From f072535eb2847cf3e4606b2e6dd62231c3322c65 Mon Sep 17 00:00:00 2001
From: adisbladis <adisbladis@gmail.com>
Date: Thu, 28 May 2026 15:43:43 +1200
Subject: [PATCH 01/28] nixos/pam: Write all pam.d config in a single
 derivation

Calling writeText in a loop is silly when we can use a single runCommand by passing all config as structured attrs.
---
 nixos/modules/security/pam.nix | 26 ++++++++++++++++++++------
 1 file changed, 20 insertions(+), 6 deletions(-)

diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix
index 6cd174fabc2b..6012b47c16e2 100644
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@@ -1802,11 +1802,6 @@ let
     else
       config.users.motdFile;
 
-  makePAMService = name: service: {
-    name = "pam.d/${name}";
-    value.source = pkgs.writeText "${name}.pam" service.text;
-  };
-
   optionalSudoConfigForSSHAgentAuth =
     lib.optionalString (config.security.pam.sshAgentAuth.enable || config.security.pam.rssh.enable)
       ''
@@ -2594,7 +2589,26 @@ in
       };
     };
 
-    environment.etc = lib.mapAttrs' makePAMService enabledServices;
+    environment.etc =
+      let
+        # Write all pam config in a single derivation for performance
+        pamd =
+          pkgs.runCommand "pam.d"
+            {
+              __structuredAttrs = true;
+              services = lib.mapAttrs (_: svc: svc.text) enabledServices;
+            }
+            ''
+              mkdir $out
+              for i in "''${!services[@]}"; do
+                printf '%s' "''${services[$i]}" > "$out/$i"
+              done
+            '';
+      in
+      lib.mapAttrs' (name: service: {
+        name = "pam.d/${name}";
+        value.source = "${pamd}/${name}";
+      }) enabledServices;
 
     systemd =
       lib.mkIf (lib.any (service: service.lastlog.enable) (lib.attrValues config.security.pam.services))

From 59a113f40ad70e811f40dc388220f09941f8ed9c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 1 Jul 2026 00:48:29 +0000
Subject: [PATCH 02/28] qemu_test: 11.0.1 -> 11.0.2

---
 pkgs/by-name/qe/qemu/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/qe/qemu/package.nix b/pkgs/by-name/qe/qemu/package.nix
index 5bd6c6e0f8c7..978d4e21cecc 100644
--- a/pkgs/by-name/qe/qemu/package.nix
+++ b/pkgs/by-name/qe/qemu/package.nix
@@ -141,11 +141,11 @@ stdenv.mkDerivation (finalAttrs: {
     + lib.optionalString nixosTestRunner "-for-vm-tests"
     + lib.optionalString toolsOnly "-utils"
     + lib.optionalString userOnly "-user";
-  version = "11.0.1";
+  version = "11.0.2";
 
   src = fetchurl {
     url = "https://download.qemu.org/qemu-${finalAttrs.version}.tar.xz";
-    hash = "sha256-DSNfWCAnjZFKMVXsJ6+OQljWl+qJKJVXCAfWnAy4zWQ=";
+    hash = "sha256-N0X26oji6H/g3IOLKx1OCncL9I4BodWhhoQqH/92zPU=";
   };
 
   depsBuildBuild = [

From 814dbea27faaa9fa4d7b20541c23237b0a4a386f Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Mon, 6 Jul 2026 17:13:54 +1000
Subject: [PATCH 03/28] nixos/nspawn-container: hash name, remove assertion

the code comment is copied from the commit that added the assertion

https://github.com/NixOS/nixpkgs/commit/af0238c70efc80925c31d293da3bf8affca6437f
---
 .../nspawn-container/default.nix              | 28 -------------------
 .../run-nspawn/src/run_nspawn/__init__.py     |  8 ++++++
 2 files changed, 8 insertions(+), 28 deletions(-)

diff --git a/nixos/modules/virtualisation/nspawn-container/default.nix b/nixos/modules/virtualisation/nspawn-container/default.nix
index 82a06929e925..621f2bcb9f33 100644
--- a/nixos/modules/virtualisation/nspawn-container/default.nix
+++ b/nixos/modules/virtualisation/nspawn-container/default.nix
@@ -81,34 +81,6 @@ in
           which is prohibited within the Nix build sandbox where the test is run.
         '';
       }
-      {
-        # Check every interface defined in allInterfaces.
-        # Containers try to create a bridge "${config.system.name}-${interfaceName}"
-        assertion = lib.all (
-          iface:
-          let
-            hostName = "${config.system.name}-${iface.name}";
-          in
-          lib.stringLength hostName <= 15
-        ) (lib.attrValues cfg.allInterfaces);
-
-        message =
-          let
-            offendingInterfaces = lib.filter (
-              iface: lib.stringLength "${config.system.name}-${iface.name}" > 15
-            ) (lib.attrValues cfg.allInterfaces);
-            offenderList = map (
-              i:
-              "${config.system.name}-${i.name} (${toString (lib.stringLength "${config.system.name}-${i.name}")} chars)"
-            ) offendingInterfaces;
-          in
-          ''
-            The following generated host interface names exceed the Linux 15-character limit:
-              ${lib.concatStringsSep "\n            " offenderList}
-
-            Please shorten 'config.system.name' or the interface names in 'virtualisation.interfaces'.
-          '';
-      }
     ];
 
     virtualisation.systemd-nspawn.options = [
diff --git a/nixos/modules/virtualisation/nspawn-container/run-nspawn/src/run_nspawn/__init__.py b/nixos/modules/virtualisation/nspawn-container/run-nspawn/src/run_nspawn/__init__.py
index f733ad1845c4..9d5d73433e66 100644
--- a/nixos/modules/virtualisation/nspawn-container/run-nspawn/src/run_nspawn/__init__.py
+++ b/nixos/modules/virtualisation/nspawn-container/run-nspawn/src/run_nspawn/__init__.py
@@ -1,6 +1,7 @@
 import contextlib
 import dataclasses
 import fcntl
+import hashlib
 import logging
 import os
 import signal
@@ -124,6 +125,13 @@ def mk_veth(
     vlan: int,
 ) -> typing.Generator[None, None, None]:
     host_intf_name = f"{container_name}-{container_intf_name}"
+    # If the names for systemd-nspawn containers are too long,
+    # the generated bridge interface names will surpass the
+    # kernel limit IFNAMSIZ (15 characters + '\0').
+    if len(host_intf_name) > 15:
+        hashed = hashlib.sha256(host_intf_name.encode()).hexdigest()[:6]
+        host_intf_name = f"{host_intf_name[:8]}-{hashed}"
+
     with ensure_vlan_bridge(vlan) as bridge_name:
         logger.info("creating interface %s", host_intf_name)
         run_ip(

From 2e6f5555de91951c95a1d5010b92b2edf6da2ea6 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Tue, 7 Jul 2026 10:20:12 +1000
Subject: [PATCH 04/28] nixosTests.grafana: switch to nspawn containers

---
 nixos/tests/grafana/basic.nix             | 4 ++--
 nixos/tests/grafana/provision/default.nix | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/nixos/tests/grafana/basic.nix b/nixos/tests/grafana/basic.nix
index eb024be44fa9..2221960135c5 100644
--- a/nixos/tests/grafana/basic.nix
+++ b/nixos/tests/grafana/basic.nix
@@ -84,7 +84,7 @@ import ../make-test-python.nix (
       };
     };
 
-    nodes = builtins.mapAttrs (
+    containers = builtins.mapAttrs (
       _: val:
       mkMerge [
         val
@@ -97,7 +97,7 @@ import ../make-test-python.nix (
 
     meta.maintainers = [ ];
 
-    inherit nodes;
+    inherit containers;
 
     testScript = ''
       start_all()
diff --git a/nixos/tests/grafana/provision/default.nix b/nixos/tests/grafana/provision/default.nix
index 8fed76d5b282..9109aa58a99a 100644
--- a/nixos/tests/grafana/provision/default.nix
+++ b/nixos/tests/grafana/provision/default.nix
@@ -183,7 +183,7 @@ import ../../make-test-python.nix (
         };
     };
 
-    nodes = builtins.mapAttrs (
+    containers = builtins.mapAttrs (
       _: val:
       mkMerge [
         val
@@ -196,7 +196,7 @@ import ../../make-test-python.nix (
 
     meta.maintainers = [ ];
 
-    inherit nodes;
+    inherit containers;
 
     testScript = ''
       start_all()

From 09bffb616bf39a8bbc69bf3880266c93223144a9 Mon Sep 17 00:00:00 2001
From: r-vdp <ramses@well-founded.dev>
Date: Mon, 6 Jul 2026 16:13:18 +0200
Subject: [PATCH 05/28] nixos-rebuild-ng: allow overriding default ssh opts via
 environment

nixos-rebuild-ng unconditionally appends ControlMaster/ControlPath/
ControlPersist options pointing at a private master under its tmpdir
and closes that master at exit. Users who configure their own
connection sharing (to reuse an interactive master and the port
forwards attached to it, e.g. an agent socket forwarded with
RemoteForward) get a second connection per deploy. That connection
re-binds any RemoteForward from ssh_config and unlinks the socket
again when the deploy exits, orphaning the forward held by the
interactive session.

Add NIXOS_REBUILD_SSH_DEFAULT_OPTS to replace the built-in defaults,
with the empty string falling back to whatever connection sharing
ssh_config sets up.
---
 .../ni/nixos-rebuild-ng/nixos-rebuild.8.scd   |  5 ++
 .../nixos-rebuild-ng/src/nixos_rebuild/nix.py |  4 +-
 .../src/nixos_rebuild/process.py              | 19 +++++++-
 .../ni/nixos-rebuild-ng/src/tests/test_nix.py | 11 +++++
 .../src/tests/test_process.py                 | 46 +++++++++++++++++++
 5 files changed, 81 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd b/pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd
index 218eaa8d395f..305c39a2c2ac 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd
@@ -379,6 +379,11 @@ NIX_PATH
 NIX_SSHOPTS
 	Additional options to be passed to ssh on the command line.
 
+NIXOS_REBUILD_SSH_DEFAULT_OPTS
+	Replaces the built-in default ssh options (connection sharing via a
+	private _ControlMaster_ that is closed on exit). If empty, no
+	default options are added.
+
 NIX_SUDOOPTS
 	Additional options to be passed to sudo on the command line.
 
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
index 4fbe7fbe2b9d..5a4be4d1a557 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
@@ -26,7 +26,7 @@ from .models import (
     Profile,
     Remote,
 )
-from .process import SSH_DEFAULT_OPTS, run_wrapper
+from .process import run_wrapper, ssh_default_opts
 from .utils import Args, dict_to_flags
 
 FLAKE_FLAGS: Final = ["--extra-experimental-features", "nix-command flakes"]
@@ -193,7 +193,7 @@ def copy_closure(
     Also supports copying a closure from a remote to another remote."""
 
     sshopts = os.getenv("NIX_SSHOPTS", "")
-    env = {"NIX_SSHOPTS": " ".join(filter(lambda x: x, [sshopts, *SSH_DEFAULT_OPTS]))}
+    env = {"NIX_SSHOPTS": " ".join(filter(lambda x: x, [sshopts, *ssh_default_opts()]))}
 
     def nix_copy_closure(host: Remote, to: bool) -> None:
         run_wrapper(
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py
index 7ba809d4cb9c..63b001a4af49 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py
@@ -31,6 +31,21 @@ SSH_DEFAULT_OPTS: Final = [
 ]
 
 
+def ssh_default_opts() -> list[str]:
+    """Default ssh options appended after NIX_SSHOPTS.
+
+    NIXOS_REBUILD_SSH_DEFAULT_OPTS replaces the built-in connection
+    sharing defaults, e.g. to reuse an externally managed ControlMaster
+    and the port forwards attached to it. Set it to the empty string to
+    fall back to the connection sharing configured in ssh_config, if
+    any.
+    """
+    env = os.getenv("NIXOS_REBUILD_SSH_DEFAULT_OPTS")
+    if env is None:
+        return SSH_DEFAULT_OPTS
+    return shlex.split(env)
+
+
 @dataclass(frozen=True)
 class Remote:
     host: str
@@ -133,7 +148,7 @@ def run_wrapper(
         ssh_args: list[Arg] = [
             "ssh",
             *remote.opts,
-            *SSH_DEFAULT_OPTS,
+            *ssh_default_opts(),
             remote.ssh_host(),
             "--",
             *[_quote_remote_arg(a) for a in remote_run_args],
@@ -282,7 +297,7 @@ def _kill_long_running_ssh_process(args: Args, remote: Remote) -> None:
             [
                 "ssh",
                 *remote.opts,
-                *SSH_DEFAULT_OPTS,
+                *ssh_default_opts(),
                 remote.ssh_host(),
                 "--",
                 "pkill",
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
index 1cdccc9a874e..848a09bb742b 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
@@ -275,6 +275,17 @@ def test_copy_closure(monkeypatch: MonkeyPatch) -> None:
             },
         )
 
+    # NIXOS_REBUILD_SSH_DEFAULT_OPTS replaces the ControlMaster defaults
+    monkeypatch.setenv("NIX_SSHOPTS", "-oControlPath=/run/user/1000/%C")
+    monkeypatch.setenv("NIXOS_REBUILD_SSH_DEFAULT_OPTS", "")
+    with patch(get_qualified_name(n.run_wrapper, n), autospec=True) as mock_run:
+        n.copy_closure(closure, target_host)
+        mock_run.assert_called_with(
+            ["nix-copy-closure", "--to", "user@target.host", closure],
+            append_local_env={"NIX_SSHOPTS": "-oControlPath=/run/user/1000/%C"},
+        )
+    monkeypatch.delenv("NIXOS_REBUILD_SSH_DEFAULT_OPTS")
+
     monkeypatch.setenv("NIX_SSHOPTS", "--ssh build-target-opt")
     env = {"NIX_SSHOPTS": " ".join(["--ssh build-target-opt", *p.SSH_DEFAULT_OPTS])}
     with patch(get_qualified_name(n.run_wrapper, n), autospec=True) as mock_run:
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_process.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_process.py
index 2abdd26ebe07..c8f1ec9126e9 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_process.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_process.py
@@ -234,6 +234,52 @@ def test_remote_from_name(monkeypatch: MonkeyPatch) -> None:
     )
 
 
+def test_ssh_default_opts(monkeypatch: MonkeyPatch) -> None:
+    monkeypatch.delenv("NIXOS_REBUILD_SSH_DEFAULT_OPTS", raising=False)
+    assert p.ssh_default_opts() == p.SSH_DEFAULT_OPTS
+
+    monkeypatch.setenv(
+        "NIXOS_REBUILD_SSH_DEFAULT_OPTS", "-o ControlPath=/run/user/1000/%C"
+    )
+    assert p.ssh_default_opts() == ["-o", "ControlPath=/run/user/1000/%C"]
+
+    monkeypatch.setenv("NIXOS_REBUILD_SSH_DEFAULT_OPTS", "")
+    assert p.ssh_default_opts() == []
+
+
+@patch.dict(
+    p.os.environ,
+    {"PATH": "/path/to/bin", "NIXOS_REBUILD_SSH_DEFAULT_OPTS": ""},
+    clear=True,
+)
+@patch("subprocess.run", autospec=True)
+def test_run_wrapper_ssh_default_opts_override(mock_run: Any) -> None:
+    p.run_wrapper(
+        ["test"],
+        check=True,
+        remote=m.Remote("user@localhost", ["-p", "2222"], "ssh"),
+    )
+    mock_run.assert_called_with(
+        [
+            "ssh",
+            "-p",
+            "2222",
+            "user@localhost",
+            "--",
+            "/bin/sh",
+            "-c",
+            """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
+            "sh",
+            "test",
+        ],
+        check=True,
+        text=True,
+        errors="surrogateescape",
+        env=None,
+        input=None,
+    )
+
+
 def test_ssh_host() -> None:
     ssh_remotes = {
         "user@[fe80::1%25eth0]": "user@fe80::1%eth0",

From 8de14381defab90bc1892551507585f0add4b0c4 Mon Sep 17 00:00:00 2001
From: Ramses <ramses@well-founded.dev>
Date: Tue, 7 Jul 2026 13:42:50 +0200
Subject: [PATCH 06/28] nixos-rebuild-ng: reword docstring

Co-authored-by: Thiago Kenji Okada <thiagokokada@gmail.com>
---
 .../ni/nixos-rebuild-ng/src/nixos_rebuild/process.py     | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py
index 63b001a4af49..3ae6afa9c68c 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py
@@ -32,14 +32,7 @@ SSH_DEFAULT_OPTS: Final = [
 
 
 def ssh_default_opts() -> list[str]:
-    """Default ssh options appended after NIX_SSHOPTS.
-
-    NIXOS_REBUILD_SSH_DEFAULT_OPTS replaces the built-in connection
-    sharing defaults, e.g. to reuse an externally managed ControlMaster
-    and the port forwards attached to it. Set it to the empty string to
-    fall back to the connection sharing configured in ssh_config, if
-    any.
-    """
+    "Default ssh options appended after NIX_SSHOPTS."
     env = os.getenv("NIXOS_REBUILD_SSH_DEFAULT_OPTS")
     if env is None:
         return SSH_DEFAULT_OPTS

From 868dff10b16e934dab7a2a388868a32d7a09851e Mon Sep 17 00:00:00 2001
From: Juan C Nuno <juancnuno@gmail.com>
Date: Sat, 9 May 2026 18:04:27 -0700
Subject: [PATCH 07/28] nixos/version: Use null for IMAGE_VERSION

On GNOME 50, if you go to Settings - System - About - System Details you
will see a blank OS Build field. That is because IMAGE_VERSION is set to
the empty string in /etc/os-release. Use null for IMAGE_VERSION if
config.system.image.version is null.
---
 nixos/modules/misc/version.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/misc/version.nix b/nixos/modules/misc/version.nix
index c563ce901dca..898c0326cf0b 100644
--- a/nixos/modules/misc/version.nix
+++ b/nixos/modules/misc/version.nix
@@ -54,7 +54,8 @@ let
       BUG_REPORT_URL = optionalString isNixos "https://github.com/NixOS/nixpkgs/issues";
       ANSI_COLOR = optionalString isNixos "0;38;2;126;186;228";
       IMAGE_ID = optionalString (config.system.image.id != null) config.system.image.id;
-      IMAGE_VERSION = optionalString (config.system.image.version != null) config.system.image.version;
+      ${if config.system.image.version != null then "IMAGE_VERSION" else null} =
+        config.system.image.version;
       VARIANT = optionalString (cfg.variantName != null) cfg.variantName;
       VARIANT_ID = optionalString (cfg.variant_id != null) cfg.variant_id;
       DEFAULT_HOSTNAME = config.system.nixos.distroId;

From fe385d83f2c4d5c5f5a4d7f2c858d6aba585a31d Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Tue, 7 Jul 2026 20:15:46 -0700
Subject: [PATCH 08/28] openssh: 10.3p1 -> 10.4p1

---
 pkgs/tools/networking/openssh/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/networking/openssh/default.nix b/pkgs/tools/networking/openssh/default.nix
index f8f82a93a828..25b2bc331b9d 100644
--- a/pkgs/tools/networking/openssh/default.nix
+++ b/pkgs/tools/networking/openssh/default.nix
@@ -14,11 +14,11 @@ in
 {
   openssh = common rec {
     pname = "openssh";
-    version = "10.3p1";
+    version = "10.4p1";
 
     src = fetchurl {
       url = urlFor version;
-      hash = "sha256-VmgqNruS3PS08Bb9jsjnQFm3mo3iXBXWcNcx59GORfQ=";
+      hash = "sha256-72Am3SrqjVYFljjV0yYpAsiSzrqfiDlYNeDQbT+2Mjg=";
     };
 
     extraPatches = [

From ca5fb292c1b285cbd36d4ef1a21eb2280934873d Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Tue, 7 Jul 2026 20:16:23 -0700
Subject: [PATCH 09/28] openssh: drop old patches that are now never evaluated

---
 pkgs/tools/networking/openssh/common.nix | 32 ------------------------
 1 file changed, 32 deletions(-)

diff --git a/pkgs/tools/networking/openssh/common.nix b/pkgs/tools/networking/openssh/common.nix
index deeab329d6cd..d93f51d24cfd 100644
--- a/pkgs/tools/networking/openssh/common.nix
+++ b/pkgs/tools/networking/openssh/common.nix
@@ -16,7 +16,6 @@
   # package without splicing See: https://github.com/NixOS/nixpkgs/pull/107606
   pkgs,
   fetchurl,
-  fetchpatch,
   autoreconfHook,
   withAudit ? false,
   audit,
@@ -72,37 +71,6 @@ stdenv.mkDerivation (finalAttrs: {
     # See discussion in https://github.com/NixOS/nixpkgs/pull/16966
     ./dont_create_privsep_path.patch
   ]
-  ++ lib.optionals (lib.versionOlder finalAttrs.version "10.3") [
-    # See discussion in https://github.com/NixOS/nixpkgs/issues/466049 and
-    # https://gitlab.archlinux.org/archlinux/packaging/packages/openssh/-/issues/23
-    (fetchpatch {
-      name = "pkcs11-fetchkey-error-to-debug.patch";
-      url = "https://github.com/openssh/openssh-portable/commit/607f337637f2077b34a9f6f96fc24237255fe175.patch";
-      hunks = [ "2-" ];
-      hash = "sha256-rdvKL6/rwrdhGKlcmdy6fxVgJgaaRsmngX0KkShXAhQ=";
-    })
-    (fetchpatch {
-      name = "pkcs11-fix-pinentry.patch";
-      url = "https://github.com/openssh/openssh-portable/commit/434ba7684054c0637ce8f2486aaacafe65d9b8aa.patch";
-      # only applies to Makefile.in (which doesn't have a date header) so no hunks= needed
-      hash = "sha256-3JQ3IJurngXclORrfC2Bx7xvmGA6w2nIh+eZ0zd0bLY=";
-    })
-
-    # See discussion in https://github.com/NixOS/nixpkgs/issues/453782 and
-    # https://github.com/openssh/openssh-portable/pull/602
-    (fetchpatch {
-      name = "pkcs11-tests-allow-module-path.patch";
-      url = "https://github.com/openssh/openssh-portable/commit/5e7c3f33b2693b668ecfbac84b85f2c0c84410c2.patch";
-      hunks = [ "2-" ];
-      hash = "sha256-mGpRGXurg8K9Wp8qoojG5MQ+3sZW2XKy2z0RDXLHaEc=";
-    })
-    (fetchpatch {
-      name = "ssh-agent-tests-increase-timeout.patch";
-      url = "https://github.com/openssh/openssh-portable/commit/1fdc3c61194819c16063dc430eeb84b81bf42dcf.patch";
-      hunks = [ "2-" ];
-      hash = "sha256-b9YCOav32kY5VEvIG3W1fyD87HaQxof6Zwq9Oo+/Lac=";
-    })
-  ]
   ++ extraPatches;
 
   postPatch =

From d9c82adcfb1ae69a727f64a70504692d79cff022 Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Tue, 7 Jul 2026 20:22:15 -0700
Subject: [PATCH 10/28] openssh_gssapi: 10.3p1 -> 10.4p1

---
 pkgs/tools/networking/openssh/default.nix | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/pkgs/tools/networking/openssh/default.nix b/pkgs/tools/networking/openssh/default.nix
index 25b2bc331b9d..f128f5e7b700 100644
--- a/pkgs/tools/networking/openssh/default.nix
+++ b/pkgs/tools/networking/openssh/default.nix
@@ -94,21 +94,27 @@ in
 
   openssh_gssapi = common rec {
     pname = "openssh-with-gssapi";
-    version = "10.3p1";
+    version = "10.4p1";
     extraDesc = " with GSSAPI support";
 
     src = fetchurl {
       url = urlFor version;
-      hash = "sha256-VmgqNruS3PS08Bb9jsjnQFm3mo3iXBXWcNcx59GORfQ=";
+      hash = "sha256-72Am3SrqjVYFljjV0yYpAsiSzrqfiDlYNeDQbT+2Mjg=";
     };
 
     extraPatches = [
       ./ssh-keysign-8.5.patch
 
       (fetchpatch {
-        name = "openssh-gssapi.patch";
-        url = "https://salsa.debian.org/ssh-team/openssh/raw/debian/1%2510.3p1-1/debian/patches/gssapi.patch";
-        hash = "sha256-gs5Vw4f/TDxmme1DbrtgwvWcPGGmYIWE/A4JWa551zA=";
+        name = "servconf-fix-gssapi.patch";
+        url = "https://salsa.debian.org/ssh-team/openssh/raw/debian/1%2510.4p1-1/debian/patches/servconf-fix-gssapi.patch";
+        hash = "sha256-ypyaoEhwxo7SYVpjMkCQnrcFgY2ouWJQlrbJy50Lidk=";
+      })
+
+      (fetchpatch {
+        name = "gssapi.patch";
+        url = "https://salsa.debian.org/ssh-team/openssh/raw/debian/1%2510.4p1-1/debian/patches/gssapi.patch";
+        hash = "sha256-K12AE4C0zMdRdMsRMQCMRIFvN+NhNvCgyt0NDZp7n24=";
       })
     ];
 

From 8ad8d5f68b14586f35c87c51eca79400d8c16f4a Mon Sep 17 00:00:00 2001
From: Jost Alemann <alemann@posteo.com>
Date: Wed, 8 Jul 2026 14:25:36 +0200
Subject: [PATCH 11/28] ty: 0.0.56 -> 0.0.57

Changelog: https://github.com/astral-sh/ty/releases/tag/0.0.57
Diff: https://github.com/astral-sh/ty/compare/0.0.56...0.0.57
---
 pkgs/by-name/ty/ty/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ty/ty/package.nix b/pkgs/by-name/ty/ty/package.nix
index b8a81fe0f97a..2a44ea5d3749 100644
--- a/pkgs/by-name/ty/ty/package.nix
+++ b/pkgs/by-name/ty/ty/package.nix
@@ -17,7 +17,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ty";
-  version = "0.0.56";
+  version = "0.0.57";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     repo = "ty";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-H5Tin3+OFSmlC2b86gPISE0ZK6+vR+ijYtJBzeyBgL4=";
+    hash = "sha256-N4skX6dGznsR/3UR1L2j6D1MAJhp90fyfd7WsPIsKqk=";
   };
 
   # For Darwin platforms, remove the integration test for file notifications,
@@ -39,7 +39,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoBuildFlags = [ "--package=ty" ];
 
-  cargoHash = "sha256-suXPAZAQ4dddcHBwmdrpC4cUEs7CgTmW9Bn/v9Roe0U=";
+  cargoHash = "sha256-5PI7X4J2JJJ4dQJGo8txkGjZNocb5wyU0Ry56X6OIO0=";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = [ rust-jemalloc-sys ];

From af30e6b4b12e1e671337af0f52b3827bbeae8634 Mon Sep 17 00:00:00 2001
From: Reese <r3es3y@gmail.com>
Date: Tue, 7 Jul 2026 23:05:51 +1200
Subject: [PATCH 12/28] nixos-rebuild-ng: prevent Man for opening

---
 .../ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py     | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
index db0fe7a4ec5c..ce5dd41514fb 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
@@ -240,7 +240,7 @@ def parse_args(
         }
     )
 
-    if args.help or args.action is None:
+    if args.help:
         if WITH_SHELL_FILES:
             r = run(["man", "8", EXECUTABLE], check=False)
             parser.exit(r.returncode)
@@ -248,6 +248,12 @@ def parse_args(
             parser.print_help()
             parser.exit()
 
+    if args.action is None and len(sys.argv) > 1:
+      parser.error(f"No valid subcommand (Eg: nixos-rebuild switch). Type {parser.prog} --help for more information")
+
+    if args.action is None:
+      parser.error(f"No valid args or subcommands. Type {parser.prog} --help for more information")
+
     def parser_warn(msg: str) -> None:
         print(f"{parser.prog}: warning: {msg}", file=sys.stderr)
 

From 99178dc67f8634a4c7f541c26bd3f8db005d853f Mon Sep 17 00:00:00 2001
From: Reese <r3es3y@gmail.com>
Date: Wed, 8 Jul 2026 07:23:56 +1200
Subject: [PATCH 13/28] nixos-rebuild-ng: Validate Once

---
 .../ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py        | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
index ce5dd41514fb..4bca0cc03678 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
@@ -248,11 +248,8 @@ def parse_args(
             parser.print_help()
             parser.exit()
 
-    if args.action is None and len(sys.argv) > 1:
-      parser.error(f"No valid subcommand (Eg: nixos-rebuild switch). Type {parser.prog} --help for more information")
-
     if args.action is None:
-      parser.error(f"No valid args or subcommands. Type {parser.prog} --help for more information")
+      parser.error(f"No valid subcommands. Type {parser.prog} --help for more information")
 
     def parser_warn(msg: str) -> None:
         print(f"{parser.prog}: warning: {msg}", file=sys.stderr)

From b4be96f0f0374a3f4a37b505f351d03c16c53989 Mon Sep 17 00:00:00 2001
From: Thiago Kenji Okada <thiagokokada@gmail.com>
Date: Thu, 9 Jul 2026 15:49:04 +0100
Subject: [PATCH 14/28] nixos-rebuild-ng: refactor tempdir context manager in
 test_tmpdir.py

---
 .../nixos-rebuild-ng/src/tests/test_tmpdir.py | 24 +++++++------------
 1 file changed, 8 insertions(+), 16 deletions(-)

diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_tmpdir.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_tmpdir.py
index 5735e7b979f3..4ade9fd9b34f 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_tmpdir.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_tmpdir.py
@@ -8,23 +8,15 @@ from nixos_rebuild.tmpdir import MAX_TMPDIR_LENGTH, make_tmpdir
 
 
 @contextlib.contextmanager
-def system_tempdir(path: Path) -> typing.Generator[None]:
-    path.mkdir(exist_ok=True)
-
-    # `tempfile` caches the tempdir, you must clear it for it to recompute.
-    tempfile.tempdir = None
-
-    og_tmpdir = os.environ.get("TMPDIR")
-
+def tempfile_tempdir(path: str) -> typing.Generator[None]:
+    Path(path).mkdir(exist_ok=True)
     try:
-        os.environ["TMPDIR"] = str(path)
-        assert Path(tempfile.gettempdir()) == path
+        og_tmpdir = tempfile.tempdir
+        tempfile.tempdir = path
+        assert tempfile.gettempdir() == path
         yield
     finally:
-        if og_tmpdir is None:
-            del os.environ["TMPDIR"]
-        else:
-            os.environ["TMPDIR"] = og_tmpdir
+        tempfile.tempdir = og_tmpdir
 
 
 def test_make_tmpdir() -> None:
@@ -36,7 +28,7 @@ def test_make_tmpdir() -> None:
     assert len(os.fsencode(str(tmp))) <= MAX_TMPDIR_LENGTH
 
     # Test with a short system temp dir. We should use it unmodified.
-    with system_tempdir(Path("/tmp/not-too-long")):
+    with tempfile_tempdir("/tmp/not-too-long"):
         tmpdir = make_tmpdir()
         tmp = Path(tmpdir.name)
 
@@ -47,7 +39,7 @@ def test_make_tmpdir() -> None:
     # Test with a long system temp dir. We should ignore
     # it and fall back to something short enough for OpenSSH to
     # create sockets in.
-    with system_tempdir(Path("/tmp/long" + ("g" * MAX_TMPDIR_LENGTH))):
+    with tempfile_tempdir("/tmp/long" + ("g" * MAX_TMPDIR_LENGTH)):
         tmpdir = make_tmpdir()
         tmp = Path(tmpdir.name)
 

From aead86a3b85421e1dc5d0075a9123afc558fdf61 Mon Sep 17 00:00:00 2001
From: Thiago Kenji Okada <thiagokokada@gmail.com>
Date: Thu, 9 Jul 2026 17:10:57 +0100
Subject: [PATCH 15/28] nixos-rebuild-ng: refactor test_tmpdir.py

---
 .../nixos-rebuild-ng/src/tests/test_tmpdir.py | 34 ++++++++++---------
 1 file changed, 18 insertions(+), 16 deletions(-)

diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_tmpdir.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_tmpdir.py
index 4ade9fd9b34f..51c2956bb5c1 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_tmpdir.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_tmpdir.py
@@ -10,8 +10,8 @@ from nixos_rebuild.tmpdir import MAX_TMPDIR_LENGTH, make_tmpdir
 @contextlib.contextmanager
 def tempfile_tempdir(path: str) -> typing.Generator[None]:
     Path(path).mkdir(exist_ok=True)
+    og_tmpdir = tempfile.tempdir
     try:
-        og_tmpdir = tempfile.tempdir
         tempfile.tempdir = path
         assert tempfile.gettempdir() == path
         yield
@@ -20,22 +20,26 @@ def tempfile_tempdir(path: str) -> typing.Generator[None]:
 
 
 def test_make_tmpdir() -> None:
-    # Basic test: whatever the default system temp dir happens to be.
-    tmpdir = make_tmpdir()
-    tmp = Path(tmpdir.name)
-    assert tmp.exists()
-    assert tmp.is_dir()
-    assert len(os.fsencode(str(tmp))) <= MAX_TMPDIR_LENGTH
-
-    # Test with a short system temp dir. We should use it unmodified.
-    with tempfile_tempdir("/tmp/not-too-long"):
-        tmpdir = make_tmpdir()
-        tmp = Path(tmpdir.name)
-
+    def assert_tmpdir(tmp: Path) -> None:
         assert tmp.exists()
         assert tmp.is_dir()
         assert len(os.fsencode(str(tmp))) <= MAX_TMPDIR_LENGTH
 
+    # Basic test: whatever the default system temp dir happens to be.
+    tmpdir = make_tmpdir()
+    tmp = Path(tmpdir.name)
+
+    assert_tmpdir(tmp)
+
+    # Test with a short system temp dir. We should use it unmodified.
+    short_tempdir = "/tmp/not-too-long"
+    with tempfile_tempdir(short_tempdir):
+        tmpdir = make_tmpdir()
+        tmp = Path(tmpdir.name)
+
+        assert tmp.parent == Path(short_tempdir)
+        assert_tmpdir(tmp)
+
     # Test with a long system temp dir. We should ignore
     # it and fall back to something short enough for OpenSSH to
     # create sockets in.
@@ -43,6 +47,4 @@ def test_make_tmpdir() -> None:
         tmpdir = make_tmpdir()
         tmp = Path(tmpdir.name)
 
-        assert tmp.exists()
-        assert tmp.is_dir()
-        assert len(os.fsencode(str(tmp))) <= MAX_TMPDIR_LENGTH
+        assert_tmpdir(tmp)

From 6d8eaba53835447fa9e96cfc8e48609a4e683496 Mon Sep 17 00:00:00 2001
From: Jost Alemann <alemann@posteo.com>
Date: Thu, 9 Jul 2026 22:52:57 +0200
Subject: [PATCH 16/28] ruff: 0.15.20 -> 0.15.21

Changelog: https://github.com/astral-sh/ruff/releases/tag/0.15.21
Diff: https://github.com/astral-sh/ruff/compare/0.15.20...0.15.21
---
 pkgs/by-name/ru/ruff/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ru/ruff/package.nix b/pkgs/by-name/ru/ruff/package.nix
index 56982ab4db18..d6140bf99b75 100644
--- a/pkgs/by-name/ru/ruff/package.nix
+++ b/pkgs/by-name/ru/ruff/package.nix
@@ -16,7 +16,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ruff";
-  version = "0.15.20";
+  version = "0.15.21";
 
   __structuredAttrs = true;
 
@@ -24,12 +24,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "astral-sh";
     repo = "ruff";
     tag = finalAttrs.version;
-    hash = "sha256-8PFMGKG15kWBpG4YXg37940WtSe/e5pQDqIe3iJRh5A=";
+    hash = "sha256-dhBdz4jgE2ZoQsTdKmzyzGHC1fDQ54sz2g5m01TETSY=";
   };
 
   cargoBuildFlags = [ "--package=ruff" ];
 
-  cargoHash = "sha256-Bf6nsUnNMYapP0YN0SBkTPoP1czmj35tPwN1awyKhUw=";
+  cargoHash = "sha256-usviiAc7tWy/fqxE5fD/1B8rsUY0UnSA5EKgk0JLDpA=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From 9159ce738ce1e8f8702748a3059c5685860b8599 Mon Sep 17 00:00:00 2001
From: Jost Alemann <alemann@posteo.com>
Date: Fri, 10 Jul 2026 09:14:39 +0200
Subject: [PATCH 17/28] ty: 0.0.57 -> 0.0.58

Changelog: https://github.com/astral-sh/ty/releases/tag/0.0.58
Diff: https://github.com/astral-sh/ty/compare/0.0.57...0.0.58
---
 pkgs/by-name/ty/ty/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ty/ty/package.nix b/pkgs/by-name/ty/ty/package.nix
index 2a44ea5d3749..51e698927324 100644
--- a/pkgs/by-name/ty/ty/package.nix
+++ b/pkgs/by-name/ty/ty/package.nix
@@ -17,7 +17,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ty";
-  version = "0.0.57";
+  version = "0.0.58";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     repo = "ty";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-N4skX6dGznsR/3UR1L2j6D1MAJhp90fyfd7WsPIsKqk=";
+    hash = "sha256-Iy8pJ9q+pfSH1JpiHmL14Wu201C3wnud97N0NFBQqok=";
   };
 
   # For Darwin platforms, remove the integration test for file notifications,
@@ -39,7 +39,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoBuildFlags = [ "--package=ty" ];
 
-  cargoHash = "sha256-5PI7X4J2JJJ4dQJGo8txkGjZNocb5wyU0Ry56X6OIO0=";
+  cargoHash = "sha256-usviiAc7tWy/fqxE5fD/1B8rsUY0UnSA5EKgk0JLDpA=";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = [ rust-jemalloc-sys ];

From 172e2f3a36bbadc02cdabfa52c3637858e06a12f Mon Sep 17 00:00:00 2001
From: Reese <r3es3y@gmail.com>
Date: Sat, 11 Jul 2026 06:04:00 +1200
Subject: [PATCH 18/28] nixos-rebuild-ng: run ruff format

---
 .../by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
index 4bca0cc03678..230e51c56e44 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
@@ -249,7 +249,9 @@ def parse_args(
             parser.exit()
 
     if args.action is None:
-      parser.error(f"No valid subcommands. Type {parser.prog} --help for more information")
+        parser.error(
+            f"No valid subcommands. Type {parser.prog} --help for more information"
+        )
 
     def parser_warn(msg: str) -> None:
         print(f"{parser.prog}: warning: {msg}", file=sys.stderr)

From b1ee6f7624ccf33f18f545a6ae471d7f7392f92b Mon Sep 17 00:00:00 2001
From: Jost Alemann <alemann@posteo.com>
Date: Mon, 13 Jul 2026 02:47:17 +0200
Subject: [PATCH 19/28] ty: 0.0.58 -> 0.0.59

Changelog: https://github.com/astral-sh/ty/releases/tag/0.0.59
Diff: https://github.com/astral-sh/ty/compare/0.0.58...0.0.59
---
 pkgs/by-name/ty/ty/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ty/ty/package.nix b/pkgs/by-name/ty/ty/package.nix
index 51e698927324..f31ab1a8747e 100644
--- a/pkgs/by-name/ty/ty/package.nix
+++ b/pkgs/by-name/ty/ty/package.nix
@@ -17,7 +17,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ty";
-  version = "0.0.58";
+  version = "0.0.59";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     repo = "ty";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-Iy8pJ9q+pfSH1JpiHmL14Wu201C3wnud97N0NFBQqok=";
+    hash = "sha256-9wk1Nl1ObVfGbjGFzvMYLnVP9PjGdI7I9HACeGfZ0d0=";
   };
 
   # For Darwin platforms, remove the integration test for file notifications,
@@ -39,7 +39,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoBuildFlags = [ "--package=ty" ];
 
-  cargoHash = "sha256-usviiAc7tWy/fqxE5fD/1B8rsUY0UnSA5EKgk0JLDpA=";
+  cargoHash = "sha256-MdzVg+FzY3AmNt2WaSeWbBxkWABedMlr2+hJXYZEmJo=";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = [ rust-jemalloc-sys ];

From 74abe2fea2efd642956a8ef24586a57a730185dd Mon Sep 17 00:00:00 2001
From: r-vdp <ramses@well-founded.dev>
Date: Mon, 13 Jul 2026 12:35:00 +0200
Subject: [PATCH 20/28] nixos/systemd/tpm2: add systemd-pcrlogin@.service

systemd v261 added systemd-pcrlogin@.service, which logind starts on
first login of a user to measure the user record into the 'login'
NvPCR. NixOS does not install the unit, so every first login logs:

  systemd-logind: Failed to start user measurement service
  'systemd-pcrlogin@1000.service', ignoring: Unit not found.

Install the unit on systems with systemd.tpm2.enable. The unit has ConditionSecurity=measured-os and does nothing elsewhere.
---
 nixos/modules/system/boot/systemd/tpm2.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/system/boot/systemd/tpm2.nix b/nixos/modules/system/boot/systemd/tpm2.nix
index de0f72e5a543..3537dab80f13 100644
--- a/nixos/modules/system/boot/systemd/tpm2.nix
+++ b/nixos/modules/system/boot/systemd/tpm2.nix
@@ -45,6 +45,7 @@
           "systemd-tpm2-setup.service"
           "systemd-pcrextend.socket"
           "systemd-pcrextend@.service"
+          "systemd-pcrlogin@.service"
         ];
       }
     )

From 503bfeb10f2b3f84787fe5742962a97b5e3ccc1f Mon Sep 17 00:00:00 2001
From: r-vdp <ramses@well-founded.dev>
Date: Mon, 13 Jul 2026 12:35:00 +0200
Subject: [PATCH 21/28] nixos/systemd/fido2: add libpcsclite_real.so.1 to
 initrd

libfido2 links against pcsclite's libpcsclite.so.1, which since
pcsclite 2.3.1 is a shim that dlopens libpcsclite_real.so.1. nixpkgs
patches that dlopen to an absolute store path. make-initrd-ng only
follows DT_NEEDED, so the real library never ends up in the initrd.

systemd-cryptsetup then logs at boot:

  loading ".../pcsclite-2.4.1-lib/lib/libpcsclite_real.so.1" failed:
  cannot open shared object file: No such file or directory

and FIDO2 tokens behind PC/SC (NFC readers) cannot be used to unlock
LUKS in stage 1. Add the real library to the initrd store paths.
---
 nixos/modules/system/boot/systemd/fido2.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nixos/modules/system/boot/systemd/fido2.nix b/nixos/modules/system/boot/systemd/fido2.nix
index 02b4a1389fba..e665d1bbb793 100644
--- a/nixos/modules/system/boot/systemd/fido2.nix
+++ b/nixos/modules/system/boot/systemd/fido2.nix
@@ -27,6 +27,8 @@ in
       "${cfg.package}/lib/udev/fido_id"
       "${cfg.package}/lib/cryptsetup/libcryptsetup-token-systemd-fido2.so"
       "${pkgs.libfido2}/lib/libfido2.so.1"
+      # dlopened by the libpcsclite.so.1 shim, invisible to make-initrd-ng
+      "${lib.getLib pkgs.pcsclite}/lib/libpcsclite_real.so.1"
     ];
   };
 }

From 53d8c7d36b9730f5c6b594d162ac2c4564c569a6 Mon Sep 17 00:00:00 2001
From: klea <klea@iwnp.org>
Date: Tue, 14 Jul 2026 20:45:35 +0000
Subject: [PATCH 22/28] nixos-option: set pname and version

---
 pkgs/by-name/ni/nixos-option/package.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/ni/nixos-option/package.nix b/pkgs/by-name/ni/nixos-option/package.nix
index cd936c7380a6..fce09f3ff798 100644
--- a/pkgs/by-name/ni/nixos-option/package.nix
+++ b/pkgs/by-name/ni/nixos-option/package.nix
@@ -13,7 +13,8 @@
 }:
 
 stdenvNoCC.mkDerivation {
-  name = "nixos-option";
+  pname = "nixos-option";
+  version = lib.trivial.release;
 
   src = ./nixos-option.sh;
 

From a284c4b3f7ec11ba9b4d9d3ae842b924464b3d67 Mon Sep 17 00:00:00 2001
From: Patrick CRESSANT <patrick.cressant@gmail.com>
Date: Mon, 13 Jul 2026 08:47:31 +0000
Subject: [PATCH 23/28] qemu: add optional BrlAPI support

---
 pkgs/by-name/qe/qemu/package.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/by-name/qe/qemu/package.nix b/pkgs/by-name/qe/qemu/package.nix
index 80362ffd6757..e4dd0cada563 100644
--- a/pkgs/by-name/qe/qemu/package.nix
+++ b/pkgs/by-name/qe/qemu/package.nix
@@ -99,6 +99,8 @@
   capstone,
   valgrindSupport ? false,
   valgrind-light,
+  brlttySupport ? !minimal,
+  brltty,
   pluginsSupport ? !stdenv.hostPlatform.isStatic,
   enableDocs ? !minimal || toolsOnly,
   enableTools ? !minimal || toolsOnly,
@@ -259,6 +261,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals u2fEmuSupport [ libu2f-emu ]
   ++ lib.optionals capstoneSupport [ capstone ]
   ++ lib.optionals valgrindSupport [ valgrind-light ]
+  ++ lib.optionals brlttySupport [ brltty ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [ apple-sdk_15 ];
 
   dontUseMesonConfigure = true; # meson's configurePhase isn't compatible with qemu build
@@ -344,6 +347,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optional canokeySupport "--enable-canokey"
   ++ lib.optional u2fEmuSupport "--enable-u2f"
   ++ lib.optional capstoneSupport "--enable-capstone"
+  ++ lib.optional brlttySupport "--enable-brlapi"
   ++ lib.optional (!pluginsSupport) "--disable-plugins"
   ++ lib.optional (!enableBlobs) "--disable-install-blobs"
   ++ lib.optional userOnly "--disable-system"

From e4a00a49f83e6b86c5de00eaeb98dc294108adf1 Mon Sep 17 00:00:00 2001
From: Jost Alemann <alemann@posteo.com>
Date: Thu, 16 Jul 2026 14:32:16 +0200
Subject: [PATCH 24/28] ty: 0.0.59 -> 0.0.60

Changelog: https://github.com/astral-sh/ty/releases/tag/0.0.60
Diff: https://github.com/astral-sh/ty/compare/0.0.59...0.0.60
---
 pkgs/by-name/ty/ty/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ty/ty/package.nix b/pkgs/by-name/ty/ty/package.nix
index f31ab1a8747e..16b4548f0ad9 100644
--- a/pkgs/by-name/ty/ty/package.nix
+++ b/pkgs/by-name/ty/ty/package.nix
@@ -17,7 +17,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ty";
-  version = "0.0.59";
+  version = "0.0.60";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     repo = "ty";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-9wk1Nl1ObVfGbjGFzvMYLnVP9PjGdI7I9HACeGfZ0d0=";
+    hash = "sha256-9sD0xtxtw9hAOvWM0UkCARjwUe/lJw+KdqC7O1o7o6s=";
   };
 
   # For Darwin platforms, remove the integration test for file notifications,
@@ -39,7 +39,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoBuildFlags = [ "--package=ty" ];
 
-  cargoHash = "sha256-MdzVg+FzY3AmNt2WaSeWbBxkWABedMlr2+hJXYZEmJo=";
+  cargoHash = "sha256-r8GvyK9gWryKdCVGzfYzDGJ2DH4H5A693aGA5DyNDZc=";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = [ rust-jemalloc-sys ];

From e433f0b122ac2a10c2f272641bedd1c5c735f09a Mon Sep 17 00:00:00 2001
From: Jost Alemann <alemann@posteo.com>
Date: Thu, 16 Jul 2026 18:39:05 +0200
Subject: [PATCH 25/28] ruff: 0.15.21 -> 0.15.22

Changelog: https://github.com/astral-sh/ruff/releases/tag/0.15.22
Diff: https://github.com/astral-sh/ruff/compare/0.15.21...0.15.22
---
 pkgs/by-name/ru/ruff/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ru/ruff/package.nix b/pkgs/by-name/ru/ruff/package.nix
index d6140bf99b75..866f615d0339 100644
--- a/pkgs/by-name/ru/ruff/package.nix
+++ b/pkgs/by-name/ru/ruff/package.nix
@@ -16,7 +16,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ruff";
-  version = "0.15.21";
+  version = "0.15.22";
 
   __structuredAttrs = true;
 
@@ -24,12 +24,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "astral-sh";
     repo = "ruff";
     tag = finalAttrs.version;
-    hash = "sha256-dhBdz4jgE2ZoQsTdKmzyzGHC1fDQ54sz2g5m01TETSY=";
+    hash = "sha256-pa42J3M5iwSjfnuatqOOR9DEqzyVtdBbMk6JIRbu12Q=";
   };
 
   cargoBuildFlags = [ "--package=ruff" ];
 
-  cargoHash = "sha256-usviiAc7tWy/fqxE5fD/1B8rsUY0UnSA5EKgk0JLDpA=";
+  cargoHash = "sha256-jDm0pIrq09ETU+djMLsKSFZJzRx0lKSUx6kjJ4hAkvE=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From 7c9fdc4a9f7306cc76e0e8bbcd7f569d08286ed4 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 18 Jul 2026 19:27:45 +0300
Subject: [PATCH 26/28] linux_7_1: 7.1.3 -> 7.1.4

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index c76095e59333..d7203a8ff3fd 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -35,8 +35,8 @@
         "lts": true
     },
     "7.1": {
-        "version": "7.1.3",
-        "hash": "sha256:1p6iknvzmd04alrf49zn8mxw863v0yzgznyckfhl4llgx1lc0hdy",
+        "version": "7.1.4",
+        "hash": "sha256:0blfl34vi6vlcdjxd7mbhskl2p7i0zpgdy707a7d6xcn24m94qqw",
         "lts": false
     }
 }

From 613e8a3e5b47aeee6018ab9ba5a46fb86e3fe71c Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 18 Jul 2026 19:27:53 +0300
Subject: [PATCH 27/28] linux_6_18: 6.18.38 -> 6.18.39

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index d7203a8ff3fd..d9629283d5d6 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -30,8 +30,8 @@
         "lts": true
     },
     "6.18": {
-        "version": "6.18.38",
-        "hash": "sha256:0igh9xy1lk2hv2jni00dqyy27j4zqh86waw7i65ryvnmmc4fa9mc",
+        "version": "6.18.39",
+        "hash": "sha256:1c4c3wf00pb8x4kxxrmn46n7mgpnnm78sfi2jx0yg5cxmv9f79x7",
         "lts": true
     },
     "7.1": {

From abe27d4ab3b54601f4a801d1ed9a163f8d80c4bb Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 18 Jul 2026 19:28:16 +0300
Subject: [PATCH 28/28] linux_6_12: 6.12.95 -> 6.12.96

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index d9629283d5d6..a62db4fe6473 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -25,8 +25,8 @@
         "lts": true
     },
     "6.12": {
-        "version": "6.12.95",
-        "hash": "sha256:1xmrsi0kimirky4cailnkkrbd72pp9n8irfx6lfmss8yrcgwbs59",
+        "version": "6.12.96",
+        "hash": "sha256:1hapz6xz7plq56jc0drbzcsfcm1amlnphwbfhl0klsxkb9finbkx",
         "lts": true
     },
     "6.18": {