diff --git a/nixos/modules/services/networking/bird.nix b/nixos/modules/services/networking/bird.nix
index 4a5192424819..3049c4f2bce9 100644
--- a/nixos/modules/services/networking/bird.nix
+++ b/nixos/modules/services/networking/bird.nix
@@ -4,6 +4,7 @@ let
   inherit (lib) mkEnableOption mkIf mkOption optionalString types;
 
   cfg = config.services.bird2;
+  caps = [ "CAP_NET_ADMIN" "CAP_NET_BIND_SERVICE" "CAP_NET_RAW" ];
 in
 {
   ###### interface
@@ -72,21 +73,14 @@ in
       serviceConfig = {
         Type = "forking";
         Restart = "on-failure";
-        # We need to start as root so bird can open netlink sockets i.e. for ospf
-        ExecStart = "${pkgs.bird}/bin/bird -c /etc/bird/bird2.conf -u bird2 -g bird2";
-        ExecReload = "/bin/sh -c '${pkgs.bird}/bin/bird -c /etc/bird/bird2.conf -p && ${pkgs.bird}/bin/birdc configure'";
+        User = "bird2";
+        Group = "bird2";
+        ExecStart = "${pkgs.bird}/bin/bird -c /etc/bird/bird2.conf";
+        ExecReload = "${pkgs.bird}/bin/birdc configure";
         ExecStop = "${pkgs.bird}/bin/birdc down";
         RuntimeDirectory = "bird";
-        CapabilityBoundingSet = [
-          "CAP_CHOWN"
-          "CAP_FOWNER"
-          "CAP_SETUID"
-          "CAP_SETGID"
-          "CAP_NET_ADMIN"
-          "CAP_NET_BROADCAST"
-          "CAP_NET_BIND_SERVICE"
-          "CAP_NET_RAW"
-        ];
+        CapabilityBoundingSet = caps;
+        AmbientCapabilities = caps;
         ProtectSystem = "full";
         ProtectHome = "yes";
         ProtectKernelTunables = true;
diff --git a/nixos/tests/bird.nix b/nixos/tests/bird.nix
index befcf4fb8acf..822a7caea9ba 100644
--- a/nixos/tests/bird.nix
+++ b/nixos/tests/bird.nix
@@ -110,6 +110,7 @@ makeTest {
 
     host1.wait_for_unit("bird2.service")
     host2.wait_for_unit("bird2.service")
+    host1.succeed("systemctl reload bird2.service")
 
     with subtest("Waiting for advertised IPv4 routes"):
       host1.wait_until_succeeds("ip --json r | jq -e 'map(select(.dst == \"10.10.0.2\")) | any'")
diff --git a/nixos/tests/shiori.nix b/nixos/tests/shiori.nix
index 418bee43c939..6c59c394009e 100644
--- a/nixos/tests/shiori.nix
+++ b/nixos/tests/shiori.nix
@@ -12,7 +12,6 @@ import ./make-test-python.nix ({ pkgs, lib, ...}:
     authJSON = pkgs.writeText "auth.json" (builtins.toJSON {
       username = "shiori";
       password = "gopher";
-      remember = 1; # hour
       owner = true;
     });
 
diff --git a/pkgs/applications/office/espanso/default.nix b/pkgs/applications/office/espanso/default.nix
index adeb087ae8be..e4b46c5bc2dd 100644
--- a/pkgs/applications/office/espanso/default.nix
+++ b/pkgs/applications/office/espanso/default.nix
@@ -55,6 +55,7 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://espanso.org";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ kimat ];
+    platforms = platforms.linux;
 
     longDescription = ''
       Espanso detects when you type a keyword and replaces it while you're typing.
diff --git a/pkgs/build-support/dotnet/build-dotnet-module/default.nix b/pkgs/build-support/dotnet/build-dotnet-module/default.nix
index 49a61f4e5d6d..d3561282d3fd 100644
--- a/pkgs/build-support/dotnet/build-dotnet-module/default.nix
+++ b/pkgs/build-support/dotnet/build-dotnet-module/default.nix
@@ -1,6 +1,7 @@
-{ lib, stdenvNoCC, linkFarmFromDrvs, nuget-to-nix, writeScript, makeWrapper, fetchurl, xml2, dotnetCorePackages, dotnetPackages, cacert }:
+{ lib, stdenvNoCC, linkFarmFromDrvs, callPackage, nuget-to-nix, writeScript, makeWrapper, fetchurl, xml2, dotnetCorePackages, dotnetPackages, cacert }:
 
 { name ? "${args.pname}-${args.version}"
+, pname ? name
 , enableParallelBuilding ? true
 , doCheck ? false
 # Flags to pass to `makeWrapper`. This is done to avoid double wrapping.
@@ -19,6 +20,8 @@
 # Flags to pass to dotnet in all phases.
 , dotnetFlags ? []
 
+# The path to publish the project to. When unset, the directory "$out/lib/$pname" is used.
+, installPath ? null
 # The binaries that should get installed to `$out/bin`, relative to `$out/lib/$pname/`. These get wrapped accordingly.
 # Unfortunately, dotnet has no method for doing this automatically.
 # If unset, all executables in the projects root will get installed. This may cause bloat!
@@ -67,6 +70,10 @@ assert projectFile == null -> throw "Defining the `projectFile` attribute is req
 assert nugetDeps == null -> throw "Defining the `nugetDeps` attribute is required, as to lock the NuGet dependencies. This file can be generated by running the `passthru.fetch-deps` script.";
 
 let
+  inherit (callPackage ./hooks {
+    inherit dotnet-sdk dotnet-test-sdk disabledTests nuget-source dotnet-runtime runtimeDeps buildType;
+  }) dotnetConfigureHook dotnetBuildHook dotnetCheckHook dotnetInstallHook dotnetFixupHook;
+
   _nugetDeps = linkFarmFromDrvs "${name}-nuget-deps" (import nugetDeps {
     fetchNuGet = { pname, version, sha256 }: fetchurl {
       name = "${pname}-${version}.nupkg";
@@ -77,8 +84,8 @@ let
   _localDeps = linkFarmFromDrvs "${name}-local-nuget-deps" projectReferences;
 
   nuget-source = stdenvNoCC.mkDerivation rec {
-    name = "${args.pname}-nuget-source";
-    meta.description = "A Nuget source with the dependencies for ${args.pname}";
+    name = "${pname}-nuget-source";
+    meta.description = "A Nuget source with the dependencies for ${pname}";
 
     nativeBuildInputs = [ dotnetPackages.Nuget xml2 ];
     buildCommand = ''
@@ -103,168 +110,63 @@ let
     )));
   };
 
-  package = stdenvNoCC.mkDerivation (args // {
-    inherit buildType;
+in stdenvNoCC.mkDerivation (args // {
+  nativeBuildInputs = args.nativeBuildInputs or [] ++ [
+    dotnetConfigureHook
+    dotnetBuildHook
+    dotnetCheckHook
+    dotnetInstallHook
+    dotnetFixupHook
 
-    nativeBuildInputs = args.nativeBuildInputs or [] ++ [ dotnet-sdk cacert makeWrapper ];
+    dotnet-sdk
+    cacert
+    makeWrapper
+  ];
 
-    # Stripping breaks the executable
-    dontStrip = true;
+  # Stripping breaks the executable
+  dontStrip = args.dontStrip or true;
 
-    # gappsWrapperArgs gets included when wrapping for dotnet, as to avoid double wrapping
-    dontWrapGApps = true;
+  # gappsWrapperArgs gets included when wrapping for dotnet, as to avoid double wrapping
+  dontWrapGApps = args.dontWrapGApps or true;
 
-    DOTNET_NOLOGO = true; # This disables the welcome message.
-    DOTNET_CLI_TELEMETRY_OPTOUT = true;
+  DOTNET_NOLOGO = args.DOTNET_NOLOGO or true; # This disables the welcome message.
+  DOTNET_CLI_TELEMETRY_OPTOUT = args.DOTNET_CLI_TELEMETRY_OPTOUT or true;
 
-    passthru = {
-      fetch-deps = writeScript "fetch-${args.pname}-deps" ''
-        set -euo pipefail
-        cd "$(dirname "''${BASH_SOURCE[0]}")"
-
-        export HOME=$(mktemp -d)
-        deps_file="/tmp/${args.pname}-deps.nix"
-
-        store_src="${package.src}"
-        src="$(mktemp -d /tmp/${args.pname}.XXX)"
-        cp -rT "$store_src" "$src"
-        chmod -R +w "$src"
-
-        trap "rm -rf $src $HOME" EXIT
-        pushd "$src"
-
-        export DOTNET_NOLOGO=1
-        export DOTNET_CLI_TELEMETRY_OPTOUT=1
-
-        mkdir -p "$HOME/nuget_pkgs"
-
-        for project in "${lib.concatStringsSep "\" \"" ((lib.toList projectFile) ++ lib.optionals (testProjectFile != "") (lib.toList testProjectFile))}"; do
-          ${dotnet-sdk}/bin/dotnet restore "$project" \
-            ${lib.optionalString (!enableParallelBuilding) "--disable-parallel"} \
-            -p:ContinuousIntegrationBuild=true \
-            -p:Deterministic=true \
-            --packages "$HOME/nuget_pkgs" \
-            "''${dotnetRestoreFlags[@]}" \
-            "''${dotnetFlags[@]}"
-        done
-
-        echo "Writing lockfile..."
-        ${nuget-to-nix}/bin/nuget-to-nix "$HOME/nuget_pkgs" > "$deps_file"
-        echo "Succesfully wrote lockfile to: $deps_file"
-      '';
-    } // args.passthru or {};
-
-    configurePhase = args.configurePhase or ''
-      runHook preConfigure
+  passthru = {
+    fetch-deps = writeScript "fetch-${pname}-deps" ''
+      set -euo pipefail
+      cd "$(dirname "''${BASH_SOURCE[0]}")"
 
       export HOME=$(mktemp -d)
+      deps_file="/tmp/${pname}-deps.nix"
 
-      for project in ''${projectFile[@]} ''${testProjectFile[@]}; do
-        dotnet restore "$project" \
+      store_src="${args.src}"
+      src="$(mktemp -d /tmp/${pname}.XXX)"
+      cp -rT "$store_src" "$src"
+      chmod -R +w "$src"
+
+      trap "rm -rf $src $HOME" EXIT
+      pushd "$src"
+
+      export DOTNET_NOLOGO=1
+      export DOTNET_CLI_TELEMETRY_OPTOUT=1
+
+      mkdir -p "$HOME/nuget_pkgs"
+
+      for project in "${lib.concatStringsSep "\" \"" ((lib.toList projectFile) ++ lib.optionals (testProjectFile != "") (lib.toList testProjectFile))}"; do
+        ${dotnet-sdk}/bin/dotnet restore "$project" \
           ${lib.optionalString (!enableParallelBuilding) "--disable-parallel"} \
           -p:ContinuousIntegrationBuild=true \
           -p:Deterministic=true \
-          --source "${nuget-source}/lib" \
-          "''${dotnetRestoreFlags[@]}" \
-          "''${dotnetFlags[@]}"
+          -p:RestoreUseStaticGraphEvaluation=true \
+          --packages "$HOME/nuget_pkgs" \
+          ${lib.optionalString (dotnetRestoreFlags != []) (builtins.toString dotnetRestoreFlags)} \
+          ${lib.optionalString (dotnetFlags != []) (builtins.toString dotnetFlags)}
       done
 
-      runHook postConfigure
+      echo "Writing lockfile..."
+      ${nuget-to-nix}/bin/nuget-to-nix "$HOME/nuget_pkgs" > "$deps_file"
+      echo "Succesfully wrote lockfile to: $deps_file"
     '';
-
-    buildPhase = args.buildPhase or ''
-      runHook preBuild
-
-      for project in ''${projectFile[@]} ''${testProjectFile[@]}; do
-        dotnet build "$project" \
-          -maxcpucount:${if enableParallelBuilding then "$NIX_BUILD_CORES" else "1"} \
-          -p:BuildInParallel=${if enableParallelBuilding then "true" else "false"} \
-          -p:ContinuousIntegrationBuild=true \
-          -p:Deterministic=true \
-          -p:Version=${args.version} \
-          --configuration "$buildType" \
-          --no-restore \
-          "''${dotnetBuildFlags[@]}"  \
-          "''${dotnetFlags[@]}"
-      done
-
-      runHook postBuild
-    '';
-
-    checkPhase = args.checkPhase or ''
-      runHook preCheck
-
-      for project in ''${testProjectFile[@]}; do
-        ${lib.getBin dotnet-test-sdk}/bin/dotnet test "$project" \
-          -maxcpucount:${if enableParallelBuilding then "$NIX_BUILD_CORES" else "1"} \
-          -p:ContinuousIntegrationBuild=true \
-          -p:Deterministic=true \
-          --configuration "$buildType" \
-          --no-build \
-          --logger "console;verbosity=normal" \
-          ${lib.optionalString (disabledTests != []) "--filter \"FullyQualifiedName!=${lib.concatStringsSep "&FullyQualifiedName!=" disabledTests}\""} \
-          "''${dotnetTestFlags[@]}"  \
-          "''${dotnetFlags[@]}"
-      done
-
-      runHook postCheck
-    '';
-
-    installPhase = args.installPhase or ''
-      runHook preInstall
-
-      for project in ''${projectFile[@]}; do
-        dotnet publish "$project" \
-          -p:ContinuousIntegrationBuild=true \
-          -p:Deterministic=true \
-          --output $out/lib/${args.pname} \
-          --configuration "$buildType" \
-          --no-build \
-          --no-self-contained \
-          "''${dotnetInstallFlags[@]}"  \
-          "''${dotnetFlags[@]}"
-      done
-    '' + lib.optionalString packNupkg ''
-      for project in ''${projectFile[@]}; do
-        dotnet pack "$project" \
-          -p:ContinuousIntegrationBuild=true \
-          -p:Deterministic=true \
-          --output $out/share \
-          --configuration "$buildType" \
-          --no-build \
-          "''${dotnetPackFlags[@]}"  \
-          "''${dotnetFlags[@]}"
-      done
-    '' + ''
-      runHook postInstall
-    '';
-
-    preFixup = ''
-      _wrapDotnetProgram() {
-        makeWrapper "$1" "$out/bin/$(basename "$executable")" \
-          --set DOTNET_ROOT "${dotnet-runtime}" \
-          --suffix LD_LIBRARY_PATH : "${lib.makeLibraryPath runtimeDeps}" \
-          "''${gappsWrapperArgs[@]}" \
-          "''${makeWrapperArgs[@]}"
-      }
-    '' + (if executables != null then ''
-      for executable in ''${executables[@]}; do
-        execPath="$out/lib/${args.pname}/$executable"
-
-        if [[ -f "$execPath" && -x "$execPath" ]]; then
-          _wrapDotnetProgram $execPath
-        else
-          echo "Specified binary \"$executable\" is either not an executable, or does not exist!"
-          exit 1
-        fi
-      done
-    '' else ''
-      for executable in $out/lib/${args.pname}/*; do
-        if [[ -f "$executable" && -x "$executable" && "$executable" != *"dll"* ]]; then
-          _wrapDotnetProgram $executable
-        fi
-      done
-    '');
-  });
-in
-  package
+  } // args.passthru or {};
+})
diff --git a/pkgs/build-support/dotnet/build-dotnet-module/hooks/default.nix b/pkgs/build-support/dotnet/build-dotnet-module/hooks/default.nix
new file mode 100644
index 000000000000..76f7eea5bfec
--- /dev/null
+++ b/pkgs/build-support/dotnet/build-dotnet-module/hooks/default.nix
@@ -0,0 +1,62 @@
+{ lib
+, callPackage
+, makeSetupHook
+, makeWrapper
+, dotnet-sdk
+, dotnet-test-sdk
+, disabledTests
+, nuget-source
+, dotnet-runtime
+, runtimeDeps
+, buildType
+}:
+
+{
+  dotnetConfigureHook = callPackage ({ }:
+    makeSetupHook {
+      name = "dotnet-configure-hook";
+      deps = [ dotnet-sdk nuget-source ];
+      substitutions = {
+        nugetSource = nuget-source;
+      };
+    } ./dotnet-configure-hook.sh) { };
+
+  dotnetBuildHook = callPackage ({ }:
+    makeSetupHook {
+      name = "dotnet-build-hook";
+      deps = [ dotnet-sdk ];
+      substitutions = {
+        inherit buildType;
+      };
+    } ./dotnet-build-hook.sh) { };
+
+  dotnetCheckHook = callPackage ({ }:
+    makeSetupHook {
+      name = "dotnet-check-hook";
+      deps = [ dotnet-test-sdk ];
+      substitutions = {
+        inherit buildType;
+        disabledTests = lib.optionalString (disabledTests != [])
+          (lib.concatStringsSep "&FullyQualifiedName!=" disabledTests);
+      };
+    } ./dotnet-check-hook.sh) { };
+
+  dotnetInstallHook = callPackage ({ }:
+    makeSetupHook {
+      name = "dotnet-install-hook";
+      deps = [ dotnet-sdk ];
+      substitutions = {
+        inherit buildType;
+      };
+    } ./dotnet-install-hook.sh) { };
+
+  dotnetFixupHook = callPackage ({ }:
+    makeSetupHook {
+      name = "dotnet-fixup-hook";
+      deps = [ dotnet-runtime makeWrapper ];
+      substitutions = {
+        dotnetRuntime = dotnet-runtime;
+        runtimeDeps = lib.makeLibraryPath runtimeDeps;
+      };
+    } ./dotnet-fixup-hook.sh) { };
+}
diff --git a/pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-build-hook.sh b/pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-build-hook.sh
new file mode 100644
index 000000000000..a1dc80a77fd7
--- /dev/null
+++ b/pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-build-hook.sh
@@ -0,0 +1,41 @@
+declare -a projectFile testProjectFile dotnetBuildFlags dotnetFlags
+
+dotnetBuildHook() {
+    echo "Executing dotnetBuildHook"
+
+    runHook preBuild
+
+    if [ "${enableParallelBuilding-}" ]; then
+        maxCpuFlag="$NIX_BUILD_CORES"
+        parallelBuildFlag="true"
+    else
+        maxCpuFlag="1"
+        parallelBuildFlag="false"
+    fi
+
+    if [ "${version-}" ]; then
+        versionFlag="-p:Version=${version-}"
+    fi
+
+    for project in ${projectFile[@]} ${testProjectFile[@]}; do
+        env \
+            dotnet build "$project" \
+                -maxcpucount:$maxCpuFlag \
+                -p:BuildInParallel=$parallelBuildFlag \
+                -p:ContinuousIntegrationBuild=true \
+                -p:Deterministic=true \
+                --configuration "@buildType@" \
+                --no-restore \
+                ${versionFlag-} \
+                "${dotnetBuildFlags[@]}"  \
+                "${dotnetFlags[@]}"
+    done
+
+    runHook postBuild
+
+    echo "Finished dotnetBuildHook"
+}
+
+if [[ -z "${dontDotnetBuild-}" && -z "${buildPhase-}" ]]; then
+    buildPhase=dotnetBuildHook
+fi
diff --git a/pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-check-hook.sh b/pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-check-hook.sh
new file mode 100644
index 000000000000..e3098908fe27
--- /dev/null
+++ b/pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-check-hook.sh
@@ -0,0 +1,33 @@
+declare -a testProjectFile dotnetTestFlags dotnetFlags
+
+dotnetCheckHook() {
+    echo "Executing dotnetCheckHook"
+
+    runHook preCheck
+
+    if [ "${disabledTests-}" ]; then
+        disabledTestsFlag="--filter FullyQualifiedName!=@disabledTests@"
+    fi
+
+    for project in ${testProjectFile[@]}; do
+        env \
+            dotnet test "$project" \
+              -maxcpucount:$maxCpuFlag \
+              -p:ContinuousIntegrationBuild=true \
+              -p:Deterministic=true \
+              --configuration "@buildType@" \
+              --no-build \
+              --logger "console;verbosity=normal" \
+              ${disabledTestsFlag-} \
+              "${dotnetTestFlags[@]}"  \
+              "${dotnetFlags[@]}"
+    done
+
+    runHook postCheck
+
+    echo "Finished dotnetCheckHook"
+}
+
+if [[ -z "${dontDotnetCheck-}" && -z "${checkPhase-}" ]]; then
+    checkPhase=dotnetCheckHook
+fi
diff --git a/pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-configure-hook.sh b/pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-configure-hook.sh
new file mode 100644
index 000000000000..e0522dc95ce5
--- /dev/null
+++ b/pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-configure-hook.sh
@@ -0,0 +1,33 @@
+declare -a projectFile testProjectFile dotnetRestoreFlags dotnetFlags
+
+dotnetConfigureHook() {
+    echo "Executing dotnetConfigureHook"
+
+    runHook preConfigure
+
+    if [ -z "${enableParallelBuilding-}" ]; then
+        parallelFlag="--disable-parallel"
+    fi
+
+    export HOME=$(mktemp -d)
+
+    for project in ${projectFile[@]} ${testProjectFile[@]}; do
+        env \
+            dotnet restore "$project" \
+                -p:ContinuousIntegrationBuild=true \
+                -p:Deterministic=true \
+                -p:RestoreUseStaticGraphEvaluation=true \
+                --source "@nugetSource@/lib" \
+                ${parallelFlag-} \
+                "${dotnetRestoreFlags[@]}" \
+                "${dotnetFlags[@]}"
+    done
+
+    runHook postConfigure
+
+    echo "Finished dotnetConfigureHook"
+}
+
+if [[ -z "${dontDotnetConfigure-}" && -z "${configurePhase-}" ]]; then
+    configurePhase=dotnetConfigureHook
+fi
diff --git a/pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-fixup-hook.sh b/pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-fixup-hook.sh
new file mode 100644
index 000000000000..f8bbb7b1805b
--- /dev/null
+++ b/pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-fixup-hook.sh
@@ -0,0 +1,42 @@
+declare -a makeWrapperArgs gappsWrapperArgs
+
+# First argument is the executable you want to wrap,
+# the second is the destination for the wrapper.
+wrapDotnetProgram() {
+    makeWrapper "$1" "$2" \
+        --set "DOTNET_ROOT" "@dotnetRuntime@" \
+        --suffix "LD_LIBRARY_PATH" : "@runtimeDeps@" \
+        "${gappsWrapperArgs[@]}" \
+        "${makeWrapperArgs[@]}"
+
+    echo "Installed wrapper to: "$2""
+}
+
+dotnetFixupHook() {
+    echo "Executing dotnetFixupPhase"
+
+    if [ "${executables-}" ]; then
+        for executable in ${executables[@]}; do
+            execPath="$out/lib/${pname-}/$executable"
+
+            if [[ -f "$execPath" && -x "$execPath" ]]; then
+                wrapDotnetProgram "$execPath" "$out/bin/$(basename "$executable")"
+            else
+                echo "Specified binary \"$executable\" is either not an executable, or does not exist!"
+                exit 1
+            fi
+        done
+    else
+        for executable in $out/lib/${pname-}/*; do
+            if [[ -f "$executable" && -x "$executable" && "$executable" != *"dll"* ]]; then
+                wrapDotnetProgram "$executable" "$out/bin/$(basename "$executable")"
+            fi
+        done
+    fi
+
+    echo "Finished dotnetFixupPhase"
+}
+
+if [[ -z "${dontDotnetFixup-}" ]]; then
+    preFixupPhases+=" dotnetFixupHook"
+fi
diff --git a/pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-install-hook.sh b/pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-install-hook.sh
new file mode 100644
index 000000000000..ed2c9160cd2c
--- /dev/null
+++ b/pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-install-hook.sh
@@ -0,0 +1,42 @@
+declare -a projectFile dotnetInstallFlags dotnetFlags
+
+dotnetInstallHook() {
+    echo "Executing dotnetInstallHook"
+
+    runHook preInstall
+
+    for project in ${projectFile[@]}; do
+        env \
+            dotnet publish "$project" \
+                -p:ContinuousIntegrationBuild=true \
+                -p:Deterministic=true \
+                --output "$out/lib/${pname}" \
+                --configuration "@buildType@" \
+                --no-build \
+                --no-self-contained \
+                "${dotnetInstallFlags[@]}"  \
+                "${dotnetFlags[@]}"
+    done
+
+    if [[ "${packNupkg-}" ]]; then
+        for project in ${projectFile[@]}; do
+            env \
+                dotnet pack "$project" \
+                    -p:ContinuousIntegrationBuild=true \
+                    -p:Deterministic=true \
+                    --output "$out/share" \
+                    --configuration "@buildType@" \
+                    --no-build \
+                    "${dotnetPackFlags[@]}"  \
+                    "${dotnetFlags[@]}"
+        done
+    fi
+
+    runHook postInstall
+
+    echo "Finished dotnetInstallHook"
+}
+
+if [[ -z "${dontDotnetInstall-}" && -z "${installPhase-}" ]]; then
+    installPhase=dotnetInstallHook
+fi
diff --git a/pkgs/development/haskell-modules/make-package-set.nix b/pkgs/development/haskell-modules/make-package-set.nix
index e9ce4f127051..86f29e731133 100644
--- a/pkgs/development/haskell-modules/make-package-set.nix
+++ b/pkgs/development/haskell-modules/make-package-set.nix
@@ -124,20 +124,17 @@ let
   haskellSrc2nix = { name, src, sha256 ? null, extraCabal2nixOptions ? "" }:
     let
       sha256Arg = if sha256 == null then "--sha256=" else ''--sha256="${sha256}"'';
-    in buildPackages.stdenv.mkDerivation {
-      name = "cabal2nix-${name}";
+    in buildPackages.runCommand "cabal2nix-${name}" {
       nativeBuildInputs = [ buildPackages.cabal2nix-unwrapped ];
       preferLocalBuild = true;
       allowSubstitutes = false;
-      phases = ["installPhase"];
       LANG = "en_US.UTF-8";
       LOCALE_ARCHIVE = pkgs.lib.optionalString (buildPlatform.libc == "glibc") "${buildPackages.glibcLocales}/lib/locale/locale-archive";
-      installPhase = ''
-        export HOME="$TMP"
-        mkdir -p "$out"
-        cabal2nix --compiler=${self.ghc.haskellCompilerName} --system=${hostPlatform.config} ${sha256Arg} "${src}" ${extraCabal2nixOptions} > "$out/default.nix"
-      '';
-  };
+    } ''
+      export HOME="$TMP"
+      mkdir -p "$out"
+      cabal2nix --compiler=${self.ghc.haskellCompilerName} --system=${hostPlatform.config} ${sha256Arg} "${src}" ${extraCabal2nixOptions} > "$out/default.nix"
+    '';
 
   all-cabal-hashes-component = name: version: buildPackages.runCommand "all-cabal-hashes-component-${name}-${version}" {} ''
     tar --wildcards -xzvf ${all-cabal-hashes} \*/${name}/${version}/${name}.{json,cabal}
diff --git a/pkgs/development/libraries/accountsservice/default.nix b/pkgs/development/libraries/accountsservice/default.nix
index bd6f2545b3b0..1887060aadb3 100644
--- a/pkgs/development/libraries/accountsservice/default.nix
+++ b/pkgs/development/libraries/accountsservice/default.nix
@@ -14,20 +14,48 @@
 , dbus
 , ninja
 , python3
+, vala
 , gettext
 }:
 
 stdenv.mkDerivation rec {
   pname = "accountsservice";
-  version = "0.6.55";
+  version = "22.07.5";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
-    url = "https://www.freedesktop.org/software/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "16wwd633jak9ajyr1f1h047rmd09fhf3kzjz6g5xjsz0lwcj8azz";
+    url = "https://www.freedesktop.org/software/accountsservice/accountsservice-${version}.tar.xz";
+    sha256 = "IdRJwN6tilQ86o8R5x6wSWwDXXMOpIOTOXowKzpMfBo=";
   };
 
+  patches = [
+    # Hardcode dependency paths.
+    (substituteAll {
+      src = ./fix-paths.patch;
+      inherit shadow coreutils;
+    })
+
+    # Do not try to create directories in /var, that will not work in Nix sandbox.
+    ./no-create-dirs.patch
+
+    # Disable mutating D-Bus methods with immutable /etc.
+    ./Disable-methods-that-change-files-in-etc.patch
+
+    # Do not ignore third-party (e.g Pantheon) extensions not matching FHS path scheme.
+    # Fixes https://github.com/NixOS/nixpkgs/issues/72396
+    ./drop-prefix-check-extensions.patch
+
+    # Work around not being able to set profile picture in GNOME Settings.
+    # https://github.com/NixOS/nixpkgs/issues/85357
+    # https://gitlab.freedesktop.org/accountsservice/accountsservice/-/issues/98
+    # https://gitlab.gnome.org/GNOME/gnome-control-center/-/issues/1629
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/accountsservice/accountsservice/-/commit/1ef3add46983af875adfed5d29954cbfb184f688.patch";
+      sha256 = "N4siK4SWkwYBnFa0JJUFgahi9XBkB/nS5yc+PyH3/iM=";
+    })
+  ];
+
   nativeBuildInputs = [
     dbus
     gettext
@@ -36,6 +64,7 @@ stdenv.mkDerivation rec {
     ninja
     pkg-config
     python3
+    vala
   ];
 
   buildInputs = [
@@ -48,7 +77,6 @@ stdenv.mkDerivation rec {
     "-Dadmin_group=wheel"
     "-Dlocalstatedir=/var"
     "-Dsystemdsystemunitdir=${placeholder "out"}/etc/systemd/system"
-    "-Dsystemd=true"
   ];
 
   postPatch = ''
@@ -56,42 +84,11 @@ stdenv.mkDerivation rec {
     patchShebangs meson_post_install.py
   '';
 
-  patches = [
-    # https://gitlab.freedesktop.org/accountsservice/accountsservice/-/issues/55
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/accountsservice/accountsservice/-/merge_requests/58.patch";
-      sha256 = "1pnwq4ycnryb2kkgvnz44qzm71240ybqj6507wynlkdsw8180fdw";
-    })
-    (substituteAll {
-      src = ./fix-paths.patch;
-      inherit shadow coreutils;
-    })
-    ./no-create-dirs.patch
-    ./Disable-methods-that-change-files-in-etc.patch
-    # Fixes https://github.com/NixOS/nixpkgs/issues/72396
-    ./drop-prefix-check-extensions.patch
-    # Systemd unit improvements. Notably using StateDirectory eliminating the
-    # need of an ad-hoc script.
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/accountsservice/accountsservice/commit/152b845bbd3ca2a64516691493a160825f1a2046.patch";
-      sha256 = "114wrf5mwj5bgc5v1g05md4ridcnwdrwppr3bjz96sknwh5hk8s5";
-    })
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/accountsservice/accountsservice/commit/0e712e935abd26499ff5995ab363e5bfd9ee7c4c.patch";
-      sha256 = "1y60a5fmgfqjzprwpizilrazqn3mggdlgc5sgcpsprsp62fv78rl";
-    })
-    # Don't use etc/dbus-1/system.d
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/accountsservice/accountsservice/commit/ced73d0fcbd2a54085a660d260482fc70d79bd5c.patch";
-      sha256 = "0s7fknfgxl8hnf6givmhfg4586fjb2n64i9arh1w7xnq7x9x8d4c";
-    })
-  ];
-
   meta = with lib; {
     description = "D-Bus interface for user account query and manipulation";
     homepage = "https://www.freedesktop.org/wiki/Software/AccountsService";
-    license = licenses.gpl3;
-    maintainers = with maintainers; [ pSub ];
+    license = licenses.gpl3Plus;
+    maintainers = teams.freedesktop.members ++ (with maintainers; [ pSub ]);
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/development/libraries/accountsservice/fix-paths.patch b/pkgs/development/libraries/accountsservice/fix-paths.patch
index 78d7a8081bfd..0ed8e04579f4 100644
--- a/pkgs/development/libraries/accountsservice/fix-paths.patch
+++ b/pkgs/development/libraries/accountsservice/fix-paths.patch
@@ -1,8 +1,8 @@
 diff --git a/src/daemon.c b/src/daemon.c
-index c52bda3..75d214e 100644
+index c8b6320..2b74949 100644
 --- a/src/daemon.c
 +++ b/src/daemon.c
-@@ -1106,7 +1106,7 @@ daemon_create_user_authorized_cb (Daemon                *daemon,
+@@ -1102,7 +1102,7 @@ daemon_create_user_authorized_cb (Daemon                *daemon,
  
          sys_log (context, "create user '%s'", cd->user_name);
  
@@ -11,9 +11,9 @@ index c52bda3..75d214e 100644
          argv[1] = "-m";
          argv[2] = "-c";
          argv[3] = cd->real_name;
-@@ -1318,7 +1318,7 @@ daemon_delete_user_authorized_cb (Daemon                *daemon,
- 
-         user_set_saved (user, FALSE);
+@@ -1335,7 +1335,7 @@ daemon_delete_user_authorized_cb (Daemon                *daemon,
+         }
+         free (resolved_homedir);
  
 -        argv[0] = "/usr/sbin/userdel";
 +        argv[0] = "@shadow@/bin/userdel";
@@ -21,19 +21,19 @@ index c52bda3..75d214e 100644
                  argv[1] = "-f";
                  argv[2] = "-r";
 diff --git a/src/user.c b/src/user.c
-index 9f57af5..e65289d 100644
+index 189b2c5..5358c02 100644
 --- a/src/user.c
 +++ b/src/user.c
-@@ -844,7 +844,7 @@ user_change_real_name_authorized_cb (Daemon                *daemon,
-                          accounts_user_get_uid (ACCOUNTS_USER (user)),
-                          name);
+@@ -1145,7 +1145,7 @@ user_change_real_name_authorized_cb (Daemon                *daemon,
+                         new_gecos = g_strdup (name);
+                 }
  
 -                argv[0] = "/usr/sbin/usermod";
 +                argv[0] = "@shadow@/bin/usermod";
                  argv[1] = "-c";
-                 argv[2] = name;
+                 argv[2] = new_gecos;
                  argv[3] = "--";
-@@ -913,7 +913,7 @@ user_change_user_name_authorized_cb (Daemon                *daemon,
+@@ -1218,7 +1218,7 @@ user_change_user_name_authorized_cb (Daemon                *daemon,
                           accounts_user_get_uid (ACCOUNTS_USER (user)),
                           name);
  
@@ -42,7 +42,7 @@ index 9f57af5..e65289d 100644
                  argv[1] = "-l";
                  argv[2] = name;
                  argv[3] = "--";
-@@ -1321,7 +1321,7 @@ user_change_home_dir_authorized_cb (Daemon                *daemon,
+@@ -1627,7 +1627,7 @@ user_change_home_dir_authorized_cb (Daemon                *daemon,
                           accounts_user_get_uid (ACCOUNTS_USER (user)),
                           home_dir);
  
@@ -51,7 +51,7 @@ index 9f57af5..e65289d 100644
                  argv[1] = "-m";
                  argv[2] = "-d";
                  argv[3] = home_dir;
-@@ -1378,7 +1378,7 @@ user_change_shell_authorized_cb (Daemon                *daemon,
+@@ -1683,7 +1683,7 @@ user_change_shell_authorized_cb (Daemon                *daemon,
                           accounts_user_get_uid (ACCOUNTS_USER (user)),
                           shell);
  
@@ -60,7 +60,7 @@ index 9f57af5..e65289d 100644
                  argv[1] = "-s";
                  argv[2] = shell;
                  argv[3] = "--";
-@@ -1520,7 +1520,7 @@ user_change_icon_file_authorized_cb (Daemon                *daemon,
+@@ -1824,7 +1824,7 @@ user_change_icon_file_authorized_cb (Daemon                *daemon,
                          return;
                  }
  
@@ -69,7 +69,7 @@ index 9f57af5..e65289d 100644
                  argv[1] = filename;
                  argv[2] = NULL;
  
-@@ -1601,7 +1601,7 @@ user_change_locked_authorized_cb (Daemon                *daemon,
+@@ -1904,7 +1904,7 @@ user_change_locked_authorized_cb (Daemon                *daemon,
                           locked ? "locking" : "unlocking",
                           accounts_user_get_user_name (ACCOUNTS_USER (user)),
                           accounts_user_get_uid (ACCOUNTS_USER (user)));
@@ -78,7 +78,7 @@ index 9f57af5..e65289d 100644
                  argv[1] = locked ? "-L" : "-U";
                  argv[2] = "--";
                  argv[3] = accounts_user_get_user_name (ACCOUNTS_USER (user));
-@@ -1726,7 +1726,7 @@ user_change_account_type_authorized_cb (Daemon                *daemon,
+@@ -2026,7 +2026,7 @@ user_change_account_type_authorized_cb (Daemon                *daemon,
  
                  g_free (groups);
  
@@ -87,7 +87,7 @@ index 9f57af5..e65289d 100644
                  argv[1] = "-G";
                  argv[2] = str->str;
                  argv[3] = "--";
-@@ -1794,7 +1794,7 @@ user_change_password_mode_authorized_cb (Daemon                *daemon,
+@@ -2093,7 +2093,7 @@ user_change_password_mode_authorized_cb (Daemon                *daemon,
                  if (mode == PASSWORD_MODE_SET_AT_LOGIN ||
                      mode == PASSWORD_MODE_NONE) {
  
@@ -96,7 +96,7 @@ index 9f57af5..e65289d 100644
                          argv[1] = "-d";
                          argv[2] = "--";
                          argv[3] = accounts_user_get_user_name (ACCOUNTS_USER (user));
-@@ -1806,7 +1806,7 @@ user_change_password_mode_authorized_cb (Daemon                *daemon,
+@@ -2105,7 +2105,7 @@ user_change_password_mode_authorized_cb (Daemon                *daemon,
                          }
  
                          if (mode == PASSWORD_MODE_SET_AT_LOGIN) {
@@ -105,7 +105,7 @@ index 9f57af5..e65289d 100644
                                  argv[1] = "-d";
                                  argv[2] = "0";
                                  argv[3] = "--";
-@@ -1827,7 +1827,7 @@ user_change_password_mode_authorized_cb (Daemon                *daemon,
+@@ -2126,7 +2126,7 @@ user_change_password_mode_authorized_cb (Daemon                *daemon,
                          accounts_user_set_locked (ACCOUNTS_USER (user), FALSE);
                  }
                  else if (accounts_user_get_locked (ACCOUNTS_USER (user))) {
@@ -114,7 +114,7 @@ index 9f57af5..e65289d 100644
                          argv[1] = "-U";
                          argv[2] = "--";
                          argv[3] = accounts_user_get_user_name (ACCOUNTS_USER (user));
-@@ -1905,7 +1905,7 @@ user_change_password_authorized_cb (Daemon                *daemon,
+@@ -2203,7 +2203,7 @@ user_change_password_authorized_cb (Daemon                *daemon,
  
          g_object_freeze_notify (G_OBJECT (user));
  
diff --git a/pkgs/development/libraries/accountsservice/no-create-dirs.patch b/pkgs/development/libraries/accountsservice/no-create-dirs.patch
index 0333f925d267..5d137eb52a11 100644
--- a/pkgs/development/libraries/accountsservice/no-create-dirs.patch
+++ b/pkgs/development/libraries/accountsservice/no-create-dirs.patch
@@ -1,15 +1,17 @@
 diff --git a/meson_post_install.py b/meson_post_install.py
-index 5cc2dc4..dd27ad5 100644
+index d8c3dd1..620f714 100644
 --- a/meson_post_install.py
 +++ b/meson_post_install.py
-@@ -9,8 +9,8 @@ localstatedir = os.path.normpath(destdir + os.sep + sys.argv[1])
+@@ -9,9 +9,9 @@ localstatedir = os.path.normpath(destdir + os.sep + sys.argv[1])
  # FIXME: meson will not track the creation of these directories
  #        https://github.com/mesonbuild/meson/blob/master/mesonbuild/scripts/uninstall.py#L39
  dst_dirs = [
+-  (os.path.join(localstatedir, 'lib'), 0o755),
 -  (os.path.join(localstatedir, 'lib', 'AccountsService', 'icons'), 0o775),
 -  (os.path.join(localstatedir, 'lib', 'AccountsService', 'users'), 0o700),
-+#  (os.path.join(localstatedir, 'lib', 'AccountsService', 'icons'), 0o775),
-+#  (os.path.join(localstatedir, 'lib', 'AccountsService', 'users'), 0o700),
++  # (os.path.join(localstatedir, 'lib'), 0o755),
++  # (os.path.join(localstatedir, 'lib', 'AccountsService', 'icons'), 0o775),
++  # (os.path.join(localstatedir, 'lib', 'AccountsService', 'users'), 0o700),
  ]
  
  for (dst_dir, dst_dir_mode) in dst_dirs:
diff --git a/pkgs/development/php-packages/composer/default.nix b/pkgs/development/php-packages/composer/default.nix
index a3920691a8d2..4c94b7421253 100644
--- a/pkgs/development/php-packages/composer/default.nix
+++ b/pkgs/development/php-packages/composer/default.nix
@@ -1,14 +1,14 @@
 { mkDerivation, fetchurl, makeWrapper, unzip, lib, php }:
 let
   pname = "composer";
-  version = "2.2.6";
+  version = "2.2.7";
 in
 mkDerivation {
   inherit pname version;
 
   src = fetchurl {
     url = "https://getcomposer.org/download/${version}/composer.phar";
-    sha256 = "sha256-HVhIa4keWengZMDVS7OFOPdNYBT3VIFULGmthNTpdwQ=";
+    sha256 = "sha256-EAQN7WY1QZkO74zh9vpEyztKR+FF77jp5ZkHoVBoAz0=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/development/python-modules/azure-mgmt-batch/default.nix b/pkgs/development/python-modules/azure-mgmt-batch/default.nix
index c153534cc642..421f068aa13e 100644
--- a/pkgs/development/python-modules/azure-mgmt-batch/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-batch/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-batch";
-  version = "16.0.0";
+  version = "16.1.0";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "1b3cecd6f16813879c6ac1a1bb01f9a6f2752cd1f9157eb04d5e41e4a89f3c34";
+    sha256 = "sha256-9J0VQ3uAsi4kuEe9UG4xpcEV1Sc+nkjECgVfzG7j5jk=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/google-cloud-dataproc/default.nix b/pkgs/development/python-modules/google-cloud-dataproc/default.nix
index 3badd796121e..f0d7cfcfc084 100644
--- a/pkgs/development/python-modules/google-cloud-dataproc/default.nix
+++ b/pkgs/development/python-modules/google-cloud-dataproc/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-dataproc";
-  version = "3.2.0";
+  version = "3.3.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c3b60ea9059070e6d0d5c3bd3a705b5c7216a54e6a586149f9caa9158d099c3f";
+    sha256 = "sha256-KQVlwyTWNC9EaFVdohle/i4xc/Fc+B6Q4iR8Tw2oAro=";
   };
 
   propagatedBuildInputs = [ google-api-core libcst proto-plus ];
diff --git a/pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix b/pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix
index 64ecd3c496bb..6345eebad1bc 100644
--- a/pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix
+++ b/pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "ibm-cloud-sdk-core";
-  version = "3.14.0";
+  version = "3.15.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "695c4125436f4f8354a67bc85af9ac306b66911c75d19ade25072dd436b55c4e";
+    sha256 = "sha256-oHQXgiW80zqgpyt5osbBCtoT3XYCGEk4mgKPIsMmBHY=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/motionblinds/default.nix b/pkgs/development/python-modules/motionblinds/default.nix
index f6f176dcd572..32a6e05a42cb 100644
--- a/pkgs/development/python-modules/motionblinds/default.nix
+++ b/pkgs/development/python-modules/motionblinds/default.nix
@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "motionblinds";
-  version = "0.5.13";
+  version = "0.6.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "starkillerOG";
     repo = "motion-blinds";
     rev = version;
-    sha256 = "sha256-7o8mov8uV5ZrEYvX1qPSMT2T8Jb/1eV2MytU+1SEYfY=";
+    sha256 = "sha256-0Vkx5Hnoa09ZgavReQ72iWqmOG42ATG5w+ptCs7geoA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/ormar/default.nix b/pkgs/development/python-modules/ormar/default.nix
index d5b9b7cf88e8..bbf95e98cffe 100644
--- a/pkgs/development/python-modules/ormar/default.nix
+++ b/pkgs/development/python-modules/ormar/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "ormar";
-  version = "0.10.24";
+  version = "0.10.25";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     owner = "collerek";
     repo = pname;
     rev = version;
-    hash = "sha256-zKugeGDcYDI4VKspJPWeZCBubTqMxxfOVQCuF4pC49E=";
+    hash = "sha256-AggrsXw9fUYfc38AiSDSoh7SIEf4gPf+LlAvrxZiFL4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/dockle/default.nix b/pkgs/development/tools/dockle/default.nix
index 48895d30f94d..d117d9319d88 100644
--- a/pkgs/development/tools/dockle/default.nix
+++ b/pkgs/development/tools/dockle/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "dockle";
-  version = "0.4.4";
+  version = "0.4.5";
 
   src = fetchFromGitHub {
     owner = "goodwithtech";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-lXX266wVvAebUaYsoANuNAyguh7F1OUPPNrSqQSINuU=";
+    sha256 = "sha256-QC0WAM+qitee0dyJorl5Hio3COy4JiIHmFgBIj7S2yM=";
   };
 
-  vendorSha256 = "sha256-4yluXfk84vJFSvz9PCSym0Vxx1glyvVZWZy2kdqk/a4=";
+  vendorSha256 = "sha256-9n/782uKu7qNV/WEpbEV3aHcPXipyOhGdAhT/F4O2xc=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ btrfs-progs lvm2 ];
diff --git a/pkgs/games/cataclysm-dda/common.nix b/pkgs/games/cataclysm-dda/common.nix
index ccba8e23d5ae..1701d84e8df7 100644
--- a/pkgs/games/cataclysm-dda/common.nix
+++ b/pkgs/games/cataclysm-dda/common.nix
@@ -68,6 +68,7 @@ stdenv.mkDerivation {
   );
 
   dontStrip = debug;
+  enableParallelBuilding = true;
 
   passthru = {
     isTiles = tiles;
diff --git a/pkgs/os-specific/linux/jool/default.nix b/pkgs/os-specific/linux/jool/default.nix
index 58894de6c2e6..2fd10778e2cf 100644
--- a/pkgs/os-specific/linux/jool/default.nix
+++ b/pkgs/os-specific/linux/jool/default.nix
@@ -28,6 +28,7 @@ stdenv.mkDerivation {
     homepage = "https://www.jool.mx/";
     description = "Fairly compliant SIIT and Stateful NAT64 for Linux - kernel modules";
     platforms = platforms.linux;
+    license = licenses.gpl2Only;
     maintainers = with maintainers; [ fpletz ];
   };
 }
diff --git a/pkgs/os-specific/linux/jool/source.nix b/pkgs/os-specific/linux/jool/source.nix
index 0517c50d4a98..87e36fe5a9eb 100644
--- a/pkgs/os-specific/linux/jool/source.nix
+++ b/pkgs/os-specific/linux/jool/source.nix
@@ -1,11 +1,11 @@
 { fetchFromGitHub }:
 
 rec {
-  version = "4.1.6";
+  version = "4.1.7";
   src = fetchFromGitHub {
     owner = "NICMx";
     repo = "Jool";
     rev = "v${version}";
-    sha256 = "09avkiazpfxzrgr3av58jbina5x9jqvqhjkn39475pfhfhrlv9fv";
+    sha256 = "08z23mi6xkr6zzp0hzh1cppvl2y0177s0lnpxqbpy8jiii5fxw8f";
   };
 }
diff --git a/pkgs/servers/rtsp-simple-server/default.nix b/pkgs/servers/rtsp-simple-server/default.nix
index 7be9b53fb9f3..b9ad0a3b5188 100644
--- a/pkgs/servers/rtsp-simple-server/default.nix
+++ b/pkgs/servers/rtsp-simple-server/default.nix
@@ -5,22 +5,20 @@
 
 buildGoModule rec {
   pname = "rtsp-simple-server";
-  version = "0.17.8";
+  version = "0.17.17";
 
   src = fetchFromGitHub {
     owner = "aler9";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-wjF7XTiUw5lPSmNiHvqUz4ZswpzLBoYF9S25dL8VPMU=";
+    hash = "sha256-JHqD9/meOOqR5Uds03/YbhfTVm3QApM64oydB0VqTxM=";
   };
 
-  vendorSha256 = "sha256-rntfePkwNGnyPjIzjLJhBYLTcndHP605Ah/xPcM6sRo=";
+  vendorSha256 = "sha256-8ULyCg36yVSM2En82ZiB+CLak1vQPykgs/i2mNhgebg=";
 
   # Tests need docker
   doCheck = false;
 
-  # In the future, we might need to switch to `main.Version`, considering:
-  # https://github.com/aler9/rtsp-simple-server/issues/503
   ldflags = [
     "-X github.com/aler9/rtsp-simple-server/internal/core.version=v${version}"
   ];
diff --git a/pkgs/servers/web-apps/shiori/default.nix b/pkgs/servers/web-apps/shiori/default.nix
index 07fefc9343ba..cbfa28b8f46d 100644
--- a/pkgs/servers/web-apps/shiori/default.nix
+++ b/pkgs/servers/web-apps/shiori/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub, nixosTests }:
 
 buildGoModule rec {
   pname = "shiori";
@@ -15,6 +15,10 @@ buildGoModule rec {
     sha256 = "sha256-Py6Lq29F7RkvSui+Z2VyogU9+azHQ2KEvEq924pQmQo=";
   };
 
+  passthru.tests = {
+    smoke-test = nixosTests.shiori;
+  };
+
   meta = with lib; {
     description = "Simple bookmark manager built with Go";
     homepage = "https://github.com/go-shiori/shiori";