From 1c5d47dd782dd7e63d16978d4bc0c6065361bcd8 Mon Sep 17 00:00:00 2001
From: Will Fancher <elvishjerricco@gmail.com>
Date: Wed, 23 Jul 2025 18:31:22 -0400
Subject: [PATCH 01/11] systemd: v257.9 -> v258

---
 nixos/modules/services/hardware/udev.nix      |  3 +-
 ...ts-for-uninitialised-encrypted-devic.patch |  8 +--
 ...on-t-try-to-unmount-nix-or-nix-store.patch |  8 +--
 .../systemd/0003-Fix-NixOS-containers.patch   |  8 +--
 ...some-NixOS-specific-unit-directories.patch | 22 +++----
 ...f-a-useless-message-in-user-sessions.patch |  4 +-
 ...d-timedated-disable-methods-that-cha.patch | 22 +++----
 ...e-usr-share-zoneinfo-to-etc-zoneinfo.patch | 59 ++++++++++++-------
 ...calectl-use-etc-X11-xkb-for-list-x11.patch |  6 +-
 ...9-add-rootprefix-to-lookup-dir-paths.patch |  4 +-
 ...-execute-scripts-in-etc-systemd-syst.patch |  2 +-
 ...ecute-scripts-in-etc-systemd-system-.patch |  4 +-
 ...-placeholder-for-DEFAULT_PATH_NORMAL.patch |  4 +-
 ...-environment-when-calling-generators.patch |  4 +-
 ...014-core-don-t-taint-on-unmerged-usr.patch |  4 +-
 ...ontext_init-fix-driver-name-checking.patch |  4 +-
 ...uggest-systemdctl-edit-runtime-on-sy.patch |  4 +-
 ....build-do-not-create-systemdstatedir.patch |  4 +-
 .../0018-meson-Don-t-link-ssh-dropins.patch   |  4 +-
 ...nit_file_exists_full-follow-symlinks.patch |  4 +-
 ...e-NSCD-when-DNSSEC-validation-is-dis.patch |  6 +-
 pkgs/os-specific/linux/systemd/default.nix    | 14 +++--
 22 files changed, 112 insertions(+), 90 deletions(-)

diff --git a/nixos/modules/services/hardware/udev.nix b/nixos/modules/services/hardware/udev.nix
index ca9464d091c1..9370fb0bf207 100644
--- a/nixos/modules/services/hardware/udev.nix
+++ b/nixos/modules/services/hardware/udev.nix
@@ -179,7 +179,8 @@ let
         for i in $packages; do
           echo "Adding hwdb files for package $i"
           for j in $i/{etc,lib}/udev/hwdb.d/*; do
-            ln -s $j etc/udev/hwdb.d/$(basename $j)
+            # This must be a copy, not a symlink, because --root below will chase links within the root argument.
+            cp $j etc/udev/hwdb.d/$(basename $j)
           done
         done
 
diff --git a/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch b/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
index d242ff7c9287..02845eb126f6 100644
--- a/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
+++ b/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
@@ -13,7 +13,7 @@ unit.  (However, this ignores the fsck unit, so it's not perfect...)
  1 file changed, 4 deletions(-)
 
 diff --git a/rules.d/99-systemd.rules.in b/rules.d/99-systemd.rules.in
-index 882cda0dcd..8e8d1f04ce 100644
+index bebc4d7d09..60278a0da7 100644
 --- a/rules.d/99-systemd.rules.in
 +++ b/rules.d/99-systemd.rules.in
 @@ -30,10 +30,6 @@ SUBSYSTEM=="block", ACTION=="add", KERNEL=="dm-*", ENV{DM_NAME}!="?*", ENV{SYSTE
@@ -24,6 +24,6 @@ index 882cda0dcd..8e8d1f04ce 100644
 -# we are probably still calling mke2fs or mkswap on it.
 -SUBSYSTEM=="block", ENV{DM_UUID}=="CRYPT-*", ENV{ID_PART_TABLE_TYPE}=="", ENV{ID_FS_USAGE}=="", ENV{SYSTEMD_READY}="0"
 -
- # add symlink to GPT root disk
- SUBSYSTEM=="block", ENV{ID_PART_GPT_AUTO_ROOT}=="1", ENV{ID_FS_TYPE}!="crypto_LUKS", SYMLINK+="gpt-auto-root"
- SUBSYSTEM=="block", ENV{ID_PART_GPT_AUTO_ROOT}=="1", ENV{ID_FS_TYPE}=="crypto_LUKS", SYMLINK+="gpt-auto-root-luks"
+ # Ignore raid devices that are not yet assembled and started
+ SUBSYSTEM=="block", ENV{DEVTYPE}=="disk", KERNEL=="md*", TEST!="md/array_state", ENV{SYSTEMD_READY}="0"
+ SUBSYSTEM=="block", ENV{DEVTYPE}=="disk", KERNEL=="md*", ATTR{md/array_state}=="|clear|inactive", ENV{SYSTEMD_READY}="0"
diff --git a/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch b/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
index 9e3496986859..d1dcbfd37a0f 100644
--- a/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
+++ b/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
@@ -14,10 +14,10 @@ Original-Author: Eelco Dolstra <eelco.dolstra@logicblox.com>
  2 files changed, 6 insertions(+), 2 deletions(-)
 
 diff --git a/src/shared/fstab-util.c b/src/shared/fstab-util.c
-index d6a256c4a7..f74d5198f1 100644
+index 57ab68deb6..8e281b8f2c 100644
 --- a/src/shared/fstab-util.c
 +++ b/src/shared/fstab-util.c
-@@ -66,6 +66,8 @@ bool fstab_is_extrinsic(const char *mount, const char *opts) {
+@@ -72,6 +72,8 @@ bool fstab_is_extrinsic(const char *mount, const char *opts) {
          /* Don't bother with the OS data itself */
          if (PATH_IN_SET(mount,
                          "/",
@@ -27,10 +27,10 @@ index d6a256c4a7..f74d5198f1 100644
                          "/etc"))
                  return true;
 diff --git a/src/shutdown/umount.c b/src/shutdown/umount.c
-index 84da5eed63..d6e2f36d52 100644
+index 45c6db9245..d7283b7fa6 100644
 --- a/src/shutdown/umount.c
 +++ b/src/shutdown/umount.c
-@@ -175,8 +175,10 @@ int mount_points_list_get(const char *mountinfo, MountPoint **head) {
+@@ -178,8 +178,10 @@ int mount_points_list_get(FILE *f, MountPoint **head) {
  static bool nonunmountable_path(const char *path) {
          assert(path);
  
diff --git a/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch b/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
index 7cc2804a05bb..3815c140d495 100644
--- a/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
+++ b/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
@@ -10,10 +10,10 @@ container, so checking early whether it exists will fail.
  1 file changed, 2 insertions(+)
 
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index 6f90f2f418..74b2a237d3 100644
+index ab8746c442..480a9c55c6 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -6189,6 +6189,7 @@ static int run(int argc, char *argv[]) {
+@@ -6165,6 +6165,7 @@ static int run(int argc, char *argv[]) {
                                  goto finish;
                          }
                  } else {
@@ -21,11 +21,11 @@ index 6f90f2f418..74b2a237d3 100644
                          _cleanup_free_ char *p = NULL;
  
                          if (arg_pivot_root_new)
-@@ -6208,6 +6209,7 @@ static int run(int argc, char *argv[]) {
+@@ -6184,6 +6185,7 @@ static int run(int argc, char *argv[]) {
                                  log_error_errno(r, "Unable to determine if %s looks like it has an OS tree (i.e. whether /usr/ exists): %m", arg_directory);
                                  goto finish;
                          }
 +#endif
                  }
  
-         } else {
+                 if (arg_userns_mode == USER_NAMESPACE_MANAGED) {
diff --git a/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch b/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch
index 2657eb9089d1..81d17a57fb2f 100644
--- a/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch
+++ b/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch
@@ -16,10 +16,10 @@ Original-Author: Eelco Dolstra <eelco.dolstra@logicblox.com>
  2 files changed, 7 insertions(+), 21 deletions(-)
 
 diff --git a/src/core/systemd.pc.in b/src/core/systemd.pc.in
-index f3b85b0190..f7aa5fca50 100644
+index 58f2463104..0c263430a7 100644
 --- a/src/core/systemd.pc.in
 +++ b/src/core/systemd.pc.in
-@@ -43,10 +43,10 @@ systemdsystemconfdir=${systemd_system_conf_dir}
+@@ -46,10 +46,10 @@ systemdsystemconfdir=${systemd_system_conf_dir}
  systemd_user_conf_dir=${sysconfdir}/systemd/user
  systemduserconfdir=${systemd_user_conf_dir}
  
@@ -32,7 +32,7 @@ index f3b85b0190..f7aa5fca50 100644
  systemduserunitpath=${systemd_user_unit_path}
  
  systemd_system_generator_dir=${prefix}/lib/systemd/system-generators
-@@ -55,10 +55,10 @@ systemdsystemgeneratordir=${systemd_system_generator_dir}
+@@ -58,10 +58,10 @@ systemdsystemgeneratordir=${systemd_system_generator_dir}
  systemd_user_generator_dir=${prefix}/lib/systemd/user-generators
  systemdusergeneratordir=${systemd_user_generator_dir}
  
@@ -46,10 +46,10 @@ index f3b85b0190..f7aa5fca50 100644
  
  systemd_sleep_dir=${prefix}/lib/systemd/system-sleep
 diff --git a/src/libsystemd/sd-path/path-lookup.c b/src/libsystemd/sd-path/path-lookup.c
-index a3b09208cb..91a085c6bc 100644
+index 3ddbda0e9f..3eddc80c90 100644
 --- a/src/libsystemd/sd-path/path-lookup.c
 +++ b/src/libsystemd/sd-path/path-lookup.c
-@@ -69,11 +69,7 @@ int runtime_directory(RuntimeScope scope, const char *suffix, char **ret) {
+@@ -64,11 +64,7 @@ int runtime_directory(RuntimeScope scope, const char *suffix, char **ret) {
  }
  
  static const char* const user_data_unit_paths[] = {
@@ -61,7 +61,7 @@ index a3b09208cb..91a085c6bc 100644
          NULL
  };
  
-@@ -481,16 +477,13 @@ int lookup_paths_init(
+@@ -476,16 +472,13 @@ int lookup_paths_init(
                                         persistent_config,
                                         SYSTEM_CONFIG_UNIT_DIR,
                                         "/etc/systemd/system",
@@ -79,7 +79,7 @@ index a3b09208cb..91a085c6bc 100644
                                         STRV_IFNOTNULL(generator_late));
                          break;
  
-@@ -508,13 +501,10 @@ int lookup_paths_init(
+@@ -503,13 +496,10 @@ int lookup_paths_init(
                          add = strv_new(persistent_config,
                                         USER_CONFIG_UNIT_DIR,
                                         "/etc/systemd/user",
@@ -95,7 +95,7 @@ index a3b09208cb..91a085c6bc 100644
                          break;
  
                  case RUNTIME_SCOPE_USER:
-@@ -653,7 +643,6 @@ void lookup_paths_log(LookupPaths *lp) {
+@@ -648,7 +638,6 @@ void lookup_paths_log(LookupPaths *lp) {
  static const char* const system_generator_paths[] = {
          "/run/systemd/system-generators",
          "/etc/systemd/system-generators",
@@ -103,7 +103,7 @@ index a3b09208cb..91a085c6bc 100644
          SYSTEM_GENERATOR_DIR,
          NULL,
  };
-@@ -661,7 +650,6 @@ static const char* const system_generator_paths[] = {
+@@ -656,7 +645,6 @@ static const char* const system_generator_paths[] = {
  static const char* const user_generator_paths[] = {
          "/run/systemd/user-generators",
          "/etc/systemd/user-generators",
@@ -111,7 +111,7 @@ index a3b09208cb..91a085c6bc 100644
          USER_GENERATOR_DIR,
          NULL,
  };
-@@ -669,7 +657,6 @@ static const char* const user_generator_paths[] = {
+@@ -664,7 +652,6 @@ static const char* const user_generator_paths[] = {
  static const char* const system_env_generator_paths[] = {
          "/run/systemd/system-environment-generators",
          "/etc/systemd/system-environment-generators",
@@ -119,7 +119,7 @@ index a3b09208cb..91a085c6bc 100644
          SYSTEM_ENV_GENERATOR_DIR,
          NULL,
  };
-@@ -677,7 +664,6 @@ static const char* const system_env_generator_paths[] = {
+@@ -672,7 +659,6 @@ static const char* const system_env_generator_paths[] = {
  static const char* const user_env_generator_paths[] = {
          "/run/systemd/user-environment-generators",
          "/etc/systemd/user-environment-generators",
diff --git a/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch b/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch
index 6c4a41ab0609..2f7139911220 100644
--- a/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch
+++ b/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch
@@ -13,10 +13,10 @@ in containers.
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index 4ccaba9054..9577b89783 100644
+index d85896577f..2a4782a55e 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -1672,7 +1672,8 @@ static unsigned manager_dispatch_stop_when_bound_queue(Manager *m) {
+@@ -1575,7 +1575,8 @@ static unsigned manager_dispatch_stop_when_bound_queue(Manager *m) {
                  if (!unit_is_bound_by_inactive(u, &culprit))
                          continue;
  
diff --git a/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch b/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch
index 44bd2263ddf0..b43dddb3d420 100644
--- a/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch
+++ b/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch
@@ -11,10 +11,10 @@ Subject: [PATCH] hostnamed, localed, timedated: disable methods that change
  3 files changed, 25 insertions(+)
 
 diff --git a/src/hostname/hostnamed.c b/src/hostname/hostnamed.c
-index ba50b59f92..9827487453 100644
+index 06fb3f2878..b656e511b7 100644
 --- a/src/hostname/hostnamed.c
 +++ b/src/hostname/hostnamed.c
-@@ -1115,6 +1115,9 @@ static int method_set_static_hostname(sd_bus_message *m, void *userdata, sd_bus_
+@@ -1388,6 +1388,9 @@ static int method_set_static_hostname(sd_bus_message *m, void *userdata, sd_bus_
          if (r < 0)
                  return r;
  
@@ -24,7 +24,7 @@ index ba50b59f92..9827487453 100644
          name = empty_to_null(name);
  
          context_read_etc_hostname(c);
-@@ -1177,6 +1180,9 @@ static int set_machine_info(Context *c, sd_bus_message *m, int prop, sd_bus_mess
+@@ -1454,6 +1457,9 @@ static int set_machine_info(Context *c, sd_bus_message *m, int prop, sd_bus_mess
          if (r < 0)
                  return r;
  
@@ -35,10 +35,10 @@ index ba50b59f92..9827487453 100644
  
          context_read_machine_info(c);
 diff --git a/src/locale/localed.c b/src/locale/localed.c
-index 062744519d..95bde4b1c3 100644
+index 11d9130bbc..dd4d9e59ea 100644
 --- a/src/locale/localed.c
 +++ b/src/locale/localed.c
-@@ -226,6 +226,9 @@ static int method_set_locale(sd_bus_message *m, void *userdata, sd_bus_error *er
+@@ -221,6 +221,9 @@ static int method_set_locale(sd_bus_message *m, void *userdata, sd_bus_error *er
  
          use_localegen = locale_gen_check_available();
  
@@ -48,7 +48,7 @@ index 062744519d..95bde4b1c3 100644
          /* If single locale without variable name is provided, then we assume it is LANG=. */
          if (strv_length(l) == 1 && !strchr(l[0], '=')) {
                  if (!locale_is_valid(l[0]))
-@@ -343,6 +346,9 @@ static int method_set_vc_keyboard(sd_bus_message *m, void *userdata, sd_bus_erro
+@@ -338,6 +341,9 @@ static int method_set_vc_keyboard(sd_bus_message *m, void *userdata, sd_bus_erro
          if (r < 0)
                  return bus_log_parse_error(r);
  
@@ -58,7 +58,7 @@ index 062744519d..95bde4b1c3 100644
          vc_context_empty_to_null(&in);
  
          r = vc_context_verify_and_warn(&in, LOG_ERR, error);
-@@ -460,6 +466,9 @@ static int method_set_x11_keyboard(sd_bus_message *m, void *userdata, sd_bus_err
+@@ -455,6 +461,9 @@ static int method_set_x11_keyboard(sd_bus_message *m, void *userdata, sd_bus_err
          if (r < 0)
                  return bus_log_parse_error(r);
  
@@ -69,10 +69,10 @@ index 062744519d..95bde4b1c3 100644
  
          r = x11_context_verify_and_warn(&in, LOG_ERR, error);
 diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
-index c79bb864df..cbd30214b7 100644
+index 662cc29ac5..57f3413dc6 100644
 --- a/src/timedate/timedated.c
 +++ b/src/timedate/timedated.c
-@@ -676,6 +676,10 @@ static int method_set_timezone(sd_bus_message *m, void *userdata, sd_bus_error *
+@@ -678,6 +678,10 @@ static int method_set_timezone(sd_bus_message *m, void *userdata, sd_bus_error *
          if (r < 0)
                  return r;
  
@@ -83,7 +83,7 @@ index c79bb864df..cbd30214b7 100644
          if (!timezone_is_valid(z, LOG_DEBUG))
                  return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid or not installed time zone '%s'", z);
  
-@@ -754,6 +758,9 @@ static int method_set_local_rtc(sd_bus_message *m, void *userdata, sd_bus_error
+@@ -756,6 +760,9 @@ static int method_set_local_rtc(sd_bus_message *m, void *userdata, sd_bus_error
          if (r < 0)
                  return r;
  
@@ -93,7 +93,7 @@ index c79bb864df..cbd30214b7 100644
          if (lrtc == c->local_rtc && !fix_system)
                  return sd_bus_reply_method_return(m, NULL);
  
-@@ -948,6 +955,9 @@ static int method_set_ntp(sd_bus_message *m, void *userdata, sd_bus_error *error
+@@ -954,6 +961,9 @@ static int method_set_ntp(sd_bus_message *m, void *userdata, sd_bus_error *error
          if (r < 0)
                  return r;
  
diff --git a/pkgs/os-specific/linux/systemd/0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch b/pkgs/os-specific/linux/systemd/0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
index 1f4184e92836..21589efdd849 100644
--- a/pkgs/os-specific/linux/systemd/0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
+++ b/pkgs/os-specific/linux/systemd/0007-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
@@ -7,10 +7,10 @@ NixOS uses this path.
 ---
  man/localtime.xml         | 4 ++--
  src/basic/time-util.c     | 8 ++++----
- src/firstboot/firstboot.c | 2 +-
+ src/firstboot/firstboot.c | 9 +++------
  src/nspawn/nspawn.c       | 4 ++--
  src/timedate/timedated.c  | 8 ++++----
- 5 files changed, 13 insertions(+), 13 deletions(-)
+ 5 files changed, 15 insertions(+), 18 deletions(-)
 
 diff --git a/man/localtime.xml b/man/localtime.xml
 index 3a13e04a27..4fd58068a1 100644
@@ -35,10 +35,10 @@ index 3a13e04a27..4fd58068a1 100644
      <literal>Etc/UTC</literal>. The resulting link should lead to the
      corresponding binary
 diff --git a/src/basic/time-util.c b/src/basic/time-util.c
-index 29afb08ebc..398ff340cd 100644
+index 55931a2546..2e00bd7539 100644
 --- a/src/basic/time-util.c
 +++ b/src/basic/time-util.c
-@@ -1418,7 +1418,7 @@ static int get_timezones_from_zone1970_tab(char ***ret) {
+@@ -1410,7 +1410,7 @@ static int get_timezones_from_zone1970_tab(char ***ret) {
  
          assert(ret);
  
@@ -47,7 +47,7 @@ index 29afb08ebc..398ff340cd 100644
          if (!f)
                  return -errno;
  
-@@ -1459,7 +1459,7 @@ static int get_timezones_from_tzdata_zi(char ***ret) {
+@@ -1451,7 +1451,7 @@ static int get_timezones_from_tzdata_zi(char ***ret) {
  
          assert(ret);
  
@@ -56,7 +56,7 @@ index 29afb08ebc..398ff340cd 100644
          if (!f)
                  return -errno;
  
-@@ -1570,7 +1570,7 @@ int verify_timezone(const char *name, int log_level) {
+@@ -1562,7 +1562,7 @@ int verify_timezone(const char *name, int log_level) {
          if (p - name >= PATH_MAX)
                  return -ENAMETOOLONG;
  
@@ -65,7 +65,7 @@ index 29afb08ebc..398ff340cd 100644
  
          fd = open(t, O_RDONLY|O_CLOEXEC);
          if (fd < 0)
-@@ -1622,7 +1622,7 @@ int get_timezone(char **ret) {
+@@ -1614,7 +1614,7 @@ int get_timezone(char **ret) {
          if (r < 0)
                  return r; /* Return EINVAL if not a symlink */
  
@@ -75,23 +75,38 @@ index 29afb08ebc..398ff340cd 100644
                  return -EINVAL;
          if (!timezone_is_valid(e, LOG_DEBUG))
 diff --git a/src/firstboot/firstboot.c b/src/firstboot/firstboot.c
-index a389eeae10..c817e91991 100644
+index 5ed6d3a9d2..f922d91a9d 100644
 --- a/src/firstboot/firstboot.c
 +++ b/src/firstboot/firstboot.c
-@@ -598,7 +598,7 @@ static int process_timezone(int rfd) {
+@@ -618,7 +618,7 @@ static int prompt_timezone(int rfd) {
+ 
+ static int process_timezone(int rfd) {
+         _cleanup_close_ int pfd = -EBADF;
+-        _cleanup_free_ char *f = NULL, *relpath = NULL;
++        _cleanup_free_ char *f = NULL;
+         const char *e;
+         int r;
+ 
+@@ -664,12 +664,9 @@ static int process_timezone(int rfd) {
          if (isempty(arg_timezone))
                  return 0;
  
--        e = strjoina("../usr/share/zoneinfo/", arg_timezone);
+-        e = strjoina("/usr/share/zoneinfo/", arg_timezone);
+-        r = path_make_relative_parent(etc_localtime(), e, &relpath);
+-        if (r < 0)
+-                return r;
 +        e = strjoina("zoneinfo/", arg_timezone);
  
-         r = symlinkat_atomic_full(e, pfd, f, /* make_relative= */ false);
+-        r = symlinkat_atomic_full(relpath, pfd, f, SYMLINK_LABEL);
++        r = symlinkat_atomic_full(e, pfd, f, SYMLINK_LABEL);
          if (r < 0)
+                 return log_error_errno(r, "Failed to create /etc/localtime symlink: %m");
+ 
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index 74b2a237d3..cf9eabf0f2 100644
+index 480a9c55c6..02c9ae6608 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -1851,8 +1851,8 @@ int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid
+@@ -1821,8 +1821,8 @@ int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid
  static const char *timezone_from_path(const char *path) {
          return PATH_STARTSWITH_SET(
                          path,
@@ -103,10 +118,10 @@ index 74b2a237d3..cf9eabf0f2 100644
  
  static bool etc_writable(void) {
 diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
-index cbd30214b7..b9b2f533a4 100644
+index 57f3413dc6..6a456fe601 100644
 --- a/src/timedate/timedated.c
 +++ b/src/timedate/timedated.c
-@@ -280,7 +280,7 @@ static int context_read_data(Context *c) {
+@@ -266,7 +266,7 @@ static int context_read_data(Context *c) {
  
          r = get_timezone(&t);
          if (r == -EINVAL)
@@ -115,24 +130,24 @@ index cbd30214b7..b9b2f533a4 100644
          else if (r < 0)
                  log_warning_errno(r, "Failed to get target of /etc/localtime: %m");
  
-@@ -304,7 +304,7 @@ static int context_write_data_timezone(Context *c) {
+@@ -290,7 +290,7 @@ static int context_write_data_timezone(Context *c) {
  
          if (isempty(c->zone) || streq(c->zone, "UTC")) {
  
 -                if (access("/usr/share/zoneinfo/UTC", F_OK) < 0) {
 +                if (access("/etc/zoneinfo/UTC", F_OK) < 0) {
  
-                         if (unlink("/etc/localtime") < 0 && errno != ENOENT)
+                         if (unlink(etc_localtime()) < 0 && errno != ENOENT)
                                  return -errno;
-@@ -312,9 +312,9 @@ static int context_write_data_timezone(Context *c) {
+@@ -298,9 +298,9 @@ static int context_write_data_timezone(Context *c) {
                          return 0;
                  }
  
--                source = "../usr/share/zoneinfo/UTC";
-+                source = "../etc/zoneinfo/UTC";
+-                source = "/usr/share/zoneinfo/UTC";
++                source = "/etc/zoneinfo/UTC";
          } else {
--                p = path_join("../usr/share/zoneinfo", c->zone);
-+                p = path_join("../etc/zoneinfo", c->zone);
+-                p = path_join("/usr/share/zoneinfo", c->zone);
++                p = path_join("/etc/zoneinfo", c->zone);
                  if (!p)
                          return -ENOMEM;
  
diff --git a/pkgs/os-specific/linux/systemd/0008-localectl-use-etc-X11-xkb-for-list-x11.patch b/pkgs/os-specific/linux/systemd/0008-localectl-use-etc-X11-xkb-for-list-x11.patch
index c670f076c34a..6c348219872f 100644
--- a/pkgs/os-specific/linux/systemd/0008-localectl-use-etc-X11-xkb-for-list-x11.patch
+++ b/pkgs/os-specific/linux/systemd/0008-localectl-use-etc-X11-xkb-for-list-x11.patch
@@ -10,15 +10,15 @@ NixOS has an option to link the xkb data files to /etc/X11, but not to
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/locale/localectl.c b/src/locale/localectl.c
-index 36dbeb9daa..265eda2751 100644
+index c595f81b40..90033f6566 100644
 --- a/src/locale/localectl.c
 +++ b/src/locale/localectl.c
-@@ -301,7 +301,7 @@ static int list_x11_keymaps(int argc, char **argv, void *userdata) {
+@@ -302,7 +302,7 @@ static int list_x11_keymaps(int argc, char **argv, void *userdata) {
          } state = NONE, look_for;
          int r;
  
 -        f = fopen("/usr/share/X11/xkb/rules/base.lst", "re");
 +        f = fopen("/etc/X11/xkb/rules/base.lst", "re");
          if (!f)
-                 return log_error_errno(errno, "Failed to open keyboard mapping list. %m");
+                 return log_error_errno(errno, "Failed to open keyboard mapping list: %m");
  
diff --git a/pkgs/os-specific/linux/systemd/0009-add-rootprefix-to-lookup-dir-paths.patch b/pkgs/os-specific/linux/systemd/0009-add-rootprefix-to-lookup-dir-paths.patch
index bf9f028d6300..beb8acc61732 100644
--- a/pkgs/os-specific/linux/systemd/0009-add-rootprefix-to-lookup-dir-paths.patch
+++ b/pkgs/os-specific/linux/systemd/0009-add-rootprefix-to-lookup-dir-paths.patch
@@ -12,10 +12,10 @@ files that I might have missed.
  1 file changed, 4 insertions(+), 2 deletions(-)
 
 diff --git a/src/basic/constants.h b/src/basic/constants.h
-index 5aaf8f535c..934175fb51 100644
+index 7a09fbf878..ee3378f109 100644
 --- a/src/basic/constants.h
 +++ b/src/basic/constants.h
-@@ -62,13 +62,15 @@
+@@ -40,13 +40,15 @@
          "/etc/" n "\0"                          \
          "/run/" n "\0"                          \
          "/usr/local/lib/" n "\0"                \
diff --git a/pkgs/os-specific/linux/systemd/0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch b/pkgs/os-specific/linux/systemd/0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
index 20b4641ac000..b05fc609d6ed 100644
--- a/pkgs/os-specific/linux/systemd/0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
+++ b/pkgs/os-specific/linux/systemd/0010-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
@@ -10,7 +10,7 @@ This is needed for NixOS to use such scripts as systemd directory is immutable.
  1 file changed, 1 insertion(+)
 
 diff --git a/src/shutdown/shutdown.c b/src/shutdown/shutdown.c
-index e26a8579c5..af814cd551 100644
+index 3317068e47..021a3c0699 100644
 --- a/src/shutdown/shutdown.c
 +++ b/src/shutdown/shutdown.c
 @@ -358,6 +358,7 @@ static void notify_supervisor(void) {
diff --git a/pkgs/os-specific/linux/systemd/0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch b/pkgs/os-specific/linux/systemd/0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
index 13578115a014..bfded1bba554 100644
--- a/pkgs/os-specific/linux/systemd/0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
+++ b/pkgs/os-specific/linux/systemd/0011-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
@@ -9,10 +9,10 @@ This is needed for NixOS to use such scripts as systemd directory is immutable.
  1 file changed, 1 insertion(+)
 
 diff --git a/src/sleep/sleep.c b/src/sleep/sleep.c
-index 181bb4ccef..2b1410d8a1 100644
+index 3390ebe0c0..affc823bc4 100644
 --- a/src/sleep/sleep.c
 +++ b/src/sleep/sleep.c
-@@ -218,6 +218,7 @@ static int execute(
+@@ -248,6 +248,7 @@ static int execute(
          };
          static const char* const dirs[] = {
                  SYSTEM_SLEEP_PATH,
diff --git a/pkgs/os-specific/linux/systemd/0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch b/pkgs/os-specific/linux/systemd/0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
index 9e29c34efcd7..1168d1249858 100644
--- a/pkgs/os-specific/linux/systemd/0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
+++ b/pkgs/os-specific/linux/systemd/0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
@@ -10,10 +10,10 @@ systemd itself uses extensively.
  1 file changed, 3 insertions(+), 3 deletions(-)
 
 diff --git a/src/basic/path-util.h b/src/basic/path-util.h
-index dff5a3a549..01344e5cf6 100644
+index 45518c07e5..94bef2f4b4 100644
 --- a/src/basic/path-util.h
 +++ b/src/basic/path-util.h
-@@ -17,10 +17,10 @@
+@@ -9,10 +9,10 @@
  #define PATH_MERGED_BIN(x) x "bin"
  #define PATH_MERGED_BIN_NULSTR(x) x "bin\0"
  
diff --git a/pkgs/os-specific/linux/systemd/0013-inherit-systemd-environment-when-calling-generators.patch b/pkgs/os-specific/linux/systemd/0013-inherit-systemd-environment-when-calling-generators.patch
index 856fdee93475..1c4ce37dde34 100644
--- a/pkgs/os-specific/linux/systemd/0013-inherit-systemd-environment-when-calling-generators.patch
+++ b/pkgs/os-specific/linux/systemd/0013-inherit-systemd-environment-when-calling-generators.patch
@@ -16,10 +16,10 @@ executables that are being called from managers.
  1 file changed, 8 insertions(+)
 
 diff --git a/src/core/manager.c b/src/core/manager.c
-index 9577b89783..9cfd2798b9 100644
+index 2a4782a55e..8dfdc227a1 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -4158,9 +4158,17 @@ static int build_generator_environment(Manager *m, char ***ret) {
+@@ -3977,9 +3977,17 @@ static int build_generator_environment(Manager *m, char ***ret) {
           * adjust generated units to that. Let's pass down some bits of information that are easy for us to
           * determine (but a bit harder for generator scripts to determine), as environment variables. */
  
diff --git a/pkgs/os-specific/linux/systemd/0014-core-don-t-taint-on-unmerged-usr.patch b/pkgs/os-specific/linux/systemd/0014-core-don-t-taint-on-unmerged-usr.patch
index fbaaed99cb61..445b08d2289f 100644
--- a/pkgs/os-specific/linux/systemd/0014-core-don-t-taint-on-unmerged-usr.patch
+++ b/pkgs/os-specific/linux/systemd/0014-core-don-t-taint-on-unmerged-usr.patch
@@ -17,10 +17,10 @@ See also: https://github.com/systemd/systemd/issues/24191
  1 file changed, 8 deletions(-)
 
 diff --git a/src/core/taint.c b/src/core/taint.c
-index b7a1c647a2..c04864c478 100644
+index 8872a224b2..bc736e2ef8 100644
 --- a/src/core/taint.c
 +++ b/src/core/taint.c
-@@ -41,14 +41,6 @@ char** taint_strv(void) {
+@@ -42,14 +42,6 @@ char** taint_strv(void) {
  
          _cleanup_free_ char *bin = NULL, *usr_sbin = NULL, *var_run = NULL;
  
diff --git a/pkgs/os-specific/linux/systemd/0015-tpm2_context_init-fix-driver-name-checking.patch b/pkgs/os-specific/linux/systemd/0015-tpm2_context_init-fix-driver-name-checking.patch
index fe8ac0ddd913..9f73ff0de547 100644
--- a/pkgs/os-specific/linux/systemd/0015-tpm2_context_init-fix-driver-name-checking.patch
+++ b/pkgs/os-specific/linux/systemd/0015-tpm2_context_init-fix-driver-name-checking.patch
@@ -27,10 +27,10 @@ filename_is_valid with path_is_valid.
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/shared/tpm2-util.c b/src/shared/tpm2-util.c
-index 5b6b3ea93c..8ab04241b6 100644
+index 57e7a91f93..faf45e4807 100644
 --- a/src/shared/tpm2-util.c
 +++ b/src/shared/tpm2-util.c
-@@ -721,7 +721,7 @@ int tpm2_context_new(const char *device, Tpm2Context **ret_context) {
+@@ -724,7 +724,7 @@ int tpm2_context_new(const char *device, Tpm2Context **ret_context) {
                  fn = strjoina("libtss2-tcti-", driver, ".so.0");
  
                  /* Better safe than sorry, let's refuse strings that cannot possibly be valid driver early, before going to disk. */
diff --git a/pkgs/os-specific/linux/systemd/0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch b/pkgs/os-specific/linux/systemd/0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
index 50dd842cc221..de846e9410b3 100644
--- a/pkgs/os-specific/linux/systemd/0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
+++ b/pkgs/os-specific/linux/systemd/0016-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
@@ -30,10 +30,10 @@ are written into `$XDG_CONFIG_HOME/systemd/user`.
  1 file changed, 3 insertions(+)
 
 diff --git a/src/systemctl/systemctl-edit.c b/src/systemctl/systemctl-edit.c
-index 7165fa1cf7..7498cf9f4c 100644
+index 53bc57186a..0ed12ce931 100644
 --- a/src/systemctl/systemctl-edit.c
 +++ b/src/systemctl/systemctl-edit.c
-@@ -323,6 +323,9 @@ int verb_edit(int argc, char *argv[], void *userdata) {
+@@ -330,6 +330,9 @@ int verb_edit(int argc, char *argv[], void *userdata) {
          sd_bus *bus;
          int r;
  
diff --git a/pkgs/os-specific/linux/systemd/0017-meson.build-do-not-create-systemdstatedir.patch b/pkgs/os-specific/linux/systemd/0017-meson.build-do-not-create-systemdstatedir.patch
index 65cd257a8a41..2e3ada02a901 100644
--- a/pkgs/os-specific/linux/systemd/0017-meson.build-do-not-create-systemdstatedir.patch
+++ b/pkgs/os-specific/linux/systemd/0017-meson.build-do-not-create-systemdstatedir.patch
@@ -8,10 +8,10 @@ Subject: [PATCH] meson.build: do not create systemdstatedir
  1 file changed, 1 deletion(-)
 
 diff --git a/meson.build b/meson.build
-index a4730f0570..b5aaecd669 100644
+index 238b935372..b0b67c9b99 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -2815,7 +2815,6 @@ install_data('LICENSE.GPL2',
+@@ -2791,7 +2791,6 @@ install_data('LICENSE.GPL2',
  install_subdir('LICENSES',
                 install_dir : docdir)
  
diff --git a/pkgs/os-specific/linux/systemd/0018-meson-Don-t-link-ssh-dropins.patch b/pkgs/os-specific/linux/systemd/0018-meson-Don-t-link-ssh-dropins.patch
index da170d869ad7..472bd260caf3 100644
--- a/pkgs/os-specific/linux/systemd/0018-meson-Don-t-link-ssh-dropins.patch
+++ b/pkgs/os-specific/linux/systemd/0018-meson-Don-t-link-ssh-dropins.patch
@@ -8,10 +8,10 @@ Subject: [PATCH] meson: Don't link ssh dropins
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/meson.build b/meson.build
-index b5aaecd669..91b23f2d72 100644
+index b0b67c9b99..4721b7482b 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -207,13 +207,13 @@ sshconfdir = get_option('sshconfdir')
+@@ -219,13 +219,13 @@ sshconfdir = get_option('sshconfdir')
  if sshconfdir == ''
          sshconfdir = sysconfdir / 'ssh/ssh_config.d'
  endif
diff --git a/pkgs/os-specific/linux/systemd/0019-install-unit_file_exists_full-follow-symlinks.patch b/pkgs/os-specific/linux/systemd/0019-install-unit_file_exists_full-follow-symlinks.patch
index 4d7ceedcbab0..7372b5214e59 100644
--- a/pkgs/os-specific/linux/systemd/0019-install-unit_file_exists_full-follow-symlinks.patch
+++ b/pkgs/os-specific/linux/systemd/0019-install-unit_file_exists_full-follow-symlinks.patch
@@ -8,10 +8,10 @@ Subject: [PATCH] install: unit_file_exists_full: follow symlinks
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/shared/install.c b/src/shared/install.c
-index 6d87858a3c..8da022eb64 100644
+index 8195436564..dfbc35f357 100644
 --- a/src/shared/install.c
 +++ b/src/shared/install.c
-@@ -3226,7 +3226,7 @@ int unit_file_exists_full(RuntimeScope scope, const LookupPaths *lp, const char
+@@ -3227,7 +3227,7 @@ int unit_file_exists_full(RuntimeScope scope, const LookupPaths *lp, const char
                          &c,
                          lp,
                          name,
diff --git a/pkgs/os-specific/linux/systemd/0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch b/pkgs/os-specific/linux/systemd/0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
index a1b1575a51d2..be03316306b6 100644
--- a/pkgs/os-specific/linux/systemd/0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
+++ b/pkgs/os-specific/linux/systemd/0020-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
@@ -13,10 +13,10 @@ directly.
  1 file changed, 11 insertions(+)
 
 diff --git a/src/timesync/timesyncd.c b/src/timesync/timesyncd.c
-index d002501d29..9b835dc031 100644
+index 40305c046b..c3ed57c54e 100644
 --- a/src/timesync/timesyncd.c
 +++ b/src/timesync/timesyncd.c
-@@ -23,6 +23,11 @@
+@@ -25,6 +25,11 @@
  #include "timesyncd-conf.h"
  #include "timesyncd-manager.h"
  #include "user-util.h"
@@ -28,7 +28,7 @@ index d002501d29..9b835dc031 100644
  
  static int advance_tstamp(int fd, usec_t epoch) {
          assert(fd >= 0);
-@@ -201,6 +206,12 @@ static int run(int argc, char *argv[]) {
+@@ -203,6 +208,12 @@ static int run(int argc, char *argv[]) {
          if (r < 0)
                  return log_error_errno(r, "Failed to parse fallback server strings: %m");
  
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 090da26ed77c..07fe2194d044 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -56,7 +56,6 @@
   elfutils,
   linuxHeaders ? stdenv.cc.libc.linuxHeaders,
   gnutls,
-  iptables,
   withSelinux ? false,
   libselinux,
   withLibseccomp ? lib.meta.availableOn stdenv.hostPlatform libseccomp,
@@ -205,7 +204,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   inherit pname;
-  version = "257.9";
+  version = "258";
 
   # We use systemd/systemd-stable for src, and ship NixOS-specific patches inside nixpkgs directly
   # This has proven to be less error-prone than the previous systemd fork.
@@ -213,7 +212,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "systemd";
     repo = "systemd";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-3Ig5TXhK99iOu41k4c5CgC4R3HhBftSAb9UbXvFY6lo=";
+    hash = "sha256-xtGZaVNsBNxkidgfVBu8xtvj0SxpY6OyJCUE+gq59qE=";
   };
 
   # On major changes, or when otherwise required, you *must* :
@@ -225,6 +224,12 @@ stdenv.mkDerivation (finalAttrs: {
   # Use `find . -name "*.patch" | sort` to get an up-to-date listing of all
   # patches
   patches = [
+    # https://github.com/systemd/systemd/pull/39094
+    (fetchpatch {
+      url = "https://github.com/systemd/systemd/commit/0f44a6c64aebc64a0611a605831206afee9cb730.patch";
+      hash = "sha256-DO6q17mE2U8iLezMYt4PX5Ror20N1gCrUbXeQmrW1is=";
+    })
+
     ./0001-Start-device-units-for-uninitialised-encrypted-devic.patch
     ./0002-Don-t-try-to-unmount-nix-or-nix-store.patch
     ./0003-Fix-NixOS-containers.patch
@@ -373,6 +378,7 @@ stdenv.mkDerivation (finalAttrs: {
         jinja2
       ]
       ++ lib.optional withEfi ps.pyelftools
+      ++ lib.optional (withUkify && finalAttrs.finalPackage.doCheck) ps.pefile
     ))
   ]
   ++ lib.optionals withLibBPF [
@@ -854,7 +860,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     ${lib.optionalString (
       !buildLibsOnly
-    ) "$out/bin/udevadm verify --resolve-names=never --no-style $out/lib/udev/rules.d"}
+    ) "$out/bin/udevadm verify --resolve-names=late --no-style $out/lib/udev/rules.d"}
 
     runHook postInstallCheck
   '';

From 5da25f9301751108d30562b4e86561a36f3cebcf Mon Sep 17 00:00:00 2001
From: Will Fancher <elvishjerricco@gmail.com>
Date: Thu, 25 Sep 2025 18:27:54 -0400
Subject: [PATCH 02/11] systemd: Patch journald's Audit setting

https://github.com/systemd/systemd/pull/39069
---
 nixos/modules/system/boot/systemd/journald.nix | 7 +++++--
 pkgs/os-specific/linux/systemd/default.nix     | 6 ++++++
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/system/boot/systemd/journald.nix b/nixos/modules/system/boot/systemd/journald.nix
index 4d2ca7f11f21..279da8f47c0b 100644
--- a/nixos/modules/system/boot/systemd/journald.nix
+++ b/nixos/modules/system/boot/systemd/journald.nix
@@ -79,8 +79,11 @@ in
     };
 
     services.journald.audit = lib.mkOption {
-      default = null;
-      type = lib.types.nullOr lib.types.bool;
+      default = "keep";
+      type = lib.types.oneOf [
+        lib.types.bool
+        (lib.types.enum [ "keep" ])
+      ];
       description = ''
         If enabled systemd-journald will turn on auditing on start-up.
         If disabled it will turn it off. If unset it will neither enable nor disable it, leaving the previous state unchanged.
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 07fe2194d044..72f9de346231 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -230,6 +230,12 @@ stdenv.mkDerivation (finalAttrs: {
       hash = "sha256-DO6q17mE2U8iLezMYt4PX5Ror20N1gCrUbXeQmrW1is=";
     })
 
+    # https://github.com/systemd/systemd/pull/39069
+    (fetchpatch {
+      url = "https://github.com/systemd/systemd/commit/b5fdfedf729712b9824a5cb457a07d5699d2946c.patch";
+      hash = "sha256-0SvAn9Dl4z80PRIvDbIVIjKp5DsT/IUoHa5IiH1HHFY=";
+    })
+
     ./0001-Start-device-units-for-uninitialised-encrypted-devic.patch
     ./0002-Don-t-try-to-unmount-nix-or-nix-store.patch
     ./0003-Fix-NixOS-containers.patch

From 2203cd2a7c9f18f55f1bb9e1c5466433dfe8c93e Mon Sep 17 00:00:00 2001
From: Will Fancher <elvishjerricco@gmail.com>
Date: Thu, 2 Oct 2025 17:10:41 -0400
Subject: [PATCH 03/11] udevCheckHook: Use `--resolve-names=late`

With systemd 258, `--resolve-names=never` causes any udev rules such
as `ENV{FOO}=="*?", GROUP=foo` to fail due to name resolution. Restore
old behvaior using the new `late` option.
---
 pkgs/by-name/ud/udevCheckHook/hook.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ud/udevCheckHook/hook.sh b/pkgs/by-name/ud/udevCheckHook/hook.sh
index bdb8e9c1f746..06740394a277 100644
--- a/pkgs/by-name/ud/udevCheckHook/hook.sh
+++ b/pkgs/by-name/ud/udevCheckHook/hook.sh
@@ -12,7 +12,7 @@ udevCheckHook() {
     for output in $(getAllOutputNames); do
         for path in etc lib ; do
             if [ -d "${!output}/$path/udev/rules.d" ]; then
-                @udevadm@ verify --resolve-names=never --no-style "${!output}/$path/udev/rules.d"
+                @udevadm@ verify --resolve-names=late --no-style "${!output}/$path/udev/rules.d"
             fi
         done
     done

From 280f6acc409676ae8b4ec35d3ddde1b8489eaee2 Mon Sep 17 00:00:00 2001
From: Will Fancher <elvishjerricco@gmail.com>
Date: Thu, 2 Oct 2025 23:58:25 -0400
Subject: [PATCH 04/11] nixos/systemd-stage-1: Add `dmi_memory_id`

It's unclear why we didn't get the error message about this binary not
existing before, because the udev rule requiring it has always been in
systemd initrd.
---
 nixos/modules/services/hardware/udev.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/services/hardware/udev.nix b/nixos/modules/services/hardware/udev.nix
index 9370fb0bf207..efc9b486149b 100644
--- a/nixos/modules/services/hardware/udev.nix
+++ b/nixos/modules/services/hardware/udev.nix
@@ -462,6 +462,7 @@ in
       "${config.boot.initrd.systemd.package}/lib/systemd/systemd-udevd"
       "${config.boot.initrd.systemd.package}/lib/udev/ata_id"
       "${config.boot.initrd.systemd.package}/lib/udev/cdrom_id"
+      "${config.boot.initrd.systemd.package}/lib/udev/dmi_memory_id"
       "${config.boot.initrd.systemd.package}/lib/udev/scsi_id"
       "${config.boot.initrd.systemd.package}/lib/udev/rules.d"
     ]

From c9115a3792c31b50cae5561ab324cd863a509429 Mon Sep 17 00:00:00 2001
From: Will Fancher <elvishjerricco@gmail.com>
Date: Wed, 17 Sep 2025 21:10:44 -0400
Subject: [PATCH 05/11] nixos/tests/machinectl: Slightly changed ID shift
 message

---
 nixos/tests/systemd-machinectl.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/tests/systemd-machinectl.nix b/nixos/tests/systemd-machinectl.nix
index 03ffc25b9113..6a3a47d938bc 100644
--- a/nixos/tests/systemd-machinectl.nix
+++ b/nixos/tests/systemd-machinectl.nix
@@ -171,7 +171,7 @@ in
     machine.succeed("ping -n -c 1 ${containerName}");
 
     # Test systemd-nspawn uses a user namespace
-    machine.succeed("test $(machinectl status ${containerName} | grep 'UID Shift: ' | wc -l) = 1")
+    machine.succeed("test $(machinectl status ${containerName} | grep 'ID Shift: ' | wc -l) = 1")
 
     # Test systemd-nspawn reboot
     machine.succeed("machinectl shell ${containerName} /run/current-system/sw/bin/reboot");

From 95ec87adcbff90ca8f011406a325a6e5dfce1b29 Mon Sep 17 00:00:00 2001
From: Will Fancher <elvishjerricco@gmail.com>
Date: Thu, 18 Sep 2025 12:01:37 -0400
Subject: [PATCH 06/11] nixos/tests/systemd: Slightly changed IP accounting
 message

---
 nixos/tests/systemd.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/tests/systemd.nix b/nixos/tests/systemd.nix
index fbece2a73dfc..f0bbdef76c61 100644
--- a/nixos/tests/systemd.nix
+++ b/nixos/tests/systemd.nix
@@ -244,7 +244,7 @@
           assert "0B read, 0B written" not in output
 
       with subtest("systemd per-unit accounting works"):
-          assert "IP traffic received: 84B sent: 84B" in output_ping
+          assert "IP Traffic: received 84B, sent 84B" in output_ping
 
       with subtest("systemd environment is properly set"):
           machine.systemctl("daemon-reexec")  # Rewrites /proc/1/environ

From f75a8b7e9a613ff37fa3d84b2ce0f85dde433de6 Mon Sep 17 00:00:00 2001
From: Will Fancher <elvishjerricco@gmail.com>
Date: Wed, 23 Jul 2025 18:03:05 -0400
Subject: [PATCH 07/11] nixos/users-groups: New clock system group

---
 nixos/modules/config/users-groups.nix | 2 ++
 nixos/modules/misc/ids.nix            | 1 +
 2 files changed, 3 insertions(+)

diff --git a/nixos/modules/config/users-groups.nix b/nixos/modules/config/users-groups.nix
index 59f1b44483df..ad61a4116ef1 100644
--- a/nixos/modules/config/users-groups.nix
+++ b/nixos/modules/config/users-groups.nix
@@ -871,6 +871,7 @@ in
         render.gid = ids.gids.render;
         sgx.gid = ids.gids.sgx;
         shadow.gid = ids.gids.shadow;
+        clock.gid = ids.gids.clock;
       };
 
       system.activationScripts.users =
@@ -1033,6 +1034,7 @@ in
           cdrom = { };
           tape = { };
           kvm = { };
+          clock = { };
         };
       };
 
diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix
index 949531d9a83c..b3cf6a063356 100644
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@@ -690,6 +690,7 @@ in
       rstudio-server = 324;
       localtimed = 325;
       automatic-timezoned = 326;
+      clock = 327;
 
       # When adding a gid, make sure it doesn't match an existing
       # uid. Users and groups with the same name should have equal

From 107893c8f366230a9297dcb27fa7e646293d861e Mon Sep 17 00:00:00 2001
From: Ali Rizvi <contact@frontear.dev>
Date: Wed, 10 Sep 2025 19:59:22 -0400
Subject: [PATCH 08/11] nixos/systemd-oomd: drop old `After=` dependency

---
 nixos/modules/system/boot/systemd/oomd.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/nixos/modules/system/boot/systemd/oomd.nix b/nixos/modules/system/boot/systemd/oomd.nix
index 82a87f00e97b..b69cfd472165 100644
--- a/nixos/modules/system/boot/systemd/oomd.nix
+++ b/nixos/modules/system/boot/systemd/oomd.nix
@@ -52,7 +52,6 @@ in
 
     systemd.services.systemd-oomd.after = [
       "swap.target" # TODO: drop after systemd v258
-      "systemd-sysusers.service" # TODO: drop after systemd v257.8
     ];
     systemd.services.systemd-oomd.wantedBy = [ "multi-user.target" ];
 

From 6160af2a3605afa9ffe7c322199cfbdd53215764 Mon Sep 17 00:00:00 2001
From: Will Fancher <elvishjerricco@gmail.com>
Date: Fri, 3 Oct 2025 01:35:50 -0400
Subject: [PATCH 09/11] nixos/systemd-oomd: Drop swap ordering

This ordering is present in the upstream unit in 258
---
 nixos/modules/system/boot/systemd/oomd.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/nixos/modules/system/boot/systemd/oomd.nix b/nixos/modules/system/boot/systemd/oomd.nix
index b69cfd472165..90c786ec5c22 100644
--- a/nixos/modules/system/boot/systemd/oomd.nix
+++ b/nixos/modules/system/boot/systemd/oomd.nix
@@ -50,9 +50,6 @@ in
       "systemd-oomd.socket"
     ];
 
-    systemd.services.systemd-oomd.after = [
-      "swap.target" # TODO: drop after systemd v258
-    ];
     systemd.services.systemd-oomd.wantedBy = [ "multi-user.target" ];
 
     environment.etc."systemd/oomd.conf".text = utils.systemdUtils.lib.settingsToSections cfg.settings;

From 4dd4e54e2ce4a669d1bc139ae2783f24fa18c580 Mon Sep 17 00:00:00 2001
From: Arian van Putten <arian.vanputten@gmail.com>
Date: Fri, 3 Oct 2025 21:17:19 +0200
Subject: [PATCH 10/11] nixos/tests/systemd-initrd-luks-tpm2: Fix on
 aarch64-linux

Systemd wants you to run tpm unlock on a machine with the TCG
bits of OVMF enabled. If not it just bails out with

No TPM2 hardware discovered and EFI firmware does not see it either, falling back to traditional unlocking
---
 nixos/tests/systemd-initrd-luks-tpm2.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/tests/systemd-initrd-luks-tpm2.nix b/nixos/tests/systemd-initrd-luks-tpm2.nix
index 20e203b0e86b..6cc42bbbda73 100644
--- a/nixos/tests/systemd-initrd-luks-tpm2.nix
+++ b/nixos/tests/systemd-initrd-luks-tpm2.nix
@@ -11,6 +11,7 @@
         useBootLoader = true;
         # Booting off the TPM2-encrypted device requires an available init script
         mountHostNixStore = true;
+        efi.OVMF = pkgs.OVMFFull; # this really should be the default. Only OVMFFull contains TCG
         useEFIBoot = true;
         tpm.enable = true;
       };

From 506887da094540d9891dd21d03fc10c846fca893 Mon Sep 17 00:00:00 2001
From: Arian van Putten <arian.vanputten@gmail.com>
Date: Fri, 3 Oct 2025 21:22:37 +0200
Subject: [PATCH 11/11] systemd: remove systemd-lock-handler from
 passthru.tests

it's not an official systemd thing and we're not the maintainers of it.
Also the test is broken. But that is not our problem
---
 pkgs/os-specific/linux/systemd/default.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 72f9de346231..bb477c9e34b9 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -1004,7 +1004,6 @@ stdenv.mkDerivation (finalAttrs: {
             systemd-journal
             systemd-journal-gateway
             systemd-journal-upload
-            systemd-lock-handler
             systemd-machinectl
             systemd-networkd
             systemd-networkd-bridge