diff --git a/.github/workflows/README.md b/.github/workflows/README.md
index 2c739bd56129..4aed9617cae4 100644
--- a/.github/workflows/README.md
+++ b/.github/workflows/README.md
@@ -64,7 +64,7 @@ This results in a key with the following semantics:
 
 ## Required Status Checks
 
-The "Required Status Checks" branch ruleset is implemented in two top-level workflows: `pr.yml` and `merge-group.yml`.
+The "Required Status Checks" branch ruleset is implemented in two top-level workflows: `pull-request-target.yml` and `merge-group.yml`.
 
 The PR workflow defines all checks that need to succeed to add a Pull Request to the Merge Queue.
 If no Merge Queue is set up for a branch, the PR workflow defines the checks required to merge into the target branch.
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index f55ff86dfdcf..d6b136204d9b 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -80,6 +80,7 @@ jobs:
         uses: ./.github/actions/checkout
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
+          target-as-trusted-at: ${{ inputs.targetSha }}
 
       - uses: cachix/install-nix-action@fd24c48048070c1be9acd18c9d369a83f0fe94d7 # v31
 
@@ -92,7 +93,7 @@ jobs:
           pushFilter: -source$
 
       - name: Build codeowners validator
-        run: nix-build nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A codeownersValidator
+        run: nix-build nixpkgs/trusted/ci --arg nixpkgs ./nixpkgs/trusted-pinned -A codeownersValidator
 
       - name: Validate codeowners
         env:
diff --git a/.github/workflows/pr.yml b/.github/workflows/pull-request-target.yml
similarity index 100%
rename from .github/workflows/pr.yml
rename to .github/workflows/pull-request-target.yml
diff --git a/.github/workflows/reviewers.yml b/.github/workflows/reviewers.yml
index b5d0ada43b9d..f22e44d7cbff 100644
--- a/.github/workflows/reviewers.yml
+++ b/.github/workflows/reviewers.yml
@@ -102,7 +102,7 @@ jobs:
             const run_id = (await github.rest.actions.listWorkflowRuns({
               owner: context.repo.owner,
               repo: context.repo.repo,
-              workflow_id: context.eventName === 'pull_request' ? 'test.yml' : 'pr.yml',
+              workflow_id: context.eventName === 'pull_request' ? 'test.yml' : 'pull-request-target.yml',
               event: context.eventName,
               head_sha: context.payload.pull_request.head.sha
             })).data.workflow_runs[0].id
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 4cac4b3f0bb6..b26f7ee98998 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -63,7 +63,7 @@ jobs:
               '.github/workflows/eval.yml',
               '.github/workflows/labels.yml',
               '.github/workflows/lint.yml',
-              '.github/workflows/pr.yml',
+              '.github/workflows/pull-request-target.yml',
               '.github/workflows/reviewers.yml',
               '.github/workflows/test.yml',
             ].includes(file))) core.setOutput('pr', true)
@@ -87,7 +87,7 @@ jobs:
     if: needs.prepare.outputs.pr
     name: PR
     needs: [prepare]
-    uses: ./.github/workflows/pr.yml
+    uses: ./.github/workflows/pull-request-target.yml
     # Those are actually only used on the pull_request_target event, but will throw an error if not set.
     permissions:
       issues: write
diff --git a/ci/github-script/labels.js b/ci/github-script/labels.js
index adb730aa257d..bd6c81bd9d99 100644
--- a/ci/github-script/labels.js
+++ b/ci/github-script/labels.js
@@ -199,12 +199,24 @@ module.exports = async ({ github, context, core, dry }) => {
       (
         await github.rest.actions.listWorkflowRuns({
           ...context.repo,
+          workflow_id: 'pull-request-target.yml',
+          event: 'pull_request_target',
+          exclude_pull_requests: true,
+          head_sha: pull_request.head.sha,
+        })
+      ).data.workflow_runs[0] ??
+      // TODO: Remove this after 2026-02-01, at which point all pr.yml artifacts will have expired.
+      (
+        await github.rest.actions.listWorkflowRuns({
+          ...context.repo,
+          // In older PRs, we need pr.yml instead of pull-request-target.yml.
           workflow_id: 'pr.yml',
           event: 'pull_request_target',
           exclude_pull_requests: true,
           head_sha: pull_request.head.sha,
         })
-      ).data.workflow_runs[0] ?? {}
+      ).data.workflow_runs[0] ??
+      {}
 
     // Newer PRs might not have run Eval to completion, yet.
     // Older PRs might not have an eval.yml workflow, yet.
diff --git a/pkgs/by-name/vb/vboot_reference/package.nix b/pkgs/by-name/vb/vboot-utils/package.nix
similarity index 51%
rename from pkgs/by-name/vb/vboot_reference/package.nix
rename to pkgs/by-name/vb/vboot-utils/package.nix
index 3c9ffbf9a881..981202ea1fa0 100644
--- a/pkgs/by-name/vb/vboot_reference/package.nix
+++ b/pkgs/by-name/vb/vboot-utils/package.nix
@@ -3,29 +3,38 @@
   stdenv,
   fetchFromGitiles,
   pkg-config,
+  makeBinaryWrapper,
   libuuid,
   openssl,
   libyaml,
   xz,
+  flashrom,
+
+  withFlashrom ? true,
 }:
 
-stdenv.mkDerivation {
-  pname = "vboot_reference";
-  version = "135.16209";
+stdenv.mkDerivation (finalAttrs: {
+  pname = "vboot-utils";
+  version = "143.16463";
 
   src = fetchFromGitiles {
     url = "https://chromium.googlesource.com/chromiumos/platform/vboot_reference";
-    rev = "bf4b21294a1c2c6b94f400819d3fce4a905b3afe"; # refs/heads/release-R135-16209.B
-    hash = "sha256-frg7NkK173wAHJRedtbJI5jI8Kee/VkByh5DCUzD9OA=";
+    rev = "refs/heads/release-R${finalAttrs.passthru.versionFormatted}.B";
+    hash = "sha256-8a49xD+EYXDouFuBmLyAtPxThYET6DtKImBPzXVhpxE=";
   };
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    pkg-config
+    makeBinaryWrapper
+  ];
+
   buildInputs = [
     libuuid
     libyaml
     openssl
     xz
-  ];
+  ]
+  ++ lib.optional withFlashrom finalAttrs.passthru.flashromChromeos;
 
   enableParallelBuilding = true;
 
@@ -42,7 +51,7 @@ stdenv.mkDerivation {
   makeFlags = [
     "DESTDIR=$(out)"
     "HOST_ARCH=${stdenv.hostPlatform.parsed.cpu.name}"
-    "USE_FLASHROM=0"
+    "USE_FLASHROM=${if withFlashrom then "1" else "0"}"
     # Upstream has weird opinions about DESTDIR
     # https://chromium.googlesource.com/chromiumos/platform/vboot_reference/+/refs/heads/release-R135-16209.B/Makefile#51
     "UB_DIR=${placeholder "out"}/bin"
@@ -54,12 +63,33 @@ stdenv.mkDerivation {
   postInstall = ''
     mkdir -p $out/share/vboot
     cp -r tests/devkeys* $out/share/vboot/
+  ''
+  + lib.optionalString withFlashrom ''
+    wrapProgram $out/bin/crossystem \
+      --prefix PATH : ${lib.makeBinPath [ finalAttrs.passthru.flashromChromeos ]}
   '';
 
+  passthru = {
+    versionFormatted = lib.concatStringsSep "-" (lib.versions.splitVersion finalAttrs.version);
+    flashromChromeos = flashrom.overrideAttrs (_prev: {
+      src = fetchFromGitiles {
+        url = "https://chromium.googlesource.com/chromiumos/third_party/flashrom";
+        rev = "refs/heads/release-R${finalAttrs.passthru.versionFormatted}.B-master";
+        hash = "sha256-zOoWpuS/vDLvnRPdA9FNGhNbcwh3PMQwbdfqsyqj858=";
+      };
+
+      # requires git
+      mesonFlags = _prev.mesonFlags ++ [ (lib.mesonEnable "documentation" false) ];
+
+      # requires specific hardware
+      doCheck = false;
+    });
+  };
+
   meta = {
     description = "Chrome OS partitioning and kernel signing tools";
     license = lib.licenses.bsd3;
     platforms = lib.platforms.linux;
     maintainers = [ lib.maintainers.jmbaur ];
   };
-}
+})
diff --git a/pkgs/misc/uboot/python.nix b/pkgs/misc/uboot/python.nix
index 0e1bb72b657f..dc81ec04f37f 100644
--- a/pkgs/misc/uboot/python.nix
+++ b/pkgs/misc/uboot/python.nix
@@ -12,7 +12,7 @@
   lzop,
   openssl,
   ubootTools,
-  vboot_reference,
+  vboot-utils,
   xilinx-bootgen,
   xz,
   zstd,
@@ -85,7 +85,7 @@ rec {
         lzop
         openssl
         ubootTools
-        vboot_reference
+        vboot-utils
         xilinx-bootgen
         xz
         zstd
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index b4a6e14d7d4e..b3ee95ce368a 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1533,6 +1533,7 @@ mapAliases {
   vamp.vampSDK = throw "'vamp.vampSDK' has been renamed to/replaced by 'vamp-plugin-sdk'"; # Converted to throw 2025-10-27
   vaultwarden-vault = throw "'vaultwarden-vault' has been renamed to/replaced by 'vaultwarden.webvault'"; # Converted to throw 2025-10-27
   vbetool = throw "'vbetool' has been removed as it is broken and not maintained upstream."; # Added 2025-06-11
+  vboot_reference = vboot-utils; # Added 2025-11-01
   vc_0_7 = throw "'vc_0_7' has been removed as it was broken, unused in nixpkgs and unmaintained"; # Added 2025-10-20
   vdirsyncerStable = throw "'vdirsyncerStable' has been renamed to/replaced by 'vdirsyncer'"; # Converted to throw 2025-10-27
   ventoy-bin = throw "'ventoy-bin' has been renamed to/replaced by 'ventoy'"; # Converted to throw 2025-10-27