diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 7530df9d7c2c..0508d2639de1 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -210,7 +210,7 @@ The last checkbox is about whether it fits the guidelines in this `CONTRIBUTING.
 This document details our standards for commit messages, reviews, licensing of contributions, etc...
 Everyone should read and understand these standards before submitting a pull request.
 
-### Rebasing between branches (i.e. from master to staging)
+### Rebasing between branches (i.e. from `master` to `staging`)
 [rebase]: #rebasing-between-branches-ie-from-master-to-staging
 
 Sometimes, changes must be rebased between branches.
@@ -271,8 +271,8 @@ To manually create a backport, follow [the standard pull request process][pr-cre
   Here is [an example](https://github.com/nixos/nixpkgs/commit/5688c39af5a6c5f3d646343443683da880eaefb8).
 
 > [!Warning]
-> Ensure the commits exist on the master branch.
-> In the case of squashed or rebased merges, the commit hash will change and the new commits can be found in the merge message at the bottom of the master pull request.
+> Ensure the commits exist on the `master` branch.
+> In the case of squashed or rebased merges, the commit hash will change and the new commits can be found in the merge message at the bottom of the `master` pull request.
 
 - In the pull request description, link to the original pull request to `master`.
   The pull request title should include `[YY.MM]` matching the release you're backporting to.
@@ -460,7 +460,7 @@ Is the change [acceptable for releases][release-acceptable] and do you wish to h
   - Yes: Use the `master` branch and [backport the pull request](#how-to-backport-pull-requests).
   - No: Create separate pull requests to the `master` and `release-YY.MM` branches.
 
-If the change causes a [mass rebuild][mass-rebuild], use the staging branch instead:
+If the change causes a [mass rebuild][mass-rebuild], use the `staging` branch instead:
 - Mass rebuilds to `master` should go to `staging` instead.
 - Mass rebuilds to `release-YY.MM` should go to `staging-YY.MM` instead.
 
@@ -492,8 +492,8 @@ In addition, major package version updates with breaking changes are also accept
 
 Which changes cause mass rebuilds is not formally defined.
 In order to help the decision, CI automatically assigns [`rebuild` labels](https://github.com/NixOS/nixpkgs/labels?q=rebuild) to pull requests based on the number of packages they cause rebuilds for.
-As a rule of thumb, if the number of rebuilds is **over 500**, it can be considered a mass rebuild.
-To get a sense for what changes are considered mass rebuilds, see [previously merged pull requests to the staging branches](https://github.com/NixOS/nixpkgs/issues?q=base%3Astaging+-base%3Astaging-next+is%3Amerged).
+As a rule of thumb, if the number of rebuilds is **500 or more**, consider targeting the `staging` branch instead of `master`; if the number is **1000 or more**, the pull request causes a mass rebuild, and should target the `staging` branch.
+See [previously merged pull requests to the staging branches](https://github.com/NixOS/nixpkgs/issues?q=base%3Astaging+-base%3Astaging-next+is%3Amerged) to get a sense for what changes are considered mass rebuilds.
 
 ## Commit conventions
 [commit-conventions]: #commit-conventions
diff --git a/ci/OWNERS b/ci/OWNERS
index 133517ed3a61..ff36987f0e3a 100644
--- a/ci/OWNERS
+++ b/ci/OWNERS
@@ -337,7 +337,7 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /pkgs/development/compilers/idris2 @mattpolzin
 
 # Bazel
-/pkgs/development/tools/build-managers/bazel @Profpatsch
+/pkgs/by-name/ba/bazel_7 @Profpatsch
 
 # NixOS modules for e-mail and dns services
 /nixos/modules/services/mail/mailman.nix    @peti
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 762e8f8f00c4..73acfdbe4d3f 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -10083,6 +10083,12 @@
     githubId = 665472;
     matrix = "@hehongbo:matrix.org";
   };
+  heichro = {
+    github = "heichro";
+    githubId = 76887148;
+    keys = [ { fingerprint = "BBA7 9E8E 17FE 9C3F BFEA  61E8 30D0 186F 4E19 7E48"; } ];
+    name = "heichro";
+  };
   heijligen = {
     email = "src@posteo.de";
     github = "heijligen";
@@ -21771,6 +21777,18 @@
     githubId = 10631029;
     name = "Richard Ipsum";
   };
+  richardjacton = {
+    email = "richardjacton@richardjacton.net";
+    github = "richardjacton";
+    githubId = 6893043;
+    name = "Richard J. Acton";
+    matrix = "@richardjacton:matrix.org";
+    keys = [
+      {
+        fingerprint = "5EE1 1764 8462 E5A3 610C  1964 8E5D EFCF C330 7916";
+      }
+    ];
+  };
   richiejp = {
     email = "io@richiejp.com";
     github = "richiejp";
diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index eea249615495..eaf0996c8aab 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -6,6 +6,8 @@
 
 - `nixos-rebuild-ng`, a full rewrite of `nixos-rebuild` in Python, is enabled by default from this release. You can disable it by setting [](#opt-system.rebuild.enableNg) to `false` in your configuration if you need, but please report any issues. It is expected that the next major version of NixOS (26.05) will remove the {option}`system.rebuild.enableNg` option.
 
+- `rEFInd`, a graphical boot manager for UEFI systems, can now be used through [](#opt-boot.loader.refind.enable).
+
 - Secure boot support can now be enabled for the Limine bootloader through {option}`boot.loader.limine.secureBoot.enable`. Bootloader install script signs the bootloader, then kernels are hashed during system rebuild and written to a config. This allows Limine to boot only the kernels installed through NixOS system.
 
 - The default PostgreSQL version for new NixOS installations (i.e. with `system.stateVersion >= 25.11`) is v17.
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 5326f1b216d5..e8cd0f7e7c94 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1817,6 +1817,7 @@
   ./system/boot/loader/init-script/init-script.nix
   ./system/boot/loader/limine/limine.nix
   ./system/boot/loader/loader.nix
+  ./system/boot/loader/refind/refind.nix
   ./system/boot/loader/systemd-boot/systemd-boot.nix
   ./system/boot/luksroot.nix
   ./system/boot/modprobe.nix
diff --git a/nixos/modules/system/boot/loader/refind/refind-install.py b/nixos/modules/system/boot/loader/refind/refind-install.py
new file mode 100644
index 000000000000..f546d3d7b568
--- /dev/null
+++ b/nixos/modules/system/boot/loader/refind/refind-install.py
@@ -0,0 +1,344 @@
+#!@python3@/bin/python3 -B
+
+from dataclasses import dataclass
+from typing import Any, Callable, Dict, List, Optional, Tuple
+
+import datetime
+import json
+from ctypes import CDLL
+import os
+import psutil
+import re
+import shutil
+import subprocess
+import textwrap
+
+
+refind_dir = None
+libc = CDLL("libc.so.6")
+install_config = json.load(open('@configPath@', 'r'))
+
+
+def config(*path: str) -> Optional[Any]:
+    result = install_config
+    for component in path:
+        result = result[component]
+    return result
+
+
+def get_system_path(profile: str = 'system', gen: Optional[str] = None, spec: Optional[str] = None) -> str:
+    basename = f'{profile}-{gen}-link' if gen is not None else profile
+    profiles_dir = '/nix/var/nix/profiles'
+    if profile == 'system':
+        result = os.path.join(profiles_dir, basename)
+    else:
+        result = os.path.join(profiles_dir, 'system-profiles', basename)
+
+    if spec is not None:
+        result = os.path.join(result, 'specialisation', spec)
+
+    return result
+
+
+def get_profiles() -> List[str]:
+    profiles_dir = '/nix/var/nix/profiles/system-profiles/'
+    dirs = os.listdir(profiles_dir) if os.path.isdir(profiles_dir) else []
+
+    return [path for path in dirs if not path.endswith('-link')]
+
+
+def get_gens(profile: str = 'system') -> List[Tuple[int, List[str]]]:
+    nix_env = os.path.join(config('nixPath'), 'bin', 'nix-env')
+    output = subprocess.check_output([
+        nix_env, '--list-generations',
+        '-p', get_system_path(profile),
+        '--option', 'build-users-group', '',
+    ], universal_newlines=True)
+
+    gen_lines = output.splitlines()
+    gen_nums = [int(line.split()[0]) for line in gen_lines]
+
+    return [gen for gen in gen_nums][-config('maxGenerations'):]
+
+
+def is_encrypted(device: str) -> bool:
+    for name, _ in config('luksDevices'):
+        if os.readlink(os.path.join('/dev/mapper', name)) == os.readlink(device):
+            return True
+
+    return False
+
+
+def is_fs_type_supported(fs_type: str) -> bool:
+    return fs_type.startswith('vfat')
+
+
+paths = {}
+
+def get_copied_path_uri(path: str, target: str) -> str:
+    package_id = os.path.basename(os.path.dirname(path))
+    suffix = os.path.basename(path)
+    dest_file = f'{package_id}-{suffix}'
+    dest_path = os.path.join(refind_dir, target, dest_file)
+
+    if not os.path.exists(dest_path):
+        copy_file(path, dest_path)
+    else:
+        paths[dest_path] = True
+
+    return os.path.join('/efi/refind', target, dest_file)
+
+def get_path_uri(path: str) -> str:
+    return get_copied_path_uri(path, "")
+
+
+def get_file_uri(profile: str, gen: Optional[str], spec: Optional[str], name: str) -> str:
+    gen_path = get_system_path(profile, gen, spec)
+    path_in_store = os.path.realpath(os.path.join(gen_path, name))
+    return get_path_uri(path_in_store)
+
+
+def get_kernel_uri(kernel_path: str) -> str:
+    return get_copied_path_uri(kernel_path, "kernels")
+
+
+@dataclass
+class BootSpec:
+    system: str
+    init: str
+    kernel: str
+    kernelParams: List[str]
+    label: str
+    toplevel: str
+    specialisations: Dict[str, "BootSpec"]
+    initrd: str | None = None
+    initrdSecrets: str | None = None
+
+
+def bootjson_to_bootspec(bootjson: dict) -> BootSpec:
+    specialisations = bootjson['org.nixos.specialisation.v1']
+    specialisations = {k: bootjson_to_bootspec(v) for k, v in specialisations.items()}
+    return BootSpec(
+        **bootjson['org.nixos.bootspec.v1'],
+        specialisations=specialisations,
+    )
+
+
+def config_entry(is_sub: bool, bootspec: BootSpec, label: str, time: str) -> str:
+    entry = ""
+    if is_sub:
+        entry += 'sub'
+
+    entry += f'menuentry "{label}" {{\n'
+    entry += '  loader ' + get_kernel_uri(bootspec.kernel) + '\n'
+
+    if bootspec.initrd:
+        entry += '  initrd ' + get_kernel_uri(bootspec.initrd) + '\n'
+
+    entry += '  options "' + ' '.join(['init=' + bootspec.init] + bootspec.kernelParams).strip() + '"\n'
+    entry += '}\n'
+    return entry
+
+
+def generate_config_entry(profile: str, gen: str, special: bool, group_name: str) -> str:
+    time = datetime.datetime.fromtimestamp(os.stat(get_system_path(profile,gen), follow_symlinks=False).st_mtime).strftime("%F %H:%M:%S")
+    boot_json = json.load(open(os.path.join(get_system_path(profile, gen), 'boot.json'), 'r'))
+    boot_spec = bootjson_to_bootspec(boot_json)
+
+    specialisation_list = boot_spec.specialisations.items()
+    entry = ""
+
+    if len(specialisation_list) > 0:
+        entry += f'menuentry "NixOS {group_name} Generation {gen}" {{\n'
+        entry += config_entry(True, boot_spec, f'Default', str(time))
+
+        for spec, spec_boot_spec in specialisation_list:
+            entry += config_entry(True, spec_boot_spec, f'{spec}', str(time))
+
+        entry += '}\n'
+    else:
+        entry += config_entry(False, boot_spec, f'NixOS {group_name} Generation {gen}', str(time))
+    return entry
+
+
+def find_disk_device(part: str) -> str:
+    part = os.path.realpath(part)
+    part = part.removeprefix('/dev/')
+    disk = os.path.realpath(os.path.join('/sys', 'class', 'block', part))
+    disk = os.path.dirname(disk)
+
+    return os.path.join('/dev', os.path.basename(disk))
+
+
+def find_mounted_device(path: str) -> str:
+    path = os.path.abspath(path)
+
+    while not os.path.ismount(path):
+        path = os.path.dirname(path)
+
+    devices = [x for x in psutil.disk_partitions() if x.mountpoint == path]
+
+    assert len(devices) == 1
+    return devices[0].device
+
+
+def copy_file(from_path: str, to_path: str):
+    dirname = os.path.dirname(to_path)
+
+    if not os.path.exists(dirname):
+        os.makedirs(dirname)
+
+    shutil.copyfile(from_path, to_path + ".tmp")
+    os.rename(to_path + ".tmp", to_path)
+
+    paths[to_path] = True
+
+
+def install_bootloader() -> None:
+    global refind_dir
+
+    refind_dir = os.path.join(str(config('efiMountPoint')), 'efi', 'refind')
+
+    if not os.path.exists(refind_dir):
+        os.makedirs(refind_dir)
+    else:
+        for dir, dirs, files in os.walk(refind_dir, topdown=True):
+            for file in files:
+                paths[os.path.join(dir, file)] = False
+
+    profiles = [('system', get_gens())]
+
+    for profile in get_profiles():
+        profiles += [(profile, get_gens(profile))]
+
+    timeout = config('timeout')
+
+    last_gen = get_gens()[-1]
+    last_gen_json = json.load(open(os.path.join(get_system_path('system', last_gen), 'boot.json'), 'r'))
+    last_gen_boot_spec = bootjson_to_bootspec(last_gen_json)
+
+    config_file = str(config('extraConfig')) + '\n'
+    config_file += textwrap.dedent(f'''
+        timeout {timeout}
+        default_selection {3 if len(last_gen_boot_spec.specialisations.items()) > 0 else 2}
+    ''')
+
+    config_file += textwrap.dedent('''
+        # NixOS boot entries start here
+    ''')
+
+    for (profile, gens) in profiles:
+        group_name = 'default profile' if profile == 'system' else f"profile '{profile}'"
+        isFirst = True
+
+        for gen in sorted(gens, key=lambda x: x, reverse=True):
+            config_file += generate_config_entry(profile, gen, isFirst, group_name)
+            isFirst = False
+
+    config_file_path = os.path.join(refind_dir, 'refind.conf')
+    config_file += '\n# NixOS boot entries end here\n\n'
+
+    with open(f"{config_file_path}.tmp", 'w') as file:
+        file.truncate()
+        file.write(config_file.strip())
+        file.flush()
+        os.fsync(file.fileno())
+    os.rename(f"{config_file_path}.tmp", config_file_path)
+
+    paths[config_file_path] = True
+
+    for dest_path, source_path in config('additionalFiles').items():
+        dest_path = os.path.join(refind_dir, dest_path)
+
+        copy_file(source_path, dest_path)
+
+    cpu_family = config('hostArchitecture', 'family')
+    if cpu_family == 'x86':
+        if config('hostArchitecture', 'bits') == 32:
+            boot_file = 'BOOTIA32.EFI'
+            efi_file = 'refind_ia32.efi'
+        elif config('hostArchitecture', 'bits') == 64:
+            boot_file = 'BOOTX64.EFI'
+            efi_file = 'refind_x64.efi'
+    elif cpu_family == 'arm':
+        if config('hostArchitecture', 'arch') == 'armv8-a' and config('hostArchitecture', 'bits') == 64:
+            boot_file = 'BOOTAA64.EFI'
+            efi_file = 'refind_aa64.efi'
+        else:
+            raise Exception(f'Unsupported CPU arch: {config("hostArchitecture", "arch")}')
+    else:
+        raise Exception(f'Unsupported CPU family: {cpu_family}')
+
+    efi_path = os.path.join(config('refindPath'), 'share', 'refind', efi_file)
+    dest_path = os.path.join(config('efiMountPoint'), 'efi', 'boot' if config('efiRemovable') else 'refind', boot_file)
+
+    copy_file(efi_path, dest_path)
+
+    if not config('efiRemovable') and not config('canTouchEfiVariables'):
+        print('warning: boot.loader.efi.canTouchEfiVariables is set to false while boot.loader.limine.efiInstallAsRemovable.\n  This may render the system unbootable.')
+
+    if config('canTouchEfiVariables'):
+        if config('efiRemovable'):
+            print('note: boot.loader.limine.efiInstallAsRemovable is true, no need to add EFI entry.')
+        else:
+            efibootmgr = os.path.join(str(config('efiBootMgrPath')), 'bin', 'efibootmgr')
+            efi_partition = find_mounted_device(str(config('efiMountPoint')))
+            efi_disk = find_disk_device(efi_partition)
+
+            efibootmgr_output = subprocess.check_output([efibootmgr], stderr=subprocess.STDOUT, universal_newlines=True)
+
+            # Check the output of `efibootmgr` to find if rEFInd is already installed and present in the boot record
+            refind_boot_entry = None
+            if matches := re.findall(r'Boot([0-9a-fA-F]{4})\*? rEFInd', efibootmgr_output):
+                refind_boot_entry = matches[0]
+
+            # If there's already a Limine entry, replace it
+            if refind_boot_entry:
+                boot_order = re.findall(r'BootOrder: ((?:[0-9a-fA-F]{4},?)*)', efibootmgr_output)[0]
+
+                efibootmgr_output = subprocess.check_output([
+                    efibootmgr,
+                    '-b', refind_boot_entry,
+                    '-B',
+                ], stderr=subprocess.STDOUT, universal_newlines=True)
+
+                efibootmgr_output = subprocess.check_output([
+                    efibootmgr,
+                    '-c',
+                    '-b', refind_boot_entry,
+                    '-d', efi_disk,
+                    '-p', efi_partition.removeprefix(efi_disk).removeprefix('p'),
+                    '-l', f'\\efi\\refind\\{boot_file}',
+                    '-L', 'rEFInd',
+                    '-o', boot_order,
+                ], stderr=subprocess.STDOUT, universal_newlines=True)
+            else:
+                efibootmgr_output = subprocess.check_output([
+                    efibootmgr,
+                    '-c',
+                    '-d', efi_disk,
+                    '-p', efi_partition.removeprefix(efi_disk).removeprefix('p'),
+                    '-l', f'\\efi\\refind\\{boot_file}',
+                    '-L', 'rEFInd',
+                ], stderr=subprocess.STDOUT, universal_newlines=True)
+
+    print("removing unused boot files...")
+    for path in paths:
+        if not paths[path]:
+            os.remove(path)
+
+
+def main() -> None:
+    try:
+        install_bootloader()
+    finally:
+        # Since fat32 provides little recovery facilities after a crash,
+        # it can leave the system in an unbootable state, when a crash/outage
+        # happens shortly after an update. To decrease the likelihood of this
+        # event sync the efi filesystem after each update.
+        rc = libc.syncfs(os.open(f"{config('efiMountPoint')}", os.O_RDONLY))
+        if rc != 0:
+            print(f"could not sync {config('efiMountPoint')}: {os.strerror(rc)}", file=sys.stderr)
+
+if __name__ == '__main__':
+    main()
diff --git a/nixos/modules/system/boot/loader/refind/refind.nix b/nixos/modules/system/boot/loader/refind/refind.nix
new file mode 100644
index 000000000000..8e52edd1610f
--- /dev/null
+++ b/nixos/modules/system/boot/loader/refind/refind.nix
@@ -0,0 +1,117 @@
+{
+  config,
+  options,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib)
+    mkIf
+    mkEnableOption
+    mkOption
+    literalExpression
+    types
+    ;
+
+  cfg = config.boot.loader.refind;
+  efi = config.boot.loader.efi;
+  refindInstallConfig = pkgs.writeText "refind-install.json" (
+    builtins.toJSON {
+      nixPath = config.nix.package;
+      efiBootMgrPath = pkgs.efibootmgr;
+      refindPath = cfg.package;
+      efiMountPoint = efi.efiSysMountPoint;
+      fileSystems = config.fileSystems;
+      luksDevices = config.boot.initrd.luks.devices;
+      canTouchEfiVariables = efi.canTouchEfiVariables;
+      efiRemovable = cfg.efiInstallAsRemovable;
+      maxGenerations = if cfg.maxGenerations == null then 0 else cfg.maxGenerations;
+      hostArchitecture = pkgs.stdenv.hostPlatform.parsed.cpu;
+      timeout = if config.boot.loader.timeout != null then config.boot.loader.timeout else 10;
+      extraConfig = cfg.extraConfig;
+      additionalFiles = cfg.additionalFiles;
+    }
+  );
+in
+{
+  meta = {
+    inherit (pkgs.refind.meta) maintainers;
+  };
+
+  options = {
+    boot.loader.refind = {
+      enable = mkEnableOption "the rEFInd boot loader";
+      extraConfig = lib.mkOption {
+        default = "";
+        type = types.lines;
+        description = ''
+          A string which is prepended to refind.conf.
+        '';
+      };
+      package = lib.mkPackageOption pkgs "refind" { };
+      maxGenerations = lib.mkOption {
+        default = null;
+        example = 50;
+        type = types.nullOr types.int;
+        description = ''
+          Maximum number of latest generations in the boot menu.
+          Useful to prevent boot partition of running out of disk space.
+          `null` means no limit i.e. all generations that were not
+          garbage collected yet.
+        '';
+      };
+      additionalFiles = mkOption {
+        default = { };
+        type = types.attrsOf types.path;
+        example = literalExpression ''
+          { "efi/memtest86/memtest86.efi" = "''${pkgs.memtest86-efi}/BOOTX64.efi"; }
+        '';
+        description = ''
+          A set of files to be copied to {file}`/boot`. Each attribute name denotes the
+          destination file name in {file}`/boot`, while the corresponding attribute value
+          specifies the source file.
+        '';
+      };
+      efiInstallAsRemovable = mkEnableOption null // {
+        default = !efi.canTouchEfiVariables;
+        defaultText = literalExpression "!config.boot.loader.efi.canTouchEfiVariables";
+        description = ''
+          Whether or not to install the rEFInd EFI files as removable.
+
+          See {option}`boot.loader.grub.efiInstallAsRemovable`
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion =
+          pkgs.stdenv.hostPlatform.isx86_64
+          || pkgs.stdenv.hostPlatform.isi686
+          || pkgs.stdenv.hostPlatform.isAarch64;
+        message = "rEFInd can only be installed on aarch64 & x86 platforms";
+      }
+      {
+        assertion = pkgs.stdenv.hostPlatform.isEfi;
+        message = "rEFInd can only be installed on UEFI platforms";
+      }
+    ];
+
+    # Common attribute for boot loaders so only one of them can be
+    # set at once.
+    system = {
+      boot.loader.id = "refind";
+      build.installBootLoader = pkgs.replaceVarsWith {
+        src = ./refind-install.py;
+        isExecutable = true;
+        replacements = {
+          python3 = pkgs.python3.withPackages (python-packages: [ python-packages.psutil ]);
+          configPath = refindInstallConfig;
+        };
+      };
+    };
+  };
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index a50c15852666..2b435d699dbd 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1291,6 +1291,7 @@ in
   redis = handleTest ./redis.nix { };
   redlib = runTest ./redlib.nix;
   redmine = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./redmine.nix { };
+  refind = runTest ./refind.nix;
   renovate = runTest ./renovate.nix;
   replace-dependencies = handleTest ./replace-dependencies { };
   reposilite = runTest ./reposilite.nix;
diff --git a/nixos/tests/refind.nix b/nixos/tests/refind.nix
new file mode 100644
index 000000000000..9cb36f0b6035
--- /dev/null
+++ b/nixos/tests/refind.nix
@@ -0,0 +1,25 @@
+{ lib, pkgs, ... }:
+{
+  name = "refind";
+  meta = {
+    inherit (pkgs.refind.meta) maintainers;
+  };
+
+  nodes.machine =
+    { ... }:
+    {
+      virtualisation.useBootLoader = true;
+      virtualisation.useEFIBoot = true;
+
+      boot.loader.grub.enable = false;
+      boot.loader.efi.canTouchEfiVariables = true;
+      boot.loader.refind.enable = true;
+      boot.loader.timeout = 1;
+    };
+
+  testScript = ''
+    machine.start()
+    with subtest('Machine boots correctly'):
+      machine.wait_for_unit('multi-user.target')
+  '';
+}
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index b2ed1a32188e..936ed34a04f6 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -11998,6 +11998,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  oklch-color-picker-nvim = buildVimPlugin {
+    pname = "oklch-color-picker.nvim";
+    version = "2025-09-04";
+    src = fetchFromGitHub {
+      owner = "eero-lehtinen";
+      repo = "oklch-color-picker.nvim";
+      rev = "ae318113cd7d0e4988b6b059327c2778911f1187";
+      sha256 = "0xhraf89b1ppijqmg1gnwp4gvnnmf8h86n8d6s8ydgj910jvagzm";
+    };
+    meta.homepage = "https://github.com/eero-lehtinen/oklch-color-picker.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   ollama-nvim = buildVimPlugin {
     pname = "ollama.nvim";
     version = "2024-06-09";
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 584970d814af..a72fe0145a46 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -921,6 +921,7 @@ https://github.com/nvimdev/oceanic-material/,,
 https://github.com/mhartington/oceanic-next/,,
 https://github.com/pwntester/octo.nvim/,,
 https://github.com/refractalize/oil-git-status.nvim/,HEAD,
+https://github.com/eero-lehtinen/oklch-color-picker.nvim/,HEAD,
 https://github.com/nomnivore/ollama.nvim/,HEAD,
 https://github.com/yonlu/omni.vim/,,
 https://github.com/Hoffs/omnisharp-extended-lsp.nvim/,HEAD,
diff --git a/pkgs/applications/emulators/libretro/cores/pcsx2.nix b/pkgs/applications/emulators/libretro/cores/pcsx2.nix
index da6bad0f728a..1827412abf21 100644
--- a/pkgs/applications/emulators/libretro/cores/pcsx2.nix
+++ b/pkgs/applications/emulators/libretro/cores/pcsx2.nix
@@ -11,13 +11,13 @@
 }:
 mkLibretroCore {
   core = "pcsx2";
-  version = "0-unstable-2025-08-07";
+  version = "0-unstable-2025-08-30";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "ps2";
-    rev = "c26b06ac2752a11ee47abc6f9c73595ee874341c";
-    hash = "sha256-c7y1jCRQd/o4RTrOeqltcH8HOwrb+BLtaw//0ZWW4E0=";
+    rev = "b0e6c4d7f4abc8cfbf2c55322fc5009a685bc042";
+    hash = "sha256-6cpVsituAWX6sVP5JUvT7KjYZ7SzvD95EB90e2UxJ9A=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix b/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
index 503ebcdeccdf..b71647b7dd19 100644
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
@@ -10,11 +10,11 @@
 buildMozillaMach rec {
   pname = "firefox-beta";
   binaryName = pname;
-  version = "143.0b7";
+  version = "143.0b8";
   applicationName = "Firefox Beta";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "bf71930c7a5ab2c4ccc4f0179702491bd314763c469501f68df6cef0f1db57da6f16da77bc5d7692c0f5edf8ce616d8f927d2fa59c5c386217b9022a8e9802f8";
+    sha512 = "bf8e78abcc1cf6c8b48a591d0185c85195a818de0d13bafa3f004ad9c76364a2c07cacdf09fe0ae2e290d9cbce7b8c3ba4b57793cd3d39240023ef53eea08377";
   };
 
   meta = {
diff --git a/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix b/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
index b69e94984daf..13f91c7d8161 100644
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
@@ -10,13 +10,13 @@
 buildMozillaMach rec {
   pname = "firefox-devedition";
   binaryName = pname;
-  version = "143.0b7";
+  version = "143.0b8";
   applicationName = "Firefox Developer Edition";
   requireSigning = false;
   branding = "browser/branding/aurora";
   src = fetchurl {
     url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "0c1c3af3412b14425df005b53af00e8af526cb6e0bc36f32f6bce1f4332959f35ffed4b795a40e004a41fea9747a7b7c7f6cacfd70b6ef4f54b47556cdc31ec5";
+    sha512 = "89152a4dd3e17f68d7991fae65a6365a2273fcbef28c245a76e9e068a1f12c486a7d0c6d3cb8988c1c9955b15809fa93e117e25b04f9b1a9d449e685cbf30cfc";
   };
 
   # buildMozillaMach sets MOZ_APP_REMOTINGNAME during configuration, but
diff --git a/pkgs/by-name/ai/airgorah/package.nix b/pkgs/by-name/ai/airgorah/package.nix
index bbab7c978ff3..bd9710c940b5 100644
--- a/pkgs/by-name/ai/airgorah/package.nix
+++ b/pkgs/by-name/ai/airgorah/package.nix
@@ -15,16 +15,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "airgorah";
-  version = "0.7.3";
+  version = "0.7.4";
 
   src = fetchFromGitHub {
     owner = "martin-olivier";
     repo = "airgorah";
     tag = "v${version}";
-    hash = "sha256-cIb40TKkk3gfy4dTP8WyZqQkRGj5nItaQ3NSfexCUOA=";
+    hash = "sha256-6TH+DRDtWajZjHNmFSKL4XJK+AuDNUbWKRPRryOpSGY=";
   };
 
-  cargoHash = "sha256-3Les/A9fBBjU6NSVVEyXCbjrNSdaEgCl5pZ36ceRDQg=";
+  cargoHash = "sha256-LiSaNyqsKBZ5nNP7mws1pjhVwTXNBF6e1wSUdG/qYog=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/development/tools/build-managers/bazel/bazel_rc.patch b/pkgs/by-name/ba/bazel_7/bazel_rc.patch
similarity index 100%
rename from pkgs/development/tools/build-managers/bazel/bazel_rc.patch
rename to pkgs/by-name/ba/bazel_7/bazel_rc.patch
diff --git a/pkgs/development/tools/build-managers/bazel/bazel_7/darwin_sleep.patch b/pkgs/by-name/ba/bazel_7/darwin_sleep.patch
similarity index 100%
rename from pkgs/development/tools/build-managers/bazel/bazel_7/darwin_sleep.patch
rename to pkgs/by-name/ba/bazel_7/darwin_sleep.patch
diff --git a/pkgs/development/tools/build-managers/bazel/bazel_7/java_toolchain.patch b/pkgs/by-name/ba/bazel_7/java_toolchain.patch
similarity index 100%
rename from pkgs/development/tools/build-managers/bazel/bazel_7/java_toolchain.patch
rename to pkgs/by-name/ba/bazel_7/java_toolchain.patch
diff --git a/pkgs/development/tools/build-managers/bazel/bazel_7/nix-build-bazel-package-hacks.patch b/pkgs/by-name/ba/bazel_7/nix-build-bazel-package-hacks.patch
similarity index 100%
rename from pkgs/development/tools/build-managers/bazel/bazel_7/nix-build-bazel-package-hacks.patch
rename to pkgs/by-name/ba/bazel_7/nix-build-bazel-package-hacks.patch
diff --git a/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix b/pkgs/by-name/ba/bazel_7/package.nix
similarity index 99%
rename from pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
rename to pkgs/by-name/ba/bazel_7/package.nix
index 7cd90a1f5822..539b563e10aa 100644
--- a/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
+++ b/pkgs/by-name/ba/bazel_7/package.nix
@@ -369,7 +369,7 @@ stdenv.mkDerivation rec {
     # On Darwin, the last argument to gcc is coming up as an empty string. i.e: ''
     # This is breaking the build of any C target. This patch removes the last
     # argument if it's found to be an empty string.
-    ../trim-last-argument-to-gcc-if-empty.patch
+    ./trim-last-argument-to-gcc-if-empty.patch
 
     # --experimental_strict_action_env (which may one day become the default
     # see bazelbuild/bazel#2574) hardcodes the default
@@ -377,13 +377,13 @@ stdenv.mkDerivation rec {
     # This is non hermetic on non-nixos systems. On NixOS, bazel cannot find the required binaries.
     # So we are replacing this bazel paths by defaultShellPath,
     # improving hermeticity and making it work in nixos.
-    (replaceVars ../strict_action_env.patch {
+    (replaceVars ./strict_action_env.patch {
       strictActionEnvPatch = defaultShellPath;
     })
 
     # bazel reads its system bazelrc in /etc
     # override this path to a builtin one
-    (replaceVars ../bazel_rc.patch {
+    (replaceVars ./bazel_rc.patch {
       bazelSystemBazelRCPath = bazelRC;
     })
   ]
diff --git a/pkgs/development/tools/build-managers/bazel/strict_action_env.patch b/pkgs/by-name/ba/bazel_7/strict_action_env.patch
similarity index 100%
rename from pkgs/development/tools/build-managers/bazel/strict_action_env.patch
rename to pkgs/by-name/ba/bazel_7/strict_action_env.patch
diff --git a/pkgs/development/tools/build-managers/bazel/bazel_7/test_source_sort.patch b/pkgs/by-name/ba/bazel_7/test_source_sort.patch
similarity index 100%
rename from pkgs/development/tools/build-managers/bazel/bazel_7/test_source_sort.patch
rename to pkgs/by-name/ba/bazel_7/test_source_sort.patch
diff --git a/pkgs/development/tools/build-managers/bazel/trim-last-argument-to-gcc-if-empty.patch b/pkgs/by-name/ba/bazel_7/trim-last-argument-to-gcc-if-empty.patch
similarity index 100%
rename from pkgs/development/tools/build-managers/bazel/trim-last-argument-to-gcc-if-empty.patch
rename to pkgs/by-name/ba/bazel_7/trim-last-argument-to-gcc-if-empty.patch
diff --git a/pkgs/development/tools/build-managers/bazel/bazel_7/xcode_locator.patch b/pkgs/by-name/ba/bazel_7/xcode_locator.patch
similarity index 100%
rename from pkgs/development/tools/build-managers/bazel/bazel_7/xcode_locator.patch
rename to pkgs/by-name/ba/bazel_7/xcode_locator.patch
diff --git a/pkgs/by-name/cl/clickhouse/generic.nix b/pkgs/by-name/cl/clickhouse/generic.nix
index 2fd4c47dd1cd..dd3378440f32 100644
--- a/pkgs/by-name/cl/clickhouse/generic.nix
+++ b/pkgs/by-name/cl/clickhouse/generic.nix
@@ -90,29 +90,33 @@ llvmPackages_19.stdenv.mkDerivation (finalAttrs: {
 
   dontCargoSetupPostUnpack = true;
 
-  # Should not be necessary after 25.9
-  patches = lib.optional (lib.versions.majorMinor version == "25.8") (fetchpatch {
-    url = "https://github.com/ClickHouse/ClickHouse/commit/67a42b78cdf1c793e78c1adbcc34162f67044032.patch";
-    sha256 = "7VF+JSztqTWD+aunCS3UVNxlRdwHc2W5fNqzDyeo3Fc=";
-  });
+  patches =
+    lib.optional (lib.versions.majorMinor version == "25.8") (fetchpatch {
+      # Disable building WASM lexer
+      url = "https://github.com/ClickHouse/ClickHouse/commit/67a42b78cdf1c793e78c1adbcc34162f67044032.patch";
+      sha256 = "7VF+JSztqTWD+aunCS3UVNxlRdwHc2W5fNqzDyeo3Fc=";
+    })
+    ++
+
+      lib.optional (lib.versions.majorMinor version == "25.8" && stdenv.hostPlatform.isDarwin)
+        (fetchpatch {
+          # Do not intercept memalign on darwin
+          url = "https://github.com/ClickHouse/ClickHouse/commit/0cfd2dbe981727fb650f3b9935f5e7e7e843180f.patch";
+          sha256 = "1iNYZbugX2g2dxNR1ZiUthzPnhLUR8g118aG23yhgUo=";
+        });
 
   postPatch = ''
     patchShebangs src/ utils/
-
-    sed -i 's|/usr/bin/env perl|"${lib.getExe perl}"|' contrib/openssl-cmake/CMakeLists.txt
-
-    substituteInPlace utils/list-licenses/list-licenses.sh \
-      --replace-fail '$(git rev-parse --show-toplevel)' "$NIX_BUILD_TOP/$sourceRoot"
-  ''
-  + lib.optionalString (lib.versions.majorMinor version <= "25.6") ''
-    substituteInPlace src/Storages/System/StorageSystemLicenses.sh \
-       --replace-fail '$(git rev-parse --show-toplevel)' "$NIX_BUILD_TOP/$sourceRoot"
   ''
   + lib.optionalString stdenv.hostPlatform.isDarwin ''
     substituteInPlace cmake/tools.cmake \
       --replace-fail 'gfind' 'find' \
       --replace-fail 'ggrep' 'grep' \
       --replace-fail '--ld-path=''${LLD_PATH}' '-fuse-ld=lld'
+
+    substituteInPlace utils/list-licenses/list-licenses.sh \
+      --replace-fail 'gfind' 'find' \
+      --replace-fail 'ggrep' 'grep'
   ''
   # Rust is handled by cmake
   + lib.optionalString rustSupport ''
diff --git a/pkgs/by-name/co/codex/package.nix b/pkgs/by-name/co/codex/package.nix
index 98329528098f..0b7bf3500a77 100644
--- a/pkgs/by-name/co/codex/package.nix
+++ b/pkgs/by-name/co/codex/package.nix
@@ -12,18 +12,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "codex";
-  version = "0.29.0";
+  version = "0.30.0";
 
   src = fetchFromGitHub {
     owner = "openai";
     repo = "codex";
     tag = "rust-v${finalAttrs.version}";
-    hash = "sha256-YCQfycmDPRxMAqo57tt/6IXkUn1JIPTzEHMNbt7m3w0=";
+    hash = "sha256-9dWVf5Q7sDfAbRIGvUqqwEouJRnS//ujlFvqZ/a8zBk=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/codex-rs";
 
-  cargoHash = "sha256-kGjpqkV0OJW8mOW/OhyfXoTgLHHrtHQcw9c8zyVtzgs=";
+  cargoHash = "sha256-qJn2oN/9LVLhHnaNp+x9cUEMODrGrgV3SiR0ykIx7B4=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/em/emmylua-doc-cli/package.nix b/pkgs/by-name/em/emmylua-doc-cli/package.nix
index 6f113229a87d..5acd6eedc2f9 100644
--- a/pkgs/by-name/em/emmylua-doc-cli/package.nix
+++ b/pkgs/by-name/em/emmylua-doc-cli/package.nix
@@ -6,18 +6,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "emmylua_doc_cli";
-  version = "0.12.0";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "EmmyLuaLs";
     repo = "emmylua-analyzer-rust";
     tag = finalAttrs.version;
-    hash = "sha256-IXoiXfRnGOZQ7c8AJaK8OGjqp1bczd/tKjtpbYdCZlU=";
+    hash = "sha256-93PlsVvlUravsnW7YBCii04jCEJPP+6U2vYbVBjcX8M=";
   };
 
   buildAndTestSubdir = "crates/emmylua_doc_cli";
 
-  cargoHash = "sha256-7QQipbnqelLdzQr+lIORyQNM9SS5yHaJLQ31M52lYCw=";
+  cargoHash = "sha256-SbsYlIVWDpBU2bxJqXUtOiMHkOoa8Up27X7rVKLLLm0=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/by-name/ep/epson-inkjet-printer-workforce-840-series/eps_raster_print-cast.patch b/pkgs/by-name/ep/epson-inkjet-printer-workforce-840-series/eps_raster_print-cast.patch
new file mode 100644
index 000000000000..618ac1c91de9
--- /dev/null
+++ b/pkgs/by-name/ep/epson-inkjet-printer-workforce-840-series/eps_raster_print-cast.patch
@@ -0,0 +1,21 @@
+diff --git a/src/raster_to_epson.c b/src/raster_to_epson.c
+index 6e621c8..a5ca797 100644
+--- a/src/raster_to_epson.c
++++ b/src/raster_to_epson.c
+@@ -438,14 +438,14 @@ static int print_page (void)
+ 					break;
+ 				}
+ 
+-				if (eps_raster_print(raster_h, image_raw, pageRegion.bytesPerLine, pageRegion.width, &nraster)) {
++				if (eps_raster_print(raster_h, image_raw, pageRegion.bytesPerLine, pageRegion.width, (int *) &nraster)) {
+ 					error  = 1;
+ 					break;
+ 				}
+ 			}
+ 
+ 			// flushing page
+-			eps_raster_print(raster_h, NULL, 0, 0, &nraster);
++			eps_raster_print(raster_h, NULL, 0, 0, (int *) &nraster);
+ 
+ 			bAbort = (error) ? TRUE : FALSE;
+ 			if (epcgEndPage (bAbort)) {
diff --git a/pkgs/by-name/ep/epson-inkjet-printer-workforce-840-series/include-raster-helper.patch b/pkgs/by-name/ep/epson-inkjet-printer-workforce-840-series/include-raster-helper.patch
new file mode 100644
index 000000000000..de32b9e54381
--- /dev/null
+++ b/pkgs/by-name/ep/epson-inkjet-printer-workforce-840-series/include-raster-helper.patch
@@ -0,0 +1,23 @@
+diff --git a/src/pagemanager/pagemanager.c b/src/pagemanager/pagemanager.c
+index 029e6d3..2881585 100644
+--- a/src/pagemanager/pagemanager.c
++++ b/src/pagemanager/pagemanager.c
+@@ -23,6 +23,7 @@
+ #include "debuglog.h"
+ #include "memory.h"
+ #include "raster.h"
++#include "raster-helper.h"
+ #include "pagemanager.h"
+
+ extern int JobCanceled;
+diff --git a/src/raster_to_epson.c b/src/raster_to_epson.c
+index 6e621c8..6eea77c 100644
+--- a/src/raster_to_epson.c
++++ b/src/raster_to_epson.c
+@@ -36,6 +36,7 @@
+ #include "raster.h"
+ #include "memory.h"
+ #include "raster_to_epson.h"
++#include "raster-helper.h"
+ #include "pagemanager.h"
+ #include "filter_option.h"
diff --git a/pkgs/by-name/ep/epson-inkjet-printer-workforce-840-series/package.nix b/pkgs/by-name/ep/epson-inkjet-printer-workforce-840-series/package.nix
new file mode 100644
index 000000000000..fde1c9855b12
--- /dev/null
+++ b/pkgs/by-name/ep/epson-inkjet-printer-workforce-840-series/package.nix
@@ -0,0 +1,131 @@
+{
+  autoreconfHook,
+  cups,
+  libjpeg,
+  rpmextract,
+  fetchurl,
+  lib,
+  stdenv,
+}:
+
+let
+  srcdirs = {
+    filter = "epson-inkjet-printer-filter-1.0.0";
+    driver = "epson-inkjet-printer-workforce-840-series-1.0.0";
+  };
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "epson-inkjet-printer-workforce-840-series";
+  version = "1.0.0";
+
+  # The Epson may be unreliable, and it has been since sometime in
+  # 2024. Non-browser requests using commands like fetchurl receive a
+  # 403 error, an access denied response -- last checked on
+  # 2025-08-21.
+  #
+  # Therefore, an archive.org link has been added as a fallback
+  # option just in case.
+  src = fetchurl {
+    # NOTE: Don't forget to update the webarchive link too!
+    urls = [
+      "https://download.ebz.epson.net/dsc/op/stable/SRPMS/epson-inkjet-printer-workforce-840-series-${finalAttrs.version}-1lsb3.2.src.rpm"
+      "https://web.archive.org/web/https://download.ebz.epson.net/dsc/op/stable/SRPMS/epson-inkjet-printer-workforce-840-series-${finalAttrs.version}-1lsb3.2.src.rpm"
+    ];
+    hash = "sha256-rTYnEmgzqR/wOZYYIe2rO9x2cX8s2qDyTuRaTjzJjbg=";
+  };
+  sourceRoot = srcdirs.filter;
+
+  nativeBuildInputs = [
+    autoreconfHook
+    rpmextract
+  ];
+  buildInputs = [
+    cups
+    libjpeg
+  ];
+
+  unpackPhase = ''
+    runHook preUnpack
+
+    rpmextract "$src"
+    for i in ${lib.concatStringsSep " " (builtins.attrValues srcdirs)}; do
+        tar xvf "$i".tar.gz
+    done
+
+    runHook postUnpack
+  '';
+
+  # Both patches fix errors that occur when building with GCC 14.
+  #
+  # eps_raster_print-cast.patch fixes 'error: passing argument 5 of
+  # ‘eps_raster_print’ from incompatible pointer type' in file
+  # raster_to_epson.c
+  #
+  # include-raster-helper.patch fixes 'error: implicit declaration of
+  # function' in files pagemanager.c and raster_to_epson.c
+  patches = [
+    ./eps_raster_print-cast.patch
+    ./include-raster-helper.patch
+  ];
+
+  installPhase =
+    let
+      filterdir = "$out/lib/cups/filter";
+      docdir = "$out/share/doc/epson-inkjet-printer-workforce-840-series";
+      ppddir = "$out/share/cups/model/epson-inkjet-printer-workforce-840-series";
+      libdir =
+        if stdenv.hostPlatform.isx86_64 then
+          "lib64"
+        else
+          throw "Platforms other than x86_64-linux are not (yet) supported.";
+    in
+    ''
+      runHook preInstall
+
+      mkdir -p "$out" "${docdir}" "${filterdir}" "${ppddir}"
+      cp src/epson_inkjet_printer_filter "${filterdir}"
+
+      cp AUTHORS COPYING COPYING.EPSON COPYING.LIB "${docdir}"
+
+      cd ../${srcdirs.driver}
+      cp Manual.txt README "${docdir}"
+      for ppd in ppds/*; do
+          substituteInPlace "$ppd" --replace-fail '/opt/epson-inkjet-printer-workforce-840-series/cups/lib' "$out/lib/cups"
+          gzip -c "$ppd" > "${ppddir}/''${ppd#*/}"
+      done
+      cp -r resource watermark ${libdir} "$out"
+
+      runHook postInstall
+    '';
+
+  meta = {
+    description = "Proprietary CUPS drivers for Epson inkjet printers";
+    longDescription = ''
+      This software is a filter program used with the Common UNIX Printing
+      System (CUPS) under Linux. It supplies high quality printing with
+      Seiko Epson Color Ink Jet Printers.
+
+      This printer driver is supporting the following printers.
+
+      Epson Stylus Office BX925
+      Epson WorkForce 840
+
+      To use the driver adjust your configuration.nix file:
+      ```nix
+      {
+        services.printing = {
+          enable = true;
+          drivers = [ pkgs.epson-inkjet-printer-workforce-840-series ];
+        };
+      }
+      ```
+    '';
+    downloadPage = "http://download.ebz.epson.net/dsc/du/02/DriverDownloadInfo.do?LG2=EN&CN2=&DSCMI=16839&DSCCHK=3d7bc6bdfca08006abfb859fb1967183156a7252";
+    license = with lib.licenses; [
+      lgpl21
+      epson
+    ];
+    maintainers = with lib.maintainers; [ heichro ];
+    platforms = [ "x86_64-linux" ];
+  };
+})
diff --git a/pkgs/by-name/gg/gg-jj/package.nix b/pkgs/by-name/gg/gg-jj/package.nix
index d9a668feea32..1bc472337a58 100644
--- a/pkgs/by-name/gg/gg-jj/package.nix
+++ b/pkgs/by-name/gg/gg-jj/package.nix
@@ -33,10 +33,20 @@ rustPlatform.buildRustPackage (finalAttrs: {
   cargoHash = "sha256-AdatJNDqIoRHfaf81iFhOs2JGLIxy7agFJj96bFPj00=";
 
   npmDeps = fetchNpmDeps {
-    inherit (finalAttrs) pname version src;
-    hash = "sha256-izCl3pE15ocEGYOYCUR1iTR+82nDB06Ed4YOGRGByfI=";
+    inherit (finalAttrs)
+      pname
+      version
+      src
+      patches
+      ;
+    hash = "sha256-ehXGLpCCN+BNqtwjEatcfR0kQHj5WOofTDR5mLSVW0U=";
   };
 
+  patches = [
+    # Remove after https://github.com/gulbanana/gg/pull/68 is released
+    ./update-tauri-npm-to-match-cargo.patch
+  ];
+
   nativeBuildInputs = [
     cargo-tauri.hook
     nodejs
diff --git a/pkgs/by-name/gg/gg-jj/update-tauri-npm-to-match-cargo.patch b/pkgs/by-name/gg/gg-jj/update-tauri-npm-to-match-cargo.patch
new file mode 100644
index 000000000000..ab26a756a514
--- /dev/null
+++ b/pkgs/by-name/gg/gg-jj/update-tauri-npm-to-match-cargo.patch
@@ -0,0 +1,81 @@
+From 627de4bd148229a1feb327262b9f0b2a75077ed3 Mon Sep 17 00:00:00 2001
+From: Mitchell Skaggs <skaggsm333@gmail.com>
+Date: Mon, 1 Sep 2025 19:02:19 -0500
+Subject: [PATCH] update `@tauri-apps/api` and `@tauri-apps/plugin-shell` to
+ match Cargo versions
+
+In Tauri *CLI* versions >=2.8.0, the build fails if NPM and Cargo versions
+are not aligned. This is not a new requirement, this merely verifies an
+existing requirement. The CLI version in Nixpkgs was updated and now
+detects this already-existing error.
+
+This pulls the NPM versions up to match the existing Cargo versions
+without touching any other dependencies.
+---
+ package-lock.json | 18 +++++++++---------
+ package.json      |  4 ++--
+ 2 files changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/package-lock.json b/package-lock.json
+index 3affe19..ebe27e7 100644
+--- a/package-lock.json
++++ b/package-lock.json
+@@ -9,8 +9,8 @@
+       "version": "0.29.0",
+       "dependencies": {
+         "@catppuccin/palette": "^1.0.3",
+-        "@tauri-apps/api": "^2.0.0-beta.0",
+-        "@tauri-apps/plugin-shell": "^2.0.0-beta.0",
++        "@tauri-apps/api": "^2.4.1",
++        "@tauri-apps/plugin-shell": "2.2.1",
+         "feather-icons": "^4.29.1",
+         "modern-normalize": "^2.0.0"
+       },
+@@ -793,9 +793,9 @@
+       }
+     },
+     "node_modules/@tauri-apps/api": {
+-      "version": "2.1.1",
+-      "resolved": "https://registry.npmjs.org/@tauri-apps/api/-/api-2.1.1.tgz",
+-      "integrity": "sha512-fzUfFFKo4lknXGJq8qrCidkUcKcH2UHhfaaCNt4GzgzGaW2iS26uFOg4tS3H4P8D6ZEeUxtiD5z0nwFF0UN30A==",
++      "version": "2.4.1",
++      "resolved": "https://registry.npmjs.org/@tauri-apps/api/-/api-2.4.1.tgz",
++      "integrity": "sha512-5sYwZCSJb6PBGbBL4kt7CnE5HHbBqwH+ovmOW6ZVju3nX4E3JX6tt2kRklFEH7xMOIwR0btRkZktuLhKvyEQYg==",
+       "license": "Apache-2.0 OR MIT",
+       "funding": {
+         "type": "opencollective",
+@@ -1002,9 +1002,9 @@
+       }
+     },
+     "node_modules/@tauri-apps/plugin-shell": {
+-      "version": "2.0.1",
+-      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-shell/-/plugin-shell-2.0.1.tgz",
+-      "integrity": "sha512-akU1b77sw3qHiynrK0s930y8zKmcdrSD60htjH+mFZqv5WaakZA/XxHR3/sF1nNv9Mgmt/Shls37HwnOr00aSw==",
++      "version": "2.2.1",
++      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-shell/-/plugin-shell-2.2.1.tgz",
++      "integrity": "sha512-G1GFYyWe/KlCsymuLiNImUgC8zGY0tI0Y3p8JgBCWduR5IEXlIJS+JuG1qtveitwYXlfJrsExt3enhv5l2/yhA==",
+       "license": "MIT OR Apache-2.0",
+       "dependencies": {
+         "@tauri-apps/api": "^2.0.0"
+@@ -2054,4 +2054,4 @@
+       "license": "ISC"
+     }
+   }
+-}
+\ No newline at end of file
++}
+diff --git a/package.json b/package.json
+index 6000620..9d61871 100644
+--- a/package.json
++++ b/package.json
+@@ -14,8 +14,8 @@
+   },
+   "dependencies": {
+     "@catppuccin/palette": "^1.0.3",
+-    "@tauri-apps/api": "^2.0.0-beta.0",
+-    "@tauri-apps/plugin-shell": "^2.0.0-beta.0",
++    "@tauri-apps/api": "^2.4.1",
++    "@tauri-apps/plugin-shell": "2.2.1",
+     "feather-icons": "^4.29.1",
+     "modern-normalize": "^2.0.0"
+   },
diff --git a/pkgs/by-name/gl/globus-cli/package.nix b/pkgs/by-name/gl/globus-cli/package.nix
new file mode 100644
index 000000000000..445ebddb1bde
--- /dev/null
+++ b/pkgs/by-name/gl/globus-cli/package.nix
@@ -0,0 +1,73 @@
+{
+  lib,
+  fetchFromGitHub,
+  python3Packages,
+  installShellFiles,
+  versionCheckHook,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "globus-cli";
+  version = "3.36.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "globus";
+    repo = "globus-cli";
+    tag = version;
+    hash = "sha256-Phu7nXMICSBFUX8wfzwA4ORBJIkhTDCMCqTyZvcG93c=";
+  };
+
+  build-system = with python3Packages; [
+    setuptools
+    ruamel-yaml
+  ];
+
+  dependencies = with python3Packages; [
+    globus-sdk
+    click
+    jmespath
+    packaging
+    typing-extensions
+    requests
+  ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  nativeCheckInputs = with python3Packages; [
+    pytest
+    pytest-xdist
+    pytest-timeout
+    responses
+
+    click
+    requests
+    pyjwt
+    cryptography
+    packaging
+    typing-extensions
+
+    pytestCheckHook
+    versionCheckHook
+  ];
+
+  versionCheckProgramArg = "version";
+
+  postInstall = ''
+    mkdir -p completions/{bash,zsh}
+    $out/bin/globus --bash-completer > completions/bash/globus
+    $out/bin/globus --zsh-completer > completions/zsh/_globus
+    installShellCompletion \
+      --bash completions/bash/globus \
+      --zsh completions/zsh/_globus
+  '';
+
+  meta = {
+    mainProgram = "globus";
+    description = "Command-line interface to Globus REST APIs, including the Transfer API and the Globus Auth API";
+    homepage = "https://github.com/globus/globus-cli";
+    changelog = "https://github.com/globus/globus-cli/releases/tag/${src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.richardjacton ];
+  };
+}
diff --git a/pkgs/by-name/gr/grav/package.nix b/pkgs/by-name/gr/grav/package.nix
index a8ed7792743b..fb19d7b57963 100644
--- a/pkgs/by-name/gr/grav/package.nix
+++ b/pkgs/by-name/gr/grav/package.nix
@@ -6,7 +6,7 @@
 }:
 
 let
-  version = "1.7.49.2";
+  version = "1.7.49.4";
 in
 stdenvNoCC.mkDerivation {
   pname = "grav";
@@ -14,7 +14,7 @@ stdenvNoCC.mkDerivation {
 
   src = fetchzip {
     url = "https://github.com/getgrav/grav/releases/download/${version}/grav-admin-v${version}.zip";
-    hash = "sha256-Yu7uFoim12pe4OT/dSsQVcZ6nyYGKWLJbsfLFtI05Z8=";
+    hash = "sha256-ZOhZ5O5s8P4nqjSsLEu4RpyTfZ34YBi0itETwcRdIPQ=";
   };
 
   patches = [
diff --git a/pkgs/by-name/gr/grub2_pvgrub_image/package.nix b/pkgs/by-name/gr/grub2_pvgrub_image/package.nix
deleted file mode 100644
index 3aa240ed9fee..000000000000
--- a/pkgs/by-name/gr/grub2_pvgrub_image/package.nix
+++ /dev/null
@@ -1,54 +0,0 @@
-{
-  lib,
-  stdenv,
-  grub2_xen,
-}:
-
-let
-  efiSystemsBuild = {
-    i686-linux.target = "i386";
-    x86_64-linux.target = "x86_64";
-    armv7l-linux.target = "arm";
-    aarch64-linux.target = "aarch64";
-    riscv32-linux.target = "riscv32";
-    riscv64-linux.target = "riscv64";
-  };
-
-in
-(
-
-  stdenv.mkDerivation rec {
-    name = "pvgrub-image";
-
-    configs = ./configs;
-
-    buildInputs = [ grub2_xen ];
-
-    buildCommand = ''
-      cp "${configs}"/* .
-      tar -cf memdisk.tar grub.cfg
-      # We include all modules except all_video.mod as otherwise grub will fail printing "no symbol table"
-      # if we include it.
-      grub-mkimage -O "${
-        efiSystemsBuild.${stdenv.hostPlatform.system}.target
-      }-xen" -c grub-bootstrap.cfg \
-        -m memdisk.tar -o "grub-${efiSystemsBuild.${stdenv.hostPlatform.system}.target}-xen.bin" \
-        $(ls "${grub2_xen}/lib/grub/${
-          efiSystemsBuild.${stdenv.hostPlatform.system}.target
-        }-xen/" |grep 'mod''$'|grep -v '^all_video\.mod''$')
-      mkdir -p "$out/lib/grub-xen"
-      cp "grub-${efiSystemsBuild.${stdenv.hostPlatform.system}.target}-xen.bin" $out/lib/grub-xen/
-    '';
-
-    meta = with lib; {
-      description = "PvGrub image for use for booting PV Xen guests";
-
-      longDescription = ''
-        This package provides a PvGrub image for booting Para-Virtualized (PV)
-        Xen guests
-      '';
-
-      platforms = platforms.gnu ++ platforms.linux;
-    };
-  }
-)
diff --git a/pkgs/by-name/gr/grub2_pvgrub_image/configs/grub-bootstrap.cfg b/pkgs/by-name/gr/grub2_pvhgrub_image/configs/grub-bootstrap.cfg
similarity index 100%
rename from pkgs/by-name/gr/grub2_pvgrub_image/configs/grub-bootstrap.cfg
rename to pkgs/by-name/gr/grub2_pvhgrub_image/configs/grub-bootstrap.cfg
diff --git a/pkgs/by-name/gr/grub2_pvgrub_image/configs/grub.cfg b/pkgs/by-name/gr/grub2_pvhgrub_image/configs/grub.cfg
similarity index 100%
rename from pkgs/by-name/gr/grub2_pvgrub_image/configs/grub.cfg
rename to pkgs/by-name/gr/grub2_pvhgrub_image/configs/grub.cfg
diff --git a/pkgs/by-name/gr/grub2_pvhgrub_image/package.nix b/pkgs/by-name/gr/grub2_pvhgrub_image/package.nix
new file mode 100644
index 000000000000..f65c0dffdc32
--- /dev/null
+++ b/pkgs/by-name/gr/grub2_pvhgrub_image/package.nix
@@ -0,0 +1,83 @@
+{
+  lib,
+  stdenv,
+  grub2_xen,
+  grub2_xen_pvh,
+  grubPlatform ? "xen_pvh",
+}:
+
+assert lib.assertOneOf "grubPlatform" grubPlatform [
+  "xen"
+  "xen_pvh"
+];
+let
+  targets = {
+    i686-linux.target = "i386";
+    x86_64-linux.target = if grubPlatform == "xen_pvh" then "i386" else "x86_64";
+  };
+in
+stdenv.mkDerivation {
+  name = "grub2_${grubPlatform}_image";
+
+  env = {
+    GRUB_CONFIGS = "${./configs}";
+    GRUB_FORMAT = "${targets.${stdenv.buildPlatform.system}.target}-${grubPlatform}";
+  };
+
+  buildInputs =
+    lib.optional (grubPlatform == "xen") grub2_xen
+    ++ lib.optional (grubPlatform == "xen_pvh") grub2_xen_pvh;
+
+  dontUnpack = true;
+
+  buildPhase = ''
+    cp "$GRUB_CONFIGS"/* .
+    tar -cf memdisk.tar grub.cfg
+    grub-mkimage \
+      -O "$GRUB_FORMAT" \
+      -c grub-bootstrap.cfg \
+      -m memdisk.tar \
+      -o grub-"$GRUB_FORMAT".bin \
+      ${if grubPlatform == "xen_pvh" then grub2_xen_pvh else grub2_xen}/lib/grub/"$GRUB_FORMAT"/*.mod
+  '';
+
+  installPhase = ''
+    mkdir -p "$out/lib/grub-${grubPlatform}"
+    cp grub-"$GRUB_FORMAT".bin $out/lib/grub-${grubPlatform}/
+  '';
+
+  dontFixup = true;
+
+  meta = {
+    description = "PvGrub2 image for booting ${
+      if grubPlatform == "xen_pvh" then "PVH" else "PV"
+    } Xen guests";
+
+    longDescription =
+      if (grubPlatform == "xen_pvh") then
+        ''
+          This package provides a prebuilt PvGrub2 image for booting PVH Xen
+          guests (also commonly referred to as PvhGrub2), which searches for
+          `grub.cfg` on the guest disk and interprets it to load the kernel,
+          eliminating the need to copy the guest kernel to the Dom0.
+
+          You will need `pkgs.grub2_xen_pvh` to build a customized PvhGrub2
+          image. See [PvGrub2](https://wiki.xenproject.org/wiki/PvGrub2) for
+          more explanations.
+        ''
+      else
+        ''
+          This package provides a prebuilt PvGrub2 image for booting PV Xen
+          guests, which searches for `grub.cfg` on the guest disk and interprets
+          it to load the kernel, eliminating the need to copy the guest kernel
+          to the Dom0.
+
+          You will need `pkgs.grub2_xen` to build a customized PvGrub2 image.
+          See [PvGrub2](https://wiki.xenproject.org/wiki/PvGrub2) for more
+          explanations.
+        '';
+
+    teams = [ lib.teams.xen ];
+    platforms = lib.attrNames targets;
+  };
+}
diff --git a/pkgs/by-name/ho/hotspot/package.nix b/pkgs/by-name/ho/hotspot/package.nix
index c58566cd3ae9..3c96d445611e 100644
--- a/pkgs/by-name/ho/hotspot/package.nix
+++ b/pkgs/by-name/ho/hotspot/package.nix
@@ -10,7 +10,7 @@
   kddockwidgets,
   kdePackages,
   libelf,
-  linuxPackages,
+  perf,
   qt6,
   rustc-demangle,
   zstd,
@@ -74,7 +74,7 @@ stdenv.mkDerivation rec {
   qtWrapperArgs = [
     "--suffix PATH : ${
       lib.makeBinPath [
-        linuxPackages.perf
+        perf
         binutils
       ]
     }"
diff --git a/pkgs/by-name/ma/mado/package.nix b/pkgs/by-name/ma/mado/package.nix
new file mode 100644
index 000000000000..ed691886dc75
--- /dev/null
+++ b/pkgs/by-name/ma/mado/package.nix
@@ -0,0 +1,62 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  installShellFiles,
+  oniguruma,
+  rust-jemalloc-sys,
+  stdenv,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "mado";
+  version = "0.3.0";
+
+  src = fetchFromGitHub {
+    owner = "akiomik";
+    repo = "mado";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-wAuV4w0dKfUbJVLTdp59/u4y13SPy3wkRfTlpvyE/zY=";
+  };
+
+  cargoHash = "sha256-fkalUnPkjjzhLaACh+WQP4tG5VzZ7wmrh5T1DVgSDwM=";
+
+  nativeBuildInputs = [
+    pkg-config
+    installShellFiles
+  ];
+
+  buildInputs = [
+    oniguruma
+    rust-jemalloc-sys
+  ];
+
+  env = {
+    RUSTONIG_SYSTEM_LIBONIG = true;
+  };
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd mado \
+      --bash <($out/bin/mado generate-shell-completion bash) \
+      --zsh <($out/bin/mado generate-shell-completion zsh) \
+      --fish <($out/bin/mado generate-shell-completion fish)
+  '';
+
+  checkFlags = [
+    #   # seem to be slightly broken inside of the build sandbox
+    "--skip=check_empty_stdin_with_file"
+    "--skip=check_stdin"
+    "--skip=check_stdin_with_file"
+    "--skip=generate_shell_completion_invalid"
+    "--skip=unknown_command"
+  ];
+
+  meta = {
+    description = "Markdown linter written in Rust";
+    homepage = "https://github.com/akiomik/mado";
+    changelog = "https://github.com/akiomik/mado/blob/v${finalAttrs.version}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ jasonxue1 ];
+    mainProgram = "mado";
+  };
+})
diff --git a/pkgs/by-name/md/mdbook-i18n-helpers/package.nix b/pkgs/by-name/md/mdbook-i18n-helpers/package.nix
index c96e9455304e..5c16e2401e3b 100644
--- a/pkgs/by-name/md/mdbook-i18n-helpers/package.nix
+++ b/pkgs/by-name/md/mdbook-i18n-helpers/package.nix
@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook-i18n-helpers";
-  version = "0.3.5";
+  version = "0.3.6";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "mdbook-i18n-helpers";
     # TODO fix once upstream uses semver for tags again
     tag = "mdbook-i18n-helpers-${version}";
-    hash = "sha256-FdguzuYpMl6i1dvoPNE1Bk+GTmeTrqLUY/sVRsbETtU=";
+    hash = "sha256-9sJ9FK85UzY3ggh3h1fipbh0LraTvQJ0ZfhSGcahiDM=";
   };
 
-  cargoHash = "sha256-ZBGMfJA2diPvvoIXPosUs4ngXU9/GMGa4GAlKIjwm8s=";
+  cargoHash = "sha256-ZinW9UFp03LXtk+9vuSNojVZtaA7uBlrpdapY48nZdY=";
 
   meta = {
     description = "Helpers for a mdbook i18n workflow based on Gettext";
diff --git a/pkgs/by-name/op/opencode/package.nix b/pkgs/by-name/op/opencode/package.nix
index 4aed8ca2fd2b..32de93095b16 100644
--- a/pkgs/by-name/op/opencode/package.nix
+++ b/pkgs/by-name/op/opencode/package.nix
@@ -22,12 +22,12 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "opencode";
-  version = "0.6.3";
+  version = "0.6.4";
   src = fetchFromGitHub {
     owner = "sst";
     repo = "opencode";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hufgCO3g0WZT4+hX1lqmhvrthFO30c0NS3ryNJMmOxo=";
+    hash = "sha256-o7SzDGbWgCh8cMNK+PeLxAw0bQMKFouHdedUslpA6gw=";
   };
 
   tui = buildGoModule {
@@ -135,6 +135,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       --define OPENCODE_TUI_PATH="'${finalAttrs.tui}/bin/tui'" \
       --define OPENCODE_VERSION="'${finalAttrs.version}'" \
       --compile \
+      --compile-exec-argv="--" \
       --target=${bun-target.${stdenvNoCC.hostPlatform.system}} \
       --outfile=opencode \
       ./packages/opencode/src/index.ts \
diff --git a/pkgs/by-name/op/openlinkhub/package.nix b/pkgs/by-name/op/openlinkhub/package.nix
index 50b82019effe..bf7c145f497a 100644
--- a/pkgs/by-name/op/openlinkhub/package.nix
+++ b/pkgs/by-name/op/openlinkhub/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "openlinkhub";
-  version = "0.6.1";
+  version = "0.6.2";
 
   src = fetchFromGitHub {
     owner = "jurkovic-nikola";
     repo = "OpenLinkHub";
     tag = version;
-    hash = "sha256-kEbJwCAs2gTNs0z8A3kOl1O4HQ4L5+urTo+hLh6vOPM=";
+    hash = "sha256-fmWfHJ6alB+UlHlUrwMQ/npv7SuMjAz5hT0UGhB7O/E=";
   };
 
   proxyVendor = true;
diff --git a/pkgs/os-specific/linux/kernel/perf/default.nix b/pkgs/by-name/pe/perf/package.nix
similarity index 74%
rename from pkgs/os-specific/linux/kernel/perf/default.nix
rename to pkgs/by-name/pe/perf/package.nix
index 81e6fb47d838..8d48a881047e 100644
--- a/pkgs/os-specific/linux/kernel/perf/default.nix
+++ b/pkgs/by-name/pe/perf/package.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchurl,
-  kernel,
+  linux_latest,
   elfutils,
   python3,
   newt,
@@ -20,14 +20,11 @@
   binutils-unwrapped,
   libiberty,
   audit,
-  libbfd,
-  libbfd_2_38,
   libopcodes,
-  libopcodes_2_38,
   libpfm,
   libtraceevent,
   openssl,
-  systemtap,
+  systemtap-unwrapped,
   numactl,
   zlib,
   babeltrace,
@@ -57,43 +54,28 @@ in
 
 stdenv.mkDerivation {
   pname = "perf-linux";
-  inherit (kernel) version src;
+  inherit (linux_latest) version src;
 
   strictDeps = true;
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
 
-  patches =
-    lib.optionals (lib.versionAtLeast kernel.version "5.10" && lib.versionOlder kernel.version "6.13")
-      [
-        # fix wrong path to dmesg
-        ./fix-dmesg-path.diff
-      ];
-
   postPatch = ''
     # Linux scripts
     patchShebangs scripts
     patchShebangs tools/perf/check-headers.sh
-  ''
-  + lib.optionalString (lib.versionAtLeast kernel.version "6.3") ''
     # perf-specific scripts
     patchShebangs tools/perf/pmu-events
-  ''
-  + ''
     cd tools/perf
 
     for x in util/build-id.c util/dso.c; do
       substituteInPlace $x --replace /usr/lib/debug /run/current-system/sw/lib/debug
     done
 
-  ''
-  + lib.optionalString (lib.versionAtLeast kernel.version "5.8") ''
     substituteInPlace scripts/python/flamegraph.py \
       --replace "/usr/share/d3-flame-graph/d3-flamegraph-base.html" \
       "${d3-flame-graph-templates}/share/d3-flame-graph/d3-flamegraph-base.html"
 
-  ''
-  + lib.optionalString (lib.versionAtLeast kernel.version "6.0") ''
     patchShebangs pmu-events/jevents.py
   '';
 
@@ -137,33 +119,14 @@ stdenv.mkDerivation {
     numactl
     python3
     babeltrace
+    libopcodes
+    libpfm
+    python3.pkgs.setuptools
   ]
-  ++ (
-    if (lib.versionAtLeast kernel.version "5.19") then
-      [
-        libbfd
-        libopcodes
-      ]
-    else
-      [
-        libbfd_2_38
-        libopcodes_2_38
-      ]
-  )
-  ++ lib.optional (lib.meta.availableOn stdenv.hostPlatform systemtap) systemtap.stapBuild
+  ++ lib.optional (lib.meta.availableOn stdenv.hostPlatform systemtap-unwrapped) systemtap-unwrapped
   ++ lib.optional withGtk gtk2
   ++ lib.optional withZstd zstd
-  ++ lib.optional withLibcap libcap
-  ++ lib.optional (lib.versionAtLeast kernel.version "5.8") libpfm
-  ++ lib.optional (lib.versionAtLeast kernel.version "6.0") python3.pkgs.setuptools
-  # Python 3.12 no longer includes distutils, not needed for 6.0 and newer.
-  ++
-    lib.optional
-      (!(lib.versionAtLeast kernel.version "6.0") && lib.versionAtLeast python3.version "3.12")
-      [
-        python3.pkgs.distutils
-        python3.pkgs.packaging
-      ];
+  ++ lib.optional withLibcap libcap;
 
   env.NIX_CFLAGS_COMPILE = toString [
     "-Wno-error=cpp"
@@ -206,6 +169,5 @@ stdenv.mkDerivation {
     mainProgram = "perf";
     maintainers = with maintainers; [ tobim ];
     platforms = platforms.linux;
-    broken = kernel.kernelOlder "5";
   };
 }
diff --git a/pkgs/by-name/po/postgres-lsp/package.nix b/pkgs/by-name/po/postgres-lsp/package.nix
index e7002986e4dd..238eb0cf396e 100644
--- a/pkgs/by-name/po/postgres-lsp/package.nix
+++ b/pkgs/by-name/po/postgres-lsp/package.nix
@@ -6,17 +6,17 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "postgres-lsp";
-  version = "0.10.0";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "supabase-community";
     repo = "postgres-language-server";
     tag = finalAttrs.version;
-    hash = "sha256-RwUX5EXRyvmC8LCnlQQIbqnLGn7XYXjLsI9UurCAThs=";
+    hash = "sha256-0Q8MxKeh12STWIJ9441uTz+qQXEJjCESj21C4X8CBC4=";
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-qs/M9+iZCx75wv+UcRRH4hjEuNDsnJYKAvnd0DNaRQ8=";
+  cargoHash = "sha256-oIbS5BUpNOXwiRconqJI/jdXeX05FIZVNl2kYt+79wY=";
 
   nativeBuildInputs = [
     rustPlatform.bindgenHook
diff --git a/pkgs/development/php-packages/psysh/default.nix b/pkgs/by-name/ps/psysh/package.nix
similarity index 100%
rename from pkgs/development/php-packages/psysh/default.nix
rename to pkgs/by-name/ps/psysh/package.nix
diff --git a/pkgs/by-name/ra/ramalama/package.nix b/pkgs/by-name/ra/ramalama/package.nix
index 53e60e549b97..b100c3f78eb8 100644
--- a/pkgs/by-name/ra/ramalama/package.nix
+++ b/pkgs/by-name/ra/ramalama/package.nix
@@ -71,6 +71,11 @@ python3.pkgs.buildPythonApplication rec {
     python3.pkgs.pytestCheckHook
   ];
 
+  # Enable when https://github.com/containers/ramalama/pull/1891 is released
+  disabledTests = [
+    "test_ollama_model_pull"
+  ];
+
   passthru = {
     tests = {
       withoutPodman = ramalama.override {
diff --git a/pkgs/by-name/re/refind/package.nix b/pkgs/by-name/re/refind/package.nix
index dbb7c622a76e..3340cdac8b09 100644
--- a/pkgs/by-name/re/refind/package.nix
+++ b/pkgs/by-name/re/refind/package.nix
@@ -163,6 +163,7 @@ stdenv.mkDerivation rec {
 
   passthru.tests = {
     uefiCdrom = nixosTests.boot.uefiCdrom;
+    inherit (nixosTests) refind;
   };
 
   meta = with lib; {
@@ -183,7 +184,10 @@ stdenv.mkDerivation rec {
       Linux kernels that provide EFI stub support.
     '';
     homepage = "http://refind.sourceforge.net/";
-    maintainers = with maintainers; [ johnrtitor ];
+    maintainers = with maintainers; [
+      johnrtitor
+      RossComputerGuy
+    ];
     platforms = [
       "i686-linux"
       "x86_64-linux"
diff --git a/pkgs/by-name/re/repomix/package.nix b/pkgs/by-name/re/repomix/package.nix
index 9c55a719d602..0b29bee4b39a 100644
--- a/pkgs/by-name/re/repomix/package.nix
+++ b/pkgs/by-name/re/repomix/package.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "repomix";
-  version = "1.3.0";
+  version = "1.4.2";
 
   src = fetchFromGitHub {
     owner = "yamadashy";
     repo = "repomix";
     tag = "v${version}";
-    hash = "sha256-09neN7sh4TRM+rQBqCQHqW165i6+RY9IF67ft6OgyhI=";
+    hash = "sha256-65A8HN0Mp8QOEfIjiDZwr/qgWe57XTCdd1eBd3mm9fE=";
   };
 
-  npmDepsHash = "sha256-nLxIPwx+zvYCMZ6y9ntbWvrJvO4g5J7Tf9rYk26gyAs=";
+  npmDepsHash = "sha256-PfElq+C8kazP3OLF5LFAZitIXhVpWdj/fCyH2S7d/zg=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
diff --git a/pkgs/by-name/sy/systemtap-unwrapped/package.nix b/pkgs/by-name/sy/systemtap-unwrapped/package.nix
new file mode 100644
index 000000000000..22109e888eff
--- /dev/null
+++ b/pkgs/by-name/sy/systemtap-unwrapped/package.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  stdenv,
+  fetchgit,
+  pkg-config,
+  gettext,
+  cpio,
+  elfutils,
+  python3,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "systemtap";
+  version = "5.2";
+
+  src = fetchgit {
+    url = "git://sourceware.org/git/systemtap.git";
+    rev = "release-${finalAttrs.version}";
+    hash = "sha256-SUPNarZW8vdK9hQaI2kU+rfKWIPiXB4BvJvRNC1T9tU=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    cpio
+    python3
+    python3.pkgs.setuptools
+  ];
+  buildInputs = [
+    elfutils
+    gettext
+    python3
+  ];
+  enableParallelBuilding = true;
+
+  meta = {
+    homepage = "https://sourceware.org/systemtap/";
+    description = "Provides a scripting language for instrumentation on a live kernel plus user-space";
+    license = lib.licenses.gpl2;
+    platforms = lib.systems.inspect.patterns.isGnu;
+  };
+})
diff --git a/pkgs/by-name/te/tea/package.nix b/pkgs/by-name/te/tea/package.nix
index 8ca3ebe7c6e6..00faa35624e8 100644
--- a/pkgs/by-name/te/tea/package.nix
+++ b/pkgs/by-name/te/tea/package.nix
@@ -2,6 +2,7 @@
   lib,
   buildGoModule,
   fetchFromGitea,
+  installShellFiles,
 }:
 
 buildGoModule rec {
@@ -28,4 +29,20 @@ buildGoModule rec {
     ];
     mainProgram = "tea";
   };
+
+  ldflags = [
+    "-X code.gitea.io/tea/cmd.Version=${version}"
+  ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    installShellCompletion --cmd tea \
+      --bash <($out/bin/tea completion bash) \
+      --fish <($out/bin/tea completion fish) \
+      --zsh <($out/bin/tea completion zsh)
+
+    mkdir $out/share/powershell/ -p
+    $out/bin/tea completion pwsh > $out/share/powershell/tea.Completion.ps1
+  '';
 }
diff --git a/pkgs/by-name/ul/ultrastardx/package.nix b/pkgs/by-name/ul/ultrastardx/package.nix
index d2b8dbb253c6..0535089cbba6 100644
--- a/pkgs/by-name/ul/ultrastardx/package.nix
+++ b/pkgs/by-name/ul/ultrastardx/package.nix
@@ -45,13 +45,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "ultrastardx";
-  version = "2025.8.0";
+  version = "2025.9.0";
 
   src = fetchFromGitHub {
     owner = "UltraStar-Deluxe";
     repo = "USDX";
     rev = "v${version}";
-    hash = "sha256-rliUJNhvbXbD+ELxwutCoQs6BO1DyJ8J/+mmYHPuvQE=";
+    hash = "sha256-SQqmcFchXaYNKzQHjBcisZTjAN9TTWuKXv657yWGghw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/yt/yt-dlp/package.nix b/pkgs/by-name/yt/yt-dlp/package.nix
index f49335d36e26..8eb6e307a551 100644
--- a/pkgs/by-name/yt/yt-dlp/package.nix
+++ b/pkgs/by-name/yt/yt-dlp/package.nix
@@ -19,14 +19,14 @@ python3Packages.buildPythonApplication rec {
   # The websites yt-dlp deals with are a very moving target. That means that
   # downloads break constantly. Because of that, updates should always be backported
   # to the latest stable release.
-  version = "2025.08.27";
+  version = "2025.09.05";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "yt-dlp";
     repo = "yt-dlp";
     tag = version;
-    hash = "sha256-E8++/gK/SpY93UW/9U266Qj1Kkn6CeNou7bKTqpCgFw=";
+    hash = "sha256-9y6OUVm6hNTTi5FFmd9DHcmAMrvSmDD+4kDe00aMTDI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/lm-eval/default.nix b/pkgs/development/python-modules/lm-eval/default.nix
index fa1830e3bd4d..5346109286e1 100644
--- a/pkgs/development/python-modules/lm-eval/default.nix
+++ b/pkgs/development/python-modules/lm-eval/default.nix
@@ -136,6 +136,8 @@ buildPythonPackage rec {
     # zeno, gptqmodel, japanese_leaderboard; all = [...];
   };
 
+  pythonRelaxDeps = [ "datasets" ];
+
   pythonImportsCheck = [ "lm_eval" ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/tools/build-managers/bazel/README.md b/pkgs/development/tools/build-managers/bazel/README.md
deleted file mode 100644
index 69ec0e30e157..000000000000
--- a/pkgs/development/tools/build-managers/bazel/README.md
+++ /dev/null
@@ -1,7 +0,0 @@
-# The Bazel build tool
-
-https://bazel.build/
-
-The bazel tool requires regular maintenance, especially under darwin, so we created a maintainers team.
-
-Please ping @NixOS/bazel in your github PR/issue to increase your chance of a quick turnaround, thanks!
diff --git a/pkgs/development/tools/build-managers/bazel/bash-tools-test.nix b/pkgs/development/tools/build-managers/bazel/bash-tools-test.nix
deleted file mode 100644
index 6ca4aebcf340..000000000000
--- a/pkgs/development/tools/build-managers/bazel/bash-tools-test.nix
+++ /dev/null
@@ -1,52 +0,0 @@
-{
-  writeText,
-  bazel,
-  runLocal,
-  bazelTest,
-  distDir,
-  extraBazelArgs ? "",
-}:
-
-# Tests that certain executables are available in bazel-executed bash shells.
-
-let
-  WORKSPACE = writeText "WORKSPACE" ''
-    workspace(name = "our_workspace")
-  '';
-
-  fileIn = writeText "input.txt" ''
-    one
-    two
-    three
-  '';
-
-  fileBUILD = writeText "BUILD" ''
-    genrule(
-      name = "tool_usage",
-      srcs = [ ":input.txt" ],
-      outs = [ "output.txt" ],
-      cmd = "cat $(location :input.txt) | gzip - | gunzip - | awk '/t/' > $@",
-    )
-  '';
-
-  workspaceDir = runLocal "our_workspace" { } ''
-    mkdir $out
-    cp ${WORKSPACE} $out/WORKSPACE
-    cp ${fileIn} $out/input.txt
-    cp ${fileBUILD} $out/BUILD
-  '';
-
-  testBazel = bazelTest {
-    name = "bazel-test-bash-tools";
-    bazelPkg = bazel;
-    inherit workspaceDir;
-
-    bazelScript = ''
-      ${bazel}/bin/bazel build :tool_usage --distdir=${distDir} ${extraBazelArgs}
-      cp bazel-bin/output.txt $out
-      echo "Testing content" && [ "$(cat $out | wc -l)" == "2" ] && echo "OK"
-    '';
-  };
-
-in
-testBazel
diff --git a/pkgs/development/tools/build-managers/bazel/cpp-test.nix b/pkgs/development/tools/build-managers/bazel/cpp-test.nix
deleted file mode 100644
index 6581331c7697..000000000000
--- a/pkgs/development/tools/build-managers/bazel/cpp-test.nix
+++ /dev/null
@@ -1,62 +0,0 @@
-{
-  bazel,
-  bazelTest,
-  bazel-examples,
-  stdenv,
-  cctools,
-  darwin,
-  extraBazelArgs ? "",
-  lib,
-  runLocal,
-  runtimeShell,
-  writeScript,
-  distDir,
-}:
-
-let
-
-  toolsBazel = writeScript "bazel" ''
-    #! ${runtimeShell}
-
-    export CXX='${stdenv.cc}/bin/clang++'
-    export LD='${cctools}/bin/ld'
-    export LIBTOOL='${cctools}/bin/libtool'
-    export CC='${stdenv.cc}/bin/clang'
-
-    # XXX: hack for macosX, this flags disable bazel usage of xcode
-    # See: https://github.com/bazelbuild/bazel/issues/4231
-    export BAZEL_USE_CPP_ONLY_TOOLCHAIN=1
-
-    exec "$BAZEL_REAL" "$@"
-  '';
-
-  workspaceDir = runLocal "our_workspace" { } (
-    ''
-      cp -r ${bazel-examples}/cpp-tutorial/stage3 $out
-      find $out -type d -exec chmod 755 {} \;
-    ''
-    + (lib.optionalString stdenv.hostPlatform.isDarwin ''
-      mkdir $out/tools
-      cp ${toolsBazel} $out/tools/bazel
-    '')
-  );
-
-  testBazel = bazelTest {
-    name = "${bazel.pname}-test-cpp";
-    inherit workspaceDir;
-    bazelPkg = bazel;
-    bazelScript = ''
-      ${bazel}/bin/bazel build //... \
-        --verbose_failures \
-        --distdir=${distDir} \
-        --curses=no \
-        ${extraBazelArgs} \
-    ''
-    + lib.optionalString (stdenv.hostPlatform.isDarwin) ''
-      --cxxopt=-x --cxxopt=c++ --host_cxxopt=-x --host_cxxopt=c++ \
-      --linkopt=-stdlib=libc++ --host_linkopt=-stdlib=libc++ \
-    '';
-  };
-
-in
-testBazel
diff --git a/pkgs/development/tools/build-managers/bazel/java-test.nix b/pkgs/development/tools/build-managers/bazel/java-test.nix
deleted file mode 100644
index c3d94a7fd8e2..000000000000
--- a/pkgs/development/tools/build-managers/bazel/java-test.nix
+++ /dev/null
@@ -1,73 +0,0 @@
-{
-  bazel,
-  bazelTest,
-  bazel-examples,
-  stdenv,
-  cctools,
-  extraBazelArgs ? "",
-  lib,
-  openjdk8,
-  jdk11_headless,
-  runLocal,
-  runtimeShell,
-  writeScript,
-  writeText,
-  distDir,
-}:
-
-let
-
-  toolsBazel = writeScript "bazel" ''
-    #! ${runtimeShell}
-
-    export CXX='${stdenv.cc}/bin/clang++'
-    export LD='${cctools}/bin/ld'
-    export LIBTOOL='${cctools}/bin/libtool'
-    export CC='${stdenv.cc}/bin/clang'
-
-    # XXX: hack for macosX, this flags disable bazel usage of xcode
-    # See: https://github.com/bazelbuild/bazel/issues/4231
-    export BAZEL_USE_CPP_ONLY_TOOLCHAIN=1
-
-    exec "$BAZEL_REAL" "$@"
-  '';
-
-  workspaceDir = runLocal "our_workspace" { } (
-    ''
-      cp -r ${bazel-examples}/java-tutorial $out
-      find $out -type d -exec chmod 755 {} \;
-    ''
-    + (lib.optionalString stdenv.hostPlatform.isDarwin ''
-      mkdir $out/tools
-      cp ${toolsBazel} $out/tools/bazel
-    '')
-  );
-
-  testBazel = bazelTest {
-    name = "${bazel.pname}-test-java";
-    inherit workspaceDir;
-    bazelPkg = bazel;
-    buildInputs = [
-      (if lib.strings.versionOlder bazel.version "5.0.0" then openjdk8 else jdk11_headless)
-    ];
-    bazelScript = ''
-      ${bazel}/bin/bazel \
-        run \
-        --announce_rc \
-        ${lib.optionalString (lib.strings.versionOlder "5.0.0" bazel.version) "--toolchain_resolution_debug='@bazel_tools//tools/jdk:(runtime_)?toolchain_type'"} \
-        --distdir=${distDir} \
-        --verbose_failures \
-        --curses=no \
-        --strict_java_deps=off \
-        //:ProjectRunner \
-    ''
-    + lib.optionalString (lib.strings.versionOlder bazel.version "5.0.0") ''
-      --host_javabase='@local_jdk//:jdk' \
-      --java_toolchain='@bazel_tools//tools/jdk:toolchain_hostjdk8' \
-      --javabase='@local_jdk//:jdk' \
-    ''
-    + extraBazelArgs;
-  };
-
-in
-testBazel
diff --git a/pkgs/development/tools/build-managers/bazel/protobuf-test.nix b/pkgs/development/tools/build-managers/bazel/protobuf-test.nix
deleted file mode 100644
index 0cbcf2dae2aa..000000000000
--- a/pkgs/development/tools/build-managers/bazel/protobuf-test.nix
+++ /dev/null
@@ -1,194 +0,0 @@
-{
-  bazel,
-  bazelTest,
-  fetchFromGitHub,
-  fetchurl,
-  stdenv,
-  cctools,
-  lib,
-  openjdk8,
-  jdk11_headless,
-  runLocal,
-  runtimeShell,
-  writeScript,
-  writeText,
-  distDir,
-}:
-
-let
-  com_google_protobuf = fetchFromGitHub {
-    owner = "protocolbuffers";
-    repo = "protobuf";
-    rev = "v3.13.0";
-    sha256 = "1nqsvi2yfr93kiwlinz8z7c68ilg1j75b2vcpzxzvripxx5h6xhd";
-  };
-
-  bazel_skylib = fetchFromGitHub {
-    owner = "bazelbuild";
-    repo = "bazel-skylib";
-    rev = "2ec2e6d715e993d96ad6222770805b5bd25399ae";
-    sha256 = "1z2r2vx6kj102zvp3j032djyv99ski1x1sl4i3p6mswnzrzna86s";
-  };
-
-  rules_python = fetchFromGitHub {
-    owner = "bazelbuild";
-    repo = "rules_python";
-    rev = "c8c79aae9aa1b61d199ad03d5fe06338febd0774";
-    sha256 = "1zn58wv5wcylpi0xj7riw34i1jjpqahanxx8y9srwrv0v93b6pqz";
-  };
-
-  rules_proto = fetchFromGitHub {
-    owner = "bazelbuild";
-    repo = "rules_proto";
-    rev = "a0761ed101b939e19d83b2da5f59034bffc19c12";
-    sha256 = "09lqfj5fxm1fywxr5w8pnpqd859gb6751jka9fhxjxjzs33glhqf";
-  };
-
-  net_zlib = fetchurl rec {
-    url = "https://zlib.net/zlib-1.2.11.tar.gz";
-    sha256 = "c3e5e9fdd5004dcb542feda5ee4f0ff0744628baf8ed2dd5d66f8ca1197cb1a1";
-
-    passthru.sha256 = sha256;
-  };
-
-  WORKSPACE = writeText "WORKSPACE" ''
-    workspace(name = "our_workspace")
-
-    load("//:proto-support.bzl", "protobuf_deps")
-    protobuf_deps()
-    load("@rules_proto//proto:repositories.bzl", "rules_proto_toolchains")
-    rules_proto_toolchains()
-  '';
-
-  protoSupport = writeText "proto-support.bzl" ''
-    """Load dependencies needed to compile the protobuf library as a 3rd-party consumer."""
-
-    load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
-
-    def protobuf_deps():
-        """Loads common dependencies needed to compile the protobuf library."""
-
-        if "zlib" not in native.existing_rules():
-            # proto_library, cc_proto_library, and java_proto_library rules implicitly
-            # depend on @com_google_protobuf for protoc and proto runtimes.
-            # This statement defines the @com_google_protobuf repo.
-            native.local_repository(
-                name = "com_google_protobuf",
-                path = "${com_google_protobuf}",
-            )
-            native.local_repository(
-                name = "bazel_skylib",
-                path = "${bazel_skylib}",
-            )
-            native.local_repository(
-                name = "rules_proto",
-                path = "${rules_proto}",
-            )
-            native.local_repository(
-                name = "rules_python",
-                path = "${rules_python}",
-            )
-
-            http_archive(
-                name = "zlib",
-                build_file = "@com_google_protobuf//:third_party/zlib.BUILD",
-                sha256 = "${net_zlib.sha256}",
-                strip_prefix = "zlib-1.2.11",
-                urls = ["file://${net_zlib}"],
-            )
-  '';
-
-  personProto = writeText "person.proto" ''
-    syntax = "proto3";
-
-    package person;
-
-    message Person {
-      string name = 1;
-      int32 id = 2;
-      string email = 3;
-    }
-  '';
-
-  personBUILD = writeText "BUILD" ''
-    load("@rules_proto//proto:defs.bzl", "proto_library")
-
-    proto_library(
-        name = "person_proto",
-        srcs = ["person.proto"],
-        visibility = ["//visibility:public"],
-    )
-
-    java_proto_library(
-        name = "person_java_proto",
-        deps = [":person_proto"],
-    )
-
-    cc_proto_library(
-        name = "person_cc_proto",
-        deps = [":person_proto"],
-    )
-  '';
-
-  toolsBazel = writeScript "bazel" ''
-    #! ${runtimeShell}
-
-    export CXX='${stdenv.cc}/bin/clang++'
-    export LD='${cctools}/bin/ld'
-    export LIBTOOL='${cctools}/bin/libtool'
-    export CC='${stdenv.cc}/bin/clang'
-
-    # XXX: hack for macosX, this flags disable bazel usage of xcode
-    # See: https://github.com/bazelbuild/bazel/issues/4231
-    export BAZEL_USE_CPP_ONLY_TOOLCHAIN=1
-
-    exec "$BAZEL_REAL" "$@"
-  '';
-
-  workspaceDir = runLocal "our_workspace" { } (
-    ''
-      mkdir $out
-      cp ${WORKSPACE} $out/WORKSPACE
-      touch $out/BUILD.bazel
-      cp ${protoSupport} $out/proto-support.bzl
-      mkdir $out/person
-      cp ${personProto} $out/person/person.proto
-      cp ${personBUILD} $out/person/BUILD.bazel
-    ''
-    + (lib.optionalString stdenv.hostPlatform.isDarwin ''
-      mkdir $out/tools
-      cp ${toolsBazel} $out/tools/bazel
-    '')
-  );
-
-  testBazel = bazelTest {
-    name = "${bazel.pname}-test-protocol-buffers";
-    inherit workspaceDir;
-    bazelPkg = bazel;
-    buildInputs = [
-      (if lib.strings.versionOlder bazel.version "5.0.0" then openjdk8 else jdk11_headless)
-    ];
-    bazelScript = ''
-      ${bazel}/bin/bazel \
-        build \
-        --distdir=${distDir} \
-        --verbose_failures \
-        --curses=no \
-        --subcommands \
-        --strict_java_deps=off \
-        --strict_proto_deps=off \
-        //... \
-    ''
-    + lib.optionalString (lib.strings.versionOlder bazel.version "5.0.0") ''
-      --host_javabase='@local_jdk//:jdk' \
-      --java_toolchain='@bazel_tools//tools/jdk:toolchain_hostjdk8' \
-      --javabase='@local_jdk//:jdk' \
-    ''
-    + lib.optionalString (stdenv.hostPlatform.isDarwin) ''
-      --cxxopt=-x --cxxopt=c++ --host_cxxopt=-x --host_cxxopt=c++ \
-      --linkopt=-stdlib=libc++ --host_linkopt=-stdlib=libc++ \
-    '';
-  };
-
-in
-testBazel
diff --git a/pkgs/development/tools/build-managers/bazel/python-bin-path-test.nix b/pkgs/development/tools/build-managers/bazel/python-bin-path-test.nix
deleted file mode 100644
index 4af2940d80c2..000000000000
--- a/pkgs/development/tools/build-managers/bazel/python-bin-path-test.nix
+++ /dev/null
@@ -1,89 +0,0 @@
-{
-  bazel,
-  bazelTest,
-  stdenv,
-  cctools,
-  extraBazelArgs ? "",
-  lib,
-  runLocal,
-  runtimeShell,
-  writeScript,
-  writeText,
-  distDir,
-}:
-
-let
-  toolsBazel = writeScript "bazel" ''
-    #! ${runtimeShell}
-
-    export CXX='${stdenv.cc}/bin/clang++'
-    export LD='${cctools}/bin/ld'
-    export LIBTOOL='${cctools}/bin/libtool'
-    export CC='${stdenv.cc}/bin/clang'
-
-    # XXX: hack for macosX, this flags disable bazel usage of xcode
-    # See: https://github.com/bazelbuild/bazel/issues/4231
-    export BAZEL_USE_CPP_ONLY_TOOLCHAIN=1
-
-    exec "$BAZEL_REAL" "$@"
-  '';
-
-  WORKSPACE = writeText "WORKSPACE" ''
-    workspace(name = "our_workspace")
-  '';
-
-  pythonLib = writeText "lib.py" ''
-    def foo():
-      return 43
-  '';
-
-  pythonBin = writeText "bin.py" ''
-    from lib import foo
-
-    assert foo() == 43
-  '';
-
-  pythonBUILD = writeText "BUILD" ''
-    py_library(
-      name = "lib",
-      srcs = [ "lib.py" ],
-    )
-
-    py_binary(
-      name = "bin",
-      srcs = [ "bin.py" ],
-      imports = [ "." ],
-      deps = [ ":lib" ],
-    )
-  '';
-
-  workspaceDir = runLocal "our_workspace" { } (
-    ''
-      mkdir $out
-      cp ${WORKSPACE} $out/WORKSPACE
-      mkdir $out/python
-      cp ${pythonLib} $out/python/lib.py
-      cp ${pythonBin} $out/python/bin.py
-      cp ${pythonBUILD} $out/python/BUILD.bazel
-    ''
-    + (lib.optionalString stdenv.hostPlatform.isDarwin ''
-      mkdir $out/tools
-      cp ${toolsBazel} $out/tools/bazel
-    '')
-  );
-
-  testBazel = bazelTest {
-    name = "${bazel.pname}-test-builtin-rules";
-    inherit workspaceDir;
-    bazelPkg = bazel;
-    bazelScript = ''
-      ${bazel}/bin/bazel \
-        run \
-        --distdir=${distDir} \
-        ${extraBazelArgs} \
-        //python:bin
-    '';
-  };
-
-in
-testBazel
diff --git a/pkgs/development/tools/build-managers/bazel/shebang-test.nix b/pkgs/development/tools/build-managers/bazel/shebang-test.nix
deleted file mode 100644
index fe12cf4de881..000000000000
--- a/pkgs/development/tools/build-managers/bazel/shebang-test.nix
+++ /dev/null
@@ -1,62 +0,0 @@
-{
-  bazel,
-  bazelTest,
-  extracted,
-  ripgrep,
-  runLocal,
-  unzip,
-  ...
-}:
-
-# Tests that all shebangs are patched appropriately.
-# #!/usr/bin/... should be replaced by Nix store references.
-# #!.../bin/env python should be replaced by Nix store reference to the python interpreter.
-
-let
-
-  workspaceDir = runLocal "our_workspace" { } "mkdir $out";
-
-  testBazel = bazelTest {
-    name = "bazel-test-shebangs";
-    inherit workspaceDir;
-    bazelPkg = bazel;
-    bazelScript = ''
-      set -ueo pipefail
-      FAIL=
-      check_shebangs() {
-        local dir="$1"
-        { rg -e '#!/usr/bin' -e '#![^[:space:]]*/bin/env' $dir -e && echo && FAIL=1; } || true
-      }
-      extract() {
-        local dir="$1"
-        find "$dir" -type f '(' -name '*.zip' -or -name '*.jar' ')' -print0 \
-        | while IFS="" read -r -d "" zip ; do
-          echo "Extracting $zip"
-          local unzipped="$zip-UNPACKED"
-          mkdir -p "$unzipped"
-          unzip -qq $zip -d "$unzipped"
-          extract "$unzipped"
-          rm -rf "$unzipped" "$zip" || true
-        done
-        check_shebangs "$dir"
-      }
-
-      mkdir install_root
-      cp --no-preserve=all -r ${extracted bazel}/install/*/* install_root/
-      extract ./install_root
-
-      if [[ $FAIL = 1 ]]; then
-        echo "Found files in the bazel distribution with illegal shebangs." >&2
-        echo "Replace those by explicit Nix store paths." >&2
-        echo "Python scripts should not use \`bin/env python' but the Python interpreter's store path." >&2
-        exit 1
-      fi
-    '';
-    buildInputs = [
-      unzip
-      ripgrep
-    ];
-  };
-
-in
-testBazel
diff --git a/pkgs/development/tools/build-managers/bazel/update-srcDeps.py b/pkgs/development/tools/build-managers/bazel/update-srcDeps.py
deleted file mode 100755
index 4105aeeb11bc..000000000000
--- a/pkgs/development/tools/build-managers/bazel/update-srcDeps.py
+++ /dev/null
@@ -1,62 +0,0 @@
-#!/usr/bin/env python3
-import sys
-import json
-
-if len(sys.argv) == 1:
-    print("usage: ./this-script WORKSPACE", file=sys.stderr)
-    print("Takes the bazel WORKSPACE file and reads all archives into a json dict (by evaling it as python code)", file=sys.stderr)
-    print("Hail Eris.", file=sys.stderr)
-    sys.exit(1)
-
-http_archives = []
-
-# just the kw args are the dict { name, sha256, urls … }
-def http_archive(**kw):
-    http_archives.append(kw)
-# like http_file
-def http_file(**kw):
-    http_archives.append(kw)
-
-# this is inverted from http_archive/http_file and bundles multiple archives
-def distdir_tar(**kw):
-    for archive_name in kw['archives']:
-        http_archives.append({
-            "name": archive_name,
-            "sha256": kw['sha256'][archive_name],
-            "urls": kw['urls'][archive_name]
-        })
-
-# stubs for symbols we are not interested in
-# might need to be expanded if new bazel releases add symbols to the workspace
-def workspace(name): pass
-def load(*args): pass
-def bind(**kw): pass
-def list_source_repository(**kw): pass
-def new_local_repository(**kw): pass
-def local_repository(**kw): pass
-DOC_VERSIONS = []
-def stardoc_repositories(**kw): pass
-def skydoc_repositories(**kw): pass
-def rules_sass_dependencies(**kw): pass
-def node_repositories(**kw): pass
-def sass_repositories(**kw): pass
-def register_execution_platforms(*args): pass
-def rbe_autoconfig(*args, **kw): pass
-def rules_pkg_dependencies(*args, **kw): pass
-def winsdk_configure(*args, **kw): pass
-def register_local_rc_exe_toolchains(*args, **kw): pass
-def register_toolchains(*args, **kw): pass
-def debian_deps(): pass
-def grpc_deps(): pass
-def grpc_extra_deps(): pass
-def bazel_skylib_workspace(): pass
-
-# execute the WORKSPACE like it was python code in this module,
-# using all the function stubs from above.
-with open(sys.argv[1]) as f:
-    exec(f.read())
-
-# transform to a dict with the names as keys
-d = { el['name']: el for el in http_archives }
-
-print(json.dumps(d, sort_keys=True, indent=4))
diff --git a/pkgs/development/tools/profiling/systemtap/default.nix b/pkgs/development/tools/profiling/systemtap/default.nix
index 7f52af9b4b34..20a9d6d5d862 100644
--- a/pkgs/development/tools/profiling/systemtap/default.nix
+++ b/pkgs/development/tools/profiling/systemtap/default.nix
@@ -1,11 +1,8 @@
 {
   lib,
-  fetchgit,
-  pkg-config,
-  gettext,
   runCommand,
   makeWrapper,
-  cpio,
+  systemtap-unwrapped,
   elfutils,
   kernel,
   gnumake,
@@ -15,33 +12,8 @@
 }:
 
 let
-  ## fetchgit info
-  url = "git://sourceware.org/git/systemtap.git";
-  rev = "release-${version}";
-  hash = "sha256-SUPNarZW8vdK9hQaI2kU+rfKWIPiXB4BvJvRNC1T9tU=";
-  version = "5.2";
-
   inherit (kernel) stdenv;
 
-  ## stap binaries
-  stapBuild = stdenv.mkDerivation {
-    pname = "systemtap";
-    inherit version;
-    src = fetchgit { inherit url rev hash; };
-    nativeBuildInputs = [
-      pkg-config
-      cpio
-      python3
-      python3.pkgs.setuptools
-    ];
-    buildInputs = [
-      elfutils
-      gettext
-      python3
-    ];
-    enableParallelBuilding = true;
-  };
-
   ## symlink farm for --sysroot flag
   sysroot = runCommand "systemtap-sysroot-${kernel.version}" { } ''
     mkdir -p $out/boot $out/usr/lib/debug
@@ -53,17 +25,12 @@ let
   pypkgs = with python3.pkgs; makePythonPath [ pyparsing ];
 
 in
-runCommand "systemtap-${version}"
+runCommand "systemtap-${systemtap-unwrapped.version}"
   {
-    inherit stapBuild;
+    stapBuild = systemtap-unwrapped;
     nativeBuildInputs = [ makeWrapper ];
     passthru.tests = { inherit (nixosTests.systemtap) linux_default linux_latest; };
-    meta = {
-      homepage = "https://sourceware.org/systemtap/";
-      description = "Provides a scripting language for instrumentation on a live kernel plus user-space";
-      license = lib.licenses.gpl2;
-      platforms = lib.systems.inspect.patterns.isGnu;
-    };
+    inherit (systemtap-unwrapped) meta;
   }
   (
     ''
diff --git a/pkgs/os-specific/linux/kernel/perf/fix-dmesg-path.diff b/pkgs/os-specific/linux/kernel/perf/fix-dmesg-path.diff
deleted file mode 100644
index 0bc3300a2eaf..000000000000
--- a/pkgs/os-specific/linux/kernel/perf/fix-dmesg-path.diff
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/tools/perf/util/evsel.c	2023-10-20 15:50:53.011023294 +0200
-+++ b/tools/perf/util/evsel.c	2023-10-20 15:51:03.205997633 +0200
-@@ -3076,7 +3076,7 @@
- 
- 	return scnprintf(msg, size,
- 	"The sys_perf_event_open() syscall returned with %d (%s) for event (%s).\n"
--	"/bin/dmesg | grep -i perf may provide additional information.\n",
-+	"\"dmesg | grep -i perf\" may provide additional information.\n",
- 			 err, str_error_r(err, sbuf, sizeof(sbuf)), evsel__name(evsel));
- }
- 
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index f03f31265a1c..4127534a923d 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -23,9 +23,9 @@ let
     };
     # ./update-zen.py lqx
     lqx = {
-      version = "6.16.3"; # lqx
+      version = "6.16.5"; # lqx
       suffix = "lqx1"; # lqx
-      sha256 = "0y7ym3kcy936p3kz71dx411l7pms53cfqbq8h8dp9vxw9vhjkh5n"; # lqx
+      sha256 = "149pkbzsx1z5b8qizf03nz5b4p7in0kbyy8d35svvzrljr6dzjqn"; # lqx
       isLqx = true;
     };
   };
diff --git a/pkgs/servers/sql/postgresql/ext/omnigres.nix b/pkgs/servers/sql/postgresql/ext/omnigres.nix
index f3933d1058f9..e6531b1f303e 100644
--- a/pkgs/servers/sql/postgresql/ext/omnigres.nix
+++ b/pkgs/servers/sql/postgresql/ext/omnigres.nix
@@ -21,13 +21,13 @@ let
 in
 postgresqlBuildExtension (finalAttrs: {
   pname = "omnigres";
-  version = "0-unstable-2025-08-24";
+  version = "0-unstable-2025-09-05";
 
   src = fetchFromGitHub {
     owner = "omnigres";
     repo = "omnigres";
-    rev = "8d986ca6c6ebc099af9ffec26bac06b39368b222";
-    hash = "sha256-3oKzLPyusvDf3Tptd7udkzpMhac6gWmSlevzHV0t5CY=";
+    rev = "f9ec95c59a786835f38629a2e04a4784a460fba1";
+    hash = "sha256-F1vG+iAlixdWwW3LIovzwnuL75QTCDlF40QOUD5dNZk=";
   };
 
   # This matches postInstall of PostgreSQL's generic.nix, which does this for the PGXS Makefile.
diff --git a/pkgs/tools/misc/grub/default.nix b/pkgs/tools/misc/grub/default.nix
index e083c3e92ed0..66f7c981fff4 100644
--- a/pkgs/tools/misc/grub/default.nix
+++ b/pkgs/tools/misc/grub/default.nix
@@ -28,6 +28,7 @@
   efiSupport ? false,
   zfsSupport ? false,
   xenSupport ? false,
+  xenPvhSupport ? false,
   kbdcompSupport ? false,
   ckbcomp,
 }:
@@ -65,6 +66,11 @@ let
     x86_64-linux.target = "x86_64";
   };
 
+  xenPvhSystemsBuild = {
+    i686-linux.target = "i386";
+    x86_64-linux.target = "i386"; # Xen PVH is only i386 on x86.
+  };
+
   inPCSystems = lib.any (system: stdenv.hostPlatform.system == system) (lib.attrNames pcSystems);
 
   gnulib = fetchgit {
@@ -84,7 +90,8 @@ let
 in
 
 assert zfsSupport -> zfs != null;
-assert !(efiSupport && xenSupport);
+assert !(efiSupport && (xenSupport || xenPvhSupport));
+assert !(xenSupport && xenPvhSupport);
 
 stdenv.mkDerivation rec {
   pname = "grub";
@@ -609,6 +616,10 @@ stdenv.mkDerivation rec {
   ++ lib.optionals xenSupport [
     "--with-platform=xen"
     "--target=${xenSystemsBuild.${stdenv.hostPlatform.system}.target}"
+  ]
+  ++ lib.optionals xenPvhSupport [
+    "--with-platform=xen_pvh"
+    "--target=${xenPvhSystemsBuild.${stdenv.hostPlatform.system}.target}"
   ];
 
   # save target that grub is compiled for
@@ -660,6 +671,8 @@ stdenv.mkDerivation rec {
         lib.attrNames efiSystemsBuild
       else if xenSupport then
         lib.attrNames xenSystemsBuild
+      else if xenPvhSupport then
+        lib.attrNames xenPvhSystemsBuild
       else
         platforms.gnu ++ platforms.linux;
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 36e0435c9ef5..a67a8155593d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3061,6 +3061,14 @@ with pkgs;
     xenSupport = true;
   };
 
+  grub2_xen_pvh = grub2.override {
+    xenPvhSupport = true;
+  };
+
+  grub2_pvgrub_image = grub2_pvhgrub_image.override {
+    grubPlatform = "xen";
+  };
+
   grub4dos = callPackage ../tools/misc/grub4dos {
     stdenv = stdenv_32bit;
   };
@@ -5626,10 +5634,6 @@ with pkgs;
     );
   buildRustCrateHelpers = callPackage ../build-support/rust/build-rust-crate/helpers.nix { };
 
-  cargo-flamegraph = callPackage ../by-name/ca/cargo-flamegraph/package.nix {
-    inherit (linuxPackages) perf;
-  };
-
   defaultCrateOverrides = callPackage ../build-support/rust/default-crate-overrides.nix { };
 
   inherit (callPackages ../development/tools/rust/cargo-pgrx { })
@@ -6479,7 +6483,7 @@ with pkgs;
 
   bazel = bazel_7;
 
-  bazel_7 = callPackage ../development/tools/build-managers/bazel/bazel_7 {
+  bazel_7 = callPackage ../by-name/ba/bazel_7/package.nix {
     inherit (darwin) sigtool;
     buildJdk = jdk21_headless;
     runJdk = jdk21_headless;
@@ -7023,7 +7027,6 @@ with pkgs;
   pycritty = with python3Packages; toPythonApplication pycritty;
 
   qtcreator = qt6Packages.callPackage ../development/tools/qtcreator {
-    inherit (linuxPackages) perf;
     llvmPackages = llvmPackages_21;
     stdenv = llvmPackages_21.stdenv;
   };
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index 8f3f0fd241c5..d64f7f282c8e 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -584,8 +584,6 @@ in
 
         netatop = callPackage ../os-specific/linux/netatop { };
 
-        perf = callPackage ../os-specific/linux/kernel/perf { };
-
         prl-tools = callPackage ../os-specific/linux/prl-tools { };
 
         isgx = callPackage ../os-specific/linux/isgx { };
@@ -714,6 +712,7 @@ in
         xmm7360-pci = throw "Support for the XMM7360 WWAN card was added to the iosm kmod in mainline kernel version 5.18";
         amdgpu-pro = throw "amdgpu-pro was removed due to lack of maintenance"; # Added 2024-06-16
         kvdo = throw "kvdo was removed, because it was added to mainline in kernel version 6.9"; # Added 2024-07-08
+        perf = lib.warnOnInstantiate "linuxPackages.perf is now perf" pkgs.perf; # Added 2025-08-28
         system76-power = lib.warnOnInstantiate "kernelPackages.system76-power is now pkgs.system76-power" pkgs.system76-power; # Added 2024-10-16
         system76-scheduler = lib.warnOnInstantiate "kernelPackages.system76-scheduler is now pkgs.system76-scheduler" pkgs.system76-scheduler; # Added 2024-10-16
         tuxedo-keyboard = self.tuxedo-drivers; # Added 2024-09-28
diff --git a/pkgs/top-level/php-packages.nix b/pkgs/top-level/php-packages.nix
index 43f6263cb817..7f752445b5b2 100644
--- a/pkgs/top-level/php-packages.nix
+++ b/pkgs/top-level/php-packages.nix
@@ -255,12 +255,11 @@ lib.makeScope pkgs.newScope (
       phpstan = callPackage ../development/php-packages/phpstan { };
 
       psalm = callPackage ../development/php-packages/psalm { };
-
-      psysh = callPackage ../development/php-packages/psysh { };
     }
     // lib.optionalAttrs config.allowAliases {
       phpcbf = throw "`phpcbf` is now deprecated, use `php-codesniffer` instead which contains both `phpcs` and `phpcbf`.";
       phpcs = throw "`phpcs` is now deprecated, use `php-codesniffer` instead which contains both `phpcs` and `phpcbf`.";
+      psysh = throw "`php8${lib.versions.minor php.version}Packages.psysh` is now deprecated, use `psysh`";
     };
 
     # This is a set of PHP extensions meant to be used in php.buildEnv