diff --git a/nixos/modules/services/web-servers/h2o/default.nix b/nixos/modules/services/web-servers/h2o/default.nix
index f752b6b9b256..e8441a3a6347 100644
--- a/nixos/modules/services/web-servers/h2o/default.nix
+++ b/nixos/modules/services/web-servers/h2o/default.nix
@@ -230,6 +230,9 @@ let
                     ssl = (lib.recursiveUpdate tlsRecAttrs value.tls.extraSettings) // {
                       inherit identity;
                     };
+                  }
+                  // lib.optionalAttrs (value.host != null) {
+                    host = value.host;
                   };
               };
           };
@@ -302,6 +305,22 @@ in
         type = settingsFormat.type;
         default = { };
         description = "Configuration for H2O (see <https://h2o.examp1e.net/configure.html>)";
+        example =
+          literalExpression
+            # nix
+            ''
+              {
+                compress = "ON";
+                ssl-offload = "kernel";
+                http2-reprioritize-blocking-assets = "ON";
+                "file.mime.addtypes" = {
+                  "text/x-rst" = {
+                    extensions = [ ".rst" ];
+                    is_compressible = "YES";
+                  };
+                };
+              }
+            '';
       };
 
       hosts = mkOption {
diff --git a/nixos/modules/services/web-servers/h2o/vhost-options.nix b/nixos/modules/services/web-servers/h2o/vhost-options.nix
index 907551113826..9c8a74a62bb1 100644
--- a/nixos/modules/services/web-servers/h2o/vhost-options.nix
+++ b/nixos/modules/services/web-servers/h2o/vhost-options.nix
@@ -33,7 +33,18 @@ in
         "example.org"
       ];
       description = ''
-        Additional names of virtual hosts served by this virtual host configuration.
+        Additional names of virtual hosts served by this virtual host
+        configuration.
+      '';
+    };
+
+    host = mkOption {
+      type = types.nullOr types.nonEmptyStr;
+      default = null;
+      example = "127.0.0.1";
+      description = ''
+        Set the host address for this virtual host. If unset, the default is to
+        listen on all network interfaces.
       '';
     };
 
@@ -70,7 +81,7 @@ in
                 config.services.h2o.defaultTLSListenPort
               '';
               description = ''
-                Override the default TLS port for this virtual host.";
+                Override the default TLS port for this virtual host.
               '';
               example = 8443;
             };
@@ -105,11 +116,17 @@ in
                   options = {
                     key-file = mkOption {
                       type = types.path;
-                      description = "Path to key file";
+                      description = ''
+                        Path to key file. See
+                        <https://h2o.examp1e.net/configure/base_directives.html#key-file>.
+                      '';
                     };
                     certificate-file = mkOption {
                       type = types.path;
-                      description = "Path to certificate file";
+                      description = ''
+                        Path to certificate file. See
+                        <https://h2o.examp1e.net/configure/base_directives.html#certificate-file>.
+                      '';
                     };
                   };
                 }
@@ -139,7 +156,8 @@ in
               type = types.attrs;
               default = { };
               description = ''
-                Additional TLS/SSL-related configuration options.
+                Additional TLS/SSL-related configuration options. See
+                <https://h2o.examp1e.net/configure/base_directives.html#listen-ssl>.
               '';
               example =
                 literalExpression
@@ -205,7 +223,8 @@ in
       default = { };
       description = ''
         Attrset to be transformed into YAML for host config. Note that the HTTP
-        / TLS configurations will override these config values.
+        / TLS configurations will override these config values. See
+        <https://h2o.examp1e.net/configure/base_directives.html#hosts>.
       '';
     };
   };
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 3fe641b4476c..476144ae8b8a 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -172,7 +172,13 @@ in stdenv.mkDerivation {
     # libspirv2dxil itself is pretty chonky, so relocate it to its own output in
     # case anything wants to use it at some point
     "spirv2dxil"
-    # tools for the host platform to be used when cross-compiling
+  ] ++ lib.optionals (!needNativeCLC) [
+    # tools for the host platform to be used when cross-compiling.
+    # mesa builds these only when not already built. hence:
+    # - for a non-cross build (needNativeCLC = false), we do not provide mesa
+    #   with any `*-clc` binaries, so it builds them and installs them.
+    # - for a cross build (needNativeCLC = true), we provide mesa with `*-clc`
+    #   binaries, so it skips building & installing any new CLC files.
     "cross_tools"
   ];
 
diff --git a/pkgs/development/libraries/nghttp3/default.nix b/pkgs/development/libraries/nghttp3/default.nix
index 20e45f342286..c354ed018946 100644
--- a/pkgs/development/libraries/nghttp3/default.nix
+++ b/pkgs/development/libraries/nghttp3/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nghttp3";
-  version = "1.7.0";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "ngtcp2";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-GLYZv5i/hqK5L65uKv0wFBO/5sCVvM/wr4qWyCQKvQQ=";
+    hash = "sha256-SWc7qTQjk03I24nYjzUnOj58ZuV3cbX0G5y4zXwiU4w=";
     fetchSubmodules = true;
   };