diff --git a/nixos/modules/config/users-groups.nix b/nixos/modules/config/users-groups.nix
index 59f1b44483df..ad61a4116ef1 100644
--- a/nixos/modules/config/users-groups.nix
+++ b/nixos/modules/config/users-groups.nix
@@ -871,6 +871,7 @@ in
         render.gid = ids.gids.render;
         sgx.gid = ids.gids.sgx;
         shadow.gid = ids.gids.shadow;
+        clock.gid = ids.gids.clock;
       };
 
       system.activationScripts.users =
@@ -1033,6 +1034,7 @@ in
           cdrom = { };
           tape = { };
           kvm = { };
+          clock = { };
         };
       };
 
diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix
index 949531d9a83c..b3cf6a063356 100644
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@@ -690,6 +690,7 @@ in
       rstudio-server = 324;
       localtimed = 325;
       automatic-timezoned = 326;
+      clock = 327;
 
       # When adding a gid, make sure it doesn't match an existing
       # uid. Users and groups with the same name should have equal
diff --git a/nixos/modules/services/hardware/udev.nix b/nixos/modules/services/hardware/udev.nix
index ca9464d091c1..efc9b486149b 100644
--- a/nixos/modules/services/hardware/udev.nix
+++ b/nixos/modules/services/hardware/udev.nix
@@ -179,7 +179,8 @@ let
         for i in $packages; do
           echo "Adding hwdb files for package $i"
           for j in $i/{etc,lib}/udev/hwdb.d/*; do
-            ln -s $j etc/udev/hwdb.d/$(basename $j)
+            # This must be a copy, not a symlink, because --root below will chase links within the root argument.
+            cp $j etc/udev/hwdb.d/$(basename $j)
           done
         done
 
@@ -461,6 +462,7 @@ in
       "${config.boot.initrd.systemd.package}/lib/systemd/systemd-udevd"
       "${config.boot.initrd.systemd.package}/lib/udev/ata_id"
       "${config.boot.initrd.systemd.package}/lib/udev/cdrom_id"
+      "${config.boot.initrd.systemd.package}/lib/udev/dmi_memory_id"
       "${config.boot.initrd.systemd.package}/lib/udev/scsi_id"
       "${config.boot.initrd.systemd.package}/lib/udev/rules.d"
     ]
diff --git a/nixos/modules/system/boot/systemd/journald.nix b/nixos/modules/system/boot/systemd/journald.nix
index 4d2ca7f11f21..279da8f47c0b 100644
--- a/nixos/modules/system/boot/systemd/journald.nix
+++ b/nixos/modules/system/boot/systemd/journald.nix
@@ -79,8 +79,11 @@ in
     };
 
     services.journald.audit = lib.mkOption {
-      default = null;
-      type = lib.types.nullOr lib.types.bool;
+      default = "keep";
+      type = lib.types.oneOf [
+        lib.types.bool
+        (lib.types.enum [ "keep" ])
+      ];
       description = ''
         If enabled systemd-journald will turn on auditing on start-up.
         If disabled it will turn it off. If unset it will neither enable nor disable it, leaving the previous state unchanged.
diff --git a/nixos/modules/system/boot/systemd/oomd.nix b/nixos/modules/system/boot/systemd/oomd.nix
index 82a87f00e97b..90c786ec5c22 100644
--- a/nixos/modules/system/boot/systemd/oomd.nix
+++ b/nixos/modules/system/boot/systemd/oomd.nix
@@ -50,10 +50,6 @@ in
       "systemd-oomd.socket"
     ];
 
-    systemd.services.systemd-oomd.after = [
-      "swap.target" # TODO: drop after systemd v258
-      "systemd-sysusers.service" # TODO: drop after systemd v257.8
-    ];
     systemd.services.systemd-oomd.wantedBy = [ "multi-user.target" ];
 
     environment.etc."systemd/oomd.conf".text = utils.systemdUtils.lib.settingsToSections cfg.settings;
diff --git a/nixos/tests/systemd-initrd-luks-tpm2.nix b/nixos/tests/systemd-initrd-luks-tpm2.nix
index 20e203b0e86b..6cc42bbbda73 100644
--- a/nixos/tests/systemd-initrd-luks-tpm2.nix
+++ b/nixos/tests/systemd-initrd-luks-tpm2.nix
@@ -11,6 +11,7 @@
         useBootLoader = true;
         # Booting off the TPM2-encrypted device requires an available init script
         mountHostNixStore = true;
+        efi.OVMF = pkgs.OVMFFull; # this really should be the default. Only OVMFFull contains TCG
         useEFIBoot = true;
         tpm.enable = true;
       };
diff --git a/nixos/tests/systemd-machinectl.nix b/nixos/tests/systemd-machinectl.nix
index 03ffc25b9113..6a3a47d938bc 100644
--- a/nixos/tests/systemd-machinectl.nix
+++ b/nixos/tests/systemd-machinectl.nix
@@ -171,7 +171,7 @@ in
     machine.succeed("ping -n -c 1 ${containerName}");
 
     # Test systemd-nspawn uses a user namespace
-    machine.succeed("test $(machinectl status ${containerName} | grep 'UID Shift: ' | wc -l) = 1")
+    machine.succeed("test $(machinectl status ${containerName} | grep 'ID Shift: ' | wc -l) = 1")
 
     # Test systemd-nspawn reboot
     machine.succeed("machinectl shell ${containerName} /run/current-system/sw/bin/reboot");
diff --git a/nixos/tests/systemd.nix b/nixos/tests/systemd.nix
index fbece2a73dfc..f0bbdef76c61 100644
--- a/nixos/tests/systemd.nix
+++ b/nixos/tests/systemd.nix
@@ -244,7 +244,7 @@
           assert "0B read, 0B written" not in output
 
       with subtest("systemd per-unit accounting works"):
-          assert "IP traffic received: 84B sent: 84B" in output_ping
+          assert "IP Traffic: received 84B, sent 84B" in output_ping
 
       with subtest("systemd environment is properly set"):
           machine.systemctl("daemon-reexec")  # Rewrites /proc/1/environ
diff --git a/pkgs/by-name/ud/udevCheckHook/hook.sh b/pkgs/by-name/ud/udevCheckHook/hook.sh
index bdb8e9c1f746..06740394a277 100644
--- a/pkgs/by-name/ud/udevCheckHook/hook.sh
+++ b/pkgs/by-name/ud/udevCheckHook/hook.sh
@@ -12,7 +12,7 @@ udevCheckHook() {
     for output in $(getAllOutputNames); do
         for path in etc lib ; do
             if [ -d "${!output}/$path/udev/rules.d" ]; then
-                @udevadm@ verify --resolve-names=never --no-style "${!output}/$path/udev/rules.d"
+                @udevadm@ verify --resolve-names=late --no-style "${!output}/$path/udev/rules.d"
             fi
         done
     done
diff --git a/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch b/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
index d242ff7c9287..02845eb126f6 100644
--- a/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
+++ b/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
@@ -13,7 +13,7 @@ unit.  (However, this ignores the fsck unit, so it's not perfect...)
  1 file changed, 4 deletions(-)
 
 diff --git a/rules.d/99-systemd.rules.in b/rules.d/99-systemd.rules.in
-index 882cda0dcd..8e8d1f04ce 100644
+index bebc4d7d09..60278a0da7 100644
 --- a/rules.d/99-systemd.rules.in
 +++ b/rules.d/99-systemd.rules.in
 @@ -30,10 +30,6 @@ SUBSYSTEM=="block", ACTION=="add", KERNEL=="dm-*", ENV{DM_NAME}!="?*", ENV{SYSTE
@@ -24,6 +24,6 @@ index 882cda0dcd..8e8d1f04ce 100644
 -# we are probably still calling mke2fs or mkswap on it.
 -SUBSYSTEM=="block", ENV{DM_UUID}=="CRYPT-*", ENV{ID_PART_TABLE_TYPE}=="", ENV{ID_FS_USAGE}=="", ENV{SYSTEMD_READY}="0"
 -
- # add symlink to GPT root disk
- SUBSYSTEM=="block", ENV{ID_PART_GPT_AUTO_ROOT}=="1", ENV{ID_FS_TYPE}!="crypto_LUKS", SYMLINK+="gpt-auto-root"
- SUBSYSTEM=="block", ENV{ID_PART_GPT_AUTO_ROOT}=="1", ENV{ID_FS_TYPE}=="crypto_LUKS", SYMLINK+="gpt-auto-root-luks"
+ # Ignore raid devices that are not yet assembled and started
+ SUBSYSTEM=="block", ENV{DEVTYPE}=="disk", KERNEL=="md*", TEST!="md/array_state", ENV{SYSTEMD_READY}="0"
+ SUBSYSTEM=="block", ENV{DEVTYPE}=="disk", KERNEL=="md*", ATTR{md/array_state}=="|clear|inactive", ENV{SYSTEMD_READY}="0"
diff --git a/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch b/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
index 9e3496986859..d1dcbfd37a0f 100644
--- a/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
+++ b/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
@@ -14,10 +14,10 @@ Original-Author: Eelco Dolstra <eelco.dolstra@logicblox.com>
  2 files changed, 6 insertions(+), 2 deletions(-)
 
 diff --git a/src/shared/fstab-util.c b/src/shared/fstab-util.c
-index d6a256c4a7..f74d5198f1 100644
+index 57ab68deb6..8e281b8f2c 100644
 --- a/src/shared/fstab-util.c
 +++ b/src/shared/fstab-util.c
-@@ -66,6 +66,8 @@ bool fstab_is_extrinsic(const char *mount, const char *opts) {
+@@ -72,6 +72,8 @@ bool fstab_is_extrinsic(const char *mount, const char *opts) {
          /* Don't bother with the OS data itself */
          if (PATH_IN_SET(mount,
                          "/",
@@ -27,10 +27,10 @@ index d6a256c4a7..f74d5198f1 100644
                          "/etc"))
                  return true;
 diff --git a/src/shutdown/umount.c b/src/shutdown/umount.c
-index 84da5eed63..d6e2f36d52 100644
+index 45c6db9245..d7283b7fa6 100644
 --- a/src/shutdown/umount.c
 +++ b/src/shutdown/umount.c
-@@ -175,8 +175,10 @@ int mount_points_list_get(const char *mountinfo, MountPoint **head) {
+@@ -178,8 +178,10 @@ int mount_points_list_get(FILE *f, MountPoint **head) {
  static bool nonunmountable_path(const char *path) {
          assert(path);
  
diff --git a/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch b/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
index 7cc2804a05bb..3815c140d495 100644
--- a/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
+++ b/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
@@ -10,10 +10,10 @@ container, so checking early whether it exists will fail.
  1 file changed, 2 insertions(+)
 
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index 6f90f2f418..74b2a237d3 100644
+index ab8746c442..480a9c55c6 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -6189,6 +6189,7 @@ static int run(int argc, char *argv[]) {
+@@ -6165,6 +6165,7 @@ static int run(int argc, char *argv[]) {
                                  goto finish;
                          }
                  } else {
@@ -21,11 +21,11 @@ index 6f90f2f418..74b2a237d3 100644
                          _cleanup_free_ char *p = NULL;
  
                          if (arg_pivot_root_new)
-@@ -6208,6 +6209,7 @@ static int run(int argc, char *argv[]) {
+@@ -6184,6 +6185,7 @@ static int run(int argc, char *argv[]) {
                                  log_error_errno(r, "Unable to determine if %s looks like it has an OS tree (i.e. whether /usr/ exists): %m", arg_directory);
                                  goto finish;
                          }
 +#endif
                  }
  
-         } else {
+                 if (arg_userns_mode == USER_NAMESPACE_MANAGED) {
diff --git a/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch b/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch
index 2657eb9089d1..81d17a57fb2f 100644
--- a/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch
+++ b/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch
@@ -16,10 +16,10 @@ Original-Author: Eelco Dolstra <eelco.dolstra@logicblox.com>
  2 files changed, 7 insertions(+), 21 deletions(-)
 
 diff --git a/src/core/systemd.pc.in b/src/core/systemd.pc.in
-index f3b85b0190..f7aa5fca50 100644
+index 58f2463104..0c263430a7 100644
 --- a/src/core/systemd.pc.in
 +++ b/src/core/systemd.pc.in
-@@ -43,10 +43,10 @@ systemdsystemconfdir=${systemd_system_conf_dir}
+@@ -46,10 +46,10 @@ systemdsystemconfdir=${systemd_system_conf_dir}
  systemd_user_conf_dir=${sysconfdir}/systemd/user
  systemduserconfdir=${systemd_user_conf_dir}
  
@@ -32,7 +32,7 @@ index f3b85b0190..f7aa5fca50 100644
  systemduserunitpath=${systemd_user_unit_path}
  
  systemd_system_generator_dir=${prefix}/lib/systemd/system-generators
-@@ -55,10 +55,10 @@ systemdsystemgeneratordir=${systemd_system_generator_dir}
+@@ -58,10 +58,10 @@ systemdsystemgeneratordir=${systemd_system_generator_dir}
  systemd_user_generator_dir=${prefix}/lib/systemd/user-generators
  systemdusergeneratordir=${systemd_user_generator_dir}
  
@@ -46,10 +46,10 @@ index f3b85b0190..f7aa5fca50 100644
  
  systemd_sleep_dir=${prefix}/lib/systemd/system-sleep
 diff --git a/src/libsystemd/sd-path/path-lookup.c b/src/libsystemd/sd-path/path-lookup.c
-index a3b09208cb..91a085c6bc 100644
+index 3ddbda0e9f..3eddc80c90 100644
 --- a/src/libsystemd/sd-path/path-lookup.c
 +++ b/src/libsystemd/sd-path/path-lookup.c
-@@ -69,11 +69,7 @@ int runtime_directory(RuntimeScope scope, const char *suffix, char **ret) {
+@@ -64,11 +64,7 @@ int runtime_directory(RuntimeScope scope, const char *suffix, char **ret) {
  }
  
  static const char* const user_data_unit_paths[] = {
@@ -61,7 +61,7 @@ index a3b09208cb..91a085c6bc 100644
          NULL
  };
  
-@@ -481,16 +477,13 @@ int lookup_paths_init(
+@@ -476,16 +472,13 @@ int lookup_paths_init(
                                         persistent_config,
                                         SYSTEM_CONFIG_UNIT_DIR,
                                         "/etc/systemd/system",
@@ -79,7 +79,7 @@ index a3b09208cb..91a085c6bc 100644
                                         STRV_IFNOTNULL(generator_late));
                          break;
  
-@@ -508,13 +501,10 @@ int lookup_paths_init(
+@@ -503,13 +496,10 @@ int lookup_paths_init(
                          add = strv_new(persistent_config,
                                         USER_CONFIG_UNIT_DIR,
                                         "/etc/systemd/user",
@@ -95,7 +95,7 @@ index a3b09208cb..91a085c6bc 100644
                          break;
  
                  case RUNTIME_SCOPE_USER:
-@@ -653,7 +643,6 @@ void lookup_paths_log(LookupPaths *lp) {
+@@ -648,7 +638,6 @@ void lookup_paths_log(LookupPaths *lp) {
  static const char* const system_generator_paths[] = {
          "/run/systemd/system-generators",
          "/etc/systemd/system-generators",
@@ -103,7 +103,7 @@ index a3b09208cb..91a085c6bc 100644
          SYSTEM_GENERATOR_DIR,
          NULL,
  };
-@@ -661,7 +650,6 @@ static const char* const system_generator_paths[] = {
+@@ -656,7 +645,6 @@ static const char* const system_generator_paths[] = {
  static const char* const user_generator_paths[] = {
          "/run/systemd/user-generators",
          "/etc/systemd/user-generators",
@@ -111,7 +111,7 @@ index a3b09208cb..91a085c6bc 100644
          USER_GENERATOR_DIR,
          NULL,
  };
-@@ -669,7 +657,6 @@ static const char* const user_generator_paths[] = {
+@@ -664,7 +652,6 @@ static const char* const user_generator_paths[] = {
  static const char* const system_env_generator_paths[] = {
          "/run/systemd/system-environment-generators",
          "/etc/systemd/system-environment-generators",
@@ -119,7 +119,7 @@ index a3b09208cb..91a085c6bc 100644
          SYSTEM_ENV_GENERATOR_DIR,
          NULL,
  };
-@@ -677,7 +664,6 @@ static const char* const system_env_generator_paths[] = {
+@@ -672,7 +659,6 @@ static const char* const system_env_generator_paths[] = {
  static const char* const user_env_generator_paths[] = {
          "/run/systemd/user-environment-generators",
          "/etc/systemd/user-environment-generators",
diff --git a/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch b/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch
index 6c4a41ab0609..2f7139911220 100644
--- a/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch
+++ b/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch
@@ -13,10 +13,10 @@ in containers.
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index 4ccaba9054..9577b89783 100644
+index d85896577f..2a4782a55e 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -1672,7 +1672,8 @@ static unsigned manager_dispatch_stop_when_bound_queue(Manager *m) {
+@@ -1575,7 +1575,8 @@ static unsigned manager_dispatch_stop_when_bound_queue(Manager *m) {
                  if (!unit_is_bound_by_inactive(u, &culprit))
                          continue;
  
diff --git a/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch b/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch
index 44bd2263ddf0..b43dddb3d420 100644
--- a/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch
+++ b/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch
@@ -11,10 +11,10 @@ Subject: [PATCH] hostnamed, localed, timedated: disable methods that change
  3 files changed, 25 insertions(+)
 
 diff --git a/src/hostname/hostnamed.c b/src/hostname/hostnamed.c
-index ba50b59f92..9827487453 100644
+index 06fb3f2878..b656e511b7 100644
 --- a/src/hostname/hostnamed.c
 +++ b/src/hostname/hostnamed.c
-@@ -1115,6 +1115,9 @@ static int method_set_static_hostname(sd_bus_message *m, void *userdata, sd_bus_
+@@ -1388,6 +1388,9 @@ static int method_set_static_hostname(sd_bus_message *m, void *userdata, sd_bus_
          if (r < 0)
                  return r;
  
@@ -24,7 +24,7 @@ index ba50b59f92..9827487453 100644
          name = empty_to_null(name);
  
          context_read_etc_hostname(c);
-@@ -1177,6 +1180,9 @@ static int set_machine_info(Context *c, sd_bus_message *m, int prop, sd_bus_mess
+@@ -1454,6 +1457,9 @@ static int set_machine_info(Context *c, sd_bus_message *m, int prop, sd_bus_mess
          if (r < 0)
                  return r;
  
@@ -35,10 +35,10 @@ index ba50b59f92..9827487453 100644
  
          context_read_machine_info(c);
 diff --git a/src/locale/localed.c b/src/locale/localed.c
-index 062744519d..95bde4b1c3 100644
+index 11d9130bbc..dd4d9e59ea 100644
 --- a/src/locale/localed.c
 +++ b/src/locale/localed.c
-@@ -226,6 +226,9 @@ static int method_set_locale(sd_bus_message *m, void *userdata, sd_bus_error *er
+@@ -221,6 +221,9 @@ static int method_set_locale(sd_bus_message *m, void *userdata, sd_bus_error *er
  
          use_localegen = locale_gen_check_available();
  
@@ -48,7 +48,7 @@ index 062744519d..95bde4b1c3 100644
          /* If single locale without variable name is provided, then we assume it is LANG=. */
          if (strv_length(l) == 1 && !strchr(l[0], '=')) {
                  if (!locale_is_valid(l[0]))
-@@ -343,6 +346,9 @@ static int method_set_vc_keyboard(sd_bus_message *m, void *userdata, sd_bus_erro
+@@ -338,6 +341,9 @@ static int method_set_vc_keyboard(sd_bus_message *m, void *userdata, sd_bus_erro
          if (r < 0)
                  return bus_log_parse_error(r);
  
@@ -58,7 +58,7 @@ index 062744519d..95bde4b1c3 100644
          vc_context_empty_to_null(&in);
  
          r = vc_context_verify_and_warn(&in, LOG_ERR, error);
-@@ -460,6 +466,9 @@ static int method_set_x11_keyboard(sd_bus_message *m, void *userdata, sd_bus_err
+@@ -455,6 +461,9 @@ static int method_set_x11_keyboard(sd_bus_message *m, void *userdata, sd_bus_err
          if (r < 0)
                  return bus_log_parse_error(r);
  
@@ -69,10 +69,10 @@ index 062744519d..95bde4b1c3 100644
  
          r = x11_context_verify_and_warn(&in, LOG_ERR, error);
 diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
-index c79bb864df..cbd30214b7 100644
+index 662cc29ac5..57f3413dc6 100644
 --- a/src/timedate/timedated.c
 +++ b/src/timedate/timedated.c
-@@ -676,6 +676,10 @@ static int method_set_timezone(sd_bus_message *m, void *userdata, sd_bus_error *
+@@ -678,6 +678,10 @@ static int method_set_timezone(sd_bus_message *m, void *userdata, sd_bus_error *
          if (r < 0)
                  return r;
  
@@ -83,7 +83,7 @@ index c79bb864df..cbd30214b7 100644
          if (!timezone_is_valid(z, LOG_DEBUG))
                  return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid or not installed time zone '%s'", z);
  
-@@ -754,6 +758,9 @@ static int method_set_local_rtc(sd_bus_message *m, void *userdata, sd_bus_error
+@@ -756,6 +760,9 @@ static int method_set_local_rtc(sd_bus_message *m, void *userdata, sd_bus_error
          if (r < 0)
                  return r;
  
@@ -93,7 +93,7 @@ index c79bb864df..cbd30214b7 100644
          if (lrtc == c->local_rtc && !fix_system)
                  return sd_bus_reply_method_return(m, NULL);
  
-@@ -948,6 +955,9 @@ static int method_set_ntp(sd_bus_message *m, void *userdata, sd_bus_error *error
+@@ -954,6 +961,9 @@ static int method_set_ntp(sd_bus_message *m, void *userdata, sd_bus_error *error
          if (r < 0)
                  return r;
  
diff --git a/pkgs/os-specific/linux/systemd/0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch b/pkgs/os-specific/linux/systemd/0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
index 1f4184e92836..21589efdd849 100644
--- a/pkgs/os-specific/linux/systemd/0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
+++ b/pkgs/os-specific/linux/systemd/0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
@@ -7,10 +7,10 @@ NixOS uses this path.
 ---
  man/localtime.xml         | 4 ++--
  src/basic/time-util.c     | 8 ++++----
- src/firstboot/firstboot.c | 2 +-
+ src/firstboot/firstboot.c | 9 +++------
  src/nspawn/nspawn.c       | 4 ++--
  src/timedate/timedated.c  | 8 ++++----
- 5 files changed, 13 insertions(+), 13 deletions(-)
+ 5 files changed, 15 insertions(+), 18 deletions(-)
 
 diff --git a/man/localtime.xml b/man/localtime.xml
 index 3a13e04a27..4fd58068a1 100644
@@ -35,10 +35,10 @@ index 3a13e04a27..4fd58068a1 100644
      <literal>Etc/UTC</literal>. The resulting link should lead to the
      corresponding binary
 diff --git a/src/basic/time-util.c b/src/basic/time-util.c
-index 29afb08ebc..398ff340cd 100644
+index 55931a2546..2e00bd7539 100644
 --- a/src/basic/time-util.c
 +++ b/src/basic/time-util.c
-@@ -1418,7 +1418,7 @@ static int get_timezones_from_zone1970_tab(char ***ret) {
+@@ -1410,7 +1410,7 @@ static int get_timezones_from_zone1970_tab(char ***ret) {
  
          assert(ret);
  
@@ -47,7 +47,7 @@ index 29afb08ebc..398ff340cd 100644
          if (!f)
                  return -errno;
  
-@@ -1459,7 +1459,7 @@ static int get_timezones_from_tzdata_zi(char ***ret) {
+@@ -1451,7 +1451,7 @@ static int get_timezones_from_tzdata_zi(char ***ret) {
  
          assert(ret);
  
@@ -56,7 +56,7 @@ index 29afb08ebc..398ff340cd 100644
          if (!f)
                  return -errno;
  
-@@ -1570,7 +1570,7 @@ int verify_timezone(const char *name, int log_level) {
+@@ -1562,7 +1562,7 @@ int verify_timezone(const char *name, int log_level) {
          if (p - name >= PATH_MAX)
                  return -ENAMETOOLONG;
  
@@ -65,7 +65,7 @@ index 29afb08ebc..398ff340cd 100644
  
          fd = open(t, O_RDONLY|O_CLOEXEC);
          if (fd < 0)
-@@ -1622,7 +1622,7 @@ int get_timezone(char **ret) {
+@@ -1614,7 +1614,7 @@ int get_timezone(char **ret) {
          if (r < 0)
                  return r; /* Return EINVAL if not a symlink */
  
@@ -75,23 +75,38 @@ index 29afb08ebc..398ff340cd 100644
                  return -EINVAL;
          if (!timezone_is_valid(e, LOG_DEBUG))
 diff --git a/src/firstboot/firstboot.c b/src/firstboot/firstboot.c
-index a389eeae10..c817e91991 100644
+index 5ed6d3a9d2..f922d91a9d 100644
 --- a/src/firstboot/firstboot.c
 +++ b/src/firstboot/firstboot.c
-@@ -598,7 +598,7 @@ static int process_timezone(int rfd) {
+@@ -618,7 +618,7 @@ static int prompt_timezone(int rfd) {
+ 
+ static int process_timezone(int rfd) {
+         _cleanup_close_ int pfd = -EBADF;
+-        _cleanup_free_ char *f = NULL, *relpath = NULL;
++        _cleanup_free_ char *f = NULL;
+         const char *e;
+         int r;
+ 
+@@ -664,12 +664,9 @@ static int process_timezone(int rfd) {
          if (isempty(arg_timezone))
                  return 0;
  
--        e = strjoina("../usr/share/zoneinfo/", arg_timezone);
+-        e = strjoina("/usr/share/zoneinfo/", arg_timezone);
+-        r = path_make_relative_parent(etc_localtime(), e, &relpath);
+-        if (r < 0)
+-                return r;
 +        e = strjoina("zoneinfo/", arg_timezone);
  
-         r = symlinkat_atomic_full(e, pfd, f, /* make_relative= */ false);
+-        r = symlinkat_atomic_full(relpath, pfd, f, SYMLINK_LABEL);
++        r = symlinkat_atomic_full(e, pfd, f, SYMLINK_LABEL);
          if (r < 0)
+                 return log_error_errno(r, "Failed to create /etc/localtime symlink: %m");
+ 
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index 74b2a237d3..cf9eabf0f2 100644
+index 480a9c55c6..02c9ae6608 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -1851,8 +1851,8 @@ int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid
+@@ -1821,8 +1821,8 @@ int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid
  static const char *timezone_from_path(const char *path) {
          return PATH_STARTSWITH_SET(
                          path,
@@ -103,10 +118,10 @@ index 74b2a237d3..cf9eabf0f2 100644
  
  static bool etc_writable(void) {
 diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
-index cbd30214b7..b9b2f533a4 100644
+index 57f3413dc6..6a456fe601 100644
 --- a/src/timedate/timedated.c
 +++ b/src/timedate/timedated.c
-@@ -280,7 +280,7 @@ static int context_read_data(Context *c) {
+@@ -266,7 +266,7 @@ static int context_read_data(Context *c) {
  
          r = get_timezone(&t);
          if (r == -EINVAL)
@@ -115,24 +130,24 @@ index cbd30214b7..b9b2f533a4 100644
          else if (r < 0)
                  log_warning_errno(r, "Failed to get target of /etc/localtime: %m");
  
-@@ -304,7 +304,7 @@ static int context_write_data_timezone(Context *c) {
+@@ -290,7 +290,7 @@ static int context_write_data_timezone(Context *c) {
  
          if (isempty(c->zone) || streq(c->zone, "UTC")) {
  
 -                if (access("/usr/share/zoneinfo/UTC", F_OK) < 0) {
 +                if (access("/etc/zoneinfo/UTC", F_OK) < 0) {
  
-                         if (unlink("/etc/localtime") < 0 && errno != ENOENT)
+                         if (unlink(etc_localtime()) < 0 && errno != ENOENT)
                                  return -errno;
-@@ -312,9 +312,9 @@ static int context_write_data_timezone(Context *c) {
+@@ -298,9 +298,9 @@ static int context_write_data_timezone(Context *c) {
                          return 0;
                  }
  
--                source = "../usr/share/zoneinfo/UTC";
-+                source = "../etc/zoneinfo/UTC";
+-                source = "/usr/share/zoneinfo/UTC";
++                source = "/etc/zoneinfo/UTC";
          } else {
--                p = path_join("../usr/share/zoneinfo", c->zone);
-+                p = path_join("../etc/zoneinfo", c->zone);
+-                p = path_join("/usr/share/zoneinfo", c->zone);
++                p = path_join("/etc/zoneinfo", c->zone);
                  if (!p)
                          return -ENOMEM;
  
diff --git a/pkgs/os-specific/linux/systemd/0008-localectl-use-etc-X11-xkb-for-list-x11.patch b/pkgs/os-specific/linux/systemd/0008-localectl-use-etc-X11-xkb-for-list-x11.patch
index c670f076c34a..6c348219872f 100644
--- a/pkgs/os-specific/linux/systemd/0008-localectl-use-etc-X11-xkb-for-list-x11.patch
+++ b/pkgs/os-specific/linux/systemd/0008-localectl-use-etc-X11-xkb-for-list-x11.patch
@@ -10,15 +10,15 @@ NixOS has an option to link the xkb data files to /etc/X11, but not to
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/locale/localectl.c b/src/locale/localectl.c
-index 36dbeb9daa..265eda2751 100644
+index c595f81b40..90033f6566 100644
 --- a/src/locale/localectl.c
 +++ b/src/locale/localectl.c
-@@ -301,7 +301,7 @@ static int list_x11_keymaps(int argc, char **argv, void *userdata) {
+@@ -302,7 +302,7 @@ static int list_x11_keymaps(int argc, char **argv, void *userdata) {
          } state = NONE, look_for;
          int r;
  
 -        f = fopen("/usr/share/X11/xkb/rules/base.lst", "re");
 +        f = fopen("/etc/X11/xkb/rules/base.lst", "re");
          if (!f)
-                 return log_error_errno(errno, "Failed to open keyboard mapping list. %m");
+                 return log_error_errno(errno, "Failed to open keyboard mapping list: %m");
  
diff --git a/pkgs/os-specific/linux/systemd/0009-add-rootprefix-to-lookup-dir-paths.patch b/pkgs/os-specific/linux/systemd/0009-add-rootprefix-to-lookup-dir-paths.patch
index bf9f028d6300..beb8acc61732 100644
--- a/pkgs/os-specific/linux/systemd/0009-add-rootprefix-to-lookup-dir-paths.patch
+++ b/pkgs/os-specific/linux/systemd/0009-add-rootprefix-to-lookup-dir-paths.patch
@@ -12,10 +12,10 @@ files that I might have missed.
  1 file changed, 4 insertions(+), 2 deletions(-)
 
 diff --git a/src/basic/constants.h b/src/basic/constants.h
-index 5aaf8f535c..934175fb51 100644
+index 7a09fbf878..ee3378f109 100644
 --- a/src/basic/constants.h
 +++ b/src/basic/constants.h
-@@ -62,13 +62,15 @@
+@@ -40,13 +40,15 @@
          "/etc/" n "\0"                          \
          "/run/" n "\0"                          \
          "/usr/local/lib/" n "\0"                \
diff --git a/pkgs/os-specific/linux/systemd/0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch b/pkgs/os-specific/linux/systemd/0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
index 20b4641ac000..b05fc609d6ed 100644
--- a/pkgs/os-specific/linux/systemd/0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
+++ b/pkgs/os-specific/linux/systemd/0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
@@ -10,7 +10,7 @@ This is needed for NixOS to use such scripts as systemd directory is immutable.
  1 file changed, 1 insertion(+)
 
 diff --git a/src/shutdown/shutdown.c b/src/shutdown/shutdown.c
-index e26a8579c5..af814cd551 100644
+index 3317068e47..021a3c0699 100644
 --- a/src/shutdown/shutdown.c
 +++ b/src/shutdown/shutdown.c
 @@ -358,6 +358,7 @@ static void notify_supervisor(void) {
diff --git a/pkgs/os-specific/linux/systemd/0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch b/pkgs/os-specific/linux/systemd/0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
index 13578115a014..bfded1bba554 100644
--- a/pkgs/os-specific/linux/systemd/0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
+++ b/pkgs/os-specific/linux/systemd/0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
@@ -9,10 +9,10 @@ This is needed for NixOS to use such scripts as systemd directory is immutable.
  1 file changed, 1 insertion(+)
 
 diff --git a/src/sleep/sleep.c b/src/sleep/sleep.c
-index 181bb4ccef..2b1410d8a1 100644
+index 3390ebe0c0..affc823bc4 100644
 --- a/src/sleep/sleep.c
 +++ b/src/sleep/sleep.c
-@@ -218,6 +218,7 @@ static int execute(
+@@ -248,6 +248,7 @@ static int execute(
          };
          static const char* const dirs[] = {
                  SYSTEM_SLEEP_PATH,
diff --git a/pkgs/os-specific/linux/systemd/0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch b/pkgs/os-specific/linux/systemd/0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
index 9e29c34efcd7..1168d1249858 100644
--- a/pkgs/os-specific/linux/systemd/0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
+++ b/pkgs/os-specific/linux/systemd/0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
@@ -10,10 +10,10 @@ systemd itself uses extensively.
  1 file changed, 3 insertions(+), 3 deletions(-)
 
 diff --git a/src/basic/path-util.h b/src/basic/path-util.h
-index dff5a3a549..01344e5cf6 100644
+index 45518c07e5..94bef2f4b4 100644
 --- a/src/basic/path-util.h
 +++ b/src/basic/path-util.h
-@@ -17,10 +17,10 @@
+@@ -9,10 +9,10 @@
  #define PATH_MERGED_BIN(x) x "bin"
  #define PATH_MERGED_BIN_NULSTR(x) x "bin\0"
  
diff --git a/pkgs/os-specific/linux/systemd/0013-inherit-systemd-environment-when-calling-generators.patch b/pkgs/os-specific/linux/systemd/0013-inherit-systemd-environment-when-calling-generators.patch
index 856fdee93475..1c4ce37dde34 100644
--- a/pkgs/os-specific/linux/systemd/0013-inherit-systemd-environment-when-calling-generators.patch
+++ b/pkgs/os-specific/linux/systemd/0013-inherit-systemd-environment-when-calling-generators.patch
@@ -16,10 +16,10 @@ executables that are being called from managers.
  1 file changed, 8 insertions(+)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index 9577b89783..9cfd2798b9 100644
+index 2a4782a55e..8dfdc227a1 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -4158,9 +4158,17 @@ static int build_generator_environment(Manager *m, char ***ret) {
+@@ -3977,9 +3977,17 @@ static int build_generator_environment(Manager *m, char ***ret) {
           * adjust generated units to that. Let's pass down some bits of information that are easy for us to
           * determine (but a bit harder for generator scripts to determine), as environment variables. */
  
diff --git a/pkgs/os-specific/linux/systemd/0014-core-don-t-taint-on-unmerged-usr.patch b/pkgs/os-specific/linux/systemd/0014-core-don-t-taint-on-unmerged-usr.patch
index fbaaed99cb61..445b08d2289f 100644
--- a/pkgs/os-specific/linux/systemd/0014-core-don-t-taint-on-unmerged-usr.patch
+++ b/pkgs/os-specific/linux/systemd/0014-core-don-t-taint-on-unmerged-usr.patch
@@ -17,10 +17,10 @@ See also: https://github.com/systemd/systemd/issues/24191
  1 file changed, 8 deletions(-)
 
 diff --git a/src/core/taint.c b/src/core/taint.c
-index b7a1c647a2..c04864c478 100644
+index 8872a224b2..bc736e2ef8 100644
 --- a/src/core/taint.c
 +++ b/src/core/taint.c
-@@ -41,14 +41,6 @@ char** taint_strv(void) {
+@@ -42,14 +42,6 @@ char** taint_strv(void) {
  
          _cleanup_free_ char *bin = NULL, *usr_sbin = NULL, *var_run = NULL;
  
diff --git a/pkgs/os-specific/linux/systemd/0015-tpm2_context_init-fix-driver-name-checking.patch b/pkgs/os-specific/linux/systemd/0015-tpm2_context_init-fix-driver-name-checking.patch
index fe8ac0ddd913..9f73ff0de547 100644
--- a/pkgs/os-specific/linux/systemd/0015-tpm2_context_init-fix-driver-name-checking.patch
+++ b/pkgs/os-specific/linux/systemd/0015-tpm2_context_init-fix-driver-name-checking.patch
@@ -27,10 +27,10 @@ filename_is_valid with path_is_valid.
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/shared/tpm2-util.c b/src/shared/tpm2-util.c
-index 5b6b3ea93c..8ab04241b6 100644
+index 57e7a91f93..faf45e4807 100644
 --- a/src/shared/tpm2-util.c
 +++ b/src/shared/tpm2-util.c
-@@ -721,7 +721,7 @@ int tpm2_context_new(const char *device, Tpm2Context **ret_context) {
+@@ -724,7 +724,7 @@ int tpm2_context_new(const char *device, Tpm2Context **ret_context) {
                  fn = strjoina("libtss2-tcti-", driver, ".so.0");
  
                  /* Better safe than sorry, let's refuse strings that cannot possibly be valid driver early, before going to disk. */
diff --git a/pkgs/os-specific/linux/systemd/0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch b/pkgs/os-specific/linux/systemd/0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
index 50dd842cc221..de846e9410b3 100644
--- a/pkgs/os-specific/linux/systemd/0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
+++ b/pkgs/os-specific/linux/systemd/0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
@@ -30,10 +30,10 @@ are written into `$XDG_CONFIG_HOME/systemd/user`.
  1 file changed, 3 insertions(+)
 
 diff --git a/src/systemctl/systemctl-edit.c b/src/systemctl/systemctl-edit.c
-index 7165fa1cf7..7498cf9f4c 100644
+index 53bc57186a..0ed12ce931 100644
 --- a/src/systemctl/systemctl-edit.c
 +++ b/src/systemctl/systemctl-edit.c
-@@ -323,6 +323,9 @@ int verb_edit(int argc, char *argv[], void *userdata) {
+@@ -330,6 +330,9 @@ int verb_edit(int argc, char *argv[], void *userdata) {
          sd_bus *bus;
          int r;
  
diff --git a/pkgs/os-specific/linux/systemd/0017-meson.build-do-not-create-systemdstatedir.patch b/pkgs/os-specific/linux/systemd/0017-meson.build-do-not-create-systemdstatedir.patch
index 65cd257a8a41..2e3ada02a901 100644
--- a/pkgs/os-specific/linux/systemd/0017-meson.build-do-not-create-systemdstatedir.patch
+++ b/pkgs/os-specific/linux/systemd/0017-meson.build-do-not-create-systemdstatedir.patch
@@ -8,10 +8,10 @@ Subject: [PATCH] meson.build: do not create systemdstatedir
  1 file changed, 1 deletion(-)
 
 diff --git a/meson.build b/meson.build
-index a4730f0570..b5aaecd669 100644
+index 238b935372..b0b67c9b99 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -2815,7 +2815,6 @@ install_data('LICENSE.GPL2',
+@@ -2791,7 +2791,6 @@ install_data('LICENSE.GPL2',
  install_subdir('LICENSES',
                 install_dir : docdir)
  
diff --git a/pkgs/os-specific/linux/systemd/0018-meson-Don-t-link-ssh-dropins.patch b/pkgs/os-specific/linux/systemd/0018-meson-Don-t-link-ssh-dropins.patch
index da170d869ad7..472bd260caf3 100644
--- a/pkgs/os-specific/linux/systemd/0018-meson-Don-t-link-ssh-dropins.patch
+++ b/pkgs/os-specific/linux/systemd/0018-meson-Don-t-link-ssh-dropins.patch
@@ -8,10 +8,10 @@ Subject: [PATCH] meson: Don't link ssh dropins
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/meson.build b/meson.build
-index b5aaecd669..91b23f2d72 100644
+index b0b67c9b99..4721b7482b 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -207,13 +207,13 @@ sshconfdir = get_option('sshconfdir')
+@@ -219,13 +219,13 @@ sshconfdir = get_option('sshconfdir')
  if sshconfdir == ''
          sshconfdir = sysconfdir / 'ssh/ssh_config.d'
  endif
diff --git a/pkgs/os-specific/linux/systemd/0019-install-unit_file_exists_full-follow-symlinks.patch b/pkgs/os-specific/linux/systemd/0019-install-unit_file_exists_full-follow-symlinks.patch
index 4d7ceedcbab0..7372b5214e59 100644
--- a/pkgs/os-specific/linux/systemd/0019-install-unit_file_exists_full-follow-symlinks.patch
+++ b/pkgs/os-specific/linux/systemd/0019-install-unit_file_exists_full-follow-symlinks.patch
@@ -8,10 +8,10 @@ Subject: [PATCH] install: unit_file_exists_full: follow symlinks
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/shared/install.c b/src/shared/install.c
-index 6d87858a3c..8da022eb64 100644
+index 8195436564..dfbc35f357 100644
 --- a/src/shared/install.c
 +++ b/src/shared/install.c
-@@ -3226,7 +3226,7 @@ int unit_file_exists_full(RuntimeScope scope, const LookupPaths *lp, const char
+@@ -3227,7 +3227,7 @@ int unit_file_exists_full(RuntimeScope scope, const LookupPaths *lp, const char
                          &c,
                          lp,
                          name,
diff --git a/pkgs/os-specific/linux/systemd/0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch b/pkgs/os-specific/linux/systemd/0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
index a1b1575a51d2..be03316306b6 100644
--- a/pkgs/os-specific/linux/systemd/0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
+++ b/pkgs/os-specific/linux/systemd/0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
@@ -13,10 +13,10 @@ directly.
  1 file changed, 11 insertions(+)
 
 diff --git a/src/timesync/timesyncd.c b/src/timesync/timesyncd.c
-index d002501d29..9b835dc031 100644
+index 40305c046b..c3ed57c54e 100644
 --- a/src/timesync/timesyncd.c
 +++ b/src/timesync/timesyncd.c
-@@ -23,6 +23,11 @@
+@@ -25,6 +25,11 @@
  #include "timesyncd-conf.h"
  #include "timesyncd-manager.h"
  #include "user-util.h"
@@ -28,7 +28,7 @@ index d002501d29..9b835dc031 100644
  
  static int advance_tstamp(int fd, usec_t epoch) {
          assert(fd >= 0);
-@@ -201,6 +206,12 @@ static int run(int argc, char *argv[]) {
+@@ -203,6 +208,12 @@ static int run(int argc, char *argv[]) {
          if (r < 0)
                  return log_error_errno(r, "Failed to parse fallback server strings: %m");
  
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 37b871f3c30b..be02ac358833 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -56,7 +56,6 @@
   elfutils,
   linuxHeaders ? stdenv.cc.libc.linuxHeaders,
   gnutls,
-  iptables,
   withSelinux ? false,
   libselinux,
   withLibseccomp ? lib.meta.availableOn stdenv.hostPlatform libseccomp,
@@ -203,7 +202,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   inherit pname;
-  version = "257.9";
+  version = "258";
 
   # We use systemd/systemd-stable for src, and ship NixOS-specific patches inside nixpkgs directly
   # This has proven to be less error-prone than the previous systemd fork.
@@ -211,7 +210,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "systemd";
     repo = "systemd";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-3Ig5TXhK99iOu41k4c5CgC4R3HhBftSAb9UbXvFY6lo=";
+    hash = "sha256-xtGZaVNsBNxkidgfVBu8xtvj0SxpY6OyJCUE+gq59qE=";
   };
 
   # On major changes, or when otherwise required, you *must* :
@@ -223,6 +222,18 @@ stdenv.mkDerivation (finalAttrs: {
   # Use `find . -name "*.patch" | sort` to get an up-to-date listing of all
   # patches
   patches = [
+    # https://github.com/systemd/systemd/pull/39094
+    (fetchpatch {
+      url = "https://github.com/systemd/systemd/commit/0f44a6c64aebc64a0611a605831206afee9cb730.patch";
+      hash = "sha256-DO6q17mE2U8iLezMYt4PX5Ror20N1gCrUbXeQmrW1is=";
+    })
+
+    # https://github.com/systemd/systemd/pull/39069
+    (fetchpatch {
+      url = "https://github.com/systemd/systemd/commit/b5fdfedf729712b9824a5cb457a07d5699d2946c.patch";
+      hash = "sha256-0SvAn9Dl4z80PRIvDbIVIjKp5DsT/IUoHa5IiH1HHFY=";
+    })
+
     ./0001-Start-device-units-for-uninitialised-encrypted-devic.patch
     ./0002-Don-t-try-to-unmount-nix-or-nix-store.patch
     ./0003-Fix-NixOS-containers.patch
@@ -371,6 +382,7 @@ stdenv.mkDerivation (finalAttrs: {
         jinja2
       ]
       ++ lib.optional withEfi ps.pyelftools
+      ++ lib.optional (withUkify && finalAttrs.finalPackage.doCheck) ps.pefile
     ))
   ]
   ++ lib.optionals withLibBPF [
@@ -852,7 +864,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     ${lib.optionalString (
       !buildLibsOnly
-    ) "$out/bin/udevadm verify --resolve-names=never --no-style $out/lib/udev/rules.d"}
+    ) "$out/bin/udevadm verify --resolve-names=late --no-style $out/lib/udev/rules.d"}
 
     runHook postInstallCheck
   '';
@@ -989,7 +1001,6 @@ stdenv.mkDerivation (finalAttrs: {
             systemd-journal
             systemd-journal-gateway
             systemd-journal-upload
-            systemd-lock-handler
             systemd-machinectl
             systemd-networkd
             systemd-networkd-bridge