
index a8649a6870a9..24bb497e4920 100644
--- a/pkgs/by-name/gi/gitaly/package.nix
+++ b/pkgs/by-name/gi/gitaly/package.nix
@@ -7,7 +7,7 @@
 }:
 
 let
-  version = "18.9.2";
+  version = "18.9.3";
   package_version = "v${lib.versions.major version}";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 
@@ -21,10 +21,10 @@ let
       owner = "gitlab-org";
       repo = "gitaly";
       rev = "v${version}";
-      hash = "sha256-qCOcy7JOR7OeY5uPZE6xo6NRi5OhVKdl5Q4n36S5XyI=";
+      hash = "sha256-k8byGIGG1sDGTX27QV1N/q9tnae3DY9v47XTv0+Mf9Y=";
     };
 
-    vendorHash = "sha256-lK0fNBhDGFOZ+sCm1VuvN4CpAb0nAkUl4yL/30tZKBY=";
+    vendorHash = "sha256-1lMOJLtwnu0drrGHuhCiZSNdpyBjLed4uV4B2NSJPJQ=";
 
     ldflags = [
       "-X ${gitaly_package}/internal/version.version=${version}"
diff --git a/pkgs/by-name/gi/gitlab-container-registry/package.nix b/pkgs/by-name/gi/gitlab-container-registry/package.nix
index 415d68950743..49a9c7bcf156 100644
--- a/pkgs/by-name/gi/gitlab-container-registry/package.nix
+++ b/pkgs/by-name/gi/gitlab-container-registry/package.nix
@@ -6,7 +6,7 @@
 
 buildGo125Module rec {
   pname = "gitlab-container-registry";
-  version = "4.37.0";
+  version = "4.39.0";
   rev = "v${version}-gitlab";
 
   # nixpkgs-update: no auto update
@@ -14,10 +14,14 @@ buildGo125Module rec {
     owner = "gitlab-org";
     repo = "container-registry";
     inherit rev;
-    hash = "sha256-ZsnmJEzoLSH5bspxTQjOV8EOeQVeFn+rYCl8QqfzGaA=";
+    hash = "sha256-7dGKV2Pc3OPdM4OZqYjp3B9/s6DHtPvrqcWnWb3wHYw=";
   };
 
-  vendorHash = "sha256-xUkfcgsw6nRDxq1Tj5Y1CYgnJ7rbCcncB94Aeh9Ek+M=";
+  vendorHash = "sha256-s08LsgYZTRJm0sWkbEUsmTYGkfb/5PJl9o9ozY1KOms=";
+
+  excludedPackages = [
+    "devvm/*"
+  ];
 
   checkFlags =
     let
diff --git a/pkgs/by-name/gi/gitlab-pages/package.nix b/pkgs/by-name/gi/gitlab-pages/package.nix
index 005dcd1e8464..7ea28f397b79 100644
--- a/pkgs/by-name/gi/gitlab-pages/package.nix
+++ b/pkgs/by-name/gi/gitlab-pages/package.nix
@@ -6,14 +6,14 @@
 
 buildGoModule (finalAttrs: {
   pname = "gitlab-pages";
-  version = "18.9.2";
+  version = "18.9.3";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-pages";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-sOJNwCcIAuLywL9r9c0RUqqtLbNmaaJ6ZMVBLQgus8k=";
+    hash = "sha256-UHQ0M/WTmjmfwFHJM8BJ5XPZs+x4A8uh4FNBp+3x0ew=";
   };
 
   vendorHash = "sha256-AZIv/CU01OAbn5faE4EkSuDCakYzDjRprB5ox5tIlck=";
diff --git a/pkgs/by-name/gi/gitlab/data.json b/pkgs/by-name/gi/gitlab/data.json
index 60b6e2d50087..a7258b500585 100644
--- a/pkgs/by-name/gi/gitlab/data.json
+++ b/pkgs/by-name/gi/gitlab/data.json
@@ -1,17 +1,17 @@
 {
-  "version": "18.9.2",
-  "repo_hash": "sha256-0ax0wYOEiL9Vl/cw9DaoyhROehZjrtv7KIKmOWrrJY8=",
+  "version": "18.9.3",
+  "repo_hash": "sha256-xApcwmDca3cK/nlDeS+DDh4MklmXxGnO/3+79WIC9Uk=",
   "yarn_hash": "sha256-uXyUJS4+YIRB3pPezVbj5u1fytOo+/bNR18Kq6FAKSQ=",
   "frontend_islands_yarn_hash": "sha256-OkCoiyL9FFJcWcNUbeRSBGGSauYIm7l+yxNfA0CsNEQ=",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v18.9.2-ee",
+  "rev": "v18.9.3-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "18.9.2",
-    "GITLAB_KAS_VERSION": "18.9.2",
-    "GITLAB_PAGES_VERSION": "18.9.2",
+    "GITALY_SERVER_VERSION": "18.9.3",
+    "GITLAB_KAS_VERSION": "18.9.3",
+    "GITLAB_PAGES_VERSION": "18.9.3",
     "GITLAB_SHELL_VERSION": "14.45.6",
     "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.13.3",
-    "GITLAB_WORKHORSE_VERSION": "18.9.2"
+    "GITLAB_WORKHORSE_VERSION": "18.9.3"
   }
 }
diff --git a/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix b/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
index ca942fc4ec80..aa710b26ed5f 100644
--- a/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
@@ -10,7 +10,7 @@ in
 buildGoModule (finalAttrs: {
   pname = "gitlab-workhorse";
 
-  version = "18.9.2";
+  version = "18.9.3";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
diff --git a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile
index 7800772abb14..23ea1555aa40 100644
--- a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile
+++ b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile
@@ -695,8 +695,8 @@ gem 'valid_email', '~> 0.1', feature_category: :shared # rubocop:todo Gemfile/Mi
 gem 'jsonb_accessor', '~> 1.4', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 gem 'json', '~> 2.13.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 gem 'json_schemer', '~> 2.3.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
-gem 'oj', '~> 3.16.0', '>=3.16.10', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
-gem 'oj-introspect', '~> 0.8', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
+gem 'oj', '~> 3.16.0', '>=3.16.16', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
+gem 'oj-introspect', '~> 0.9', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 gem 'multi_json', '~> 1.17.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 gem 'yajl-ruby', '~> 1.4.3', require: 'yajl', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 
diff --git a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock
index ce669010fea7..55d6ecf8c196 100644
--- a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock
@@ -1292,11 +1292,11 @@ GEM
       plist (~> 3.1)
       train-core
       wmi-lite (~> 1.0)
-    oj (3.16.13)
+    oj (3.16.16)
       bigdecimal (>= 3.0)
       ostruct (>= 0.2)
-    oj-introspect (0.8.0)
-      oj (>= 3.16.10)
+    oj-introspect (0.9.0)
+      oj (>= 3.16.16)
     omniauth (2.1.4)
       hashie (>= 3.4.6)
       logger
@@ -1555,7 +1555,7 @@ GEM
     pyu-ruby-sasl (0.0.3.3)
     raabro (1.4.0)
     racc (1.8.1)
-    rack (2.2.21)
+    rack (2.2.22)
     rack-accept (0.4.5)
       rack (>= 0.4)
     rack-attack (6.8.0)
@@ -2308,8 +2308,8 @@ DEPENDENCIES
   oauth2 (~> 2.0)
   octokit (~> 9.0)
   ohai (~> 19.1.16)
-  oj (~> 3.16.0, >= 3.16.10)
-  oj-introspect (~> 0.8)
+  oj (~> 3.16.0, >= 3.16.16)
+  oj-introspect (~> 0.9)
   omniauth (~> 2.1.0)
   omniauth-alicloud (~> 3.0.0)
   omniauth-atlassian-oauth2 (~> 0.2.0)
diff --git a/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix b/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix
index 84a0d3dd62f1..b0a2a5f34c8f 100644
--- a/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix
+++ b/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix
@@ -5789,10 +5789,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "00q33rm7lpfc319pf6him05ak76gfy7i04iiddrz317q7swbq55i";
+      sha256 = "0g817hjx1rh4zhvcpb9m6lr6l8yyq3n8vnjm9x1rc5wr51hv6d9n";
       type = "gem";
     };
-    version = "3.16.13";
+    version = "3.16.16";
   };
   oj-introspect = {
     dependencies = [ "oj" ];
@@ -5800,10 +5800,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0r4jgnw44qvswidfd8fh4s7pkdg34bmmrxn2wn0lhab0klq1bfsw";
+      sha256 = "0kw38qahkkbj3pmn89dss1vwbhamc74pww5p5f8371sfcms4kbxp";
       type = "gem";
     };
-    version = "0.8.0";
+    version = "0.9.0";
   };
   omniauth = {
     dependencies = [
@@ -7105,10 +7105,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0fgpa9qm5qgza69fjnagg2alxs2wmj41aq7z4kj5yib50wpzgqhl";
+      sha256 = "0hj5yq200wlq1clpdvh44pqwllbxll0k3gjajxnrcn95hxzhpky5";
       type = "gem";
     };
-    version = "2.2.21";
+    version = "2.2.22";
   };
   rack-accept = {
     dependencies = [ "rack" ];
diff --git a/pkgs/by-name/gr/gridtracker2/package.nix b/pkgs/by-name/gr/gridtracker2/package.nix
index 71dda41083d4..aba9890cff20 100644
--- a/pkgs/by-name/gr/gridtracker2/package.nix
+++ b/pkgs/by-name/gr/gridtracker2/package.nix
@@ -11,16 +11,16 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "gridtracker2";
-  version = "2.260111.0";
+  version = "2.260323.0";
 
   src = fetchFromGitLab {
     owner = "gridtracker.org";
     repo = "gridtracker2";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LcaIOzCMtJxeMs7kEqTYmgMlrV62+HOXmG5wk67NUoE=";
+    hash = "sha256-3DUbKG7bMR2VpJPPsLNRLzYaStv5iTanECAT6DHMExo=";
   };
 
-  npmDepsHash = "sha256-8bhOfLLsNSK+/mXku5ukLr65bfk+RwC3SyOGRHndqVQ=";
+  npmDepsHash = "sha256-dJmrNP2AwIaQaCq0guG+OTogfcL8f97MAp6N7HAw5z8=";
 
   nativeBuildInputs = [
     makeBinaryWrapper
diff --git a/pkgs/by-name/gr/grub2_efi/package.nix b/pkgs/by-name/gr/grub2_efi/package.nix
deleted file mode 100644
index 20c46f1dda7c..000000000000
--- a/pkgs/by-name/gr/grub2_efi/package.nix
+++ /dev/null
@@ -1,7 +0,0 @@
-{
-  grub2,
-}:
-
-grub2.override {
-  efiSupport = true;
-}
diff --git a/pkgs/by-name/gr/grub2_ieee1275/package.nix b/pkgs/by-name/gr/grub2_ieee1275/package.nix
deleted file mode 100644
index d23c9a3c27fa..000000000000
--- a/pkgs/by-name/gr/grub2_ieee1275/package.nix
+++ /dev/null
@@ -1,7 +0,0 @@
-{
-  grub2,
-}:
-
-grub2.override {
-  ieee1275Support = true;
-}
diff --git a/pkgs/by-name/gr/grub2_light/package.nix b/pkgs/by-name/gr/grub2_light/package.nix
deleted file mode 100644
index b397c8f7ad72..000000000000
--- a/pkgs/by-name/gr/grub2_light/package.nix
+++ /dev/null
@@ -1,7 +0,0 @@
-{
-  grub2,
-}:
-
-grub2.override {
-  zfsSupport = false;
-}
diff --git a/pkgs/by-name/gr/grub2_pvgrub_image/package.nix b/pkgs/by-name/gr/grub2_pvgrub_image/package.nix
deleted file mode 100644
index 032dfb81f0d7..000000000000
--- a/pkgs/by-name/gr/grub2_pvgrub_image/package.nix
+++ /dev/null
@@ -1,7 +0,0 @@
-{
-  grub2_pvhgrub_image,
-}:
-
-grub2_pvhgrub_image.override {
-  grubPlatform = "xen";
-}
diff --git a/pkgs/by-name/gr/grub2_xen/package.nix b/pkgs/by-name/gr/grub2_xen/package.nix
deleted file mode 100644
index 6f369bbcf131..000000000000
--- a/pkgs/by-name/gr/grub2_xen/package.nix
+++ /dev/null
@@ -1,7 +0,0 @@
-{
-  grub2,
-}:
-
-grub2.override {
-  xenSupport = true;
-}
diff --git a/pkgs/by-name/gr/grub2_xen_pvh/package.nix b/pkgs/by-name/gr/grub2_xen_pvh/package.nix
deleted file mode 100644
index 8f8744c975fc..000000000000
--- a/pkgs/by-name/gr/grub2_xen_pvh/package.nix
+++ /dev/null
@@ -1,7 +0,0 @@
-{
-  grub2,
-}:
-
-grub2.override {
-  xenPvhSupport = true;
-}
diff --git a/pkgs/by-name/ha/harbor-cli/package.nix b/pkgs/by-name/ha/harbor-cli/package.nix
index ac8ad8499dca..6364b535addd 100644
--- a/pkgs/by-name/ha/harbor-cli/package.nix
+++ b/pkgs/by-name/ha/harbor-cli/package.nix
@@ -5,6 +5,7 @@
   fetchFromGitHub,
   testers,
   installShellFiles,
+  writableTmpDirAsHomeHook,
 }:
 
 buildGoModule (finalAttrs: {
@@ -25,7 +26,10 @@ buildGoModule (finalAttrs: {
     "doc"
   ];
 
-  nativeBuildInputs = [ installShellFiles ];
+  nativeBuildInputs = [
+    installShellFiles
+    writableTmpDirAsHomeHook
+  ];
 
   ldflags = [
     "-s"
@@ -36,8 +40,6 @@ buildGoModule (finalAttrs: {
   doCheck = false; # Network required
 
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-    export HOME="$(mktemp -d)"
-
     installShellCompletion --cmd harbor \
       --bash <($out/bin/harbor completion bash) \
       --fish <($out/bin/harbor completion fish) \
diff --git a/pkgs/by-name/id/ida-free/package.nix b/pkgs/by-name/id/ida-free/package.nix
index d5a6d0f3aebb..d0d65d92672f 100644
--- a/pkgs/by-name/id/ida-free/package.nix
+++ b/pkgs/by-name/id/ida-free/package.nix
@@ -34,12 +34,12 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "ida-free";
-  version = "9.2";
+  version = "9.3";
 
   src = requireFile {
     name = "ida-free-pc_${lib.replaceStrings [ "." ] [ "" ] finalAttrs.version}_x64linux.run";
     url = "https://my.hex-rays.com/dashboard/download-center/installers/release/${finalAttrs.version}/ida-free";
-    hash = "sha256-CQm9phkqLXhht4UQxooKmhmiGuW3lV8RIJuDrm52aNw=";
+    hash = "sha256-eSX6/nT9joEMs48qFq92qT8Qr25B38xy4FxxaPIOwLw=";
   };
 
   nativeBuildInputs = [
@@ -88,6 +88,7 @@ stdenv.mkDerivation (finalAttrs: {
     "libQt6Network.so.6"
     "libQt6EglFSDeviceIntegration.so.6"
     "libQt6WaylandEglClientHwIntegration.so.6"
+    "libQt6WaylandCompositor.so.6"
     "libQt6WlShellIntegration.so.6"
   ];
 
diff --git a/pkgs/by-name/ju/just/fix-just-path-in-tests.patch b/pkgs/by-name/ju/just/fix-just-path-in-tests.patch
deleted file mode 100644
index 63587ebc698a..000000000000
--- a/pkgs/by-name/ju/just/fix-just-path-in-tests.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-diff --git a/tests/completions/just.bash b/tests/completions/just.bash
-index 6d5c12c..13bff87 100755
---- a/tests/completions/just.bash
-+++ b/tests/completions/just.bash
-@@ -17,11 +17,13 @@ reply_equals() {
-   fi
- }
- 
-+just() {
-+  cargo run -- "$@"
-+}
-+
- # --- Initial Setup ---
- source "$1"
- cd tests/completions
--cargo build
--PATH="$(git rev-parse --show-toplevel)/target/debug:$PATH"
- exit_code=0
- 
- # --- Tests ---
diff --git a/pkgs/by-name/ju/just/package.nix b/pkgs/by-name/ju/just/package.nix
index f34216b76d66..22a87c26f2c8 100644
--- a/pkgs/by-name/ju/just/package.nix
+++ b/pkgs/by-name/ju/just/package.nix
@@ -17,7 +17,7 @@
   withDocumentation ? stdenv.buildPlatform.canExecute stdenv.hostPlatform,
 }:
 let
-  version = "1.47.1";
+  version = "1.48.0";
 in
 rustPlatform.buildRustPackage {
   inherit version;
@@ -34,10 +34,10 @@ rustPlatform.buildRustPackage {
     owner = "casey";
     repo = "just";
     tag = version;
-    hash = "sha256-HGrUiPe4vVYNISovTb9PZt8s6xCUg+OWkrp8dPm9tWg=";
+    hash = "sha256-U/o9MyT/DMybfV/LHi50KL7sh6ZqJ6rvqAY5pzlJAA8=";
   };
 
-  cargoHash = "sha256-ZRcYVvodaQmQtBGnkTIOI3PXC6YQ1kqycm6Xh/MwIqA=";
+  cargoHash = "sha256-1cSk7dGuh5ZX4XrYgOvqM89e54o8yrr13VpTtdFbtEA=";
 
   nativeBuildInputs =
     lib.optionals (installShellCompletions || installManPages) [ installShellFiles ]
@@ -66,10 +66,6 @@ rustPlatform.buildRustPackage {
     patchShebangs tests
   '';
 
-  patches = [
-    ./fix-just-path-in-tests.patch
-  ];
-
   cargoBuildFlags = [
     "--package=just"
   ]
diff --git a/pkgs/by-name/kr/krita-plugin-gmic/package.nix b/pkgs/by-name/kr/krita-plugin-gmic/package.nix
index e3f5d92c781f..714b068c025f 100644
--- a/pkgs/by-name/kr/krita-plugin-gmic/package.nix
+++ b/pkgs/by-name/kr/krita-plugin-gmic/package.nix
@@ -1,23 +1,27 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchFromGitHub,
   cmake,
-  extra-cmake-modules,
+  curl,
   fftw,
   krita-unwrapped,
-  libsForQt5,
+  kdePackages,
+  qt6,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "krita-plugin-gmic";
-  version = "3.6.4.1";
+  version = "3.7.4.1";
 
-  src = fetchurl {
-    url = "https://files.kde.org/krita/build/dependencies/gmic-${finalAttrs.version}.tar.gz";
-    hash = "sha256-prbGkwFWC+LqK1WDqOwZvX5Q5LQal3dFUXzpILwF+v4=";
+  src = fetchFromGitHub {
+    owner = "vanyossi";
+    repo = "gmic";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-xyln60z9r4spPtN3r2+3a1e5yzd8+B7d9UAR3VsRZ78=";
   };
-  sourceRoot = "gmic-v${finalAttrs.version}/gmic-qt";
+
+  sourceRoot = "${finalAttrs.src.name}/gmic-qt";
   dontWrapQtApps = true;
 
   postPatch = ''
@@ -28,14 +32,16 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     cmake
-    extra-cmake-modules
-    libsForQt5.qttools
+    kdePackages.extra-cmake-modules
+    qt6.qttools
   ];
 
   buildInputs = [
+    curl
     fftw
     krita-unwrapped
-    libsForQt5.kcoreaddons
+    kdePackages.kcoreaddons
+    qt6.qtbase
   ];
 
   strictDeps = true;
diff --git a/pkgs/by-name/kr/krita-unwrapped/package.nix b/pkgs/by-name/kr/krita-unwrapped/package.nix
index b354e813bce2..94685a4c48dd 100644
--- a/pkgs/by-name/kr/krita-unwrapped/package.nix
+++ b/pkgs/by-name/kr/krita-unwrapped/package.nix
@@ -4,10 +4,8 @@
   boost,
   cmake,
   curl,
-  eigen,
+  eigen_5,
   exiv2,
-  extra-cmake-modules,
-  fetchpatch,
   fetchurl,
   fftw,
   fribidi,
@@ -24,7 +22,8 @@
   libjxl,
   libmypaint,
   libraw,
-  libsForQt5,
+  qt6,
+  kdePackages,
   libunibreak,
   libwebp,
   opencolorio,
@@ -39,34 +38,25 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "krita-unwrapped";
 
-  version = "5.2.15";
+  version = "6.0.0";
   src = fetchurl {
     url = "mirror://kde/stable/krita/${finalAttrs.version}/krita-${finalAttrs.version}.tar.gz";
-    hash = "sha256-m5T4Qh2XZ8KU3vWY+xBwfd5usje67KJZBmn7DUuQOzk=";
+    hash = "sha256-kytodhJvfGKeQn7j0BIwDIKGsFoYQnc1S0FK9kGg8e0=";
   };
 
-  patches = [
-    # Fixes build with SIP 6.8
-    (fetchpatch {
-      name = "bump-SIP-ABI-version-to-12.8.patch";
-      url = "https://invent.kde.org/graphics/krita/-/commit/2d71c47661d43a4e3c1ab0c27803de980bdf2bb2.diff";
-      hash = "sha256-U3E44nj4vra++PJV20h4YHjES78kgrJtr4ktNeQfOdA=";
-    })
-  ];
-
   nativeBuildInputs = [
     cmake
-    extra-cmake-modules
+    kdePackages.extra-cmake-modules
     pkg-config
     python3Packages.sip
-    libsForQt5.wrapQtAppsHook
+    qt6.wrapQtAppsHook
   ];
 
   buildInputs = [
     boost
     libraw
     fftw
-    eigen
+    eigen_5
     exiv2
     fribidi
     lcms2
@@ -90,9 +80,12 @@ stdenv.mkDerivation (finalAttrs: {
     libwebp
     SDL2
     zug
-    python3Packages.pyqt5
+    python3Packages.pyqt6
+
+    qt6.qtmultimedia
+    qt6.qttools
   ]
-  ++ (with libsForQt5; [
+  ++ (with kdePackages; [
     breeze-icons
     karchive
     kcompletion
@@ -108,16 +101,10 @@ stdenv.mkDerivation (finalAttrs: {
     kwindowsystem
     mlt
     poppler
-    qtmultimedia
-    qtx11extras
     quazip
-
-    # TODO: reenable libkdcraw when migrating to Qt6, see #430298
-    # libkdcraw
+    libkdcraw
   ]);
 
-  env.NIX_CFLAGS_COMPILE = toString (lib.optional stdenv.cc.isGNU "-Wno-deprecated-copy");
-
   # Krita runs custom python scripts in CMake with custom PYTHONPATH which krita determined in their CMake script.
   # Patch the PYTHONPATH so python scripts can import sip successfully.
   postPatch =
@@ -143,8 +130,9 @@ stdenv.mkDerivation (finalAttrs: {
   cmakeBuildType = "RelWithDebInfo";
 
   cmakeFlags = [
-    "-DPYQT5_SIP_DIR=${python3Packages.pyqt5}/${python3Packages.python.sitePackages}/PyQt5/bindings"
-    "-DPYQT_SIP_DIR_OVERRIDE=${python3Packages.pyqt5}/${python3Packages.python.sitePackages}/PyQt5/bindings"
+    "-DBUILD_WITH_QT6=ON"
+    "-DALLOW_UNSTABLE=QT6"
+    "-DENABLE_UPDATERS=OFF"
     "-DBUILD_KRITA_QT_DESIGNER_PLUGINS=ON"
   ];
 
diff --git a/pkgs/by-name/kr/krita/package.nix b/pkgs/by-name/kr/krita/package.nix
index 53a447010169..6dc47408d0b4 100644
--- a/pkgs/by-name/kr/krita/package.nix
+++ b/pkgs/by-name/kr/krita/package.nix
@@ -1,6 +1,4 @@
 {
-  lib,
-  libsForQt5,
   symlinkJoin,
   krita-plugin-gmic,
   binaryPlugins ? [
diff --git a/pkgs/by-name/ks/kseexpr/package.nix b/pkgs/by-name/ks/kseexpr/package.nix
index fafad3921687..ab98cde58b09 100644
--- a/pkgs/by-name/ks/kseexpr/package.nix
+++ b/pkgs/by-name/ks/kseexpr/package.nix
@@ -3,39 +3,41 @@
   stdenv,
   fetchFromGitLab,
   cmake,
-  extra-cmake-modules,
-  qt5,
-  libsForQt5,
+  qt6,
+  kdePackages,
   bison,
   flex,
-  llvm,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "kseexpr";
-  version = "4.0.4.0";
+  version = "6.0.0.0";
   src = fetchFromGitLab {
     domain = "invent.kde.org";
     owner = "graphics";
     repo = "kseexpr";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-XjFGAN7kK2b0bLouYG3OhajhOQk4AgC4EQRzseccGCE=";
+    hash = "sha256-Z3CjQdKHeZ/6He43qVYQj8Fo0y88v/ldJJD8bPYOaEo=";
   };
+
   patches = [
     # see https://github.com/NixOS/nixpkgs/issues/144170
     ./cmake_libdir.patch
   ];
+
   nativeBuildInputs = [
     cmake
-    extra-cmake-modules
-    qt5.wrapQtAppsHook
+    kdePackages.extra-cmake-modules
   ];
+
+  dontWrapQtApps = true;
+
   buildInputs = [
     bison
     flex
-    libsForQt5.ki18n
-    llvm
-    qt5.qtbase
+    kdePackages.ki18n
+    qt6.qtbase
+    qt6.qttools
   ];
 
   meta = {
diff --git a/pkgs/by-name/la/lasuite-meet-frontend/package.nix b/pkgs/by-name/la/lasuite-meet-frontend/package.nix
index 11b12b988244..f48816866ab8 100644
--- a/pkgs/by-name/la/lasuite-meet-frontend/package.nix
+++ b/pkgs/by-name/la/lasuite-meet-frontend/package.nix
@@ -7,13 +7,13 @@
 
 buildNpmPackage rec {
   pname = "lasuite-meet-frontend";
-  version = "1.11.0";
+  version = "1.12.0";
 
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "meet";
     tag = "v${version}";
-    hash = "sha256-CvpGDfdK1+EJ+Tj9NLrfRfK4VpJVcDqezVJL6ZVdOQ8=";
+    hash = "sha256-xm9NhsoM4ggLdtULfiUqJkB41n8q6eS8g4Q/zBaKRbs=";
   };
 
   sourceRoot = "source/src/frontend";
@@ -21,7 +21,7 @@ buildNpmPackage rec {
   npmDeps = fetchNpmDeps {
     inherit version src;
     sourceRoot = "source/src/frontend";
-    hash = "sha256-/JvAnfqaWHc91T5NhqEJGcqLMbSJmnGmReGjrqc+Chw=";
+    hash = "sha256-HobRnbl7fJJ2F0YuA3eyI0R0eW9FveGyqosj0F+Q73I=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/la/lasuite-meet/gh1199.patch b/pkgs/by-name/la/lasuite-meet/gh1199.patch
deleted file mode 100644
index 8545a1f6d108..000000000000
--- a/pkgs/by-name/la/lasuite-meet/gh1199.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From cacd75fc0aeba7cf1733193c28c6118e2c249999 Mon Sep 17 00:00:00 2001
-From: Martin Weinelt <hexa@darmstadt.ccc.de>
-Date: Tue, 24 Mar 2026 16:07:00 +0100
-Subject: [PATCH] =?UTF-8?q?=F0=9F=90=9B(backend):=20fix=20module=20inclusi?=
- =?UTF-8?q?on=20with=20uv-build?=
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-After migrating to uv-build only the module matching the project name was
-included in sdist/wheel packages. Without a src layout additional modules
-need to be tracked manually to ship them in built packages.
----
- pyproject.toml | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/pyproject.toml b/pyproject.toml
-index 1f7757146..4a04e995d 100644
---- a/pyproject.toml
-+++ b/pyproject.toml
-@@ -90,6 +90,11 @@ dev = [
- ]
-
- [tool.uv.build-backend]
-+module-name = [
-+    "core",
-+    "demo",
-+    "meet"
-+]
- module-root = ""
- source-exclude = [
-     "**/tests/**",
diff --git a/pkgs/by-name/la/lasuite-meet/package.nix b/pkgs/by-name/la/lasuite-meet/package.nix
index 3dc1aa9547ee..6c66b61c6540 100644
--- a/pkgs/by-name/la/lasuite-meet/package.nix
+++ b/pkgs/by-name/la/lasuite-meet/package.nix
@@ -13,14 +13,14 @@ in
 
 python.pkgs.buildPythonApplication rec {
   pname = "lasuite-meet";
-  version = "1.11.0";
+  version = "1.12.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "meet";
     tag = "v${version}";
-    hash = "sha256-CvpGDfdK1+EJ+Tj9NLrfRfK4VpJVcDqezVJL6ZVdOQ8=";
+    hash = "sha256-xm9NhsoM4ggLdtULfiUqJkB41n8q6eS8g4Q/zBaKRbs=";
   };
 
   sourceRoot = "source/src/backend";
@@ -28,10 +28,6 @@ python.pkgs.buildPythonApplication rec {
   patches = [
     # Support configuration throught environment variables for SECURE_*
     ./secure_settings.patch
-    # Fix module inclusion after switching to uv-build
-    # https://github.com/suitenumerique/meet/pull/1199
-    ./gh1199.patch
-
   ];
 
   postPatch = ''
diff --git a/pkgs/by-name/li/libwebp/package.nix b/pkgs/by-name/li/libwebp/package.nix
index ba0c095a593d..a3f4955b96b1 100644
--- a/pkgs/by-name/li/libwebp/package.nix
+++ b/pkgs/by-name/li/libwebp/package.nix
@@ -100,7 +100,10 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://developers.google.com/speed/webp/";
     license = lib.licenses.bsd3;
     platforms = lib.platforms.all;
-    maintainers = with lib.maintainers; [ ajs124 ];
+    maintainers = with lib.maintainers; [
+      ajs124
+      savtrip
+    ];
     pkgConfigModules = [
       # configure_pkg_config() calls for these are unconditional
       "libwebp"
diff --git a/pkgs/by-name/nb/nb/package.nix b/pkgs/by-name/nb/nb/package.nix
index e319049499e3..53ccac64c697 100644
--- a/pkgs/by-name/nb/nb/package.nix
+++ b/pkgs/by-name/nb/nb/package.nix
@@ -10,13 +10,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "nb";
-  version = "7.25.2";
+  version = "7.25.3";
 
   src = fetchFromGitHub {
     owner = "xwmx";
     repo = "nb";
     tag = finalAttrs.version;
-    hash = "sha256-G/4BDOsrBqN92noEzDCG9lkZTblsz/HbYl0D+oyLEXc=";
+    hash = "sha256-liDNmc7pueIk0nFUkPjP8llXzV6dTpHMVkRSc0stEVk=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/by-name/nf/nfs-ganesha/package.nix b/pkgs/by-name/nf/nfs-ganesha/package.nix
index 6704a7e1202a..ab6cd71b7aa8 100644
--- a/pkgs/by-name/nf/nfs-ganesha/package.nix
+++ b/pkgs/by-name/nf/nfs-ganesha/package.nix
@@ -25,7 +25,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nfs-ganesha";
-  version = "9.8";
+  version = "9.9";
 
   outputs = [
     "out"
@@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "nfs-ganesha";
     repo = "nfs-ganesha";
     tag = "V${finalAttrs.version}";
-    hash = "sha256-os0juaxJGOB1Ugh+7MvK0Gg11PSKkesCq6TgaFR+sDE=";
+    hash = "sha256-yr9rXdW1rNiYt3bc1Rj4mdQTx9SZX6kp7RbdODR1ck0=";
   };
 
   patches = lib.optional useDbus ./allow-bypassing-dbus-pkg-config-test.patch;
diff --git a/pkgs/by-name/ni/nixos-install-tools/package.nix b/pkgs/by-name/ni/nixos-install-tools/package.nix
index 03be3c9ea39b..98588f4abc54 100644
--- a/pkgs/by-name/ni/nixos-install-tools/package.nix
+++ b/pkgs/by-name/ni/nixos-install-tools/package.nix
@@ -56,9 +56,9 @@ in
           '';
         }
         ''
-          nixos-install --help | grep -F 'NixOS Reference Pages'
+          nixos-install --help | grep -F "System Manager's Manual"
           nixos-install --help | grep -F 'configuration.nix'
-          nixos-generate-config --help | grep -F 'NixOS Reference Pages'
+          nixos-generate-config --help | grep -F "System Manager's Manual"
           nixos-generate-config --help | grep -F 'hardware-configuration.nix'
 
           # FIXME: Tries to call unshare, which it must not do for --help
diff --git a/pkgs/by-name/ni/nixos-install/nixos-install.8 b/pkgs/by-name/ni/nixos-install/nixos-install.8
index 5b4f8c936720..186c85566416 100644
--- a/pkgs/by-name/ni/nixos-install/nixos-install.8
+++ b/pkgs/by-name/ni/nixos-install/nixos-install.8
@@ -33,9 +33,19 @@
 .Sh DESCRIPTION
 This command installs NixOS in the file system mounted on
 .Pa /mnt Ns
-, based on the NixOS configuration specified in
-.Pa /mnt/etc/nixos/configuration.nix Ns
-\&. It performs the following steps:
+, or defined through the
+.Fl -root
+option, based on the NixOS configuration specified in
+.Pa /mnt/etc/nixos/system.nix Ns
+,
+.Pa /mnt/etc/nixos/configuration.nix
+or specified through the
+.Fl -file Ns
+,
+.Fl -attr Ns
+or
+.Fl -flake Ns
+options. It performs the following steps:
 .
 .Bl -enum
 .It
@@ -46,9 +56,7 @@ It copies Nix and its dependencies to
 .It
 It runs Nix in
 .Pa /mnt
-to build the NixOS configuration specified in
-.Pa /mnt/etc/nixos/configuration.nix Ns
-\&.
+to build the given NixOS configuration.
 .
 .It
 It installs the current channel
@@ -114,7 +122,7 @@ output named
 \&.
 .
 .It Fl -file Ar path , Fl f Ar path
-Enable and build the NixOS system from the specified file. The file must
+Build the NixOS system from the specified file. The file must
 evaluate to an attribute set, and it must contain a valid NixOS configuration
 at attribute
 .Va attrPath Ns
@@ -127,17 +135,19 @@ function in nixpkgs or importing and calling
 from nixpkgs. If specified without
 .Fl -attr
 option, builds the configuration from the top-level
-attribute of the file.
+attribute set of the file.
 .
 .It Fl -attr Ar attrPath , Fl A Ar attrPath
-Enable and build the NixOS system from nix file and use the specified attribute
+Build the NixOS system from nix file and use the specified attribute
 path from file specified by the
 .Fl -file
 option. If specified without
 .Fl -file
-option, uses
-.Va [root] Ns Pa /etc/nixos/default.nix Ns
-\&.
+option, it tires to find
+.Pa system.nix
+in
+.Va root Ns Pa /etc/nixos Ns
+, in current directory and iteratively in parent directories.
 .
 .It Fl -channel Ar channel
 If this option is provided, do not copy the current
diff --git a/pkgs/by-name/ni/nixos-install/nixos-install.sh b/pkgs/by-name/ni/nixos-install/nixos-install.sh
index fe3a8bf26d45..c9445c36cc7d 100755
--- a/pkgs/by-name/ni/nixos-install/nixos-install.sh
+++ b/pkgs/by-name/ni/nixos-install/nixos-install.sh
@@ -19,7 +19,8 @@ system=
 verbosity=()
 attr=
 buildFile=
-buildingAttribute=1
+# keys: module, by-attrset, flake, system
+declare -A requestedBuildMethods
 
 while [ "$#" -gt 0 ]; do
     i="$1"; shift 1
@@ -38,10 +39,12 @@ while [ "$#" -gt 0 ]; do
             ;;
         --system|--closure|--store-path)
             system="$1"; shift 1
+            requestedBuildMethods["system"]=1
             ;;
         --flake)
           flake="$1"
           flakeFlags=(--extra-experimental-features 'nix-command flakes')
+          requestedBuildMethods["flake"]=1
           shift 1
           ;;
         --file|-f)
@@ -49,8 +52,14 @@ while [ "$#" -gt 0 ]; do
                 log "$0: '$i' requires an argument"
                 exit 1
             fi
-            buildFile="$1"
-            buildingAttribute=
+            if [ -f "$1" ]; then
+                buildFile="$1"
+            elif [ -f "$1/system.nix" ]; then
+                buildFile="${1%/}/system.nix"
+            else
+                buildFile="${1%/}/default.nix"
+            fi
+            requestedBuildMethods["by-attrset"]=1
             shift 1
             ;;
         --attr|-A)
@@ -59,7 +68,7 @@ while [ "$#" -gt 0 ]; do
                 exit 1
             fi
             attr="$1"
-            buildingAttribute=
+            requestedBuildMethods["by-attrset"]=1
             shift 1
             ;;
         --recreate-lock-file|--no-update-lock-file|--no-write-lock-file|--no-registries|--commit-lock-file)
@@ -106,6 +115,20 @@ while [ "$#" -gt 0 ]; do
     esac
 done
 
+# Finds a specific file in a directory or its parents
+findInParents() {
+    local dir=$1
+    local filename=$2
+    while [[ ! -f "$dir/$filename" ]] && [[ "$dir" != / ]]; do
+        dir=$(dirname "$dir")
+    done
+    if [[ -f "$dir/$filename" ]]; then
+        echo "$dir/$filename"
+    else
+        return 1
+    fi
+}
+
 if ! test -e "$mountPoint"; then
     echo "mount point $mountPoint doesn't exist"
     exit 1
@@ -122,30 +145,61 @@ while [[ "$checkPath" != "/" ]]; do
     checkPath="$(dirname "$checkPath")"
 done
 
-# Verify that user is not trying to use attribute building and flake
-# at the same time
-if [[ -z $buildingAttribute && -n $flake ]]; then
-    echo "$0: '--flake' cannot be used with '--file' or '--attr'"
+# If user requested multiple build methods, abort
+if [[ ${#requestedBuildMethods[@]} -gt 1 ]]; then
+    echo "error: multiple build methods requested: ${!requestedBuildMethods[@]}"
     exit 1
 fi
 
 # Get the path of the NixOS configuration file.
-if [[ -z $flake && -n $buildingAttribute ]]; then
-    if [[ -z $NIXOS_CONFIG ]]; then
-        NIXOS_CONFIG=$mountPoint/etc/nixos/configuration.nix
+findByAttrset() {
+    # - From system.nix up from the current directory
+    # - Hardcoded to $mountPoint/etc/nixos/system.nix
+    # - Hardcoded to /etc/nixos/system.nix
+    # (default.nix is also searched for backward compatibility)
+    if resolvedBuildFile="$(findInParents "$PWD" system.nix)"; then
+        buildFile=$resolvedBuildFile
+        return 0
+    elif resolvedBuildFile="$(findInParents "$PWD" default.nix)"; then
+        buildFile=$resolvedBuildFile
+        return 0
+    elif [[ -f "/etc/nixos/system.nix" ]]; then
+        buildFile="/etc/nixos/system.nix"
+        return 0
+    elif [[ -f "/etc/nixos/default.nix" ]]; then
+        buildFile="/etc/nixos/default.nix"
+        return 0
     fi
+    return 1
+}
 
-    if [[ ${NIXOS_CONFIG:0:1} != / ]]; then
-        echo "$0: \$NIXOS_CONFIG is not an absolute path"
+findModule() {
+    # - From NIXOS_CONFIG environment variable
+    # - hardcoded to $mountPoint/etc/nixos/configuration.nix
+    if [[ -n $NIXOS_CONFIG ]]; then
+        return 0
+    elif [[ -f "$mountPoint/etc/nixos/configuration.nix" ]]; then
+        NIXOS_CONFIG="$mountPoint/etc/nixos/configuration.nix"
+        return 0
+    fi
+    return 1
+}
+
+# If user didn't request a specific build method, try to find one
+if [[ ${#requestedBuildMethods[@]} -eq 0 ]]; then
+    # Flakes cannot be resolved without knowing hostname
+    if findByAttrset; then
+        requestedBuildMethods["by-attrset"]=1
+    elif findModule; then
+        requestedBuildMethods["module"]=1
+    else
+        echo "error: no build method found"
         exit 1
     fi
-elif [[ -z $buildingAttribute ]]; then
-    if [[ -z $buildFile ]]; then
-        buildFile="$mountPoint/etc/nixos/default.nix"
-    elif [[ -d $buildFile ]]; then
-        buildFile="$buildFile/default.nix"
-    fi
-elif [[ -n $flake ]]; then
+fi
+
+# Find configuration files if not already found
+if [[ -n "${requestedBuildMethods["flake"]}" ]]; then
     if [[ $flake =~ ^(.*)\#([^\#\"]*)$ ]]; then
        flake="${BASH_REMATCH[1]}"
        flakeAttr="${BASH_REMATCH[2]}"
@@ -156,19 +210,28 @@ elif [[ -n $flake ]]; then
         exit 1
     fi
     flakeAttr="nixosConfigurations.\"$flakeAttr\""
+elif [[ -n "${requestedBuildMethods["by-attrset"]}" && -z $buildFile ]]; then
+    findByAttrset
+elif [[ -n "${requestedBuildMethods["module"]}" && -z $NIXOS_CONFIG ]]; then
+    findModule
+
+    if [[ ${NIXOS_CONFIG:0:1} != / ]]; then
+        echo "$0: \$NIXOS_CONFIG is not an absolute path"
+        exit 1
+    fi
 fi
 
 # Resolve the flake.
-if [[ -n $flake ]]; then
+if [[ -n "${requestedBuildMethods["flake"]}" ]]; then
     flake=$(nix "${flakeFlags[@]}" flake metadata --json "${extraBuildFlags[@]}" "${lockFlags[@]}" -- "$flake" | jq -r .url)
 fi
 
-if [[ ! -e $NIXOS_CONFIG && -z $system && -z $flake && -n $buildingAttribute ]]; then
+if [[ ! -e $NIXOS_CONFIG && -n "${requestedBuildMethods["module"]}" ]]; then
     echo "configuration file $NIXOS_CONFIG doesn't exist"
     exit 1
 fi
 
-if [[ ! -z $buildingAttribute && -e $buildFile && -z $system ]]; then
+if [[ ! -e $buildFile && -n "${requestedBuildMethods["by-attrset"]}" ]]; then
     echo "configuration file $buildFile doesn't exist"
     exit 1
 fi
@@ -202,12 +265,12 @@ fi
 # Build the system configuration in the target filesystem.
 if [[ -z $system ]]; then
     outLink="$tmpdir/system"
-    if [[ -z $flake && -n $buildingAttribute ]]; then
+    if [[ -n "${requestedBuildMethods["module"]}" ]]; then
         echo "building the configuration in $NIXOS_CONFIG..."
         nix-build --out-link "$outLink" --store "$mountPoint" "${extraBuildFlags[@]}" \
             --extra-substituters "$sub" \
             '<nixpkgs/nixos>' -A system -I "nixos-config=$NIXOS_CONFIG" "${verbosity[@]}"
-    elif [[ -z $buildingAttribute ]]; then
+    elif [[ -n "${requestedBuildMethods["by-attrset"]}" ]]; then
         if [[ -n $attr ]]; then
             echo "building the configuration in $buildFile and attribute $attr..."
         else
@@ -216,7 +279,7 @@ if [[ -z $system ]]; then
         nix-build --out-link "$outLink" --store "$mountPoint" "${extraBuildFlags[@]}" \
             --extra-substituters "$sub" \
             "$buildFile" -A "${attr:+$attr.}config.system.build.toplevel" "${verbosity[@]}"
-    else
+    else # [[ -n "${requestedBuildMethods["flake"]}" ]]
         echo "building the flake in $flake..."
         nix "${flakeFlags[@]}" build "$flake#$flakeAttr.config.system.build.toplevel" \
             --store "$mountPoint" --extra-substituters "$sub" "${verbosity[@]}" \
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd b/pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd
index b2298ce10639..d4f83ac9d803 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd
@@ -28,11 +28,12 @@ _nixos-rebuild_ \[--verbose] [--quiet] [--max-jobs MAX_JOBS] [--cores CORES] [--
 # DESCRIPTION
 
 This command updates the system so that it corresponds to the configuration
-specified in /etc/nixos/configuration.nix, /etc/nixos/flake.nix or the file and
-attribute specified by the *--file* and/or *--attr* options. Thus, every
+specified in /etc/nixos/configuration.nix, /etc/nixos/flake.nix,
+/etc/nixos/system.nix or the file and attribute specified by the *--file*,
+*--attr* or *--flake* options. Thus, every
 time you modify the configuration or any other NixOS module, you must run
 *nixos-rebuild* to make the changes take effect. It builds the new system in
-/nix/store, runs its activation script, and stop and (re)starts any system
+/nix/store, runs its activation script, stops and (re)starts any system
 services if needed. Please note that user services need to be started manually
 as they aren't detected by the activation script at the moment.
 
@@ -281,20 +282,21 @@ It must be one of the following:
 	Implies *--sudo*.
 
 *--file* _path_, *-f* _path_
-	Enable and build the NixOS system from the specified file. The file must
+	Build the NixOS system from the specified file. The file must
 	evaluate to an attribute set, and it must contain a valid NixOS
 	configuration at attribute _attrPath_. This is useful for building a
 	NixOS system from a nix file that is not a flake or a NixOS
 	configuration module. Attribute set a with valid NixOS configuration can
 	be made using _nixos_ function in nixpkgs or importing and calling
 	nixos/lib/eval-config.nix from nixpkgs. If specified without *--attr*
-	option, builds the configuration from the top-level attribute of the
+	option, builds the configuration from the top-level attribute set of the
 	file.
 
 *--attr* _attrPath_, *-A* _attrPath_
-	Enable and build the NixOS system from nix file and use the specified
-	attribute path from file specified by the *--file* option. If specified
-	without *--file* option, uses _default.nix_ in current directory.
+	Build the NixOS system from a nix file and use the specified
+	attribute path from the file specified by the *--file* option.
+	If specified without *--file* option, uses _system.nix_ in current directory,
+	the system-wide _<nixos-system>_ file, or finally, /etc/nixos/system.nix.
 
 *--flake* _flake-uri[#name]_, *-F* _flake-uri[#name]_
 	Build the NixOS system from the specified flake. It defaults to the
@@ -355,6 +357,11 @@ NIX_SUDOOPTS
 
 # FILES
 
+/etc/nixos/system.nix
+	If this file exists, then *nixos-rebuild* will use it as if the
+	*--file* option was given. This allows to build a self-contained
+	system configuration, without requiring ‘nixos’ channel.
+
 /etc/nixos/flake.nix
 	If this file exists, then *nixos-rebuild* will use it as if the
 	*--flake* option was given. This file may be a symlink to a
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/models.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/models.py
index 7fb37e8f97a9..ad28e368c2f5 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/models.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/models.py
@@ -7,6 +7,7 @@ from enum import Enum
 from pathlib import Path
 from typing import Any, ClassVar, Self, TypedDict, override
 
+from . import nix
 from .process import Remote, run_wrapper
 from .utils import Args
 
@@ -58,9 +59,31 @@ class BuildAttr:
 
     @classmethod
     def from_arg(cls, attr: str | None, file: str | None) -> Self:
-        if not (attr or file):
-            return cls("<nixpkgs/nixos>", None)
-        return cls(Path(file or "default.nix"), attr)
+        # We use, in this order:
+        #   1. the --file argument (can be a directory, implying /system.nix)
+        #   2. system.nix in the cwd, but only if --attr is used
+        #   3. the <nixos-system> Nix path entry
+        #   4. /etc/nixos/system.nix
+        #   5. the <nixpkgs/nixos> Nix path entry (uses configuration.nix)
+
+        if file:
+            fpath = Path(file)
+            if fpath.is_dir() and (fpath / "system.nix").exists():
+                return cls(fpath / "system.nix", attr)
+            # Backward compatibility
+            elif fpath.is_dir() and (fpath / "default.nix").exists():
+                return cls(fpath / "default.nix", attr)
+            return cls(fpath, attr)
+        elif attr and Path("system.nix").exists():
+            return cls(Path("system.nix"), attr)
+        elif attr and Path("default.nix").exists():
+            # Backward compatibility
+            return cls(Path("default.nix"), attr)
+        elif nix.find_file("nixos-system"):
+            return cls("<nixos-system>", attr)
+        elif Path("/etc/nixos/system.nix").exists():
+            return cls(Path("/etc/nixos/system.nix"), attr)
+        return cls("<nixpkgs/nixos>", attr)
 
 
 @dataclass(frozen=True)
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
index 6699cc1778e1..95ebb3c9c0c2 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
@@ -270,8 +270,8 @@ def find_file(file: str, nix_flags: Args | None = None) -> Path | None:
     "Find classic Nix file location."
     r = run_wrapper(
         ["nix-instantiate", "--find-file", file, *dict_to_flags(nix_flags)],
-        stdout=PIPE,
         check=False,
+        capture_output=True,
     )
     if r.returncode:
         return None
@@ -670,6 +670,8 @@ def set_profile(
         remote=target_host,
         sudo=sudo,
     )
+
+
 def switch_to_configuration(
     path_to_config: Path,
     action: Literal[Action.SWITCH, Action.BOOT, Action.TEST, Action.DRY_ACTIVATE],
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
index 7f51c09d7497..456a41f46eac 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
@@ -187,12 +187,18 @@ def test_execute_nix_boot(mock_run: Mock, tmp_path: Path) -> None:
 
     nr.execute(["nixos-rebuild", "boot", "--no-flake", "-vvv", "--no-reexec"])
 
-    assert mock_run.call_count == 7
+    assert mock_run.call_count == 8
     mock_run.assert_has_calls(
         [
+            call(
+                ["nix-instantiate", "--find-file", "nixos-system"],
+                capture_output=True,
+                check=False,
+                **DEFAULT_RUN_KWARGS,
+            ),
             call(
                 ["nix-instantiate", "--find-file", "nixpkgs", "-vvv"],
-                stdout=PIPE,
+                capture_output=True,
                 check=False,
                 **DEFAULT_RUN_KWARGS,
             ),
@@ -210,7 +216,7 @@ def test_execute_nix_boot(mock_run: Mock, tmp_path: Path) -> None:
             call(
                 [
                     "nix-build",
-                    "<nixpkgs/nixos>",
+                    "<nixos-system>",
                     "--attr",
                     "config.system.build.toplevel",
                     "--no-out-link",
@@ -278,9 +284,15 @@ def test_execute_nix_build(mock_run: Mock, tmp_path: Path) -> None:
         ]
     )
 
-    assert mock_run.call_count == 1
+    assert mock_run.call_count == 2
     mock_run.assert_has_calls(
         [
+            call(
+                ["nix-instantiate", "--find-file", "nixos-system"],
+                check=False,
+                capture_output=True,
+                **DEFAULT_RUN_KWARGS,
+            ),
             call(
                 [
                     "nix",
@@ -308,6 +320,8 @@ def test_execute_nix_build_vm(mock_run: Mock, tmp_path: Path) -> None:
     def run_side_effect(args: list[str], **kwargs: Any) -> CompletedProcess[str]:
         if args[0] == "nix-build":
             return CompletedProcess([], 0, str(config_path))
+        elif args[0] == "nix-instantiate":
+            return CompletedProcess([], 1)
         else:
             return CompletedProcess([], 0)
 
@@ -326,9 +340,15 @@ def test_execute_nix_build_vm(mock_run: Mock, tmp_path: Path) -> None:
         ]
     )
 
-    assert mock_run.call_count == 1
+    assert mock_run.call_count == 2
     mock_run.assert_has_calls(
         [
+            call(
+                ["nix-instantiate", "--find-file", "nixos-system"],
+                check=False,
+                capture_output=True,
+                **DEFAULT_RUN_KWARGS,
+            ),
             call(
                 [
                     "nix-build",
@@ -343,7 +363,7 @@ def test_execute_nix_build_vm(mock_run: Mock, tmp_path: Path) -> None:
                 check=True,
                 stdout=PIPE,
                 **DEFAULT_RUN_KWARGS,
-            )
+            ),
         ]
     )
 
@@ -363,6 +383,8 @@ def test_execute_nix_build_image_flake(mock_run: Mock, tmp_path: Path) -> None:
             )
         elif args[0] == "nix":
             return CompletedProcess([], 0, str(config_path))
+        elif args[0] == "nix-instantiate":
+            return CompletedProcess([], 1)
         else:
             return CompletedProcess([], 0)
 
@@ -379,9 +401,15 @@ def test_execute_nix_build_image_flake(mock_run: Mock, tmp_path: Path) -> None:
         ]
     )
 
-    assert mock_run.call_count == 3
+    assert mock_run.call_count == 4
     mock_run.assert_has_calls(
         [
+            call(
+                ["nix-instantiate", "--find-file", "nixos-system"],
+                check=False,
+                capture_output=True,
+                **DEFAULT_RUN_KWARGS,
+            ),
             call(
                 [
                     "nix",
@@ -440,6 +468,8 @@ def test_execute_nix_switch_flake(mock_run: Mock, tmp_path: Path) -> None:
     def run_side_effect(args: list[str], **kwargs: Any) -> CompletedProcess[str]:
         if args[0] == "nix":
             return CompletedProcess([], 0, str(config_path))
+        elif args[0] == "nix-instantiate":
+            return CompletedProcess([], 1)
         else:
             return CompletedProcess([], 0)
 
@@ -462,9 +492,15 @@ def test_execute_nix_switch_flake(mock_run: Mock, tmp_path: Path) -> None:
         ]
     )
 
-    assert mock_run.call_count == 4
+    assert mock_run.call_count == 5
     mock_run.assert_has_calls(
         [
+            call(
+                ["nix-instantiate", "--find-file", "nixos-system"],
+                check=False,
+                capture_output=True,
+                **DEFAULT_RUN_KWARGS,
+            ),
             call(
                 [
                     "nix",
@@ -572,9 +608,15 @@ def test_execute_nix_switch_build_target_host(
         ]
     )
 
-    assert mock_run.call_count == 11
+    assert mock_run.call_count == 12
     mock_run.assert_has_calls(
         [
+            call(
+                ["nix-instantiate", "--find-file", "nixos-system"],
+                check=False,
+                capture_output=True,
+                **DEFAULT_RUN_KWARGS,
+            ),
             call(
                 [
                     "nix-instantiate",
@@ -586,7 +628,7 @@ def test_execute_nix_switch_build_target_host(
                     "nixpkgs=$HOME/.nix-defexpr/channels/pinned_nixpkgs",
                 ],
                 check=False,
-                stdout=PIPE,
+                capture_output=True,
                 **DEFAULT_RUN_KWARGS,
             ),
             call(
@@ -777,6 +819,8 @@ def test_execute_nix_switch_flake_target_host(
     def run_side_effect(args: list[str], **kwargs: Any) -> CompletedProcess[str]:
         if args[0] == "nix":
             return CompletedProcess([], 0, str(config_path))
+        elif args[0] == "nix-instantiate":
+            return CompletedProcess([], 1)
         else:
             return CompletedProcess([], 0)
 
@@ -795,9 +839,15 @@ def test_execute_nix_switch_flake_target_host(
         ]
     )
 
-    assert mock_run.call_count == 5
+    assert mock_run.call_count == 6
     mock_run.assert_has_calls(
         [
+            call(
+                ["nix-instantiate", "--find-file", "nixos-system"],
+                check=False,
+                capture_output=True,
+                **DEFAULT_RUN_KWARGS,
+            ),
             call(
                 [
                     "nix",
@@ -896,6 +946,8 @@ def test_execute_nix_switch_flake_build_host(
             return CompletedProcess([], 0, str(config_path))
         elif args[0] == "ssh" and "nix" in args:
             return CompletedProcess([], 0, str(config_path))
+        elif args[0] == "nix-instantiate":
+            return CompletedProcess([], 1)
         else:
             return CompletedProcess([], 0)
 
@@ -913,9 +965,15 @@ def test_execute_nix_switch_flake_build_host(
         ]
     )
 
-    assert mock_run.call_count == 7
+    assert mock_run.call_count == 8
     mock_run.assert_has_calls(
         [
+            call(
+                ["nix-instantiate", "--find-file", "nixos-system"],
+                check=False,
+                capture_output=True,
+                **DEFAULT_RUN_KWARGS,
+            ),
             call(
                 [
                     "nix",
@@ -1001,7 +1059,9 @@ def test_execute_switch_rollback(mock_run: Mock, tmp_path: Path) -> None:
     (nixpkgs_path / ".git").mkdir(parents=True)
 
     def run_side_effect(args: list[str], **kwargs: Any) -> CompletedProcess[str]:
-        if args[0] == "nix-instantiate":
+        if args[0] == "nix-instantiate" and "nixos-system" in args:
+            return CompletedProcess([], 1)
+        elif args[0] == "nix-instantiate":
             return CompletedProcess([], 0, str(nixpkgs_path))
         elif args[0] == "git":
             return CompletedProcess([], 0, "")
@@ -1023,13 +1083,19 @@ def test_execute_switch_rollback(mock_run: Mock, tmp_path: Path) -> None:
         ]
     )
 
-    assert mock_run.call_count == 5
+    assert mock_run.call_count == 6
     mock_run.assert_has_calls(
         [
+            call(
+                ["nix-instantiate", "--find-file", "nixos-system"],
+                capture_output=True,
+                check=False,
+                **DEFAULT_RUN_KWARGS,
+            ),
             call(
                 ["nix-instantiate", "--find-file", "nixpkgs"],
                 check=False,
-                stdout=PIPE,
+                capture_output=True,
                 **DEFAULT_RUN_KWARGS,
             ),
             call(
@@ -1077,15 +1143,23 @@ def test_execute_build(mock_run: Mock, tmp_path: Path) -> None:
     config_path = tmp_path / "test"
     config_path.touch()
     mock_run.side_effect = [
+        # nix-instantiate --find-file nixos-system
+        CompletedProcess([], 1),
         # nixos_build_flake
         CompletedProcess([], 0, str(config_path)),
     ]
 
     nr.execute(["nixos-rebuild", "build", "--no-flake", "--no-reexec"])
 
-    assert mock_run.call_count == 1
+    assert mock_run.call_count == 2
     mock_run.assert_has_calls(
         [
+            call(
+                ["nix-instantiate", "--find-file", "nixos-system"],
+                capture_output=True,
+                check=False,
+                **DEFAULT_RUN_KWARGS,
+            ),
             call(
                 [
                     "nix-build",
@@ -1096,7 +1170,7 @@ def test_execute_build(mock_run: Mock, tmp_path: Path) -> None:
                 check=True,
                 stdout=PIPE,
                 **DEFAULT_RUN_KWARGS,
-            )
+            ),
         ]
     )
 
@@ -1108,6 +1182,8 @@ def test_execute_build_dry_run_build_and_target_remote(
     config_path = tmp_path / "test"
     config_path.touch()
     mock_run.side_effect = [
+        # nix-instantiate --find-file nixos-system
+        CompletedProcess([], 1),
         CompletedProcess([], 0, str(config_path)),
         CompletedProcess([], 0),
         CompletedProcess([], 0, str(config_path)),
@@ -1126,9 +1202,15 @@ def test_execute_build_dry_run_build_and_target_remote(
         ]
     )
 
-    assert mock_run.call_count == 3
+    assert mock_run.call_count == 4
     mock_run.assert_has_calls(
         [
+            call(
+                ["nix-instantiate", "--find-file", "nixos-system"],
+                capture_output=True,
+                check=False,
+                **DEFAULT_RUN_KWARGS,
+            ),
             call(
                 [
                     "nix",
@@ -1181,6 +1263,8 @@ def test_execute_test_flake(mock_run: Mock, tmp_path: Path) -> None:
     def run_side_effect(args: list[str], **kwargs: Any) -> CompletedProcess[str]:
         if args[0] == "nix":
             return CompletedProcess([], 0, str(config_path))
+        elif args[0] == "nix-instantiate":
+            return CompletedProcess([], 1)
         elif args[0] == "test":
             return CompletedProcess([], 1)
         else:
@@ -1192,9 +1276,15 @@ def test_execute_test_flake(mock_run: Mock, tmp_path: Path) -> None:
         ["nixos-rebuild", "test", "--flake", "github:user/repo#hostname", "--no-reexec"]
     )
 
-    assert mock_run.call_count == 3
+    assert mock_run.call_count == 4
     mock_run.assert_has_calls(
         [
+            call(
+                ["nix-instantiate", "--find-file", "nixos-system"],
+                capture_output=True,
+                check=False,
+                **DEFAULT_RUN_KWARGS,
+            ),
             call(
                 [
                     "nix",
@@ -1242,6 +1332,8 @@ def test_execute_test_rollback(
                 2084   2024-11-07 23:54:17   (current)
                 """),
             )
+        elif args[0] == "nix-instantiate" and "nixos-system" in args:
+            return CompletedProcess([], 1)
         elif args[0] == "test":
             return CompletedProcess([], 1)
         else:
@@ -1253,7 +1345,7 @@ def test_execute_test_rollback(
         ["nixos-rebuild", "test", "--rollback", "--profile-name", "foo", "--no-reexec"]
     )
 
-    assert mock_run.call_count == 3
+    assert mock_run.call_count == 4
     mock_run.assert_has_calls(
         [
             call(
@@ -1296,7 +1388,7 @@ def test_execute_switch_store_path(mock_run: Mock, tmp_path: Path) -> None:
     config_path = tmp_path / "test-system"
     config_path.mkdir()
 
-    mock_run.return_value = CompletedProcess([], 0)
+    mock_run.return_value = CompletedProcess([], 0, stdout="")
 
     nr.execute(
         [
@@ -1309,9 +1401,15 @@ def test_execute_switch_store_path(mock_run: Mock, tmp_path: Path) -> None:
     )
 
     # --store-path skips build and write_version_suffix, so only activation calls
-    assert mock_run.call_count == 3
+    assert mock_run.call_count == 4
     mock_run.assert_has_calls(
         [
+            call(
+                ["nix-instantiate", "--find-file", "nixos-system"],
+                capture_output=True,
+                check=False,
+                **DEFAULT_RUN_KWARGS,
+            ),
             call(
                 [
                     "nix-env",
@@ -1359,7 +1457,7 @@ def test_execute_switch_store_path_target_host(
     config_path = tmp_path / "test-system"
     config_path.mkdir()
 
-    mock_run.return_value = CompletedProcess([], 0)
+    mock_run.return_value = CompletedProcess([], 0, stdout="")
 
     nr.execute(
         [
@@ -1375,7 +1473,7 @@ def test_execute_switch_store_path_target_host(
     )
 
     # --store-path skips build and write_version_suffix, so only copy/activation calls
-    assert mock_run.call_count == 5
+    assert mock_run.call_count == 6
     mock_run.assert_has_calls(
         [
             call(
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_models.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_models.py
index 21c957b9d821..64ffce686976 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_models.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_models.py
@@ -5,19 +5,57 @@ from unittest.mock import Mock, patch
 from pytest import MonkeyPatch
 
 import nixos_rebuild.models as m
+import nixos_rebuild.nix as n
 
 from .helpers import get_qualified_name
 
 
-def test_build_attr_from_arg() -> None:
-    assert m.BuildAttr.from_arg(None, None) == m.BuildAttr("<nixpkgs/nixos>", None)
-    assert m.BuildAttr.from_arg("attr", None) == m.BuildAttr(
-        Path("default.nix"), "attr"
-    )
+def test_build_attr_from_arg(tmp_path: Path) -> None:
     assert m.BuildAttr.from_arg("attr", "file.nix") == m.BuildAttr(
         Path("file.nix"), "attr"
     )
-    assert m.BuildAttr.from_arg(None, "file.nix") == m.BuildAttr(Path("file.nix"), None)
+
+    with patch(
+        # system.nix exists
+        "pathlib.Path.exists",
+        autospec=True,
+        side_effect=[True],
+    ):
+        assert m.BuildAttr.from_arg("attr", None) == m.BuildAttr(
+            Path("system.nix"), "attr"
+        )
+
+    with patch(
+        # <nixos-system> is defined
+        get_qualified_name(n.find_file),
+        autospec=True,
+        return_value=Path("/some/file.nix"),
+    ):
+        assert m.BuildAttr.from_arg("attr", None) == m.BuildAttr(
+            "<nixos-system>", "attr"
+        )
+
+    with (
+        # <nixos-system> not defined
+        patch(get_qualified_name(n.find_file), autospec=True, return_value=None),
+        # system.nix does not exist, but /etc/nixos/system.nix does
+        patch(
+            "pathlib.Path.exists",
+            autospec=True,
+            side_effect=[True],
+        ),
+    ):
+        assert m.BuildAttr.from_arg(None, None) == m.BuildAttr(
+            Path("/etc/nixos/system.nix"), None
+        )
+
+    with patch(
+        # <nixos-system> not defined
+        get_qualified_name(n.find_file),
+        autospec=True,
+        return_value=None,
+    ):
+        assert m.BuildAttr.from_arg(None, None) == m.BuildAttr("<nixpkgs/nixos>", None)
 
 
 def test_build_attr_to_attr() -> None:
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_services.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_services.py
index 529073e62464..6bd823b1d48d 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_services.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_services.py
@@ -1,5 +1,6 @@
 import os
 from pathlib import Path
+from subprocess import CompletedProcess
 from unittest.mock import ANY, Mock, call, patch
 
 from pytest import MonkeyPatch
@@ -12,8 +13,13 @@ from .helpers import get_qualified_name
 
 @patch.dict(os.environ, {}, clear=True)
 @patch("os.execve", autospec=True)
+@patch(get_qualified_name(n.nix.run_wrapper, n.nix), autospec=True)
 @patch(get_qualified_name(s.nix.build), autospec=True)
-def test_reexec(mock_build: Mock, mock_execve: Mock, monkeypatch: MonkeyPatch) -> None:
+def test_reexec(
+    mock_build: Mock, mock_run: Mock, mock_execve: Mock, monkeypatch: MonkeyPatch
+) -> None:
+    mock_run.return_value = CompletedProcess([], 0, stdout="")
+
     monkeypatch.setattr(s, "EXECUTABLE", "nixos-rebuild-ng")
     argv = ["/path/bin/nixos-rebuild-ng", "switch", "--no-flake"]
     args, _ = n.parse_args(argv)
diff --git a/pkgs/by-name/oh/oh-my-posh/package.nix b/pkgs/by-name/oh/oh-my-posh/package.nix
index 1034cec4f0e7..67f39d42b992 100644
--- a/pkgs/by-name/oh/oh-my-posh/package.nix
+++ b/pkgs/by-name/oh/oh-my-posh/package.nix
@@ -6,16 +6,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "oh-my-posh";
-  version = "29.1.0";
+  version = "29.9.1";
 
   src = fetchFromGitHub {
     owner = "jandedobbeleer";
     repo = "oh-my-posh";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gbb/ZVd3oNABw8Hjeht//bPdLVQnWtEtAkvYudGqMTs=";
+    hash = "sha256-U+zqRCRJrbjmIVJqfYoQ0qCt4EJCaHswIlsmJwNB7M4=";
   };
 
-  vendorHash = "sha256-75buRo7DNq4gzY+66NEVSI1XOJdgckqzHoDwraUmEAw=";
+  vendorHash = "sha256-0pxVRDXdvImA2B3yonnl01Y1UuEKNb6UCVH4enohu2I=";
 
   sourceRoot = "${finalAttrs.src.name}/src";
 
diff --git a/pkgs/by-name/ok/okteto/package.nix b/pkgs/by-name/ok/okteto/package.nix
index cd9c55c5d8ee..33850f0322b1 100644
--- a/pkgs/by-name/ok/okteto/package.nix
+++ b/pkgs/by-name/ok/okteto/package.nix
@@ -4,6 +4,7 @@
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
+  writableTmpDirAsHomeHook,
   testers,
 }:
 
@@ -45,9 +46,7 @@ buildGoModule (finalAttrs: {
     "static_build"
   ];
 
-  preCheck = ''
-    export HOME="$(mktemp -d)"
-  '';
+  nativeCheckInputs = [ writableTmpDirAsHomeHook ];
 
   checkFlags =
     let
diff --git a/pkgs/by-name/ph/phpstan/package.nix b/pkgs/by-name/ph/phpstan/package.nix
index 04daf5710983..43a107d7e9ae 100644
--- a/pkgs/by-name/ph/phpstan/package.nix
+++ b/pkgs/by-name/ph/phpstan/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "phpstan";
-  version = "2.1.41";
+  version = "2.1.43";
 
   src = fetchFromGitHub {
     owner = "phpstan";
     repo = "phpstan";
     tag = finalAttrs.version;
-    hash = "sha256-qmexB+JpL9mpWVmTeXmffM+oChdNCRc6be1O+WJcML0=";
+    hash = "sha256-HIRM73A+pXWUV0gdcGPI4vjEKAYntNUAVqg4iEKx9To=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pi/pi-coding-agent/package.nix b/pkgs/by-name/pi/pi-coding-agent/package.nix
index de44ccb6e0c7..1b630f142b59 100644
--- a/pkgs/by-name/pi/pi-coding-agent/package.nix
+++ b/pkgs/by-name/pi/pi-coding-agent/package.nix
@@ -11,16 +11,16 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "pi-coding-agent";
-  version = "0.58.3";
+  version = "0.62.0";
 
   src = fetchFromGitHub {
     owner = "badlogic";
     repo = "pi-mono";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3GrE60n+EY5G50iRrbH7R74e+LQIy1M9+huZTp0ZTns=";
+    hash = "sha256-nUK7R9kPkULg8eP9lwyqUpzPGRJeSRv3mDgBkHacf8I=";
   };
 
-  npmDepsHash = "sha256-EC5fXZTtBTRkYXLg5p4xWE/ghi2iw30XwnSqJs/PT8I=";
+  npmDepsHash = "sha256-mzFtHU3xGFZxIaQ1XTkYLmQ4UCcn9HhPVfNJ0DHi7Ps=";
 
   npmWorkspace = "packages/coding-agent";
 
diff --git a/pkgs/by-name/qe/qemu/package.nix b/pkgs/by-name/qe/qemu/package.nix
index 1b544c0dbb9a..5dde5e581158 100644
--- a/pkgs/by-name/qe/qemu/package.nix
+++ b/pkgs/by-name/qe/qemu/package.nix
@@ -138,11 +138,11 @@ stdenv.mkDerivation (finalAttrs: {
     + lib.optionalString nixosTestRunner "-for-vm-tests"
     + lib.optionalString toolsOnly "-utils"
     + lib.optionalString userOnly "-user";
-  version = "10.2.1";
+  version = "10.2.2";
 
   src = fetchurl {
     url = "https://download.qemu.org/qemu-${finalAttrs.version}.tar.xz";
-    hash = "sha256-o3F0d9jiyE1jC//7wg9s0yk+tFqh5trG0MwnaJmRyeE=";
+    hash = "sha256-eEspb/KcFBeqcjI6vLLS6pq5dxck9Xfc14XDsE8h4XY=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/by-name/ra/radicle-job/package.nix b/pkgs/by-name/ra/radicle-job/package.nix
index bbbf3b3de996..b688e421b6af 100644
--- a/pkgs/by-name/ra/radicle-job/package.nix
+++ b/pkgs/by-name/ra/radicle-job/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "radicle-job";
-  version = "0.5.1";
+  version = "0.5.2";
 
   src = fetchFromRadicle {
-    seed = "iris.radicle.xyz";
+    seed = "seed.radicle.xyz";
     repo = "z2UcCU1LgMshWvXj6hXSDDrwB8q8M";
     tag = "releases/v${finalAttrs.version}";
-    hash = "sha256-1gvOpdgnug46PUD+4LZF8u73L3XpQGMGZyQCvnYvkgE=";
+    hash = "sha256-kFlSig0eiUdw6GHwacNHtuGkuW14CkHkc3okN2ZeTns=";
   };
 
-  cargoHash = "sha256-nRif/ab+7r9ODuZVXOnYbEDHiipFg91XjezS1OBYYb4=";
+  cargoHash = "sha256-kZg2X9GXyqr1kj82Pxq6+tjhIXAhOk0vMeU0owSi7gU=";
 
   nativeCheckInputs = [
     radicle-node
@@ -32,8 +32,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   meta = {
     description = "Create, update, and query Radicle Job Collaborative Objects";
-    homepage = "https://app.radicle.xyz/nodes/iris.radicle.xyz/rad:z2UcCU1LgMshWvXj6hXSDDrwB8q8M";
-    changelog = "https://app.radicle.xyz/nodes/iris.radicle.xyz/rad:z2UcCU1LgMshWvXj6hXSDDrwB8q8M/tree/CHANGELOG.md";
+    homepage = "https://app.radicle.xyz/nodes/seed.radicle.xyz/rad:z2UcCU1LgMshWvXj6hXSDDrwB8q8M";
+    changelog = "https://app.radicle.xyz/nodes/seed.radicle.xyz/rad:z2UcCU1LgMshWvXj6hXSDDrwB8q8M/tree/CHANGELOG.md";
     license = with lib.licenses; [
       mit
       asl20
diff --git a/pkgs/by-name/re/repomix/package.nix b/pkgs/by-name/re/repomix/package.nix
index 4fc768fda4fe..9a279c8def94 100644
--- a/pkgs/by-name/re/repomix/package.nix
+++ b/pkgs/by-name/re/repomix/package.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "repomix";
-  version = "1.12.0";
+  version = "1.13.0";
 
   src = fetchFromGitHub {
     owner = "yamadashy";
     repo = "repomix";
     tag = "v${version}";
-    hash = "sha256-ymceZ6HUtHfsJrUc1g2OprO5cNjCzL1QYn4QbZ2rFo4=";
+    hash = "sha256-rHatX8bFfUm3wxjH8TWFnGp/1OfCN6g+ZV9ZoCjCF8U=";
   };
 
-  npmDepsHash = "sha256-DJH7ogNZNqqnA1M9n0v6Oj5FcSHaOifAyCVjibN/2fU=";
+  npmDepsHash = "sha256-EXpjSOMgESM5oTIdDXQ1CX9GrafFbvolqRcoZPLVG+E=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
diff --git a/pkgs/by-name/ru/ruff/package.nix b/pkgs/by-name/ru/ruff/package.nix
index 72235a369e99..4eb1a03897a4 100644
--- a/pkgs/by-name/ru/ruff/package.nix
+++ b/pkgs/by-name/ru/ruff/package.nix
@@ -16,18 +16,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ruff";
-  version = "0.15.6";
+  version = "0.15.7";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "ruff";
     tag = finalAttrs.version;
-    hash = "sha256-a8A9FdfrGCyg6TdunsZcXqAzeXb9pCWO/02f9Nl5juU=";
+    hash = "sha256-aDRFNJKvxuHPYaZtoM+93DxJGsTPMLKGBH5QhIiTh0Y=";
   };
 
   cargoBuildFlags = [ "--package=ruff" ];
 
-  cargoHash = "sha256-TD5FLdi4YJwDzJpCctNKYxUNj/VgMnB/OBp3exk3cZw=";
+  cargoHash = "sha256-m3VkHXhjemXVOFFVSUOVz0xD2Rc2pMsP+dnMYQD29uI=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/s7/s7/package.nix b/pkgs/by-name/s7/s7/package.nix
index aa446dccc044..dc16844a1664 100644
--- a/pkgs/by-name/s7/s7/package.nix
+++ b/pkgs/by-name/s7/s7/package.nix
@@ -26,14 +26,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "s7";
-  version = "11.7-unstable-2026-03-14";
+  version = "11.7-unstable-2026-03-24";
 
   src = fetchFromGitLab {
     domain = "cm-gitlab.stanford.edu";
     owner = "bil";
     repo = "s7";
-    rev = "18e645b614e053482a8721a0c84c4621586a1676";
-    hash = "sha256-8FGb12BSKZkx9oKg2D2udP7j4V9ZLAhVtWICIDSp7v0=";
+    rev = "cd2667b03715dde80c0188ee117d1853b8c2a05f";
+    hash = "sha256-1+b8yM8JkHRn8b/BsETf5sLWGBN0QSdzQ31NH6Hni0U=";
   };
 
   buildInputs =
diff --git a/pkgs/by-name/sl/slobdict/package.nix b/pkgs/by-name/sl/slobdict/package.nix
index 50aa85b78213..3bd9099dea35 100644
--- a/pkgs/by-name/sl/slobdict/package.nix
+++ b/pkgs/by-name/sl/slobdict/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   blueprint-compiler,
   meson,
   ninja,
@@ -17,7 +18,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "slobdict";
-  version = "1.0.0";
+  version = "1.2.0";
 
   pyproject = false; # built with meson
 
@@ -25,11 +26,12 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "MuntashirAkon";
     repo = "SlobDict";
     tag = finalAttrs.version;
-    hash = "sha256-V6EmEpxUMZUN9lHSNs4nZBZI2QNxUUWWODukm01lYxY=";
+    hash = "sha256-4u0VqaPDpyflWkN119IOVqKxpsskou3ou1dqpuRSaHI=";
   };
 
   nativeBuildInputs = [
     blueprint-compiler
+    glib
     gobject-introspection
     meson
     ninja
@@ -62,13 +64,28 @@ python3Packages.buildPythonApplication (finalAttrs: {
     pymorphy3
     # python-romkan-ng not packaged
     xxhash
+
+    # Deps for cli mode
+    pygments
+    rich
+    premailer
+    cssutils
+    markdownify
   ];
 
   # Prevent double wrapping, let the Python wrapper use the args in preFixup.
   dontWrapGApps = true;
 
+  postBuild = ''
+    glib-compile-schemas --strict ../gnome-extension/slobdict@muntashir.dev/schemas
+  '';
+
   postInstall = ''
     chmod +x $out/bin/slobdict
+
+    mkdir -p $out/share/gnome-shell/extensions/slobdict@muntashir.dev
+    cp -r ../gnome-extension/slobdict@muntashir.dev/schemas $out/share/gnome-shell/extensions/slobdict@muntashir.dev
+    cp ../gnome-extension/slobdict@muntashir.dev/{extension.js,metadata.json} $out/share/gnome-shell/extensions/slobdict@muntashir.dev
   '';
 
   preFixup = ''
@@ -77,6 +94,11 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   strictDeps = true;
 
+  passthru = {
+    extensionPortalSlug = "slobdict";
+    extensionUuid = "slobdict@muntashir.dev";
+  };
+
   meta = {
     homepage = "https://github.com/MuntashirAkon/SlobDict";
     description = "Modern, lightweight GTK 4 dictionary app";
diff --git a/pkgs/by-name/sq/sqlitebrowser/package.nix b/pkgs/by-name/sq/sqlitebrowser/package.nix
index b4f18bf67981..8cf6b67850d2 100644
--- a/pkgs/by-name/sq/sqlitebrowser/package.nix
+++ b/pkgs/by-name/sq/sqlitebrowser/package.nix
@@ -87,7 +87,10 @@ stdenv.mkDerivation (finalAttrs: {
     mainProgram = "sqlitebrowser";
     homepage = "https://sqlitebrowser.org/";
     license = lib.licenses.gpl3;
-    maintainers = with lib.maintainers; [ peterhoeg ];
+    maintainers = with lib.maintainers; [
+      peterhoeg
+      savtrip
+    ];
     platforms = lib.platforms.unix;
   };
 })
diff --git a/pkgs/by-name/te/temporal/package.nix b/pkgs/by-name/te/temporal/package.nix
index 08d1fd6fad88..282295ed9bbe 100644
--- a/pkgs/by-name/te/temporal/package.nix
+++ b/pkgs/by-name/te/temporal/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "temporal";
-  version = "1.30.1";
+  version = "1.30.2";
 
   src = fetchFromGitHub {
     owner = "temporalio";
     repo = "temporal";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pmgQkvWjwwaErKnj/nn73qTeYqIMsHi0lyrY6c1+o/0=";
+    hash = "sha256-Rk1H07UqLr/GLIT4VW4eC3SezYPAZPxlC4TTpZm/F9Q=";
   };
 
-  vendorHash = "sha256-pZrMwud23xq8uA+lDO6Va8iH+AUsoBLestqsB2yRBFw=";
+  vendorHash = "sha256-YJbovD2woypOiYfn9axO8lshIg/6gO9Sa8a3DIt8QFg=";
 
   overrideModAttrs = old: {
     # netdb.go allows /etc/protocols and /etc/services to not exist and happily proceeds, but it panic()s if they exist but return permission denied.
diff --git a/pkgs/by-name/te/terminusdb/package.nix b/pkgs/by-name/te/terminusdb/package.nix
index 0ad90475818a..535b866c13fb 100644
--- a/pkgs/by-name/te/terminusdb/package.nix
+++ b/pkgs/by-name/te/terminusdb/package.nix
@@ -97,7 +97,7 @@ stdenv.mkDerivation (finalAttrs: {
     # Fix MAKEFLAGS order in vendored tikv-jemalloc-sys
     # TODO: remove when tikv-jemalloc-sys 0.6.2+ is released
     # equivalent to https://github.com/tikv/jemallocator/pull/152
-    substituteInPlace $cargoDepsCopy/tikv-jemalloc-sys-*/build.rs \
+    substituteInPlace $cargoDepsCopy/*/tikv-jemalloc-sys-*/build.rs \
       --replace-fail 'format!("{orig_makeflags} {makeflags}")' \
                      'format!("{makeflags} {orig_makeflags}")'
   '';
diff --git a/pkgs/by-name/un/unifont/package.nix b/pkgs/by-name/un/unifont/package.nix
index 910d12abca5a..30b81d2741be 100644
--- a/pkgs/by-name/un/unifont/package.nix
+++ b/pkgs/by-name/un/unifont/package.nix
@@ -9,21 +9,21 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "unifont";
-  version = "16.0.03";
+  version = "17.0.04";
 
   otf = fetchurl {
     url = "mirror://gnu/unifont/unifont-${finalAttrs.version}/unifont-${finalAttrs.version}.otf";
-    hash = "sha256-9TnyHLrjkWoJP4GdNsR3EtVwGshtrO2KaOzPe9nTPAw=";
+    hash = "sha256-0fZkqXU7nGt/81cSh0njK10+7pDHwDYYNj+r1Do5tbc=";
   };
 
   pcf = fetchurl {
     url = "mirror://gnu/unifont/unifont-${finalAttrs.version}/unifont-${finalAttrs.version}.pcf.gz";
-    hash = "sha256-ysKULOBusx4n7NfYRAzEoRfqaTNn5JtjigTVmb7wozY=";
+    hash = "sha256-21hNQMglGdfPrx8VWP3lMT+/Guga7uoKbm72MqXjxJY=";
   };
 
   bdf = fetchurl {
     url = "mirror://gnu/unifont/unifont-${finalAttrs.version}/unifont-${finalAttrs.version}.bdf.gz";
-    hash = "sha256-fz0WZKwcBR9ZoaE2DdZU942CwkamiMNC6GPOx/a6ldQ=";
+    hash = "sha256-mi3kgmOIJCdxEhx/4A5BJSPDGDGLjuOOa+bNRU5+yAI=";
   };
 
   nativeBuildInputs = [
@@ -62,6 +62,8 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  passthru.updateScript = ./update.sh;
+
   meta = {
     description = "Unicode font for Base Multilingual Plane";
     homepage = "https://unifoundry.com/unifont/";
@@ -71,7 +73,10 @@ stdenv.mkDerivation (finalAttrs: {
       gpl2Plus
       fontException
     ];
-    maintainers = [ lib.maintainers.rycee ];
+    maintainers = with lib.maintainers; [
+      rycee
+      qweered
+    ];
     platforms = lib.platforms.all;
   };
 })
diff --git a/pkgs/by-name/un/unifont/update.sh b/pkgs/by-name/un/unifont/update.sh
new file mode 100755
index 000000000000..86ab374c8d40
--- /dev/null
+++ b/pkgs/by-name/un/unifont/update.sh
@@ -0,0 +1,10 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl common-updater-scripts
+
+set -euo pipefail
+
+latest=$(curl -sL "https://ftp.gnu.org/gnu/unifont/" | grep -oP 'unifont-\K\d+\.\d+\.\d+' | sort -V | tail -1)
+
+update-source-version unifont "$latest" --ignore-same-version --source-key=otf
+update-source-version unifont "$latest" --ignore-same-version --source-key=pcf
+update-source-version unifont "$latest" --ignore-same-version --source-key=bdf
diff --git a/pkgs/by-name/uv/uv/package.nix b/pkgs/by-name/uv/uv/package.nix
index aec0a495afa0..7e20e3ea241a 100644
--- a/pkgs/by-name/uv/uv/package.nix
+++ b/pkgs/by-name/uv/uv/package.nix
@@ -18,16 +18,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "uv";
-  version = "0.11.0";
+  version = "0.11.1";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "uv";
     tag = finalAttrs.version;
-    hash = "sha256-brKoPk7Wr5QKgJmcUy54zocahbtI1nSnire4o2HAUOU=";
+    hash = "sha256-KZESEU54kD68JqcJwsF5FLvNtgRfV6CHJ7OnSUr2M3s=";
   };
 
-  cargoHash = "sha256-/wWYnsffHWhpDVD3VIybKImmFye5FxeU5h1qXuqNbpc=";
+  cargoHash = "sha256-Qf+u7GdFgTH3Qi0c0MySv54IUeh1Dtf0EMQ5/Ty65G8=";
 
   buildInputs = [
     rust-jemalloc-sys
diff --git a/pkgs/by-name/zo/zoraxy/package.nix b/pkgs/by-name/zo/zoraxy/package.nix
index 0f0c45ceb20d..01162decc07f 100644
--- a/pkgs/by-name/zo/zoraxy/package.nix
+++ b/pkgs/by-name/zo/zoraxy/package.nix
@@ -6,18 +6,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "zoraxy";
-  version = "3.2.5r2";
+  version = "3.3.1";
 
   src = fetchFromGitHub {
     owner = "tobychui";
     repo = "zoraxy";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-O7Rzx62O0h3kK6+lMag+5totijJoobOKi8DNWT9sDjg=";
+    hash = "sha256-NhjT1z/O2KJtlF/LkGWgxhm2/i83mJUZeBHDiZke0FE=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/src";
 
-  vendorHash = "sha256-Bl3FI8lodSV5kzHvM8GHbQsep0W8s2BG8IbGf2AahZc=";
+  vendorHash = "sha256-HaQP6ZARSHwEnW/G95t5NHdM8/EcXEfN2Q1wPVRWIzQ=";
 
   checkFlags =
     let
diff --git a/pkgs/development/python-modules/b2sdk/default.nix b/pkgs/development/python-modules/b2sdk/default.nix
index 74bb155da240..3a7db46c2a41 100644
--- a/pkgs/development/python-modules/b2sdk/default.nix
+++ b/pkgs/development/python-modules/b2sdk/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "b2sdk";
-  version = "2.10.3";
+  version = "2.10.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Backblaze";
     repo = "b2-sdk-python";
     tag = "v${version}";
-    hash = "sha256-Gu4MRfjNWuwEFn13U49dEndWA/HNPwrQdX9VEz1ny+M=";
+    hash = "sha256-hgTQRVOgQmCA5RuwKATAev8y+S5R6xXnpmgprJ+bUYY=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/langgraph/default.nix b/pkgs/development/python-modules/langgraph/default.nix
index d74488efb3a9..c362b90cdf0f 100644
--- a/pkgs/development/python-modules/langgraph/default.nix
+++ b/pkgs/development/python-modules/langgraph/default.nix
@@ -41,14 +41,14 @@
 }:
 buildPythonPackage (finalAttrs: {
   pname = "langgraph";
-  version = "1.1.2";
+  version = "1.1.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langgraph";
     tag = finalAttrs.version;
-    hash = "sha256-Dbzyp9Tl6VaLoWDnLk5UCiYnWFcZM3kljv8EdB1IEAI=";
+    hash = "sha256-J8QqbzJe5tW11Nuio2uFAJk2EZIL1LNGIbJn7TZvlaA=";
   };
 
   postgresqlTestSetupPost = ''
diff --git a/pkgs/development/python-modules/lastversion/default.nix b/pkgs/development/python-modules/lastversion/default.nix
index f7a893dc8692..2caa6f5d5313 100644
--- a/pkgs/development/python-modules/lastversion/default.nix
+++ b/pkgs/development/python-modules/lastversion/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "lastversion";
-  version = "3.6.9";
+  version = "3.6.10";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dvershinin";
     repo = "lastversion";
     tag = "v${version}";
-    hash = "sha256-NyNa9x2sJqx65sntchWnpnyJiluDIUxxGMRIimH4SIs=";
+    hash = "sha256-nWhIV8aDug3B/lSwjzIqhvszJILR5w9qM2tJ6li9dJs=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/premailer/default.nix b/pkgs/development/python-modules/premailer/default.nix
new file mode 100644
index 000000000000..9e67be6eeee6
--- /dev/null
+++ b/pkgs/development/python-modules/premailer/default.nix
@@ -0,0 +1,44 @@
+{
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  lxml,
+  cssselect,
+  cssutils,
+  requests,
+  cachetools,
+  lib,
+}:
+
+buildPythonPackage {
+  pname = "premailer";
+  version = "3.10.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "peterbe";
+    repo = "premailer";
+    rev = "f4ded0b9701c4985e7ff5c5beda83324c264ea62";
+    hash = "sha256-8ALdpR3aIDg0wP+JYCPY1f7mEJgdJm8xlLlgGpa0Sa4=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    lxml
+    cssselect
+    cssutils
+    requests
+    cachetools
+  ];
+
+  pythonImportsCheck = [ "premailer" ];
+
+  meta = {
+    changelog = "https://github.com/peterbe/premailer/blob/master/CHANGES.rst";
+    description = "Turns CSS blocks into style attributes";
+    homepage = "https://github.com/peterbe/premailer";
+    license = lib.licenses.bsd3;
+    maintainers = [ lib.maintainers.linsui ];
+  };
+}
diff --git a/pkgs/development/python-modules/pysrdaligateway/default.nix b/pkgs/development/python-modules/pysrdaligateway/default.nix
index 57b148571b87..350f8bf7fe22 100644
--- a/pkgs/development/python-modules/pysrdaligateway/default.nix
+++ b/pkgs/development/python-modules/pysrdaligateway/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pysrdaligateway";
-  version = "0.20.3";
+  version = "0.20.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "maginawin";
     repo = "PySrDaliGateway";
     tag = "v${version}";
-    hash = "sha256-D98hT87xcLxwOKHgd0M4wIdQIrojxYhtEFlw3hkE2FI=";
+    hash = "sha256-VHNrlvtSDG66beeKule8OqJ03itmdnu+d2qSqSqd6SE=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/rembg/default.nix b/pkgs/development/python-modules/rembg/default.nix
index 3a4caf7f93f9..4c1bd229c843 100644
--- a/pkgs/development/python-modules/rembg/default.nix
+++ b/pkgs/development/python-modules/rembg/default.nix
@@ -46,14 +46,14 @@ let
 in
 buildPythonPackage (finalAttrs: {
   pname = "rembg";
-  version = "2.0.73";
+  version = "2.0.74";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "danielgatis";
     repo = "rembg";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-J7xE/GAcebw9URhVagbWLNfnFxkiMbfq1nP6Kkk9754=";
+    hash = "sha256-bCwteS0OJThIAIXxWjzol33p+EH1Gy+CBjKNDwcH7p8=";
   };
 
   env.POETRY_DYNAMIC_VERSIONING_BYPASS = finalAttrs.version;
diff --git a/pkgs/development/python-modules/ruff/default.nix b/pkgs/development/python-modules/ruff/default.nix
index 2322db869620..ca3a8793d0ca 100644
--- a/pkgs/development/python-modules/ruff/default.nix
+++ b/pkgs/development/python-modules/ruff/default.nix
@@ -29,7 +29,7 @@ buildPythonPackage {
     # to avoid rebuilding the ruff binary for every active python package set.
     + ''
       substituteInPlace pyproject.toml \
-        --replace-fail 'requires = ["maturin>=1.9,<2.0"]' 'requires = ["hatchling"]' \
+        --replace-fail 'requires = ["maturin>=1.9.3,<2.0"]' 'requires = ["hatchling"]' \
         --replace-fail 'build-backend = "maturin"' 'build-backend = "hatchling.build"'
 
       cat >> pyproject.toml <<EOF
diff --git a/pkgs/os-specific/linux/iputils/default.nix b/pkgs/os-specific/linux/iputils/default.nix
index 9dc388ff2414..498a1255761d 100644
--- a/pkgs/os-specific/linux/iputils/default.nix
+++ b/pkgs/os-specific/linux/iputils/default.nix
@@ -69,7 +69,7 @@ stdenv.mkDerivation (finalAttrs: {
           [ libcap ] ++ lib.optional (!stdenv.hostPlatform.isMusl) libidn2
         )
       }"
-      include <local/bin.ping>
+      include if exists <local/bin.ping>
       capability net_raw,
       network inet raw,
       network inet6 raw,
diff --git a/pkgs/os-specific/linux/kernel/build.nix b/pkgs/os-specific/linux/kernel/build.nix
index e7068efa3afe..9635c9c0d7f5 100644
--- a/pkgs/os-specific/linux/kernel/build.nix
+++ b/pkgs/os-specific/linux/kernel/build.nix
@@ -438,6 +438,9 @@ lib.makeOverridable (
       # Keep root and arch-specific Makefiles
       chmod u-w Makefile arch/*/Makefile*
 
+      # Keep rust Makefile
+      ${lib.optionalString withRust "chmod u-w rust/Makefile"}
+
       # Keep whole scripts dir
       chmod u-w -R scripts
 
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 6150070f1f1b..f2509976295c 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -685,6 +685,8 @@ let
       FANOTIFY = yes;
       FANOTIFY_ACCESS_PERMISSIONS = yes;
 
+      FS_DAX = yes;
+
       TMPFS = yes;
       TMPFS_POSIX_ACL = yes;
       FS_ENCRYPTION = yes;
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 1028c242a000..8eaa7261baa0 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,12 +1,12 @@
 {
     "testing": {
-        "version": "7.0-rc4",
-        "hash": "sha256:1954j1rlzv3qqmk8a96gvmcwsji5rjdzdm7yhjfs3jyrdahz37pz",
+        "version": "7.0-rc5",
+        "hash": "sha256:00q4scz3kyrbd8v23pjdzgmaz9scmxg10cqlfwrrd7xj0hxp3pah",
         "lts": false
     },
     "6.1": {
-        "version": "6.1.166",
-        "hash": "sha256:0jcl12gjlfdf9pwqg1m84rzwnrj3grxxgk5blrq8zlaq45sgr3c1",
+        "version": "6.1.167",
+        "hash": "sha256:1jwqwp2fg3wdsh9w663rbnbv1rvsvksv1pj4bzns8swp0wy0a618",
         "lts": true
     },
     "5.15": {
@@ -20,23 +20,23 @@
         "lts": true
     },
     "6.6": {
-        "version": "6.6.129",
-        "hash": "sha256:12j42awg44w97zq8fzifpm300jm9q9ya7qkpn7xbnkr2480qz86a",
+        "version": "6.6.130",
+        "hash": "sha256:139480lyi3if8pd2j3yld5a01lk7113kbcn2kxpzyk29p5kslq14",
         "lts": true
     },
     "6.12": {
-        "version": "6.12.77",
-        "hash": "sha256:0rzz5hdixa5xmr99gja3xr9nxgpmrpxyg4llmvkl3vyawpmkd21m",
+        "version": "6.12.78",
+        "hash": "sha256:0gdgykr4nqk1dzb5ms2m07saxx58zvacpfv8ynhfrv7snjs835vi",
         "lts": true
     },
     "6.18": {
-        "version": "6.18.19",
-        "hash": "sha256:0309xd8ifsy9pa19s8qnsyxkmcqq4z3p16jckjnnhz6h3hkpibza",
+        "version": "6.18.20",
+        "hash": "sha256:0lrm76rdlr92kjq3g410qdff9v49mpdf400lmsh7hq74k2ymlyl3",
         "lts": true
     },
     "6.19": {
-        "version": "6.19.9",
-        "hash": "sha256:1gsmklhqpx5k9wca3gr8j439q8khr9byy7ivxqyr9qqjmyinhq61",
+        "version": "6.19.10",
+        "hash": "sha256:072s76238rnf87yhdy15nbxfyq7x3ch7p2v14dq4pq551qd48va6",
         "lts": false
     }
 }
diff --git a/pkgs/servers/monitoring/zabbix/versions.nix b/pkgs/servers/monitoring/zabbix/versions.nix
index 022841633488..86efb44cfd16 100644
--- a/pkgs/servers/monitoring/zabbix/versions.nix
+++ b/pkgs/servers/monitoring/zabbix/versions.nix
@@ -1,14 +1,14 @@
 generic: {
   v74 = generic {
-    version = "7.4.7";
-    hash = "sha256-FsOZQv6yg9euoX6Ccfy0/9usBpkVYVjcs3IZZ095m9g=";
+    version = "7.4.8";
+    hash = "sha256-qbRStsV00igpziBpOhqpyriL8PWFt6oqajrUyxTdOxw=";
   };
   v70 = generic {
-    version = "7.0.23";
-    hash = "sha256-Q+pfyx5dsl50vcg+qJNtebgJO2FK9OiJQXSFvHTwYeI=";
+    version = "7.0.24";
+    hash = "sha256-b4rpkLmyV2fk//vLXMfEVdZ04qOS3CFHhIil0cDn1Zc=";
   };
   v60 = generic {
-    version = "6.0.44";
-    hash = "sha256-TveW2ofMnm3PXUPwoklTPe48tI6dED/dAQKjwO2P4F4=";
+    version = "6.0.45";
+    hash = "sha256-duB2w2xDH9ZHEDh9iZ5Fr6RH0dI2lMCVvySA5dmSZcU=";
   };
 }
diff --git a/pkgs/by-name/gr/grub2/add-hidden-menu-entries.patch b/pkgs/tools/misc/grub/add-hidden-menu-entries.patch
similarity index 100%
rename from pkgs/by-name/gr/grub2/add-hidden-menu-entries.patch
rename to pkgs/tools/misc/grub/add-hidden-menu-entries.patch
diff --git a/pkgs/by-name/gr/grub2/package.nix b/pkgs/tools/misc/grub/default.nix
similarity index 100%
rename from pkgs/by-name/gr/grub2/package.nix
rename to pkgs/tools/misc/grub/default.nix
diff --git a/pkgs/by-name/gr/grub2/fix-bash-completion.patch b/pkgs/tools/misc/grub/fix-bash-completion.patch
similarity index 100%
rename from pkgs/by-name/gr/grub2/fix-bash-completion.patch
rename to pkgs/tools/misc/grub/fix-bash-completion.patch
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 8a773dbf6afb..733687899795 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2520,6 +2520,32 @@ with pkgs;
     withXorg = false;
   };
 
+  grub2 = callPackage ../tools/misc/grub/default.nix { };
+
+  grub2_efi = grub2.override {
+    efiSupport = true;
+  };
+
+  grub2_ieee1275 = grub2.override {
+    ieee1275Support = true;
+  };
+
+  grub2_light = grub2.override {
+    zfsSupport = false;
+  };
+
+  grub2_xen = grub2.override {
+    xenSupport = true;
+  };
+
+  grub2_xen_pvh = grub2.override {
+    xenPvhSupport = true;
+  };
+
+  grub2_pvgrub_image = grub2_pvhgrub_image.override {
+    grubPlatform = "xen";
+  };
+
   gruut = with python3.pkgs; toPythonApplication gruut;
 
   gruut-ipa = with python3.pkgs; toPythonApplication gruut-ipa;
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index ea8eaec3b412..4c320588d721 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -12787,6 +12787,8 @@ self: super: with self; {
 
   preggy = callPackage ../development/python-modules/preggy { };
 
+  premailer = callPackage ../development/python-modules/premailer { };
+
   preprocess-cancellation = callPackage ../development/python-modules/preprocess-cancellation { };
 
   presenterm-export = callPackage ../development/python-modules/presenterm-export { };