diff --git a/nixos/lib/test-driver/src/test_driver/driver.py b/nixos/lib/test-driver/src/test_driver/driver.py
index 361bb1c2a93d..c4f268404cbc 100644
--- a/nixos/lib/test-driver/src/test_driver/driver.py
+++ b/nixos/lib/test-driver/src/test_driver/driver.py
@@ -344,7 +344,7 @@ class Driver:
                     return ret
 
                 with driver.logger.nested(f"waiting for {self.condition.description}"):
-                    retry(condition, timeout=timeout)
+                    retry(condition, timeout_seconds=timeout)
 
         if fun_ is None:
             return Poll
diff --git a/nixos/lib/test-driver/src/test_driver/machine/__init__.py b/nixos/lib/test-driver/src/test_driver/machine/__init__.py
index 71e14a87eb36..f722d36ae40e 100644
--- a/nixos/lib/test-driver/src/test_driver/machine/__init__.py
+++ b/nixos/lib/test-driver/src/test_driver/machine/__init__.py
@@ -93,19 +93,24 @@ def make_command(args: list) -> str:
     return " ".join(map(shlex.quote, (map(str, args))))
 
 
-def retry(fn: Callable, timeout: int = 900) -> None:
-    """Call the given function repeatedly, with 1 second intervals,
-    until it returns True or a timeout is reached.
-    """
+def retry(fn: Callable, timeout_seconds: int = 900) -> None:
+    """Call the given function repeatedly, with a one second interval between
+    retries, until it returns True or a timeout is reached.
 
-    for _ in range(timeout):
+    Note that the timeout shown will include the time of the last attempted run.
+    """
+    start_time = time.monotonic()
+
+    while time.monotonic() - start_time < timeout_seconds:
         if fn(False):
             return
         time.sleep(1)
 
+    elapsed = time.monotonic() - start_time
+
     if not fn(True):
         raise RequestedAssertionFailed(
-            f"action timed out after {timeout} tries with one-second pause in-between"
+            f"action timed out after {elapsed:.2f} seconds (timeout={timeout_seconds})"
         )
 
 
diff --git a/nixos/modules/installer/tools/nixos-generate-config.pl b/nixos/modules/installer/tools/nixos-generate-config.pl
index 77139976e7ad..bbd0a093b998 100644
--- a/nixos/modules/installer/tools/nixos-generate-config.pl
+++ b/nixos/modules/installer/tools/nixos-generate-config.pl
@@ -205,10 +205,15 @@ sub pciCheck {
         ($device eq "0x4229" || $device eq "0x4230" ||
          $device eq "0x4222" || $device eq "0x4227");
 
-    push @attrs, "hardware.cpu.intel.npu.enable = true;" if
-        $vendor eq "0x8086" &&
-        ($device eq "0x7d1d" || $device eq "0xad1d" ||
-         $device eq "0x643e" || $device eq "0xb03e");
+    # Intel NPU driver
+    # list taken from linux(v6.18): drivers/accel/ivpu/ivpu_drv.h
+    if ($vendor eq "0x8086" &&
+        ($device eq "0xfd3e" || $device eq "0x7d1d" || $device eq "0xad1d" ||
+         $device eq "0x643e" || $device eq "0xb03e"))
+    {
+        push @imports, "(modulesPath + \"/hardware/cpu/intel-npu.nix\")";
+        push @attrs, "hardware.cpu.intel.npu.enable = true;";
+    }
 
     # Assume that all NVIDIA cards are supported by the NVIDIA driver.
     # There may be exceptions (e.g. old cards).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 0b50f0616c26..953444abe586 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -257,6 +257,7 @@
   ./programs/less.nix
   ./programs/liboping.nix
   ./programs/light.nix
+  ./programs/lix.nix
   ./programs/localsend.nix
   ./programs/mdevctl.nix
   ./programs/mepo.nix
diff --git a/nixos/modules/programs/lix.nix b/nixos/modules/programs/lix.nix
new file mode 100644
index 000000000000..d87ff84eafba
--- /dev/null
+++ b/nixos/modules/programs/lix.nix
@@ -0,0 +1,128 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+
+  cfg = config.nix;
+
+  nixPackage = cfg.package.out;
+
+  commonNixDaemonConfig = {
+    path = [
+      nixPackage
+      config.programs.ssh.package
+    ];
+
+    environment =
+      cfg.envVars
+      // {
+        CURL_CA_BUNDLE = config.security.pki.caBundle;
+      }
+      // config.networking.proxy.envVars;
+
+    serviceConfig = {
+      CPUSchedulingPolicy = cfg.daemonCPUSchedPolicy;
+      IOSchedulingClass = cfg.daemonIOSchedClass;
+      IOSchedulingPriority = cfg.daemonIOSchedPriority;
+    };
+  };
+
+  makeNixBuildUser = nr: {
+    name = "nixbld${toString nr}";
+    value = {
+      description = "Lix build user ${toString nr}";
+      uid = builtins.add config.ids.uids.nixbld nr;
+      isSystemUser = true;
+      group = "nixbld";
+      extraGroups = [ "nixbld" ];
+    };
+  };
+
+  nixbldUsers = lib.listToAttrs (map makeNixBuildUser (lib.range 1 cfg.nrBuildUsers));
+
+in
+
+{
+  config = lib.mkIf (cfg.enable && nixPackage.pname == "lix") {
+    environment.systemPackages = [
+      nixPackage
+      pkgs.nix-info
+    ]
+    ++ lib.optional (config.programs.bash.completion.enable) pkgs.nix-bash-completions;
+
+    systemd.packages = [ nixPackage ];
+
+    systemd.tmpfiles.packages = [ nixPackage ];
+
+    systemd.sockets.nix-daemon.wantedBy = [ "sockets.target" ];
+
+    systemd.services."nix-daemon@" = lib.mkMerge [
+      commonNixDaemonConfig
+      {
+        # Do not kill connections serving established connections on upgrade.
+        restartIfChanged = false;
+      }
+    ];
+
+    systemd.services.nix-daemon = lib.mkMerge [
+      commonNixDaemonConfig
+      {
+        restartTriggers = [ config.environment.etc."nix/nix.conf".source ];
+
+        # `stopIfChanged = false` changes to switch behavior
+        # from   stop -> update units -> start
+        #   to   update units -> restart
+        #
+        # The `stopIfChanged` setting therefore controls a trade-off between a
+        # more predictable lifecycle, which runs the correct "version" of
+        # the `ExecStop` line, and on the other hand the availability of
+        # sockets during the switch, as the effectiveness of the stop operation
+        # depends on the socket being stopped as well.
+        #
+        # As `nix-daemon.service` does not make use of `ExecStop`, we prefer
+        # to keep the socket up and available. This is important for machines
+        # that run Nix-based services, such as automated build, test, and deploy
+        # services, that expect the daemon socket to be available at all times.
+        #
+        # Notably, the Nix client does not retry on failure to connect to the
+        # daemon socket, and the in-process RemoteStore instance will disable
+        # itself. This makes retries infeasible even for services that are
+        # aware of the issue. Failure to connect can affect not only new client
+        # processes, but also new RemoteStore instances in existing processes,
+        # as well as existing RemoteStore instances that have not saturated
+        # their connection pool.
+        #
+        # Also note that `stopIfChanged = true` does not kill existing
+        # connection handling daemons, as one might wish to happen before a
+        # breaking Nix upgrade (which is rare). The daemon forks that handle
+        # the individual connections split off into their own sessions, causing
+        # them not to be stopped by systemd.
+        # If a Nix upgrade does require all existing daemon processes to stop,
+        # nix-daemon must do so on its own accord, and only when the new version
+        # starts and detects that Nix's persistent state needs an upgrade.
+        stopIfChanged = false;
+
+      }
+    ];
+
+    # Set up the environment variables for running Nix.
+    environment.sessionVariables = cfg.envVars;
+
+    nix.nrBuildUsers = lib.mkDefault (
+      if cfg.settings.auto-allocate-uids or false then
+        0
+      else
+        lib.max 32 (if cfg.settings.max-jobs == "auto" then 0 else cfg.settings.max-jobs)
+    );
+
+    users.users = nixbldUsers;
+
+    services.displayManager.hiddenUsers = lib.attrNames nixbldUsers;
+
+    # Legacy configuration conversion.
+    nix.settings.sandbox-fallback = false;
+  };
+}
diff --git a/nixos/modules/services/networking/firewall-nftables.nix b/nixos/modules/services/networking/firewall-nftables.nix
index a22fc29d35ff..093160e78dbf 100644
--- a/nixos/modules/services/networking/firewall-nftables.nix
+++ b/nixos/modules/services/networking/firewall-nftables.nix
@@ -117,6 +117,10 @@ in
           ifaceSet != ""
         ) ''iifname { ${ifaceSet} } accept comment "trusted interfaces"''}
 
+        # Multicast ICMPv6 echo replies get marked as invalid by conntrack.
+        # Accept them before conntrack to avoid dropped replies.
+        icmpv6 type echo-reply accept
+
         # Some ICMPv6 types like NDP is untracked
         ct state vmap {
           invalid : drop,
diff --git a/nixos/modules/services/system/dbus.nix b/nixos/modules/services/system/dbus.nix
index 3751fa5e57fd..a0edb9336208 100644
--- a/nixos/modules/services/system/dbus.nix
+++ b/nixos/modules/services/system/dbus.nix
@@ -174,6 +174,10 @@ in
         permissions = "u+rx,g+rx,o-rx";
       };
 
+      system.switch.inhibitors = [
+        cfg.dbusPackage
+      ];
+
       systemd.services.dbus = {
         aliases = [
           # hack aiding to prevent dbus from restarting when switching from dbus-broker back to dbus
@@ -212,6 +216,10 @@ in
         cfg.brokerPackage
       ];
 
+      system.switch.inhibitors = [
+        cfg.brokerPackage
+      ];
+
       # Just to be sure we don't restart through the unit alias
       systemd.services.dbus.reloadIfChanged = true;
       systemd.user.services.dbus.reloadIfChanged = true;
diff --git a/nixos/modules/services/system/nix-daemon.nix b/nixos/modules/services/system/nix-daemon.nix
index 2c4769da5764..ef740b9ba8d9 100644
--- a/nixos/modules/services/system/nix-daemon.nix
+++ b/nixos/modules/services/system/nix-daemon.nix
@@ -16,10 +16,6 @@ let
 
   nixPackage = cfg.package.out;
 
-  # nixVersion is an attribute which defines the implementation version.
-  # This is useful for Nix implementations which don't follow Nix's versioning.
-  isNixAtLeast = lib.versionAtLeast (nixPackage.nixVersion or (lib.getVersion nixPackage));
-
   makeNixBuildUser = nr: {
     name = "nixbld${toString nr}";
     value = {
@@ -187,7 +183,7 @@ in
 
   ###### implementation
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf (cfg.enable && nixPackage.pname != "lix") {
     environment.systemPackages = [
       nixPackage
       pkgs.nix-info
@@ -196,26 +192,15 @@ in
 
     systemd.packages = [ nixPackage ];
 
-    systemd.tmpfiles = lib.mkMerge [
-      (lib.mkIf (isNixAtLeast "2.8") {
-        packages = [ nixPackage ];
-      })
-      (lib.mkIf (!isNixAtLeast "2.8") {
-        rules = [
-          "d /nix/var/nix/daemon-socket 0755 root root - -"
-        ];
-      })
-    ];
+    systemd.tmpfiles.packages = [ nixPackage ];
 
     systemd.sockets.nix-daemon.wantedBy = [ "sockets.target" ];
 
     systemd.services.nix-daemon = {
       path = [
         nixPackage
-        pkgs.util-linux
         config.programs.ssh.package
-      ]
-      ++ lib.optionals cfg.distributedBuilds [ pkgs.gzip ];
+      ];
 
       environment =
         cfg.envVars
@@ -224,15 +209,10 @@ in
         }
         // config.networking.proxy.envVars;
 
-      unitConfig.RequiresMountsFor = "/nix/store";
-
       serviceConfig = {
         CPUSchedulingPolicy = cfg.daemonCPUSchedPolicy;
         IOSchedulingClass = cfg.daemonIOSchedClass;
         IOSchedulingPriority = cfg.daemonIOSchedPriority;
-        LimitNOFILE = 1048576;
-        Delegate = "yes";
-        DelegateSubgroup = "supervisor";
       };
 
       restartTriggers = [ config.environment.etc."nix/nix.conf".source ];
@@ -287,10 +267,7 @@ in
     services.displayManager.hiddenUsers = lib.attrNames nixbldUsers;
 
     # Legacy configuration conversion.
-    nix.settings = lib.mkMerge [
-      (lib.mkIf (isNixAtLeast "2.3pre") { sandbox-fallback = false; })
-    ];
-
+    nix.settings.sandbox-fallback = false;
   };
 
 }
diff --git a/nixos/modules/system/activation/activatable-system.nix b/nixos/modules/system/activation/activatable-system.nix
index bb207ec0c18f..c3739f627a16 100644
--- a/nixos/modules/system/activation/activatable-system.nix
+++ b/nixos/modules/system/activation/activatable-system.nix
@@ -11,12 +11,6 @@ let
     mkOption
     types
     ;
-
-  systemBuilderArgs = {
-    activationScript = config.system.activationScripts.script;
-    dryActivationScript = config.system.dryActivationScript;
-  };
-
 in
 {
   options = {
@@ -52,36 +46,51 @@ in
       '';
     };
   };
-  config = {
-    system.activatableSystemBuilderCommands = ''
-      echo "$activationScript" > $out/activate
-      echo "$dryActivationScript" > $out/dry-activate
-      substituteInPlace $out/activate --subst-var-by out ''${!toplevelVar}
-      substituteInPlace $out/dry-activate --subst-var-by out ''${!toplevelVar}
-      chmod u+x $out/activate $out/dry-activate
-      unset activationScript dryActivationScript
-    '';
+  config =
+    let
+      activationScript = lib.getExe (
+        pkgs.writeShellApplication {
+          name = "activate";
+          text = config.system.activationScripts.script;
+          checkPhase = "";
+          bashOptions = [ ];
+        }
+      );
+      dryActivationScript = lib.getExe (
+        pkgs.writeShellApplication {
+          name = "dry-activate";
+          text = config.system.dryActivationScript;
+          checkPhase = "";
+          bashOptions = [ ];
+        }
+      );
+    in
+    {
+      system.activatableSystemBuilderCommands =
+        # We use sed here instead of substitute(InPlace), because the substitute
+        # functions load the content of the file into a bash variable, which fails
+        # for very large activation scripts.
+        # bash
+        ''
+          cp ${activationScript} $out/activate
+          cp ${dryActivationScript} $out/dry-activate
+          ${lib.getExe pkgs.gnused} --in-place --expression "s|@out@|''${!toplevelVar}|g" $out/activate $out/dry-activate
+        '';
 
-    system.systemBuilderCommands = lib.mkIf config.system.activatable config.system.activatableSystemBuilderCommands;
-    system.systemBuilderArgs = lib.mkIf config.system.activatable (
-      systemBuilderArgs
-      // {
+      system.systemBuilderCommands = lib.mkIf config.system.activatable config.system.activatableSystemBuilderCommands;
+      system.systemBuilderArgs = lib.mkIf config.system.activatable {
         toplevelVar = "out";
-      }
-    );
+      };
 
-    system.build.separateActivationScript =
-      pkgs.runCommand "separate-activation-script"
-        (
-          systemBuilderArgs
-          // {
+      system.build.separateActivationScript =
+        pkgs.runCommand "separate-activation-script"
+          {
             toplevelVar = "toplevel";
             toplevel = config.system.build.toplevel;
           }
-        )
-        ''
-          mkdir $out
-          ${config.system.activatableSystemBuilderCommands}
-        '';
-  };
+          ''
+            mkdir $out
+            ${config.system.activatableSystemBuilderCommands}
+          '';
+    };
 }
diff --git a/nixos/modules/system/activation/activation-script.nix b/nixos/modules/system/activation/activation-script.nix
index 08ab396e1de2..8fd274276a61 100644
--- a/nixos/modules/system/activation/activation-script.nix
+++ b/nixos/modules/system/activation/activation-script.nix
@@ -50,8 +50,6 @@ let
       ) withHeadlines;
     in
     ''
-      #!${pkgs.runtimeShell}
-
       source ${./lib/lib.sh}
 
       systemConfig='@out@'
diff --git a/nixos/modules/system/activation/switchable-system.nix b/nixos/modules/system/activation/switchable-system.nix
index a2e804e8a788..380b52b6825d 100644
--- a/nixos/modules/system/activation/switchable-system.nix
+++ b/nixos/modules/system/activation/switchable-system.nix
@@ -16,38 +16,129 @@
     '')
   ];
 
-  options.system.switch.enable = lib.mkOption {
-    type = lib.types.bool;
-    default = true;
-    description = ''
-      Whether to include the capability to switch configurations.
+  options.system.switch = {
+    enable = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = ''
+        Whether to include the capability to switch configurations.
 
-      Disabling this makes the system unable to be reconfigured via `nixos-rebuild`.
+        Disabling this makes the system unable to be reconfigured via `nixos-rebuild`.
 
-      This is good for image based appliances where updates are handled
-      outside the image. Reducing features makes the image lighter and
-      slightly more secure.
-    '';
+        This is good for image based appliances where updates are handled
+        outside the image. Reducing features makes the image lighter and
+        slightly more secure.
+      '';
+    };
+
+    inhibitors = lib.mkOption {
+      type = lib.types.listOf lib.types.pathInStore;
+      default = [ ];
+      description = ''
+        List of derivations that will prevent switching into a configuration when
+        they change.
+        This can be manually overridden on the command line if required.
+      '';
+    };
   };
 
   config = lib.mkIf config.system.switch.enable {
     # Use a subshell so we can source makeWrapper's setup hook without
     # affecting the rest of activatableSystemBuilderCommands.
-    system.activatableSystemBuilderCommands = ''
-      (
-        source ${pkgs.buildPackages.makeWrapper}/nix-support/setup-hook
+    system = {
+      activatableSystemBuilderCommands = ''
+        (
+          source ${pkgs.buildPackages.makeWrapper}/nix-support/setup-hook
 
-        mkdir $out/bin
-        ln -sf ${lib.getExe pkgs.switch-to-configuration-ng} $out/bin/switch-to-configuration
-        wrapProgram $out/bin/switch-to-configuration \
-          --set OUT $out \
-          --set TOPLEVEL ''${!toplevelVar} \
-          --set DISTRO_ID ${lib.escapeShellArg config.system.nixos.distroId} \
-          --set INSTALL_BOOTLOADER ${lib.escapeShellArg config.system.build.installBootLoader} \
-          --set PRE_SWITCH_CHECK ${lib.escapeShellArg config.system.preSwitchChecksScript} \
-          --set LOCALE_ARCHIVE ${config.i18n.glibcLocales}/lib/locale/locale-archive \
-          --set SYSTEMD ${config.systemd.package}
-      )
-    '';
+          mkdir $out/bin
+          ln -sf ${lib.getExe pkgs.switch-to-configuration-ng} $out/bin/switch-to-configuration
+          wrapProgram $out/bin/switch-to-configuration \
+            --set OUT $out \
+            --set TOPLEVEL ''${!toplevelVar} \
+            --set DISTRO_ID ${lib.escapeShellArg config.system.nixos.distroId} \
+            --set INSTALL_BOOTLOADER ${lib.escapeShellArg config.system.build.installBootLoader} \
+            --set PRE_SWITCH_CHECK ${lib.escapeShellArg config.system.preSwitchChecksScript} \
+            --set LOCALE_ARCHIVE ${config.i18n.glibcLocales}/lib/locale/locale-archive \
+            --set SYSTEMD ${config.systemd.package}
+        )
+      '';
+
+      systemBuilderCommands = ''
+        ln -s ${config.system.build.inhibitSwitch} $out/switch-inhibitors
+      '';
+
+      build.inhibitSwitch = pkgs.writeTextFile {
+        name = "switch-inhibitors";
+        text = lib.concatMapStringsSep "\n" (drv: drv.outPath) config.system.switch.inhibitors;
+      };
+
+      preSwitchChecks.switchInhibitors =
+        let
+          realpath = lib.getExe' pkgs.coreutils "realpath";
+          sha256sum = lib.getExe' pkgs.coreutils "sha256sum";
+          diff = lib.getExe' pkgs.diffutils "diff";
+        in
+        # bash
+        ''
+          incoming="''${1-}"
+          action="''${2-}"
+
+          if [ "$action" == "boot" ]; then
+            echo "Not checking switch inhibitors (action = $action)"
+            exit
+          fi
+
+          echo -n "Checking switch inhibitors..."
+
+          booted_inhibitors="$(${realpath} /run/booted-system)/switch-inhibitors"
+          booted_inhibitors_sha="$(
+            if [ -f "$booted_inhibitors" ]; then
+              ${sha256sum} - < "$booted_inhibitors"
+            else
+              echo 'none'
+            fi
+          )"
+
+          if [ "$booted_inhibitors_sha" == "none" ]; then
+            echo
+            echo "The previous configuration did not specify switch inhibitors, nothing to check."
+            exit
+          fi
+
+          new_inhibitors="$(${realpath} "$incoming")/switch-inhibitors"
+          new_inhibitors_sha="$(
+            if [ -f "$new_inhibitors" ]; then
+              ${sha256sum} - < "$new_inhibitors"
+            else
+              echo 'none'
+            fi
+          )"
+
+          if [ "$new_inhibitors_sha" == "none" ]; then
+            echo
+            echo "The new configuration does not specify switch inhibitors, nothing to check."
+            exit
+          fi
+
+          if [ "$new_inhibitors_sha" != "$booted_inhibitors_sha" ]; then
+            echo
+            echo "Found diff in switch inhibitors:"
+            echo
+            ${diff} --color "$booted_inhibitors" "$new_inhibitors"
+            echo
+            echo "The new configuration contains changes to packages that were"
+            echo "listed as switch inhibitors."
+            echo
+            echo "If you really want to switch into this configuration directly, then"
+            echo "you can set NIXOS_NO_CHECK=1 to ignore these pre-switch checks."
+            echo
+            echo "WARNING: doing so might cause the switch to fail or your system to become unstable."
+            echo
+            exit 1
+          else
+            echo " done"
+          fi
+        '';
+    };
   };
 }
diff --git a/nixos/modules/system/boot/stage-1-init.sh b/nixos/modules/system/boot/stage-1-init.sh
index b8dbfb70c0bb..cc0894593c30 100644
--- a/nixos/modules/system/boot/stage-1-init.sh
+++ b/nixos/modules/system/boot/stage-1-init.sh
@@ -73,7 +73,7 @@ trap 'fail' 0
 
 # Print a greeting.
 info
-info "<<< @distroName@ Stage 1 >>>"
+info "@stage1Greeting@"
 info
 
 # Make several required directories.
diff --git a/nixos/modules/system/boot/stage-1.nix b/nixos/modules/system/boot/stage-1.nix
index c87b3ecef4da..343777d05c3a 100644
--- a/nixos/modules/system/boot/stage-1.nix
+++ b/nixos/modules/system/boot/stage-1.nix
@@ -323,6 +323,7 @@ let
         postMountCommands
         preFailCommands
         kernelModules
+        stage1Greeting
         ;
 
       resumeDevices = map (sd: if sd ? device then sd.device else "/dev/disk/by-label/${sd.label}") (
@@ -686,6 +687,15 @@ in
       '';
     };
 
+    boot.initrd.stage1Greeting = mkOption {
+      type = types.str;
+      default = "<<< ${config.system.nixos.distroName} Stage 1 >>>";
+      defaultText = literalExpression ''"<<< ''${config.system.nixos.distroName} Stage 1 >>>"'';
+      description = ''
+        The greeting message displayed during NixOS stage 1 boot.
+      '';
+    };
+
     boot.loader.supportsInitrdSecrets = mkOption {
       internal = true;
       default = false;
diff --git a/nixos/modules/system/boot/stage-2-init.sh b/nixos/modules/system/boot/stage-2-init.sh
index e960f1bbcc39..cb7cec2afece 100755
--- a/nixos/modules/system/boot/stage-2-init.sh
+++ b/nixos/modules/system/boot/stage-2-init.sh
@@ -19,7 +19,7 @@ if [ "${IN_NIXOS_SYSTEMD_STAGE1:-}" != true ]; then
 
     # Print a greeting.
     echo
-    echo -e "\e[1;32m<<< @distroName@ Stage 2 >>>\e[0m"
+    echo -e "\e[1;32m@stage2Greeting@\e[0m"
     echo
 
 
diff --git a/nixos/modules/system/boot/stage-2.nix b/nixos/modules/system/boot/stage-2.nix
index 9565ac5e8ef1..680f5eed55c0 100644
--- a/nixos/modules/system/boot/stage-2.nix
+++ b/nixos/modules/system/boot/stage-2.nix
@@ -17,9 +17,8 @@ let
     replacements = {
       shell = "${pkgs.bash}/bin/bash";
       systemConfig = null; # replaced in ../activation/top-level.nix
-      inherit (config.boot) systemdExecutable;
+      inherit (config.boot) systemdExecutable stage2Greeting;
       nixStoreMountOpts = lib.concatStringsSep " " (map lib.escapeShellArg config.boot.nixStoreMountOpts);
-      inherit (config.system.nixos) distroName;
       inherit useHostResolvConf;
       inherit (config.system.build) earlyMountScript;
       path = lib.makeBinPath (
@@ -87,6 +86,15 @@ in
         '';
       };
 
+      stage2Greeting = mkOption {
+        type = types.str;
+        default = "<<< ${config.system.nixos.distroName} Stage 2 >>>";
+        defaultText = literalExpression ''"<<< ''${config.system.nixos.distroName} Stage 2 >>>"'';
+        description = ''
+          The greeting message displayed during NixOS stage 2 boot.
+        '';
+      };
+
       extraSystemdUnitPaths = mkOption {
         default = [ ];
         type = types.listOf types.str;
diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index 7fb5c2259062..25bd4c624bfe 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -567,6 +567,10 @@ in
       );
     };
 
+    system.switch.inhibitors = [
+      cfg.package
+    ];
+
     environment.systemPackages = [ cfg.package ];
 
     environment.etc =
diff --git a/nixos/modules/tasks/auto-upgrade.nix b/nixos/modules/tasks/auto-upgrade.nix
index 7028c0be444d..8bb445db9352 100644
--- a/nixos/modules/tasks/auto-upgrade.nix
+++ b/nixos/modules/tasks/auto-upgrade.nix
@@ -114,6 +114,27 @@ in
         '';
       };
 
+      rebootTriggers = lib.mkOption {
+        type = lib.types.listOf lib.types.pathInStore;
+        default = [ ];
+        description = ''
+          List of derivations that will cause an auto-reboot when changed when
+          {option}`system.autoUpgrade.allowReboot` is set to true.
+        '';
+        defaultText = lib.literalExpression ''
+          [
+            config.system.build.initialRamdisk
+            config.system.build.kernel
+            config.hardware.firmware
+            (pkgs.writeTextFile {
+              name = "kernel-params";
+              text = lib.concatStringsSep " " config.boot.kernelParams;
+            })
+          ]
+          ++ config.system.switch.inhibitors
+        '';
+      };
+
       randomizedDelaySec = lib.mkOption {
         default = "0";
         type = lib.types.str;
@@ -197,133 +218,205 @@ in
 
   };
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkMerge [
 
-    assertions = [
-      {
-        assertion = !((cfg.channel != null) && (cfg.flake != null));
-        message = ''
-          The options 'system.autoUpgrade.channel' and 'system.autoUpgrade.flake' cannot both be set.
-        '';
-      }
-      {
-        assertion = (cfg.runGarbageCollection -> config.nix.enable);
-        message = ''
-          The option 'system.autoUpgrade.runGarbageCollection = true' requires 'nix.enable = true'.
-        '';
-      }
-    ];
-
-    system.autoUpgrade.flags = (
-      if cfg.flake == null then
-        [ "--no-build-output" ]
-        ++ lib.optionals (cfg.channel != null) [
-          "-I"
-          "nixpkgs=${cfg.channel}/nixexprs.tar.xz"
+    {
+      system = {
+        autoUpgrade.rebootTriggers = [
+          config.system.build.initialRamdisk
+          config.system.build.kernel
+          config.hardware.firmware
+          (pkgs.writeTextFile {
+            name = "kernel-params";
+            text = lib.concatStringsSep " " config.boot.kernelParams;
+          })
         ]
-      else
-        [
-          "--refresh"
-          "--flake ${cfg.flake}"
-        ]
-    );
+        ++ config.system.switch.inhibitors;
 
-    systemd.services.nixos-upgrade = {
-      description = "NixOS Upgrade";
+        systemBuilderCommands = ''
+          ln -s ${config.system.build.rebootTriggers} $out/reboot-triggers
+        '';
 
-      restartIfChanged = false;
-      unitConfig.X-StopOnRemoval = false;
-      unitConfig.OnSuccess = lib.optional (
-        cfg.runGarbageCollection && config.nix.enable
-      ) "nix-gc.service";
+        build.rebootTriggers = pkgs.writeTextFile {
+          name = "reboot-triggers";
+          text = lib.concatMapStringsSep "\n" (drv: drv.outPath) config.system.autoUpgrade.rebootTriggers;
+        };
+      };
+    }
 
-      serviceConfig.Type = "oneshot";
-
-      environment =
-        config.nix.envVars
-        // {
-          inherit (config.environment.sessionVariables) NIX_PATH;
-          HOME = "/root";
+    (lib.mkIf cfg.enable {
+      assertions = [
+        {
+          assertion = !((cfg.channel != null) && (cfg.flake != null));
+          message = ''
+            The options 'system.autoUpgrade.channel' and 'system.autoUpgrade.flake' cannot both be set.
+          '';
+        }
+        {
+          assertion = (cfg.runGarbageCollection -> config.nix.enable);
+          message = ''
+            The option 'system.autoUpgrade.runGarbageCollection = true' requires 'nix.enable = true'.
+          '';
         }
-        // config.networking.proxy.envVars;
-
-      path = with pkgs; [
-        coreutils
-        gnutar
-        xz.bin
-        gzip
-        gitMinimal
-        config.nix.package.out
-        config.programs.ssh.package
       ];
 
-      script =
-        let
-          nixos-rebuild = "${config.system.build.nixos-rebuild}/bin/nixos-rebuild";
-          date = "${pkgs.coreutils}/bin/date";
-          readlink = "${pkgs.coreutils}/bin/readlink";
-          shutdown = "${config.systemd.package}/bin/shutdown";
-          upgradeFlag = lib.optional (cfg.channel == null && cfg.upgrade) "--upgrade";
-        in
-        if cfg.allowReboot then
-          ''
-            ${nixos-rebuild} boot ${toString (cfg.flags ++ upgradeFlag)}
-            booted="$(${readlink} /run/booted-system/{initrd,kernel,kernel-modules})"
-            built="$(${readlink} /nix/var/nix/profiles/system/{initrd,kernel,kernel-modules})"
-
-            ${lib.optionalString (cfg.rebootWindow != null) ''
-              current_time="$(${date} +%H:%M)"
-
-              lower="${cfg.rebootWindow.lower}"
-              upper="${cfg.rebootWindow.upper}"
-
-              if [[ "''${lower}" < "''${upper}" ]]; then
-                if [[ "''${current_time}" > "''${lower}" ]] && \
-                   [[ "''${current_time}" < "''${upper}" ]]; then
-                  do_reboot="true"
-                else
-                  do_reboot="false"
-                fi
-              else
-                # lower > upper, so we are crossing midnight (e.g. lower=23h, upper=6h)
-                # we want to reboot if cur > 23h or cur < 6h
-                if [[ "''${current_time}" < "''${upper}" ]] || \
-                   [[ "''${current_time}" > "''${lower}" ]]; then
-                  do_reboot="true"
-                else
-                  do_reboot="false"
-                fi
-              fi
-            ''}
-
-            if [ "''${booted}" = "''${built}" ]; then
-              ${nixos-rebuild} ${cfg.operation} ${toString cfg.flags}
-            ${lib.optionalString (cfg.rebootWindow != null) ''
-              elif [ "''${do_reboot}" != true ]; then
-                echo "Outside of configured reboot window, skipping."
-            ''}
-            else
-              ${shutdown} -r +1
-            fi
-          ''
+      system.autoUpgrade.flags = (
+        if cfg.flake == null then
+          [ "--no-build-output" ]
+          ++ lib.optionals (cfg.channel != null) [
+            "-I"
+            "nixpkgs=${cfg.channel}/nixexprs.tar.xz"
+          ]
         else
-          ''
-            ${nixos-rebuild} ${cfg.operation} ${toString (cfg.flags ++ upgradeFlag)}
-          '';
+          [
+            "--refresh"
+            "--flake ${cfg.flake}"
+          ]
+      );
 
-      startAt = cfg.dates;
+      systemd.services.nixos-upgrade = {
+        description = "NixOS Upgrade";
 
-      after = [ "network-online.target" ];
-      wants = [ "network-online.target" ];
-    };
+        restartIfChanged = false;
+        unitConfig.X-StopOnRemoval = false;
+        unitConfig.OnSuccess = lib.optional (
+          cfg.runGarbageCollection && config.nix.enable
+        ) "nix-gc.service";
 
-    systemd.timers.nixos-upgrade = {
-      timerConfig = {
-        RandomizedDelaySec = cfg.randomizedDelaySec;
-        FixedRandomDelay = cfg.fixedRandomDelay;
-        Persistent = cfg.persistent;
+        serviceConfig.Type = "oneshot";
+
+        environment =
+          config.nix.envVars
+          // {
+            inherit (config.environment.sessionVariables) NIX_PATH;
+            HOME = "/root";
+          }
+          // config.networking.proxy.envVars;
+
+        path = with pkgs; [
+          coreutils
+          gnutar
+          xz.bin
+          gzip
+          gitMinimal
+          config.nix.package.out
+          config.programs.ssh.package
+          config.system.build.nixos-rebuild
+          config.systemd.package
+        ];
+
+        script =
+          let
+            upgradeFlag = lib.optional (cfg.channel == null && cfg.flake == null) "--upgrade";
+          in
+          if cfg.allowReboot then
+            # bash
+            ''
+              echo "Running nixos-rebuild boot..."
+              new_configuration="$(
+                # For some reason we still get a newline here in the journal between the
+                # nixos-rebuild stderr output and us echoing the store path that was
+                # printed on stdout.
+                # This might have to do with the particular way in which systemd handles
+                # stdout/stderr, they are unix sockets and not normal streams.
+                store_path="$(nixos-rebuild boot ${toString (cfg.flags ++ upgradeFlag)})"
+                echo "$store_path" >&2
+                echo "$store_path"
+              )"
+              if [ -z "$new_configuration" ]; then
+                echo "Looks like nixos-rebuild failed... Aborting"
+                exit 1
+              fi
+              echo "New configuration is $new_configuration"
+              switch_to_new_configuration="$new_configuration"/bin/switch-to-configuration
+
+              ${lib.optionalString (cfg.rebootWindow != null) # bash
+                ''
+                  current_time="$(date +%H:%M)"
+
+                  lower="${cfg.rebootWindow.lower}"
+                  upper="${cfg.rebootWindow.upper}"
+
+                  if [[ "''${lower}" < "''${upper}" ]]; then
+                    if [[ "''${current_time}" > "''${lower}" ]] && [[ "''${current_time}" < "''${upper}" ]]; then
+                      do_reboot="true"
+                    else
+                      do_reboot="false"
+                    fi
+                  else
+                    # lower > upper, so we are crossing midnight (e.g. lower=23h, upper=6h)
+                    # we want to reboot if cur > 23h or cur < 6h
+                    if [[ "''${current_time}" < "''${upper}" ]] || [[ "''${current_time}" > "''${lower}" ]]; then
+                      do_reboot="true"
+                    else
+                      do_reboot="false"
+                    fi
+                  fi
+                ''
+              }
+
+              booted_triggers="$(realpath /run/booted-system)/reboot-triggers"
+              booted_triggers_sha="$(
+                if [ -f "$booted_triggers" ]; then
+                  sha256sum - < "$booted_triggers"
+                else
+                  echo 'none'
+                fi
+              )"
+
+              new_triggers="$(realpath "$new_configuration")/reboot-triggers"
+              new_triggers_sha="$(
+                if [ -f "$new_triggers" ]; then
+                  sha256sum - < "$new_triggers"
+                else
+                  echo 'none'
+                fi
+              )"
+
+              ${lib.optionalString (cfg.operation == "switch") # bash
+                ''
+                  echo "Running switch-to-configuration check..."
+                  if "$switch_to_new_configuration" check; then
+                    echo "Checking reboot triggers..."
+                    if [ "$new_triggers_sha" == "$booted_triggers_sha" ]; then
+                      echo "Switching into the new generation..."
+                      "$switch_to_new_configuration" ${cfg.operation}
+                      exit 0
+                    fi
+                  fi
+                ''
+              }
+              ${lib.optionalString (cfg.rebootWindow != null) # bash
+                ''
+                  if [ "''${do_reboot}" != true ]; then
+                    echo "Outside of configured reboot window, skipping."
+                    exit 0
+                  fi
+                ''
+              }
+              echo "Scheduling a reboot to activate the new generation"
+              systemctl reboot --when="+2min"
+            ''
+          else
+            # bash
+            ''
+              nixos-rebuild ${cfg.operation} ${toString (cfg.flags ++ upgradeFlag)}
+            '';
+
+        startAt = cfg.dates;
+
+        after = [ "network-online.target" ];
+        wants = [ "network-online.target" ];
       };
-    };
-  };
 
+      systemd.timers.nixos-upgrade = {
+        timerConfig = {
+          RandomizedDelaySec = cfg.randomizedDelaySec;
+          FixedRandomDelay = cfg.fixedRandomDelay;
+          Persistent = cfg.persistent;
+        };
+      };
+    })
+
+  ];
 }
diff --git a/nixos/tests/openssh.nix b/nixos/tests/openssh.nix
index 4bf584338c49..97ed224b5afb 100644
--- a/nixos/tests/openssh.nix
+++ b/nixos/tests/openssh.nix
@@ -290,23 +290,23 @@ in
   testScript = ''
     start_all()
 
-    server.wait_for_unit("sshd", timeout=30)
-    server_allowed_users.wait_for_unit("sshd", timeout=30)
-    server_localhost_only.wait_for_unit("sshd", timeout=30)
-    server_match_rule.wait_for_unit("sshd", timeout=30)
-    server_no_openssl.wait_for_unit("sshd", timeout=30)
-    server_no_pam.wait_for_unit("sshd", timeout=30)
-    server_null_pam.wait_for_unit("sshd", timeout=30)
+    server.wait_for_unit("sshd", timeout=60)
+    server_allowed_users.wait_for_unit("sshd", timeout=60)
+    server_localhost_only.wait_for_unit("sshd", timeout=60)
+    server_match_rule.wait_for_unit("sshd", timeout=60)
+    server_no_openssl.wait_for_unit("sshd", timeout=60)
+    server_no_pam.wait_for_unit("sshd", timeout=60)
+    server_null_pam.wait_for_unit("sshd", timeout=60)
     server_null_pam.fail("journalctl -u sshd.service | grep 'Unsupported option UsePAM'")
-    server_sftp.wait_for_unit("sshd", timeout=30)
+    server_sftp.wait_for_unit("sshd", timeout=60)
 
-    server_lazy.wait_for_unit("sshd.socket", timeout=30)
-    server_localhost_only_lazy.wait_for_unit("sshd.socket", timeout=30)
-    server_lazy_socket.wait_for_unit("sshd.socket", timeout=30)
+    server_lazy.wait_for_unit("sshd.socket", timeout=60)
+    server_localhost_only_lazy.wait_for_unit("sshd.socket", timeout=60)
+    server_lazy_socket.wait_for_unit("sshd.socket", timeout=60)
 
     # sshd-keygen is a oneshot unit, so just wait for multi-user.target, which
     # pulls it in.
-    server_no_sshd_with_key.wait_for_unit("multi-user.target", timeout=30)
+    server_no_sshd_with_key.wait_for_unit("multi-user.target", timeout=60)
 
     with subtest("manual-authkey"):
         client.succeed(
diff --git a/nixos/tests/restart-by-activation-script.nix b/nixos/tests/restart-by-activation-script.nix
index 6d26d9843aff..2fad1f21584e 100644
--- a/nixos/tests/restart-by-activation-script.nix
+++ b/nixos/tests/restart-by-activation-script.nix
@@ -6,7 +6,7 @@
   };
 
   nodes.machine =
-    { pkgs, ... }:
+    { pkgs, lib, ... }:
     {
       imports = [ ../modules/profiles/minimal.nix ];
 
@@ -46,6 +46,14 @@
           fi
         '';
       };
+
+      # Make sure we don't crash on long activation scripts
+      specialisation.longscript.configuration = {
+        system.activationScripts.long = {
+          supportsDryActivation = true;
+          text = lib.concatStringsSep "\n" (lib.genList (i: ''# line number ${toString i}'') 1000000);
+        };
+      };
     };
 
   testScript = # python
diff --git a/pkgs/by-name/bi/bind/package.nix b/pkgs/by-name/bi/bind/package.nix
index 208db30f4350..6eb8f91e4c1d 100644
--- a/pkgs/by-name/bi/bind/package.nix
+++ b/pkgs/by-name/bi/bind/package.nix
@@ -29,11 +29,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bind";
-  version = "9.20.16";
+  version = "9.20.17";
 
   src = fetchurl {
     url = "https://downloads.isc.org/isc/bind9/${finalAttrs.version}/bind-${finalAttrs.version}.tar.xz";
-    hash = "sha256-A//Mek/LfDm4KzS+G6K1n2wZG8eVxZNVMNXr5jCjUtY=";
+    hash = "sha256-XMiaCdoJF+sd32QMwHwXL/RPqbvzo0raS2ovfucP8cg=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/de/devenv/package.nix b/pkgs/by-name/de/devenv/package.nix
index 1d9633ccf52e..6fe3cacc41ca 100644
--- a/pkgs/by-name/de/devenv/package.nix
+++ b/pkgs/by-name/de/devenv/package.nix
@@ -1,6 +1,7 @@
 {
   lib,
   fetchFromGitHub,
+  fetchpatch2,
   gitMinimal,
   makeBinaryWrapper,
   installShellFiles,
@@ -20,16 +21,27 @@ let
   devenvNixVersion = "2.30.4";
 
   devenv_nix =
+    let
+      components =
+        (nixVersions.nixComponents_git.override { version = devenvNixVersion; }).overrideSource
+          (fetchFromGitHub {
+            owner = "cachix";
+            repo = "nix";
+            rev = "devenv-${devenvNixVersion}";
+            hash = "sha256-3+GHIYGg4U9XKUN4rg473frIVNn8YD06bjwxKS1IPrU=";
+          });
+    in
     (
-      (nixVersions.nixComponents_git.override { version = devenvNixVersion; })
-      .nix-everything.overrideSource
-      (fetchFromGitHub {
-        owner = "cachix";
-        repo = "nix";
-        rev = "devenv-${devenvNixVersion}";
-        hash = "sha256-3+GHIYGg4U9XKUN4rg473frIVNn8YD06bjwxKS1IPrU=";
-      })
-    ).overrideAttrs
+      # Support for mdbook >= 0.5, https://github.com/NixOS/nix/issues/14628
+      components.appendPatches [
+        (fetchpatch2 {
+          name = "nix-2.30-14695-mdbook-0.5-support.patch";
+          url = "https://github.com/NixOS/nix/commit/5cbd7856de0a9c13351f98e32a1e26d0854d87fd.patch";
+          excludes = [ "doc/manual/package.nix" ];
+          hash = "sha256-GYaTOG9wZT9UI4G6za535PkLyjHKSxwBjJsXbjmI26g=";
+        })
+      ]
+    ).nix-everything.overrideAttrs
       (old: {
         pname = "devenv-nix";
         version = devenvNixVersion;
diff --git a/pkgs/by-name/en/engage/mdbook-0.5-support.patch b/pkgs/by-name/en/engage/mdbook-0.5-support.patch
new file mode 100644
index 000000000000..0082bf5e7a37
--- /dev/null
+++ b/pkgs/by-name/en/engage/mdbook-0.5-support.patch
@@ -0,0 +1,16 @@
+--- a/book.toml
++++ b/book.toml
+@@ -1,6 +1,5 @@
+ [book]
+ language = "en"
+-multilingual = false
+ src = "book"
+ title = "Engage"
+
+@@ -8,5 +7,5 @@ build-dir = "public"
+
+ [output.html]
+-git-repository-icon = "fa-git-square"
++git-repository-icon = "fab-square-git"
+ git-repository-url = "https://gitlab.computer.surgery/charles/engage"
+
diff --git a/pkgs/by-name/en/engage/package.nix b/pkgs/by-name/en/engage/package.nix
index 6ae2bde48e24..2d57f8307c77 100644
--- a/pkgs/by-name/en/engage/package.nix
+++ b/pkgs/by-name/en/engage/package.nix
@@ -28,6 +28,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-n7ypFJBYT712Uzh1NnWWSOIpEDKR0e6sQxbiIN6pZgo=";
   };
 
+  patches = [
+    # Support mdbook 0.5.x - remove deprecated multilingual field
+    ./mdbook-0.5-support.patch
+  ];
+
   cargoHash = "sha256-UTIxxPBtxzsZilxriAT8ksl2ovoDzIhB+8f+b2cGN3k=";
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/he/helix/mdbook-0.5-support.patch b/pkgs/by-name/he/helix/mdbook-0.5-support.patch
new file mode 100644
index 000000000000..11591af15937
--- /dev/null
+++ b/pkgs/by-name/he/helix/mdbook-0.5-support.patch
@@ -0,0 +1,14 @@
+--- a/helix-term/src/commands.rs
++++ b/helix-term/src/commands.rs
+@@ -424,9 +424,9 @@ impl MappableCommand {
+         add_newline_below, "Add newline below",
+         goto_type_definition, "Goto type definition",
+         goto_implementation, "Goto implementation",
+-        goto_file_start, "Goto line number <n> else file start",
++        goto_file_start, "Goto line number &lt;n&gt; else file start",
+         goto_file_end, "Goto file end",
+-        extend_to_file_start, "Extend to line number<n> else file start",
++        extend_to_file_start, "Extend to line number &lt;n&gt; else file start",
+         extend_to_file_end, "Extend to file end",
+         goto_file, "Goto files/URLs in selections",
+         goto_file_hsplit, "Goto files in selections (hsplit)",
diff --git a/pkgs/by-name/he/helix/package.nix b/pkgs/by-name/he/helix/package.nix
index 1355ee7b76e8..b71f940fe492 100644
--- a/pkgs/by-name/he/helix/package.nix
+++ b/pkgs/by-name/he/helix/package.nix
@@ -1,5 +1,6 @@
 {
   fetchzip,
+  fetchpatch,
   lib,
   rustPlatform,
   mdbook,
@@ -25,6 +26,17 @@ rustPlatform.buildRustPackage (final: {
     stripRoot = false;
   };
 
+  patches = [
+    # Support mdbook 0.5.x: escape HTML tags in command descriptions
+    ./mdbook-0.5-support.patch
+  ];
+
+  postPatch = ''
+    # mdbook 0.5 uses asset hashing for CSS/JS files
+    # Remove custom theme to use default mdbook theme with correct asset references
+    rm -f book/theme/index.hbs
+  '';
+
   cargoHash = "sha256-Mf0nrgMk1MlZkSyUN6mlM5lmTcrOHn3xBNzmVGtApEU=";
 
   nativeBuildInputs = [
@@ -49,7 +61,7 @@ rustPlatform.buildRustPackage (final: {
     mkdir -p $out/share/{applications,icons/hicolor/256x256/apps}
     cp contrib/Helix.desktop $out/share/applications
     cp contrib/helix.png $out/share/icons/hicolor/256x256/apps
-    cp -r book-html $doc/share/doc/$name
+    cp -r ../book-html $doc/share/doc/$name
   '';
 
   nativeInstallCheckInputs = [
diff --git a/pkgs/by-name/md/mdbook-cmdrun/package.nix b/pkgs/by-name/md/mdbook-cmdrun/package.nix
index 125056be57e0..30597d4df679 100644
--- a/pkgs/by-name/md/mdbook-cmdrun/package.nix
+++ b/pkgs/by-name/md/mdbook-cmdrun/package.nix
@@ -10,13 +10,14 @@
 
 rustPlatform.buildRustPackage {
   pname = "mdbook-cmdrun";
-  version = "0.6.0-unstable-2024-04-15";
+  version = "0.7.3-unstable-2025-12-22";
 
+  # mdbook 0.5 upgrade: https://github.com/FauconFan/mdbook-cmdrun/pull/23
   src = fetchFromGitHub {
-    owner = "FauconFan";
+    owner = "roberth";
     repo = "mdbook-cmdrun";
-    rev = "d1fef67f100563c2a433b1f5dd5a71810db6b90d";
-    hash = "sha256-Q2h64XCyDxLmmCNC3wTw81pBotaMEUjY5y0Oq6q20cQ=";
+    rev = "3947c797d063352e0f983311c078430215cc1cca";
+    hash = "sha256-0RkyMJ8tsnGcSD0ksGTGAyliH6AihVl0HEesljEmTH8=";
   };
 
   nativeCheckInputs = [
@@ -26,7 +27,7 @@ rustPlatform.buildRustPackage {
     util-linux # used by tests/regression/shell/input.md
   ];
 
-  cargoHash = "sha256-C3Rg+WXHBA7KyUDFdhBz4mOm8CFH/f7UVA8KOLs9ClE=";
+  cargoHash = "sha256-oUlH+z50a1FtzDADXfGKSYjauZGTok0bVMq718HLglY=";
 
   meta = {
     description = "mdbook preprocessor to run arbitrary commands";
diff --git a/pkgs/by-name/md/mdbook/package.nix b/pkgs/by-name/md/mdbook/package.nix
index 6a21c8180575..010aabc320d4 100644
--- a/pkgs/by-name/md/mdbook/package.nix
+++ b/pkgs/by-name/md/mdbook/package.nix
@@ -8,7 +8,7 @@
   installShellFiles,
 }:
 let
-  version = "0.4.52";
+  version = "0.5.1";
 in
 rustPlatform.buildRustPackage rec {
   inherit version;
@@ -18,18 +18,10 @@ rustPlatform.buildRustPackage rec {
     owner = "rust-lang";
     repo = "mdBook";
     tag = "v${version}";
-    hash = "sha256-a3GSMz1+8Ve5cp4x1NjBlsCU/wMC4Jl3/H9qx7+1XlI=";
+    hash = "sha256-t7Qou3H6dlO97puWQGkPlyb0jjpGoYCrz041iZWWL/s=";
   };
 
-  cargoHash = "sha256-wvTixSVHXglJM+nBMulZNZKF8pZfNd2G8Z+1PlAWmpk=";
-
-  patches = [
-    (fetchpatch2 {
-      name = "fix-rust-1.91-tests.patch";
-      url = "https://github.com/rust-lang/mdBook/commit/841c68d05e763b031524a2b4d679f033cd15e64c.patch?full_index=1";
-      hash = "sha256-KDQhmFX2TWamtdyssFL69MP3vg9LABb+bF8/7vaFsew=";
-    })
-  ];
+  cargoHash = "sha256-bJr0u025syrP/LGgIbXD0mRvQrvnnOntiaAfr/9tQ90=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/ru/ruff/package.nix b/pkgs/by-name/ru/ruff/package.nix
index f96425f63112..7e2f0084c645 100644
--- a/pkgs/by-name/ru/ruff/package.nix
+++ b/pkgs/by-name/ru/ruff/package.nix
@@ -16,18 +16,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ruff";
-  version = "0.14.9";
+  version = "0.14.10";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "ruff";
     tag = finalAttrs.version;
-    hash = "sha256-2EuI11mdwxKry7d56Ua7ZEU7K0XMgIVHm1zSVoWLkzM=";
+    hash = "sha256-YwgW3sjI3l3H9Tq2BO7yDOhiiaIy///xxj4UQYq39gI=";
   };
 
   cargoBuildFlags = [ "--package=ruff" ];
 
-  cargoHash = "sha256-db45h6I5tCcPMbPGa/dV3eJ9CxCwnGShmHdg92AUhv0=";
+  cargoHash = "sha256-NyNXR1PGds+GXAha9u4DglUyy7T+yqLjNpGnchYn6oc=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/wo/wolfssl/package.nix b/pkgs/by-name/wo/wolfssl/package.nix
index b85e2c2016e0..e904c4dfefcc 100644
--- a/pkgs/by-name/wo/wolfssl/package.nix
+++ b/pkgs/by-name/wo/wolfssl/package.nix
@@ -17,13 +17,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "wolfssl-${variant}";
-  version = "5.8.2";
+  version = "5.8.4";
 
   src = fetchFromGitHub {
     owner = "wolfSSL";
     repo = "wolfssl";
     tag = "v${finalAttrs.version}-stable";
-    hash = "sha256-rWBfpI6tdpKvQA/XdazBvU5hzyai5PtKRBpM4iplZDU=";
+    hash = "sha256-vfJKmDdM0r591t5GnuSS7NyiUYXCQOTKbWLVydB3N9s=";
   };
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/busybox/default.nix b/pkgs/os-specific/linux/busybox/default.nix
index 1142e8c1fc30..873d5ec4c91d 100644
--- a/pkgs/os-specific/linux/busybox/default.nix
+++ b/pkgs/os-specific/linux/busybox/default.nix
@@ -57,14 +57,14 @@ in
 
 stdenv.mkDerivation rec {
   pname = "busybox";
-  version = "1.36.1";
+  version = "1.37.0";
 
   # Note to whoever is updating busybox: please verify that:
   # nix-build pkgs/stdenv/linux/make-bootstrap-tools.nix -A test
   # still builds after the update.
   src = fetchurl {
     url = "https://busybox.net/downloads/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-uMwkyVdNgJ5yecO+NJeVxdXOtv3xnKcJ+AzeUOR94xQ=";
+    sha256 = "sha256-MxHf8y50ZJn03w1d8E1+s5Y4LX4Qi7klDntRm4NwQ6Q=";
   };
 
   hardeningDisable = [
@@ -77,53 +77,9 @@ stdenv.mkDerivation rec {
     # necessary when it's run from the Nix store as <hash>-busybox during
     # stdenv bootstrap.
     ./busybox-in-store.patch
-    # libbb: sockaddr2str: ensure only printable characters are returned for the hostname part
-    (fetchurl {
-      name = "CVE-2022-28391.patch";
-      url = "https://git.alpinelinux.org/aports/plain/main/busybox/0001-libbb-sockaddr2str-ensure-only-printable-characters-.patch?id=ed92963eb55bbc8d938097b9ccb3e221a94653f4";
-      sha256 = "sha256-yviw1GV+t9tbHbY7YNxEqPi7xEreiXVqbeRyf8c6Awo=";
-    })
-    # nslookup: sanitize all printed strings with printable_string
-    (fetchurl {
-      name = "CVE-2022-28391.patch";
-      url = "https://git.alpinelinux.org/aports/plain/main/busybox/0002-nslookup-sanitize-all-printed-strings-with-printable.patch?id=ed92963eb55bbc8d938097b9ccb3e221a94653f4";
-      sha256 = "sha256-vl1wPbsHtXY9naajjnTicQ7Uj3N+EQ8pRNnrdsiow+w=";
-    })
-    # shell: avoid segfault on ${0::0/0~09J}
-    # See also: https://bugs.busybox.net/show_bug.cgi?id=15216
-    (fetchpatch {
-      name = "CVE-2022-48174.patch";
-      url = "https://git.busybox.net/busybox/patch/?id=d417193cf37ca1005830d7e16f5fa7e1d8a44209";
-      hash = "sha256-mpDEwYncpU6X6tmtj9xM2KCrB/v2ys5bYxmPPrhm6es=";
-    })
-    # Make sure we don't read past the end of the string in next_token()
-    # when backslash is the last character in an (invalid) regexp.
-    # See also: https://bugs.busybox.net/show_bug.cgi?id=15874
-    # This patch is also used by Alpine, see https://git.alpinelinux.org/aports/tree/main/busybox/0037-awk.c-fix-CVE-2023-42366-bug-15874.patch
-    (fetchpatch {
-      name = "CVE-2023-42366.patch";
-      url = "https://bugs.busybox.net/attachment.cgi?id=9697";
-      hash = "sha256-2eYfLZLjStea9apKXogff6sCAdG9yHx0ZsgUBaGfQIA=";
-    })
-    # awk: fix use after free (CVE-2023-42363)
-    # See also: https://bugs.busybox.net/show_bug.cgi?id=15865
-    (fetchpatch {
-      name = "CVE-2023-42363.patch";
-      url = "https://git.launchpad.net/ubuntu/+source/busybox/plain/debian/patches/CVE-2023-42363.patch?id=c9d8a323b337d58e302717d41796aa0242963d5a";
-      hash = "sha256-1W9Q8+yFkYQKzNTrvndie8QuaEbyAFL1ZASG2fPF+Z4=";
-    })
-    # awk: fix ternary operator and precedence of =
-    # See also: https://bugs.busybox.net/show_bug.cgi?id=15871 https://bugs.busybox.net/show_bug.cgi?id=15868
-    (fetchpatch {
-      name = "CVE-2023-42364_CVE-2023-42365.patch";
-      url = "https://git.alpinelinux.org/aports/plain/main/busybox/CVE-2023-42364-CVE-2023-42365.patch?id=8a4bf5971168bf48201c05afda7bee0fbb188e13";
-      hash = "sha256-nQPgT9eA1asCo38Z9X7LR9My0+Vz5YBPba3ARV3fWcc=";
-    })
-    # tar: fix TOCTOU symlink race condition
-    (fetchurl {
-      url = "https://git.alpinelinux.org/aports/plain/main/busybox/0001-tar-fix-TOCTOU-symlink-race-condition.patch?id=9e42dea5fba84a8afad1f1910b7d3884128a567e";
-      hash = "sha256-GmXQhwB1/IPVjXXpGi5RjRvuGJgIMIb7lQKB63m306g=";
-    })
+    # Fix aarch64 build failure: sha1_process_block64_shaNI is x86-specific
+    # https://lists.busybox.net/pipermail/busybox/2024-September/090943.html
+    ./fix-aarch64-sha1.patch
   ]
   ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) ./clang-cross.patch;
 
diff --git a/pkgs/os-specific/linux/busybox/fix-aarch64-sha1.patch b/pkgs/os-specific/linux/busybox/fix-aarch64-sha1.patch
new file mode 100644
index 000000000000..83fe7a2bb6f1
--- /dev/null
+++ b/pkgs/os-specific/linux/busybox/fix-aarch64-sha1.patch
@@ -0,0 +1,24 @@
+From upstream commit fixing aarch64 build failure
+
+The sha1_process_block64_shaNI function is x86-specific and needs
+architecture guards to prevent undeclared function errors on ARM64
+and other non-x86 platforms.
+
+This fixes the compile error: 'sha1_process_block64_shaNI' undeclared
+(first use in this function)
+
+Reference: https://lists.busybox.net/pipermail/busybox/2024-September/090943.html
+Upstream patch: https://www.mail-archive.com/busybox@busybox.net/msg29511.html
+
+--- a/libbb/hash_md5_sha.c
++++ b/libbb/hash_md5_sha.c
+@@ -1313,7 +1313,9 @@ unsigned FAST_FUNC sha1_end(sha1_ctx_t *ctx, void *resbuf)
+ 	hash_size = 8;
+ 	if (ctx->process_block == sha1_process_block64
+ #if ENABLE_SHA1_HWACCEL
++# if defined(__GNUC__) && (defined(__i386__) || defined(__x86_64__))
+ 	 || ctx->process_block == sha1_process_block64_shaNI
++# endif
+ #endif
+ 	) {
+ 		hash_size = 5;
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 1d5867631002..e1380b86a11f 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -1328,6 +1328,14 @@ let
         HOTPLUG_PCI_ACPI = yes; # PCI hotplug using ACPI
         HOTPLUG_PCI_PCIE = yes; # PCI-Expresscard hotplug support
 
+        # Enable all available thermal governors
+        THERMAL_GOV_BANG_BANG = yes;
+        THERMAL_GOV_FAIR_SHARE = yes;
+        THERMAL_GOV_POWER_ALLOCATOR = yes;
+        THERMAL_GOV_STEP_WISE = yes;
+        THERMAL_GOV_USER_SPACE = yes;
+        DEVFREQ_THERMAL = yes;
+
         # Enable AMD's ROCm GPU compute stack
         HSA_AMD = lib.mkIf stdenv.hostPlatform.is64bit yes;
         ZONE_DEVICE = lib.mkIf (
@@ -1355,6 +1363,8 @@ let
         X86_PLATFORM_DRIVERS_DELL = lib.mkIf stdenv.hostPlatform.isx86 (whenAtLeast "5.12" yes);
         X86_PLATFORM_DRIVERS_HP = lib.mkIf stdenv.hostPlatform.isx86 (whenAtLeast "6.1" yes);
 
+        ARM64_PMEM = lib.mkIf stdenv.hostPlatform.isAarch64 yes;
+
         LIRC = yes;
 
         SCHED_CORE = whenAtLeast "5.14" yes;
diff --git a/pkgs/tools/package-management/lix/default.nix b/pkgs/tools/package-management/lix/default.nix
index e2dfa1650ce2..80df0b52c248 100644
--- a/pkgs/tools/package-management/lix/default.nix
+++ b/pkgs/tools/package-management/lix/default.nix
@@ -31,6 +31,14 @@
   confDir ? "/etc",
 }:
 let
+  # Support for mdbook >= 0.5, https://git.lix.systems/lix-project/lix/issues/1051
+  lixMdbookPatch = fetchpatch2 {
+    name = "lix-mdbook-0.5-support.patch";
+    url = "https://git.lix.systems/lix-project/lix/commit/54df89f601b3b4502a5c99173c9563495265d7e7.patch";
+    excludes = [ "package.nix" ];
+    hash = "sha256-uu/SIG8fgVVWhsGxmszTPHwe4SQtLgbxdShOMKbeg2w=";
+  };
+
   makeLixScope =
     {
       attrName,
@@ -223,6 +231,8 @@ lib.makeExtensible (
             url = "https://git.lix.systems/lix-project/lix/commit/b6d5670bcffebdd43352ea79b36135e35a8148d9.patch";
             hash = "sha256-f4s0TR5MhNMNM5TYLOR7K2/1rtZ389KDjTCKFVK0OcE=";
           })
+
+          lixMdbookPatch
         ];
       };
     };
@@ -246,6 +256,8 @@ lib.makeExtensible (
           inherit src;
           hash = "sha256-APm8m6SVEAO17BBCka13u85/87Bj+LePP7Y3zHA3Mpg=";
         };
+
+        patches = [ lixMdbookPatch ];
       };
     };
 
@@ -268,6 +280,8 @@ lib.makeExtensible (
           inherit src;
           hash = "sha256-APm8m6SVEAO17BBCka13u85/87Bj+LePP7Y3zHA3Mpg=";
         };
+
+        patches = [ lixMdbookPatch ];
       };
     };
 
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 445a993d3af1..72914913e83d 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -136,19 +136,34 @@ lib.makeExtensible (
         version = "2.28.5";
         hash = "sha256-oIfAHxO+BCtHXJXLHBnsKkGl1Pw+Uuq1PwNxl+lZ+Oc=";
         self_attribute_name = "nix_2_28";
+        patches = [
+          (fetchpatch2 {
+            name = "nix-2.28-14764-mdbook-0.5-support.patch";
+            url = "https://github.com/NixOS/nix/commit/5a64138e862fe364e751c5c286e8db8c466aaee7.patch";
+            hash = "sha256-K5TNroqSRH9j7vSzWw/6/b19mu7q+J5XPTDvJ3xVWlE=";
+          })
+        ];
       };
 
-      nixComponents_2_30 = nixDependencies.callPackage ./modular/packages.nix rec {
-        version = "2.30.3";
-        inherit maintainers teams;
-        otherSplices = generateSplicesForNixComponents "nixComponents_2_30";
-        src = fetchFromGitHub {
-          owner = "NixOS";
-          repo = "nix";
-          tag = version;
-          hash = "sha256-kBuwzMgIE9Tmve0Rpp+q+YCsE2mw9d62M/950ViWeJ0=";
-        };
-      };
+      nixComponents_2_30 =
+        (nixDependencies.callPackage ./modular/packages.nix rec {
+          version = "2.30.3";
+          inherit maintainers teams;
+          otherSplices = generateSplicesForNixComponents "nixComponents_2_30";
+          src = fetchFromGitHub {
+            owner = "NixOS";
+            repo = "nix";
+            tag = version;
+            hash = "sha256-kBuwzMgIE9Tmve0Rpp+q+YCsE2mw9d62M/950ViWeJ0=";
+          };
+        }).appendPatches
+          [
+            (fetchpatch2 {
+              name = "nix-2.30-14695-mdbook-0.5-support.patch";
+              url = "https://github.com/NixOS/nix/commit/5cbd7856de0a9c13351f98e32a1e26d0854d87fd.patch";
+              hash = "sha256-w8WQfWxMtprDLoZUhrCm4zr6xZXKhoIirq3la0Y7/wU=";
+            })
+          ];
 
       nix_2_30 = addTests "nix_2_30" self.nixComponents_2_30.nix-everything;
 
@@ -165,39 +180,55 @@ lib.makeExtensible (
           };
         }).appendPatches
           (
-            # issues on darwin: https://github.com/NixOS/nixpkgs/pull/468208#issuecomment-3626314109
-            lib.optional stdenv.isLinux (fetchpatch2 {
-              name = "nix-2.31-14240-sri-error-message.patch";
-              url = "https://github.com/NixOS/nix/commit/56751b1cd2c4700c71c545f2246adf602c97fdf5.patch";
-              hash = "sha256-CerSBAI+H2RqPp9jsCP0QIM2rZYx3yBZHVVUAztgc18=";
-            })
+            [
+              (fetchpatch2 {
+                name = "nix-2.31-14692-mdbook-0.5-support.patch";
+                url = "https://github.com/NixOS/nix/commit/a4f5f365090980a6eeb2ef483e49c04bdefd71a8.patch";
+                hash = "sha256-GOWZtHSzHovnD8iUknr61bo7y85i0BKdw3kVBGDfBX0=";
+              })
+            ]
+            ++
+              # issues on darwin: https://github.com/NixOS/nixpkgs/pull/468208#issuecomment-3626314109
+              lib.optional stdenv.isLinux (fetchpatch2 {
+                name = "nix-2.31-14240-sri-error-message.patch";
+                url = "https://github.com/NixOS/nix/commit/56751b1cd2c4700c71c545f2246adf602c97fdf5.patch";
+                hash = "sha256-CerSBAI+H2RqPp9jsCP0QIM2rZYx3yBZHVVUAztgc18=";
+              })
           );
 
       nix_2_31 = addTests "nix_2_31" self.nixComponents_2_31.nix-everything;
 
-      nixComponents_2_32 = nixDependencies.callPackage ./modular/packages.nix rec {
-        version = "2.32.4";
-        inherit (self.nix_2_31.meta) maintainers teams;
-        otherSplices = generateSplicesForNixComponents "nixComponents_2_32";
-        src = fetchFromGitHub {
-          owner = "NixOS";
-          repo = "nix";
-          tag = version;
-          hash = "sha256-8QYnRyGOTm3h/Dp8I6HCmQzlO7C009Odqyp28pTWgcY=";
-        };
-      };
+      nixComponents_2_32 =
+        (nixDependencies.callPackage ./modular/packages.nix rec {
+          version = "2.32.4";
+          inherit (self.nix_2_31.meta) maintainers teams;
+          otherSplices = generateSplicesForNixComponents "nixComponents_2_32";
+          src = fetchFromGitHub {
+            owner = "NixOS";
+            repo = "nix";
+            tag = version;
+            hash = "sha256-8QYnRyGOTm3h/Dp8I6HCmQzlO7C009Odqyp28pTWgcY=";
+          };
+        }).appendPatches
+          [
+            (fetchpatch2 {
+              name = "nix-2.32-14693-mdbook-0.5-support.patch";
+              url = "https://github.com/NixOS/nix/commit/ba5bede9f51f126b29aaa01a3170da281cef0231.patch";
+              hash = "sha256-jY5fWnJSBfHRmB0RnBKeu3aYQ8wmDKYVqTj85cWVZRA=";
+            })
+          ];
 
       nix_2_32 = addTests "nix_2_32" self.nixComponents_2_32.nix-everything;
 
       nixComponents_git = nixDependencies.callPackage ./modular/packages.nix rec {
-        version = "2.33pre20251107_${lib.substring 0 8 src.rev}";
+        version = "2.34pre20251217_${lib.substring 0 8 src.rev}";
         inherit maintainers teams;
         otherSplices = generateSplicesForNixComponents "nixComponents_git";
         src = fetchFromGitHub {
           owner = "NixOS";
           repo = "nix";
-          rev = "479b6b73a9576452c14ca66b7f3cd4873969077e";
-          hash = "sha256-eBjgsauQXFz2yeiNoPEzgkf7uyV+S8HYCQgZhPVx/9I=";
+          rev = "b6add8dcc6f4f6feb1ce83aaffe4d7e660e6f616";
+          hash = "sha256-2au7PdQ4HXSuktTPCtOJoD/LNjqMwbHIJmuzEYW1b7I=";
         };
       };