diff --git a/doc/release-notes/rl-2611.section.md b/doc/release-notes/rl-2611.section.md
index 78bf06e376be..923e3c4394ec 100644
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -4,7 +4,17 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- Create the first release note entry in this section!
+- The {file}`nixexprs.tar.xz` tarball will be discontinued together with Nixpkgs
+  27.05 after 2027-12-31. Migrate to the {file}`nixexprs.tar.zst` tarball
+  instead.
+
+  This affects for example users who pull Nixpkgs as a flake input from
+  https://channels.nixos.org:
+
+  ```diff
+  -nixpkgs.url = "https://channels.nixos.org/nixos-26.05/nixexprs.tar.xz";
+  +nixpkgs.url = "https://channels.nixos.org/nixos-26.05/nixexprs.tar.zst";
+  ```
 
 ## Backward Incompatibilities {#sec-nixpkgs-release-26.11-incompatibilities}
 
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 11ecc142c4e1..c473272396de 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -28293,6 +28293,12 @@
     githubId = 1334474;
     name = "Timothy Stott";
   };
+  tiptenbrink = {
+    email = "tip@tenbrinkmeijs.com";
+    github = "tiptenbrink";
+    githubId = 75669206;
+    name = "Tip ten Brink";
+  };
   tiramiseb = {
     email = "sebastien@maccagnoni.eu";
     github = "tiramiseb";
diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index 6165870c9bff..e09af6becee4 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -6,6 +6,18 @@
 
 - The default PostgreSQL version for new NixOS installations (i.e. with `system.stateVersion >= 26.11`) is v18.
 
+- The {file}`nixexprs.tar.xz` tarball will be discontinued together with Nixpkgs
+  27.05 after 2027-12-31. Migrate to the {file}`nixexprs.tar.zst` tarball
+  instead.
+
+  This affects for example users who pull Nixpkgs as a flake input from
+  https://channels.nixos.org:
+
+  ```diff
+  -nixpkgs.url = "https://channels.nixos.org/nixos-26.05/nixexprs.tar.xz";
+  +nixpkgs.url = "https://channels.nixos.org/nixos-26.05/nixexprs.tar.zst";
+  ```
+
 ## New Modules {#sec-release-26.11-new-modules}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/nixos/lib/make-channel.nix b/nixos/lib/make-channel.nix
index e366006e908c..098be3237dae 100644
--- a/nixos/lib/make-channel.nix
+++ b/nixos/lib/make-channel.nix
@@ -18,7 +18,10 @@ pkgs.releaseTools.makeSourceTarball {
   officialRelease = false; # FIXME: fix this in makeSourceTarball
   inherit version versionSuffix;
 
-  buildInputs = [ pkgs.nix ];
+  buildInputs = with pkgs; [
+    nix
+    zstd
+  ];
 
   distPhase = ''
     rm -rf .git
@@ -32,6 +35,35 @@ pkgs.releaseTools.makeSourceTarball {
     NIX_STATE_DIR=$TMPDIR nix-env -f ../$releaseName/default.nix -qaP --meta --show-trace --xml \* > /dev/null
     cd ..
     chmod -R u+w $releaseName
-    tar cfJ $out/tarballs/$releaseName.tar.xz $releaseName
+
+    # The compression tasks are shortlived; use all available CPUs (-T0) to
+    # prioritize fast channel advancement.
+    XZ_OPT="-T0" tar \
+      --create \
+      --file=$out/tarballs/$releaseName.tar.xz \
+      --xz \
+      --absolute-names \
+      --owner=0 \
+      --group=0 \
+      --numeric-owner \
+      --format=gnu \
+      --sort=name \
+      --mtime="@$SOURCE_DATE_EPOCH" \
+      --hard-dereference \
+      $releaseName
+
+    tar \
+      --create \
+      --file="$out/tarballs/$releaseName.tar.zst" \
+      --use-compress-program="zstd -19 -T0" \
+      --absolute-names \
+      --owner=0 \
+      --group=0 \
+      --numeric-owner \
+      --format=gnu \
+      --sort=name \
+      --mtime="@$SOURCE_DATE_EPOCH" \
+      --hard-dereference \
+      $releaseName
   '';
 }
diff --git a/nixos/modules/services/web-apps/akkoma.md b/nixos/modules/services/web-apps/akkoma.md
index 7f07f2c73df8..c8419fe94ecc 100644
--- a/nixos/modules/services/web-apps/akkoma.md
+++ b/nixos/modules/services/web-apps/akkoma.md
@@ -27,7 +27,7 @@ be run behind a HTTP proxy on `fediverse.example.com`.
         name = "My Akkoma instance";
         description = "More detailed description";
         email = "admin@example.com";
-        registration_open = false;
+        registrations_open = false;
       };
 
       "Pleroma.Web.Endpoint" = {
@@ -221,17 +221,28 @@ of the fediverse and providing a pleasant experience to the users of an instance
 
     ":mrf_simple" = {
       # Tag all media as sensitive
-      media_nsfw = mkMap { "nsfw.weird.kinky" = "Untagged NSFW content"; };
+      media_nsfw = map mkTuple [
+        [
+          "nsfw.weird.kinky"
+          "Untagged NSFW content"
+        ]
+      ];
 
       # Reject all activities except deletes
-      reject = mkMap {
-        "kiwifarms.cc" = "Persistent harassment of users, no moderation";
-      };
+      reject = map mkTuple [
+        [
+          "kiwifarms.cc"
+          "Persistent harassment of users, no moderation"
+        ]
+      ];
 
       # Force posts to be visible by followers only
-      followers_only = mkMap {
-        "beta.birdsite.live" = "Avoid polluting timelines with Twitter posts";
-      };
+      followers_only = map mkTuple [
+        [
+          "beta.birdsite.live"
+          "Avoid polluting timelines with Twitter posts"
+        ]
+      ];
     };
   };
 }
diff --git a/pkgs/applications/editors/android-studio/default.nix b/pkgs/applications/editors/android-studio/default.nix
index 3d37f4d389b5..3d0a8f3d6e1f 100644
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@@ -26,9 +26,9 @@ let
     url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.2.8/android-studio-quail2-rc1-linux.tar.gz";
   };
   latestVersion = {
-    version = "2026.1.3.2"; # "Android Studio Quail 3 | 2026.1.3 Canary 2"
-    sha256Hash = "sha256-bGCLbl+b9vTml0m+uxBBWg99ikBAFfk5X+UnR+j2Ogw=";
-    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.3.2/android-studio-quail3-canary2-linux.tar.gz";
+    version = "2026.1.3.3"; # "Android Studio Quail 3 | 2026.1.3 Canary 3"
+    sha256Hash = "sha256-C8rbR+0iGNzsr7HtiNiFw++ZG9/t00/c1Ozr9ngssPs=";
+    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.3.3/android-studio-quail3-canary3-linux.tar.gz";
   };
 in
 {
diff --git a/pkgs/applications/networking/irc/weechat/default.nix b/pkgs/applications/networking/irc/weechat/default.nix
index c9e8fc153c49..43667f130449 100644
--- a/pkgs/applications/networking/irc/weechat/default.nix
+++ b/pkgs/applications/networking/irc/weechat/default.nix
@@ -105,11 +105,11 @@ assert lib.all (p: p.enabled -> !(builtins.elem null p.buildInputs)) plugins;
 
 stdenv.mkDerivation rec {
   pname = "weechat";
-  version = "4.9.2";
+  version = "4.9.3";
 
   src = fetchurl {
     url = "https://weechat.org/files/src/weechat-${version}.tar.xz";
-    hash = "sha256-0TianlIb2gxOv6EI4qv4he5sUVDDhSmfXcoBgaQ6CRQ=";
+    hash = "sha256-XH2VOfqGyZ6nalUaiJqSusIeq3uyeQ29NGRS0AsQw3w=";
   };
 
   # Why is this needed? https://github.com/weechat/weechat/issues/2031
diff --git a/pkgs/by-name/di/discordchatexporter-desktop/package.nix b/pkgs/by-name/di/discordchatexporter-desktop/package.nix
index 475e651b162e..903bb1f90088 100644
--- a/pkgs/by-name/di/discordchatexporter-desktop/package.nix
+++ b/pkgs/by-name/di/discordchatexporter-desktop/package.nix
@@ -41,7 +41,10 @@ buildDotnetModule rec {
     license = lib.licenses.gpl3Plus;
     changelog = "https://github.com/Tyrrrz/DiscordChatExporter/releases/tag/${version}";
     maintainers = with lib.maintainers; [ willow ];
-    platforms = [ "x86_64-linux" ];
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+    ];
     mainProgram = "discordchatexporter";
   };
 }
diff --git a/pkgs/by-name/fn/fnox/package.nix b/pkgs/by-name/fn/fnox/package.nix
new file mode 100644
index 000000000000..980fbad11216
--- /dev/null
+++ b/pkgs/by-name/fn/fnox/package.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  perl,
+  pkg-config,
+  testers,
+  udev,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  __structuredAttrs = true;
+  pname = "fnox";
+  version = "1.20.0";
+
+  src = fetchFromGitHub {
+    owner = "jdx";
+    repo = "fnox";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-8LNMJEZNUlwpPT674/6SfR5dmFRALDI6X1WLKeaJ06M=";
+  };
+
+  cargoHash = "sha256-SoQseyrRqvq/XRmd/HhMX8r42pyn4Ncw6r9G4596bGc=";
+
+  nativeBuildInputs = [
+    perl
+    pkg-config
+  ];
+
+  buildInputs = [ udev ];
+
+  passthru.tests.version = testers.testVersion { package = finalAttrs.finalPackage; };
+
+  checkFlags = [
+    # requires a D-Bus session unavailable in the sandbox
+    "--skip=providers::keychain::tests::test_keychain_set_and_get"
+  ];
+
+  meta = {
+    description = "Flexible secret management tool supporting multiple providers and encryption methods";
+    homepage = "https://github.com/jdx/fnox";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ tiptenbrink ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/go/go-avahi-cname/package.nix b/pkgs/by-name/go/go-avahi-cname/package.nix
new file mode 100644
index 000000000000..d71c450ccc83
--- /dev/null
+++ b/pkgs/by-name/go/go-avahi-cname/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "go-avahi-cname";
+  version = "2.6.1";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "grishy";
+    repo = "go-avahi-cname";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-MeEytTRZF5zpfWYNzvqiMdjvf6IJpS1t5V7+D08GjAY=";
+  };
+
+  vendorHash = "sha256-vbIHB9u9Ftwdw7rHnj6rkk/ABmESNvOgp0hixeWVnkI=";
+
+  ldflags = [
+    "-w"
+    "-s"
+    "-X=main.version=${finalAttrs.version}"
+    "-X=main.commit=${finalAttrs.src.rev}"
+    "-X=main.date=1970-01-01T00:00:00Z"
+  ];
+
+  # bind: operation not permitted
+  __darwinAllowLocalNetworking = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Lightweight mDNS publisher of subdomains for your machine";
+    homepage = "https://github.com/grishy/go-avahi-cname";
+    changelog = "https://github.com/grishy/go-avahi-cname/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ sarahec ];
+    mainProgram = "go-avahi-cname";
+  };
+})
diff --git a/pkgs/by-name/go/goda/package.nix b/pkgs/by-name/go/goda/package.nix
index 2049fd55f7d8..1918922bf141 100644
--- a/pkgs/by-name/go/goda/package.nix
+++ b/pkgs/by-name/go/goda/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "goda";
-  version = "0.9.3";
+  version = "0.9.4";
 
   src = fetchFromGitHub {
     owner = "loov";
     repo = "goda";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-tUt/VxO3QLqPuHleFSO7txiHZ1bJ7ohGak09ZIr/62A=";
+    hash = "sha256-ARiI5varW7p7eX58N8mtS6yeXeTlZfiiTFgI8pcDD6M=";
   };
 
-  vendorHash = "sha256-ZDiDAabLUGa/NFs2EQpwWAd8ypxUZ32I8AOeYCm/ntA=";
+  vendorHash = "sha256-jtri/73UnpI5oyykW2DYiH0vra62+jk8VIHhcWT2oJA=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/hk/hk/package.nix b/pkgs/by-name/hk/hk/package.nix
new file mode 100644
index 000000000000..6e2ebfa81cd8
--- /dev/null
+++ b/pkgs/by-name/hk/hk/package.nix
@@ -0,0 +1,78 @@
+{
+  lib,
+  stdenv,
+  rustPlatform,
+  fetchFromGitHub,
+  installShellFiles,
+  versionCheckHook,
+  nix-update-script,
+  pkg-config,
+  libgit2,
+  openssl,
+  usage,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "hk";
+  version = "1.48.0";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "jdx";
+    repo = "hk";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-jQVEKyFdzeVLBKkX3/zjJBXawxR6ayuf+8wSingESZA=";
+  };
+
+  cargoHash = "sha256-QzjoLnHlGTdnNfsfaRn7ZVeTwQZumN87IOhubLcEDLQ=";
+
+  nativeBuildInputs = [
+    installShellFiles
+    versionCheckHook
+    pkg-config
+    usage
+  ];
+
+  buildInputs = [
+    libgit2
+    openssl
+  ];
+
+  # These tests require external dependencies and are fragile -- skipping.
+  checkFlags = [
+    "--skip=cli::init::detector::tests::test_detect_builtins_with_cargo_toml"
+    "--skip=cli::init::detector::tests::test_detect_builtins_with_package_json"
+    "--skip=cli::init::detector::tests::test_detect_eslint_with_contains"
+    "--skip=cli::init::detector::tests::test_detect_shell_scripts"
+    "--skip=cli::util::python_check_ast::tests::test_invalid_python"
+    "--skip=settings::tests::test_settings_builder_fluent_api"
+    "--skip=settings::tests::test_settings_from_config"
+    "--skip=settings::tests::test_settings_snapshot_caching"
+  ];
+
+  cargoBuildFlags = [
+    "--bin"
+    "hk"
+  ];
+
+  cargoTestFlags = [ "--all-features" ];
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd hk \
+      --bash <($out/bin/hk completion bash) \
+      --fish <($out/bin/hk completion fish) \
+      --zsh <($out/bin/hk completion zsh)
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Tool for managing git hooks";
+    homepage = "https://hk.jdx.dev";
+    changelog = "https://github.com/jdx/hk/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ typedrat ];
+    mainProgram = "hk";
+  };
+})
diff --git a/pkgs/by-name/qo/qownnotes/package.nix b/pkgs/by-name/qo/qownnotes/package.nix
index 306151fd6cd1..c0ed53a4b757 100644
--- a/pkgs/by-name/qo/qownnotes/package.nix
+++ b/pkgs/by-name/qo/qownnotes/package.nix
@@ -19,11 +19,11 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "qownnotes";
   appname = "QOwnNotes";
-  version = "26.6.9";
+  version = "26.7.3";
 
   src = fetchurl {
     url = "https://github.com/pbek/QOwnNotes/releases/download/v${finalAttrs.version}/qownnotes-${finalAttrs.version}.tar.xz";
-    hash = "sha256-9mWyWzIPufiyRyDlif4aW+llyAIiD0Do2MV24P2Z/E0=";
+    hash = "sha256-8xlt9rH64B4A+vNFB67Wodrg2XLPF1fnSM3kKSxePKU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/skrl/default.nix b/pkgs/development/python-modules/skrl/default.nix
index 2990385ef1ab..6fa48b98f9bb 100644
--- a/pkgs/development/python-modules/skrl/default.nix
+++ b/pkgs/development/python-modules/skrl/default.nix
@@ -17,6 +17,7 @@
 
   # tests
   flax,
+  hypothesis,
   jax,
   optax,
   pettingzoo,
@@ -29,6 +30,7 @@ buildPythonPackage (finalAttrs: {
   pname = "skrl";
   version = "1.4.3";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "Toni-SM";
@@ -70,6 +72,7 @@ buildPythonPackage (finalAttrs: {
 
   nativeCheckInputs = [
     flax
+    hypothesis
     jax
     optax
     pettingzoo
diff --git a/pkgs/development/python-modules/weasyprint/default.nix b/pkgs/development/python-modules/weasyprint/default.nix
index db4e7b8d5b46..c94c45b94efb 100644
--- a/pkgs/development/python-modules/weasyprint/default.nix
+++ b/pkgs/development/python-modules/weasyprint/default.nix
@@ -34,7 +34,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "weasyprint";
-  version = "68.1-unstable-2026-05-18";
+  version = "69.0";
   pyproject = true;
 
   __darwinAllowLocalNetworking = true;
@@ -42,10 +42,8 @@ buildPythonPackage (finalAttrs: {
   src = fetchFromGitHub {
     owner = "Kozea";
     repo = "WeasyPrint";
-    # Includes upstream's Ghostscript 10.07-compatible rasterization tests.
-    # Drop the pin when the next WeasyPrint release is packaged.
-    rev = "2cb9b3d2378c67e2bfde646344ca4c2cb7c0f25f";
-    hash = "sha256-zQ8gvYy72ROMwprT5dWA3N1vC7y+6ZKNwKESwtPS21w=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-kd5ei3dBty8VL0ATPz8LZFP+UTUq7yTjuDtO1s/fdxg=";
   };
 
   patches = [
@@ -115,16 +113,10 @@ buildPythonPackage (finalAttrs: {
   # Set env variable explicitly for Darwin, but allow overriding when invoking directly
   makeWrapperArgs = [ "--set-default FONTCONFIG_FILE ${finalAttrs.env.FONTCONFIG_FILE}" ];
 
-  # Upstream still reports the last release version from weasyprint.__version__.
-  # Remove when the next release is packaged.
-  preVersionCheck = ''
-    version=68.1
-  '';
-
   pythonImportsCheck = [ "weasyprint" ];
 
   meta = {
-    changelog = "https://github.com/Kozea/WeasyPrint/commits/${finalAttrs.src.rev}";
+    changelog = "https://github.com/Kozea/WeasyPrint/releases/tag/${finalAttrs.src.tag}";
     description = "Converts web documents to PDF";
     homepage = "https://weasyprint.org/";
     license = lib.licenses.bsd3;
diff --git a/pkgs/development/tools/electron/binary/info.json b/pkgs/development/tools/electron/binary/info.json
index 896922954a0a..a1d798116a09 100644
--- a/pkgs/development/tools/electron/binary/info.json
+++ b/pkgs/development/tools/electron/binary/info.json
@@ -1,15 +1,4 @@
 {
-    "38": {
-        "hashes": {
-            "aarch64-darwin": "1fe8f6fd73eba947344e990da4d6de2cc6d2048f70db4e1148ec9ce99f14d0b7",
-            "aarch64-linux": "6e0e35f65b45dc8504cc6b1e7d49cdc6822c3ad83ea0f0f35a7f3adc3770eb9c",
-            "armv7l-linux": "0425b81fecb0de31c2b81e8a9cac60a7e1353e8d207c0b9d9deb7b4e6c1d932e",
-            "headers": "1q0d7yi1424vr7571qsh6xi50jvvjlqgjcgm7nisp2wrlzvn9sa7",
-            "x86_64-darwin": "a49f611f939a951185a26e989429cae2875aaacccef9898370754cb043a0fc88",
-            "x86_64-linux": "02083b307d7fb74e1d19ae0df27b3382b9a9a1a65fd519d139cf82cc7de7841e"
-        },
-        "version": "38.8.4"
-    },
     "39": {
         "hashes": {
             "aarch64-darwin": "f7e3ed2cc34dd2eba3f2a95234b576fe8082d35fb133e482102c08105f298572",
diff --git a/pkgs/development/tools/electron/chromedriver/info.json b/pkgs/development/tools/electron/chromedriver/info.json
index 4577a69901ed..71c49c5380d8 100644
--- a/pkgs/development/tools/electron/chromedriver/info.json
+++ b/pkgs/development/tools/electron/chromedriver/info.json
@@ -1,15 +1,4 @@
 {
-    "38": {
-        "hashes": {
-            "aarch64-darwin": "01d8ac4b49466417a431cb881bbf991830d66dc818f34ff2e053405f185694f7",
-            "aarch64-linux": "de2b49797bd68b6fd523ec0c097cd69a8acbb4ed363e609ed234211b5a27d57f",
-            "armv7l-linux": "bdec3500085f4f1362242cc0beeef1f9cce1d776f6dbc0193d0b170a8477fe1e",
-            "headers": "1q0d7yi1424vr7571qsh6xi50jvvjlqgjcgm7nisp2wrlzvn9sa7",
-            "x86_64-darwin": "5d86d7cc68106fbf64660d093806cc43181c6400d72489bc0b8465d5a9ab34ae",
-            "x86_64-linux": "0a822adff8265eddbb64b9bca3ab381519e6522aaf7b08c648d8502606117a77"
-        },
-        "version": "38.8.4"
-    },
     "39": {
         "hashes": {
             "aarch64-darwin": "c21e261f8047a51c5a2e8d5ad19fc66d9f389c215bd2ada680c3ea39618f3f90",
diff --git a/pkgs/os-specific/linux/rtl8188eus-aircrack/default.nix b/pkgs/os-specific/linux/rtl8188eus-aircrack/default.nix
index c1f1cbcf6454..98cbbfb295de 100644
--- a/pkgs/os-specific/linux/rtl8188eus-aircrack/default.nix
+++ b/pkgs/os-specific/linux/rtl8188eus-aircrack/default.nix
@@ -8,20 +8,20 @@
 
 stdenv.mkDerivation {
   pname = "rtl8188eus-aircrack";
-  version = "${kernel.version}-unstable-2024-09-18";
+  version = "${kernel.version}-unstable-2026-06-22";
 
   src = fetchFromGitHub {
-    owner = "aircrack-ng";
+    owner = "gglluukk";
     repo = "rtl8188eus";
-    rev = "f969c544ab6100da3d80a5709e077f920f2df698";
-    sha256 = "sha256-uwO2nDDff4t0PZw3mLWmUPOHHftDgoaBaWMXQKHQunI=";
+    rev = "cbeae98cb423378dfd5e5efb63290fe43a6ed965";
+    hash = "sha256-wiWG0ndtQML/h88alNyQOX64krpJOf56HyB8LW5dYbA=";
   };
 
   prePatch = ''
     substituteInPlace ./Makefile \
-      --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace /sbin/depmod \# \
-      --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
+      --replace-fail /lib/modules/ "${kernel.dev}/lib/modules/" \
+      --replace-fail /sbin/depmod \# \
+      --replace-fail '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
 
   hardeningDisable = [ "pic" ];
@@ -36,9 +36,8 @@ stdenv.mkDerivation {
 
   meta = {
     description = "RealTek RTL8188eus WiFi driver with monitor mode & frame injection support";
-    homepage = "https://github.com/aircrack-ng/rtl8188eus";
+    homepage = "https://github.com/gglluukk/rtl8188eus";
     license = lib.licenses.gpl2Only;
     maintainers = with lib.maintainers; [ moni ];
-    broken = kernel.kernelAtLeast "6.17";
   };
 }
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 2725af403fa1..c514f87d803f 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -700,12 +700,15 @@ mapAliases {
   electron-chromedriver_35 = throw "electron-chromedriver_35 has been removed in favor of newer versions"; # Added 2025-11-10
   electron-chromedriver_36 = throw "electron-chromedriver_36 has been removed in favor of newer versions"; # Added 2026-02-02
   electron-chromedriver_37 = throw "electron-chromedriver_37 has been removed in favor of newer versions"; # Added 2026-03-20
+  electron-chromedriver_38 = throw "electron-chromedriver_38 has been removed in favor of newer versions"; # Added 2026-07-07
   electron_35 = throw "electron_35 has been removed in favor of newer versions"; # Added 2025-11-06
   electron_35-bin = throw "electron_35-bin has been removed in favor of newer versions"; # Added 2025-11-06
   electron_36 = throw "electron_36 has been removed in favor of newer versions"; # Added 2026-02-02
   electron_36-bin = throw "electron_36-bin has been removed in favor of newer versions"; # Added 2026-02-02
   electron_37 = throw "electron_37 has been removed in favor of newer versions"; # Added 2026-03-20
   electron_37-bin = throw "electron_37-bin has been removed in favor of newer versions"; # Added 2026-03-20
+  electron_38 = throw "electron_38 has been removed in favor of newer versions"; # Added 2026-07-07
+  electron_38-bin = throw "electron_38-bin has been removed in favor of newer versions"; # Added 2026-07-07
   elementsd-simplicity = throw "'elementsd-simplicity' has been removed due to lack of maintenance, consider using 'elementsd' instead"; # Added 2025-06-04
   elixir = warnAlias "'elixir' is deprecated in favor of using the beamPackages sets. Use 'beamPackages.elixir' instead." beamPackages.elixir; # added 2026-06-15
   elixir_1_15 = throw "'elixir_1_15' has been removed, due to the removal of erlang_26 as EOL"; # added 2026-04-01
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a4cbba225ac2..05377ba9281c 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4833,7 +4833,6 @@ with pkgs;
   electron-source = callPackage ../development/tools/electron { };
 
   inherit (callPackages ../development/tools/electron/binary { })
-    electron_38-bin
     electron_39-bin
     electron_40-bin
     electron_41-bin
@@ -4841,7 +4840,6 @@ with pkgs;
     ;
 
   inherit (callPackages ../development/tools/electron/chromedriver { })
-    electron-chromedriver_38
     electron-chromedriver_39
     electron-chromedriver_40
     electron-chromedriver_41
@@ -4865,7 +4863,6 @@ with pkgs;
           });
       in
       {
-        electron_38 = electron_38-bin;
         electron_39 = electron_39-bin;
         electron_40 = getElectronPkg {
           src = electron-source.electron_40;
@@ -4881,7 +4878,6 @@ with pkgs;
         };
       }
     )
-    electron_38
     electron_39
     electron_40
     electron_41
diff --git a/pkgs/top-level/make-tarball.nix b/pkgs/top-level/make-tarball.nix
index 3318b17ba926..eeaea8a32f36 100644
--- a/pkgs/top-level/make-tarball.nix
+++ b/pkgs/top-level/make-tarball.nix
@@ -24,6 +24,7 @@ pkgs.releaseTools.sourceTarball {
     jq
     lib-tests
     brotli
+    zstd
   ];
 
   configurePhase = ''
@@ -63,6 +64,9 @@ pkgs.releaseTools.sourceTarball {
   #   Some context: https://github.com/NixOS/infra/issues/438
   distPhase = ''
     mkdir -p $out/tarballs
+
+    # The compression tasks are shortlived; use all available CPUs (-T0) to
+    # prioritize fast channel advancement.
     XZ_OPT="-T0" tar \
       --create \
       --xz \
@@ -79,5 +83,22 @@ pkgs.releaseTools.sourceTarball {
       --mode=ug+w \
       --hard-dereference \
       $src $(pwd)/{.version-suffix,.git-revision}
+
+    tar \
+      --create \
+      --use-compress-program="zstd -19 -T0" \
+      --file=$out/tarballs/$releaseName.tar.zst \
+      --absolute-names \
+      --transform="s|^$src|$releaseName|g" \
+      --transform="s|^$(pwd)|$releaseName|g" \
+      --owner=0 \
+      --group=0 \
+      --numeric-owner \
+      --format=gnu \
+      --sort=name \
+      --mtime="@$SOURCE_DATE_EPOCH" \
+      --mode=ug+w \
+      --hard-dereference \
+      $src $(pwd)/{.version-suffix,.git-revision}
   '';
 }
diff --git a/pkgs/top-level/qt6-packages.nix b/pkgs/top-level/qt6-packages.nix
index 515e6a7f12c6..9b63e9cfb403 100644
--- a/pkgs/top-level/qt6-packages.nix
+++ b/pkgs/top-level/qt6-packages.nix
@@ -147,8 +147,8 @@ makeScopeWithSplicing' {
         callPackage ../development/libraries/sailfish-access-control-plugin
           { };
 
-      sddm-unwrapped = kdePackages.callPackage ../applications/display-managers/sddm/unwrapped.nix { };
-      sddm = kdePackages.callPackage ../applications/display-managers/sddm { };
+      sddm-unwrapped = callPackage ../applications/display-managers/sddm/unwrapped.nix { };
+      sddm = callPackage ../applications/display-managers/sddm { };
 
       sierra-breeze-enhanced =
         kdePackages.callPackage ../data/themes/kwin-decorations/sierra-breeze-enhanced