diff --git a/nixos/modules/services/networking/ncps.nix b/nixos/modules/services/networking/ncps.nix
index 2e33abd8b608..96f557edd41f 100644
--- a/nixos/modules/services/networking/ncps.nix
+++ b/nixos/modules/services/networking/ncps.nix
@@ -18,89 +18,110 @@ let
   ];
 
   ncpsWrapper = pkgs.writeShellScript "ncps-wrapper" ''
+    ${lib.optionalString (cfg.cache.secretKeyPath != null) ''
+      export CACHE_SECRET_KEY_PATH="$CREDENTIALS_DIRECTORY/secretKey"
+    ''}
+
     ${lib.optionalString (cfg.cache.storage.s3 != null) ''
       export CACHE_STORAGE_S3_ACCESS_KEY_ID="$(cat "$CREDENTIALS_DIRECTORY/s3AccessKeyId")"
       export CACHE_STORAGE_S3_SECRET_ACCESS_KEY="$(cat "$CREDENTIALS_DIRECTORY/s3SecretAccessKey")"
     ''}
 
-    ${lib.optionalString (cfg.cache.redis != null && cfg.cache.redis.passwordFile != null) ''
-      export CACHE_REDIS_PASSWORD="$(cat "$CREDENTIALS_DIRECTORY/redisPassword")"
-    ''}
+    ${lib.optionalString (cfg.cache.redis != null) (
+      if cfg.cache.redis.passwordFile != null then
+        ''export CACHE_REDIS_PASSWORD="$(cat "$CREDENTIALS_DIRECTORY/redisPassword")"''
+      else if cfg.cache.redis.password != null then
+        ''export CACHE_REDIS_PASSWORD="${cfg.cache.redis.password}"''
+      else
+        ""
+    )}
 
     ${lib.optionalString (cfg.cache.databaseURLFile != null) ''
       export CACHE_DATABASE_URL="$(cat "$CREDENTIALS_DIRECTORY/databaseURL")"
     ''}
 
-    exec ${lib.getExe cfg.package} "$@"
+    exec ${lib.getExe cfg.package} --config "${configFile}" "$@"
   '';
 
-  globalFlags = lib.concatStringsSep " " (
-    [ "--log-level='${cfg.logLevel}'" ]
-    ++ (lib.optionals cfg.openTelemetry.enable (
-      [
-        "--otel-enabled"
-      ]
-      ++ (lib.optional (
-        cfg.openTelemetry.grpcURL != null
-      ) "--otel-grpc-url='${cfg.openTelemetry.grpcURL}'")
-    ))
-    ++ (lib.optional cfg.prometheus.enable "--prometheus-enabled")
-    ++ (lib.optional (!cfg.analytics.reporting.enable) "--analytics-reporting-enabled=false")
-  );
+  settings = {
+    log.level = cfg.logLevel;
+    opentelemetry = lib.optionalAttrs cfg.openTelemetry.enable {
+      enabled = true;
+      grpc-url = cfg.openTelemetry.grpcURL;
+    };
+    prometheus = lib.optionalAttrs cfg.prometheus.enable {
+      enabled = true;
+    };
+    analytics.reporting = {
+      enabled = cfg.analytics.reporting.enable;
+      samples = cfg.analytics.reporting.samples;
+    };
+    server.addr = cfg.server.addr;
+    cache = {
+      allow-delete-verb = cfg.cache.allowDeleteVerb;
+      allow-put-verb = cfg.cache.allowPutVerb;
+      hostname = cfg.cache.hostName;
+      database-url = cfg.cache.databaseURL;
+      database.pool = {
+        max-open-conns = cfg.cache.database.pool.maxOpenConns;
+        max-idle-conns = cfg.cache.database.pool.maxIdleConns;
+      };
+      max-size = cfg.cache.maxSize;
+      lru = {
+        schedule = cfg.cache.lru.schedule;
+        timezone = cfg.cache.lru.scheduleTimeZone;
+      };
+      sign-narinfo = cfg.cache.signNarinfo;
+      storage =
+        if cfg.cache.storage.s3 != null then
+          {
+            s3 = {
+              bucket = cfg.cache.storage.s3.bucket;
+              endpoint = cfg.cache.storage.s3.endpoint;
+              region = cfg.cache.storage.s3.region;
+              force-path-style = cfg.cache.storage.s3.forcePathStyle;
+            };
+          }
+        else
+          {
+            local = cfg.cache.storage.local;
+          };
+      temp-path = cfg.cache.tempPath;
+      netrc-file = cfg.netrcFile;
+      upstream = {
+        urls = cfg.cache.upstream.urls;
+        public-keys = cfg.cache.upstream.publicKeys;
+        dialer-timeout = cfg.cache.upstream.dialerTimeout;
+        response-header-timeout = cfg.cache.upstream.responseHeaderTimeout;
+      };
+      lock = {
+        backend = cfg.cache.lock.backend;
+        redis.key-prefix = cfg.cache.lock.redisKeyPrefix;
+        postgres.key-prefix = cfg.cache.lock.postgresKeyPrefix;
+        download-lock-ttl = cfg.cache.lock.downloadTTL;
+        lru-lock-ttl = cfg.cache.lock.lruTTL;
+        retry = {
+          max-attempts = cfg.cache.lock.retry.maxAttempts;
+          initial-delay = cfg.cache.lock.retry.initialDelay;
+          max-delay = cfg.cache.lock.retry.maxDelay;
+          jitter = cfg.cache.lock.retry.jitter;
+        };
+        allow-degraded-mode = cfg.cache.lock.allowDegradedMode;
+      };
+      redis = lib.optionalAttrs (cfg.cache.redis != null) {
+        addrs = cfg.cache.redis.addresses;
+        db = cfg.cache.redis.database;
+        username = cfg.cache.redis.username;
+        use-tls = cfg.cache.redis.useTLS;
+        pool-size = cfg.cache.redis.poolSize;
+      };
+    };
+  };
 
-  serveFlags = lib.concatStringsSep " " (
-    [
-      "--cache-hostname='${cfg.cache.hostName}'"
-      "--cache-lock-backend='${cfg.cache.lock.backend}'"
-      "--cache-temp-path='${cfg.cache.tempPath}'"
-      "--server-addr='${cfg.server.addr}'"
-    ]
-    ++ (lib.optional (cfg.cache.databaseURL != null) "--cache-database-url='${cfg.cache.databaseURL}'")
-    ++ (lib.optionals (cfg.cache.redis != null) (
-      [
-        "--cache-redis-addrs='${builtins.concatStringsSep "," cfg.cache.redis.addresses}'"
-        "--cache-redis-db='${builtins.toString cfg.cache.redis.database}'"
-        "--cache-redis-pool-size='${builtins.toString cfg.cache.redis.poolSize}'"
-      ]
-      ++ (lib.optional (
-        cfg.cache.redis.username != null
-      ) "--cache-redis-username='${cfg.cache.redis.username}'")
-      ++ (lib.optional (
-        cfg.cache.redis.password != null
-      ) "--cache-redis-password='${cfg.cache.redis.password}'")
-      ++ (lib.optional cfg.cache.redis.useTLS "--cache-redis-use-tls")
-    ))
-    ++ (lib.optional (
-      cfg.cache.storage.s3 == null
-    ) "--cache-storage-local='${cfg.cache.storage.local}'")
-    ++ (lib.optionals (cfg.cache.storage.s3 != null) (
-      [
-        "--cache-storage-s3-bucket='${cfg.cache.storage.s3.bucket}'"
-        "--cache-storage-s3-endpoint='${cfg.cache.storage.s3.endpoint}'"
-      ]
-      ++ (lib.optional cfg.cache.storage.s3.forcePathStyle "--cache-storage-s3-force-path-style")
-      ++ (lib.optional (
-        cfg.cache.storage.s3.region != null
-      ) "--cache-storage-s3-region='${cfg.cache.storage.s3.region}'")
-    ))
-    ++ (lib.optional cfg.cache.allowDeleteVerb "--cache-allow-delete-verb")
-    ++ (lib.optional cfg.cache.allowPutVerb "--cache-allow-put-verb")
-    ++ (lib.optional (cfg.cache.maxSize != null) "--cache-max-size='${cfg.cache.maxSize}'")
-    ++ (lib.optionals (cfg.cache.lru.schedule != null) [
-      "--cache-lru-schedule='${cfg.cache.lru.schedule}'"
-      "--cache-lru-schedule-timezone='${cfg.cache.lru.scheduleTimeZone}'"
-    ])
-    ++ (lib.optional (cfg.cache.secretKeyPath != null) "--cache-secret-key-path='%d/secretKey'")
-    ++ (lib.optional (!cfg.cache.signNarinfo) "--cache-sign-narinfo='false'")
-    ++ (lib.optional (
-      cfg.cache.upstream.dialerTimeout != null
-    ) "--cache-upstream-dialer-timeout='${cfg.cache.upstream.dialerTimeout}'")
-    ++ (lib.optional (
-      cfg.cache.upstream.responseHeaderTimeout != null
-    ) "--cache-upstream-response-header-timeout='${cfg.cache.upstream.responseHeaderTimeout}'")
-    ++ (lib.forEach cfg.cache.upstream.publicKeys (pk: "--cache-upstream-public-key='${pk}'"))
-    ++ (lib.forEach cfg.cache.upstream.urls (url: "--cache-upstream-url='${url}'"))
-    ++ (lib.optional (cfg.netrcFile != null) "--netrc-file='${cfg.netrcFile}'")
+  configFile = pkgs.writeText "ncps-config.json" (
+    builtins.toJSON (
+      lib.filterAttrsRecursive (_: v: v != null && v != { } && v != "" && v != [ ]) settings
+    )
   );
 
   isSqlite = cfg.cache.databaseURL != null && lib.strings.hasPrefix "sqlite:" cfg.cache.databaseURL;
@@ -136,12 +157,16 @@ in
     services.ncps = {
       enable = lib.mkEnableOption "ncps: Nix binary cache proxy service implemented in Go";
 
-      analytics.reporting.enable = lib.mkOption {
-        type = lib.types.bool;
-        default = true;
-        description = ''
-          Enable reporting anonymous usage statistics (DB type, Lock type, Total Size) to the project maintainers.
-        '';
+      analytics.reporting = {
+        enable = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+          description = ''
+            Enable reporting anonymous usage statistics (DB type, Lock type, Total Size) to the project maintainers.
+          '';
+        };
+
+        samples = lib.mkEnableOption "Enable printing the analytics samples to stdout. This is useful for debugging and verification purposes only.";
       };
 
       package = lib.mkPackageOption pkgs "ncps" { };
@@ -208,6 +233,28 @@ in
           '';
         };
 
+        database = {
+          pool = {
+            maxOpenConns = lib.mkOption {
+              type = lib.types.int;
+              default = 0;
+              description = ''
+                Maximum number of open connections to the database (0 = use
+                database-specific defaults).
+              '';
+            };
+
+            maxIdleConns = lib.mkOption {
+              type = lib.types.int;
+              default = 0;
+              description = ''
+                Maximum number of idle connections in the pool (0 = use
+                database-specific defaults).
+              '';
+            };
+          };
+        };
+
         lru = {
           schedule = lib.mkOption {
             type = lib.types.nullOr lib.types.str;
@@ -233,17 +280,107 @@ in
           };
         };
 
-        lock.backend = lib.mkOption {
-          type = lib.types.enum [
-            "local"
-            "redis"
-            "postgres"
-          ];
-          default = "local";
-          description = ''
-            Lock backend to use: 'local' (single instance), 'redis'
-            (distributed), or 'postgres' (distributed, requires PostgreSQL).
-          '';
+        lock = {
+          backend = lib.mkOption {
+            type = lib.types.enum [
+              "local"
+              "redis"
+              "postgres"
+            ];
+            default = "local";
+            description = ''
+              Lock backend to use: 'local' (single instance), 'redis'
+              (distributed), 'postgres' (distributed, requires PostgreSQL).
+
+              Advisory Locks and Connection Pools: If you use PostgreSQL as
+              your distributed lock backend, each active lock consumes a
+              dedicated connection from the pool. A single request can consume
+              up to 3 connections simultaneously.
+
+              To avoid deadlocks under concurrent load, ensure
+              {option}`services.ncps.cache.database.pool.maxOpenConns` is
+              significantly higher than your expected concurrency (at least
+              50-100 is recommended).
+            '';
+          };
+
+          redisKeyPrefix = lib.mkOption {
+            type = lib.types.str;
+            default = "ncps:lock:";
+            description = ''
+              Prefix for all Redis lock keys (only used when Redis is
+              configured).
+            '';
+          };
+
+          postgresKeyPrefix = lib.mkOption {
+            type = lib.types.str;
+            default = "ncps:lock:";
+            description = ''
+              Prefix for all PostgreSQL advisory lock keys (only used when
+              PostgreSQL is configured as lock backend).
+            '';
+          };
+
+          downloadTTL = lib.mkOption {
+            type = lib.types.str;
+            default = "5m0s";
+            description = ''
+              TTL for download locks (per-hash locks).
+            '';
+          };
+
+          lruTTL = lib.mkOption {
+            type = lib.types.str;
+            default = "30m0s";
+            description = ''
+              TTL for LRU lock (global exclusive lock).
+            '';
+          };
+
+          retry = {
+            maxAttempts = lib.mkOption {
+              type = lib.types.int;
+              default = 3;
+              description = ''
+                Maximum number of retry attempts for distributed locks.
+              '';
+            };
+
+            initialDelay = lib.mkOption {
+              type = lib.types.str;
+              default = "100ms";
+              description = ''
+                Initial retry delay for distributed locks.
+              '';
+            };
+
+            maxDelay = lib.mkOption {
+              type = lib.types.str;
+              default = "2s";
+              description = ''
+                Maximum retry delay for distributed locks (exponential backoff
+                caps at this).
+              '';
+            };
+
+            jitter = lib.mkOption {
+              type = lib.types.bool;
+              default = true;
+              description = ''
+                Enable jitter in retry delays to prevent thundering herd.
+              '';
+            };
+          };
+
+          allowDegradedMode = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+            description = ''
+              Allow falling back to local locks if Redis is unavailable (WARNING:
+              breaks HA guarantees).
+            '';
+          };
         };
 
         maxSize = lib.mkOption {
@@ -555,7 +692,7 @@ in
 
       serviceConfig = lib.mkMerge [
         {
-          ExecStart = "${ncpsWrapper} ${globalFlags} serve ${serveFlags}";
+          ExecStart = "${ncpsWrapper} serve";
           User = "ncps";
           Group = "ncps";
           Restart = "on-failure";
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 10a337e441fe..ed08e308eed0 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1039,7 +1039,8 @@ in
     imports = [ ./ncps.nix ];
     defaults.services.ncps.cache.storage.local = "/path/to/ncps";
   };
-  ncps-ha = runTest ./ncps-ha.nix;
+  ncps-ha-pg = runTest ./ncps-ha-pg.nix;
+  ncps-ha-pg-redis = runTest ./ncps-ha-pg-redis.nix;
   ndppd = runTest ./ndppd.nix;
   nebula-lighthouse-service = runTest ./nebula-lighthouse-service.nix;
   nebula.connectivity = runTest ./nebula/connectivity.nix;
diff --git a/nixos/tests/ncps-ha.nix b/nixos/tests/ncps-ha-pg-redis.nix
similarity index 100%
rename from nixos/tests/ncps-ha.nix
rename to nixos/tests/ncps-ha-pg-redis.nix
diff --git a/nixos/tests/ncps-ha-pg.nix b/nixos/tests/ncps-ha-pg.nix
new file mode 100644
index 000000000000..45bb7a14b7a5
--- /dev/null
+++ b/nixos/tests/ncps-ha-pg.nix
@@ -0,0 +1,196 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+let
+  # s3 creds
+  bucket = "ncps";
+  region = "us-west-1";
+  accessKey = builtins.toFile "minio-access-key" "easy-key";
+  secretKey = builtins.toFile "minio-secret-key" "easy-secret";
+
+  # pg creds
+  postgresPassword = "easypwd";
+
+  initMinio = pkgs.writeShellScriptBin "init-minio.sh" ''
+    set -euo pipefail
+
+    mc alias set local "http://127.0.0.1:9000" minioadmin minioadmin
+    mc mb local/${bucket}
+    mc admin user svcacct add --access-key "$(cat ${accessKey})" --secret-key "$(cat ${secretKey})" local minioadmin
+  '';
+
+  ncpsAttrs = hostname: {
+    services.ncps = {
+      enable = true;
+
+      analytics.reporting.enable = false;
+
+      cache = {
+        hostName = hostname;
+
+        databaseURL = "postgres://ncps:${lib.escapeURL postgresPassword}@postgres:5432/ncps?sslmode=disable";
+
+        lock.backend = "postgres";
+
+        secretKeyPath = builtins.toString (
+          pkgs.writeText "ncps-cache-key" "ncps:dcrGsrku0KvltFhrR5lVIMqyloAdo0y8vYZOeIFUSLJS2IToL7dPHSSCk/fi+PJf8EorpBn8PU7MNhfvZoI8mA=="
+        );
+
+        storage.s3 = {
+          inherit bucket region;
+
+          endpoint = "http://minio:9000";
+
+          accessKeyIdPath = accessKey;
+          secretAccessKeyPath = secretKey;
+        };
+
+        upstream = {
+          urls = [ "http://harmonia:5000" ];
+          publicKeys = [
+            "cache.example.com-1:eIGQXcGQpc00x6/XFcyacLEUmC07u4RAEHt5Y8vdglo="
+          ];
+        };
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = [ 8501 ];
+  };
+in
+{
+  name = "ncps-storage-s3";
+  meta = with lib.maintainers; {
+    maintainers = [
+      aciceri
+      kalbasit
+    ];
+  };
+
+  nodes = {
+    client0 = {
+      nix.settings = {
+        substituters = lib.mkForce [ "http://ncps0:8501" ];
+        trusted-public-keys = lib.mkForce [
+          "ncps:UtiE6C+3Tx0kgpP34vjyX/BKK6QZ/D1OzDYX72aCPJg="
+        ];
+      };
+    };
+
+    client1 = {
+      nix.settings = {
+        substituters = lib.mkForce [ "http://ncps1:8501" ];
+        trusted-public-keys = lib.mkForce [
+          "ncps:UtiE6C+3Tx0kgpP34vjyX/BKK6QZ/D1OzDYX72aCPJg="
+        ];
+      };
+    };
+
+    harmonia = {
+      services.harmonia = {
+        enable = true;
+        signKeyPaths = [
+          (pkgs.writeText "cache-key" "cache.example.com-1:9FhO0w+7HjZrhvmzT1VlAZw4OSAlFGTgC24Seg3tmPl4gZBdwZClzTTHr9cVzJpwsRSYLTu7hEAQe3ljy92CWg==")
+        ];
+        settings.priority = 35;
+      };
+
+      networking.firewall.allowedTCPPorts = [ 5000 ];
+      system.extraDependencies = [ pkgs.emptyFile ];
+    };
+
+    minio = {
+      services.minio = {
+        inherit region;
+
+        enable = true;
+      };
+
+      networking.firewall.allowedTCPPorts = [ 9000 ];
+      environment.systemPackages = [
+        pkgs.minio-client
+        initMinio
+      ];
+    };
+
+    ncps0 = lib.mkMerge [
+      (ncpsAttrs "ncps0")
+      {
+        services.ncps.cache.databaseURL = lib.mkForce null;
+        services.ncps.cache.databaseURLFile = builtins.toFile "db-url" "postgres://ncps:${lib.escapeURL postgresPassword}@postgres:5432/ncps?sslmode=disable";
+      }
+    ];
+    ncps1 = ncpsAttrs "ncps1";
+
+    postgres = {
+      services.postgresql = {
+        enable = true;
+        enableTCPIP = true;
+        authentication = ''
+          host all all all scram-sha-256
+        '';
+        initialScript = pkgs.writeText "init-postgres.sql" ''
+          CREATE DATABASE "ncps" WITH ENCODING = 'UTF8';
+          CREATE ROLE "ncps" WITH LOGIN PASSWORD '${
+            builtins.replaceStrings [ "'" ] [ "''" ] postgresPassword
+          }';
+          ALTER DATABASE "ncps" OWNER TO "ncps";
+        '';
+      };
+
+      networking.firewall.allowedTCPPorts = [ 5432 ];
+    };
+  };
+
+  testScript =
+    { nodes, ... }:
+    let
+      narinfoName =
+        (lib.strings.removePrefix "/nix/store/" (
+          lib.strings.removeSuffix "-empty-file" pkgs.emptyFile.outPath
+        ))
+        + ".narinfo";
+
+      narinfoNameChars = lib.strings.stringToCharacters narinfoName;
+
+      narinfoPath = lib.concatStringsSep "/" [
+        (builtins.head nodes.minio.services.minio.dataDir)
+        bucket
+        "store/narinfo"
+        (lib.lists.elemAt narinfoNameChars 0)
+        ((lib.lists.elemAt narinfoNameChars 0) + (lib.lists.elemAt narinfoNameChars 1))
+        narinfoName
+        "xl.meta"
+      ];
+    in
+    ''
+      harmonia.start()
+      minio.start()
+      postgres.start()
+
+      minio.wait_for_unit("minio.service")
+
+      minio.wait_until_succeeds("init-minio.sh")
+
+      postgres.wait_for_unit("postgresql.service")
+
+      start_all()
+
+      harmonia.wait_for_unit("harmonia.service")
+
+      ncps0.wait_for_unit("ncps.service")
+      ncps1.wait_for_unit("ncps.service")
+
+      client0.wait_until_succeeds("curl -f http://ncps0:8501/ | grep '\"hostname\":\"${toString nodes.ncps0.services.ncps.cache.hostName}\"' >&2")
+      client1.wait_until_succeeds("curl -f http://ncps1:8501/ | grep '\"hostname\":\"${toString nodes.ncps1.services.ncps.cache.hostName}\"' >&2")
+
+      client0.succeed("cat /etc/nix/nix.conf >&2")
+      client0.succeed("nix-store --realise ${pkgs.emptyFile}")
+
+      client1.succeed("cat /etc/nix/nix.conf >&2")
+      client1.succeed("nix-store --realise ${pkgs.emptyFile}")
+
+      minio.succeed("cat ${narinfoPath} >&2")
+    '';
+}
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 7c1c08bea20d..dcadcab4e118 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1175,11 +1175,11 @@
     "vendorHash": "sha256-f3b4NULINH8XworCn46fiz4GmBM31ROdAJy1j4GKkx4="
   },
   "scaleway_scaleway": {
-    "hash": "sha256-3p/g43WkVI3T2e2xSm/hwzu9aFqivszUtVcPsFSsx1o=",
+    "hash": "sha256-YRap8Y0KAaFD7uWo1J2Qrb0l+OPhxS+DfKwGN/QQOw4=",
     "homepage": "https://registry.terraform.io/providers/scaleway/scaleway",
     "owner": "scaleway",
     "repo": "terraform-provider-scaleway",
-    "rev": "v2.67.1",
+    "rev": "v2.68.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-rT8ScPPnrbUBviiK03U96K5vvVEbcLra3MGSJ8+SYyE="
   },
diff --git a/pkgs/by-name/di/dix/package.nix b/pkgs/by-name/di/dix/package.nix
index 57daa6a9b66a..78888ad84600 100644
--- a/pkgs/by-name/di/dix/package.nix
+++ b/pkgs/by-name/di/dix/package.nix
@@ -7,16 +7,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "dix";
-  version = "1.4.0";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     owner = "faukah";
     repo = "dix";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-p02luVvo02zFTpXUoIK86xIiLKdnhjzGaLJkZ3RSUdw=";
+    hash = "sha256-CcvPQ041W6FzGb4L9bBXgkY0iuXPzvNhcoSsXSvagzA=";
   };
 
-  cargoHash = "sha256-DBswUOoUMvTy9CijUJF2VGLTkx9WiT1ebdntl9+ytY4=";
+  cargoHash = "sha256-8yz9X+hz3dTCBgUTmx7XjRycAljYXZ4WYg7VYQdViDA=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
diff --git a/pkgs/by-name/fa/faust2/package.nix b/pkgs/by-name/fa/faust2/package.nix
index 3eba50a9e712..25a359d0e913 100644
--- a/pkgs/by-name/fa/faust2/package.nix
+++ b/pkgs/by-name/fa/faust2/package.nix
@@ -175,9 +175,9 @@ let
 
     args
     // {
-      name = "${baseName}-${version}";
+      pname = baseName;
 
-      inherit src;
+      inherit src version;
 
       dontBuild = true;
 
diff --git a/pkgs/by-name/fr/frogatto/package.nix b/pkgs/by-name/fr/frogatto/package.nix
index 206c0d519209..b7a98598c199 100644
--- a/pkgs/by-name/fr/frogatto/package.nix
+++ b/pkgs/by-name/fr/frogatto/package.nix
@@ -26,7 +26,8 @@ let
   inherit (data) version;
 in
 buildEnv {
-  name = "frogatto-${version}";
+  pname = "frogatto";
+  inherit version;
 
   nativeBuildInputs = [ makeWrapper ];
   paths = [
diff --git a/pkgs/by-name/gh/gh-dash/package.nix b/pkgs/by-name/gh/gh-dash/package.nix
index b81bc10c430c..5ea3707f310c 100644
--- a/pkgs/by-name/gh/gh-dash/package.nix
+++ b/pkgs/by-name/gh/gh-dash/package.nix
@@ -2,22 +2,22 @@
   lib,
   fetchFromGitHub,
   buildGoModule,
-  testers,
-  gh-dash,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
 }:
 
 buildGoModule rec {
   pname = "gh-dash";
-  version = "4.18.0";
+  version = "4.22.0";
 
   src = fetchFromGitHub {
     owner = "dlvhdr";
     repo = "gh-dash";
     rev = "v${version}";
-    hash = "sha256-iYz4rHoIWIW1XR83ZqkAbsU+5mIkLzq8wemVKUMGf6A=";
+    hash = "sha256-vfp0AUSNl11w9jo7UeYDt+AdSxPzwPdeX7bWcZUkOGc=";
   };
 
-  vendorHash = "sha256-IsEz6hA8jnWP+2ELkZ6V5Y0/rpTz1tAzaYJvzgPQQCo=";
+  vendorHash = "sha256-4AbeoH0l7eIS7d0yyJxM7+woC7Q/FCh0BOJj3d1zyX4=";
 
   ldflags = [
     "-s"
@@ -30,9 +30,9 @@ buildGoModule rec {
     "-skip=TestFullOutput"
   ];
 
-  passthru.tests = {
-    version = testers.testVersion { package = gh-dash; };
-  };
+  nativeCheckInputs = [ writableTmpDirAsHomeHook ];
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
 
   meta = {
     changelog = "https://github.com/dlvhdr/gh-dash/releases/tag/${src.rev}";
diff --git a/pkgs/by-name/go/gotosocial/package.nix b/pkgs/by-name/go/gotosocial/package.nix
index a89d164c6130..601f7ec23270 100644
--- a/pkgs/by-name/go/gotosocial/package.nix
+++ b/pkgs/by-name/go/gotosocial/package.nix
@@ -10,11 +10,11 @@ let
   owner = "superseriousbusiness";
   repo = "gotosocial";
 
-  version = "0.20.2";
+  version = "0.20.3";
 
   web-assets = fetchurl {
     url = "https://${domain}/${owner}/${repo}/releases/download/v${version}/${repo}_${version}_web-assets.tar.gz";
-    hash = "sha256-85tFn3LsuMbLoiH6FFtBK60GhclfTsSiI7K/iNLadjY=";
+    hash = "sha256-Xh4SgzBG2Cm4SaMb9lebW/gBv94HuVXNSjd8L+bowUg=";
   };
 in
 buildGo124Module rec {
@@ -24,7 +24,7 @@ buildGo124Module rec {
   src = fetchFromGitea {
     inherit domain owner repo;
     tag = "v${version}";
-    hash = "sha256-H5+1BZ1jIISU6EPszIuOhqowoMe9WF36BGwV7TpAqj8=";
+    hash = "sha256-tWICsPN9r3mJqcs0EHE1+QFhQCzI1pD1eXZXSi2Peo4=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/gu/guile-git/package.nix b/pkgs/by-name/gu/guile-git/package.nix
index cd7ddae16674..061dddf2d57a 100644
--- a/pkgs/by-name/gu/guile-git/package.nix
+++ b/pkgs/by-name/gu/guile-git/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitLab,
+  fetchpatch,
   guile,
   libgit2,
   scheme-bytestructures,
@@ -21,6 +22,21 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-ihKpEnng6Uemrguecbd25vElEhIu2Efb86aM8679TAc=";
   };
 
+  patches = [
+    # remove > 0.10.0
+    (fetchpatch {
+      name = "catch-git-error-guile";
+      url = "https://gitlab.com/guile-git/guile-git/-/commit/9c76c6b31e217c470c8576172b123be9c373dc9b.diff";
+      hash = "sha256-H0s7Ebl+HNL8Zak58kJmFETWZJcNq+Z5gTGRqU9gj58=";
+    })
+    # remove > 0.10.0
+    (fetchpatch {
+      name = "test-typo";
+      url = "https://gitlab.com/guile-git/guile-git/-/commit/4451c0808fbdf8cd13d486a18b03881f998f6e88.diff";
+      hash = "sha256-K2f67WXUBLI/09eF8Xg3JMX7gkISFTZK3yHu0VDVQ4E=";
+    })
+  ];
+
   strictDeps = true;
   nativeBuildInputs = [
     autoreconfHook
diff --git a/pkgs/by-name/gu/guix/package.nix b/pkgs/by-name/gu/guix/package.nix
index 1ad8a6d73a7e..e074858b47ba 100644
--- a/pkgs/by-name/gu/guix/package.nix
+++ b/pkgs/by-name/gu/guix/package.nix
@@ -38,17 +38,14 @@
   storeDir ? "/gnu/store",
   confDir ? "/etc",
 }:
-let
-  rev = "30a5d140aa5a789a362749d057754783fea83dde";
-in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "guix";
-  version = "1.4.0-unstable-2025-06-24";
+  version = "1.5.0";
 
   src = fetchgit {
     url = "https://codeberg.org/guix/guix.git";
-    inherit rev;
-    hash = "sha256-QsOYApnwA2hb1keSv6p3EpMT09xCs9uyoSeIdXzftF0=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-/g8JMUGM5GaZjtPLnl4vlrBNYMxSTjsHUDdhKLtHaQA=";
   };
 
   patches = [
@@ -124,10 +121,13 @@ stdenv.mkDerivation rec {
     "--localstatedir=${stateDir}"
     "--sysconfdir=${confDir}"
     "--with-bash-completion-dir=$(out)/etc/bash_completion.d"
+    "--with-zsh-completion-dir=$(out)/share/zsh/site-functions"
+    "--with-fish-completion-dir=$(out)/share/fish/vendor_completions.d"
+    "--with-apparmor-profile-dir=$(out)/etc/apparmor.d"
   ];
 
   preAutoreconf = ''
-    echo ${version} > .tarball-version
+    echo ${finalAttrs.version} > .tarball-version
     ./bootstrap
   '';
 
@@ -161,7 +161,7 @@ stdenv.mkDerivation rec {
       Guix is based on the Nix package manager.
     '';
     homepage = "https://guix.gnu.org/";
-    changelog = "https://codeberg.org/guix/guix/raw/commit/${rev}/NEWS";
+    changelog = "https://codeberg.org/guix/guix/raw/tag/v${finalAttrs.version}/NEWS";
     license = lib.licenses.gpl3Plus;
     mainProgram = "guix";
     maintainers = with lib.maintainers; [
@@ -170,4 +170,4 @@ stdenv.mkDerivation rec {
     ];
     platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/by-name/ly/ly/package.nix b/pkgs/by-name/ly/ly/package.nix
index d92c7aaefb39..ba447952895b 100644
--- a/pkgs/by-name/ly/ly/package.nix
+++ b/pkgs/by-name/ly/ly/package.nix
@@ -13,14 +13,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ly";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "fairyglade";
     repo = "ly";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-OmbOWZZR5kvqWJkNhTkV5O2tfFj5BtJPLtINe59Y0tI=";
+    hash = "sha256-BelsR/+sfm3qdEnyf4bbadyzuUVvVPrPEhdZaNPLxiE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/me/metals/package.nix b/pkgs/by-name/me/metals/package.nix
index 3a31b4b4ae69..10f7cf4243c6 100644
--- a/pkgs/by-name/me/metals/package.nix
+++ b/pkgs/by-name/me/metals/package.nix
@@ -9,7 +9,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "metals";
-  version = "1.6.4";
+  version = "1.6.5";
 
   deps = stdenv.mkDerivation {
     name = "metals-deps-${finalAttrs.version}";
@@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     outputHashMode = "recursive";
     outputHashAlgo = "sha256";
-    outputHash = "sha256-MuzyVyTOVWZjs+GPqrztmEilirRjxF9SJIKyxgicbXM=";
+    outputHash = "sha256-NOS1HUS4TJXnleZTEji3HAHUa9WOGmJDX2yT7zwmX08=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ne/net-snmp/package.nix b/pkgs/by-name/ne/net-snmp/package.nix
index d7d759cf7943..b48964047045 100644
--- a/pkgs/by-name/ne/net-snmp/package.nix
+++ b/pkgs/by-name/ne/net-snmp/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  fetchpatch,
   file,
   openssl,
   perl,
@@ -23,32 +22,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "net-snmp";
-  version = "5.9.4";
+  version = "5.9.5.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/net-snmp/${pname}-${version}.tar.gz";
-    sha256 = "sha256-i03gE5HnTjxwFL60OWGi1tb6A6zDQoC5WF9JMHRbBUQ=";
+    hash = "sha256-FnB3GfgzGEpLcoNdrDWa4YgSOwa15CgXwAeQ19wThL8=";
   };
 
-  patches =
-    let
-      fetchAlpinePatch =
-        name: sha256:
-        fetchurl {
-          url = "https://git.alpinelinux.org/aports/plain/main/net-snmp/${name}?id=ebb21045c31f4d5993238bcdb654f21d8faf8123";
-          inherit name sha256;
-        };
-    in
-    [
-      (fetchAlpinePatch "fix-includes.patch" "0zpkbb6k366qpq4dax5wknwprhwnhighcp402mlm7950d39zfa3m")
-      (fetchAlpinePatch "netsnmp-swinst-crash.patch" "0gh164wy6zfiwiszh58fsvr25k0ns14r3099664qykgpmickkqid")
-      (fetchpatch {
-        name = "configure-musl.patch";
-        url = "https://github.com/net-snmp/net-snmp/commit/a62169f1fa358be8f330ea8519ade0610fac525b.patch";
-        hash = "sha256-+vWH095fFL3wE6XLsTaPXgMDya0LRWdlL6urD5AIBUs=";
-      })
-    ];
-
   outputs = [
     "bin"
     "out"
@@ -69,7 +49,7 @@ stdenv.mkDerivation rec {
   ++ lib.optional stdenv.hostPlatform.isLinux "--with-mnttab=/proc/mounts";
 
   postPatch = ''
-    substituteInPlace testing/fulltests/support/simple_TESTCONF.sh --replace "/bin/netstat" "${net-tools}/bin/netstat"
+    substituteInPlace testing/fulltests/support/simple_TESTCONF.sh --replace-fail "/bin/netstat" "${net-tools}/bin/netstat"
   '';
 
   postConfigure = ''
@@ -105,5 +85,6 @@ stdenv.mkDerivation rec {
     homepage = "https://www.net-snmp.org/";
     license = lib.licenses.bsd3;
     platforms = lib.platforms.unix;
+    changelog = "https://github.com/net-snmp/net-snmp/blob/v${version}/NEWS";
   };
 }
diff --git a/pkgs/by-name/ne/nextcloud-client/package.nix b/pkgs/by-name/ne/nextcloud-client/package.nix
index 0a5d2c675f01..a86b8da4663d 100644
--- a/pkgs/by-name/ne/nextcloud-client/package.nix
+++ b/pkgs/by-name/ne/nextcloud-client/package.nix
@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation rec {
   pname = "nextcloud-client";
-  version = "4.0.5";
+  version = "4.0.6";
 
   outputs = [
     "out"
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     owner = "nextcloud-releases";
     repo = "desktop";
     tag = "v${version}";
-    hash = "sha256-cEe1GTRFC+iGAAgddRm70uf5tXmpCat7Q7BptFEYKnE=";
+    hash = "sha256-GPNJ2zrHzHQgJvj1ANi6LYsTlkuc5splFAwC5XaR3+0=";
   };
 
   patches = [
diff --git a/pkgs/by-name/od/odamex/package.nix b/pkgs/by-name/od/odamex/package.nix
index 2e32151b459e..83ceb829e46e 100644
--- a/pkgs/by-name/od/odamex/package.nix
+++ b/pkgs/by-name/od/odamex/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
 
   cmake,
   copyDesktopItems,
@@ -52,26 +51,16 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "odamex";
-  version = "11.2.0";
+  version = "12.1.0";
 
   src = fetchFromGitHub {
     owner = "odamex";
     repo = "odamex";
     tag = finalAttrs.version;
-    hash = "sha256-f9st852Sqmdmb/qNP1ioBY9MApt9Ruw8dBjkkyGM5Qs=";
+    hash = "sha256-kLI1gdGH5NXJ8YI1tR0N5W6yvGZ+7302z0QLl2j+b0k=";
     fetchSubmodules = true;
   };
 
-  patches = [
-    # fix file-open panel on Darwin
-    # https://github.com/odamex/odamex/pull/1402
-    # TODO: remove on next release
-    (fetchpatch {
-      url = "https://patch-diff.githubusercontent.com/raw/odamex/odamex/pull/1402.patch";
-      hash = "sha256-JrcQ0rYkaFP5aKNWeXbrY2TN4r8nHpue19qajNXJXg4=";
-    })
-  ];
-
   nativeBuildInputs = [
     cmake
     copyDesktopItems
@@ -208,10 +197,12 @@ stdenv.mkDerivation (finalAttrs: {
   passthru.updateScript = nix-update-script { };
 
   meta = {
-    homepage = "http://odamex.net/";
+    homepage = "https://odamex.net";
     description = "Client/server port for playing old-school Doom online";
+    changelog = "https://github.com/odamex/odamex/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.gpl2Only;
     platforms = lib.platforms.unix;
+    broken = stdenv.hostPlatform.isDarwin;
     maintainers = with lib.maintainers; [ eljamm ];
     mainProgram = "odalaunch";
   };
diff --git a/pkgs/by-name/pr/proton-pass-cli/package.nix b/pkgs/by-name/pr/proton-pass-cli/package.nix
index 9c44bd96c4b7..e72e2dca2c69 100644
--- a/pkgs/by-name/pr/proton-pass-cli/package.nix
+++ b/pkgs/by-name/pr/proton-pass-cli/package.nix
@@ -14,7 +14,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "proton-pass-cli";
-  version = "1.3.5";
+  version = "1.4.1";
 
   src = finalAttrs.passthru.sources.${stdenv.hostPlatform.system};
 
@@ -47,19 +47,19 @@ stdenv.mkDerivation (finalAttrs: {
     sources = {
       "aarch64-darwin" = fetchurl {
         url = "https://proton.me/download/pass-cli/${finalAttrs.version}/pass-cli-macos-aarch64";
-        hash = "sha256-I+QYefg6ECxxb68RDyjw0dK4+vSOvu8qQ2kPhuPoabU=";
+        hash = "sha256-cBkFD0kNgonAReyjmmq/P9SA9rzD+ngHgxJBtOwT1/E=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://proton.me/download/pass-cli/${finalAttrs.version}/pass-cli-linux-aarch64";
-        hash = "sha256-ohKFj+d75hYev6jwn7WLtf2exNJJN2cFeGkwgFHvx1E=";
+        hash = "sha256-KPSrJbDqIVyV6H1NV8JJn+gJrKbpVFEE7AiZWXOqg60=";
       };
       "x86_64-darwin" = fetchurl {
         url = "https://proton.me/download/pass-cli/${finalAttrs.version}/pass-cli-macos-x86_64";
-        hash = "sha256-7TMcen4iX9nr0rxmF7vFWJ19tkNN5d7YqImL0LF9jkw=";
+        hash = "sha256-zv+lR9FK+Opazwlj8R7w1g7gvTf9ftNKTHDvhtgq0DU=";
       };
       "x86_64-linux" = fetchurl {
         url = "https://proton.me/download/pass-cli/${finalAttrs.version}/pass-cli-linux-x86_64";
-        hash = "sha256-LerztCDNQ63wYUOfiULdvY2zQDUlVXNcDsf13SDaIg8=";
+        hash = "sha256-DGQs34QYbOUISZW3ECnA+7d5VCgjK+q42HQZN/23Jks=";
       };
     };
     updateScript = writeShellScript "update-proton-pass-cli" ''
diff --git a/pkgs/by-name/rk/rkik/package.nix b/pkgs/by-name/rk/rkik/package.nix
index a2dbef583ffb..81b4c8ee4c84 100644
--- a/pkgs/by-name/rk/rkik/package.nix
+++ b/pkgs/by-name/rk/rkik/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rkik";
-  version = "2.0.0";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "aguacero7";
     repo = "rkik";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qZVHDWVCRW/xuiEXBo923R2Wn8rK5VqKatwekWxkSnk=";
+    hash = "sha256-RueOfDzWgWkrQC0PqsyCewsU/8cC0HLpi+OFHi+qz6c=";
   };
 
-  cargoHash = "sha256-zJ7xqidEkfxSIL/rR/hLR/vDn0Ac85AOFn6mluUER/8=";
+  cargoHash = "sha256-qT5P28TkClb3hY+5vYb/MJ5gyt/EONs94ct93uw2YPM=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/sp/spacectl/package.nix b/pkgs/by-name/sp/spacectl/package.nix
index ce740e360fb3..bebc90827001 100644
--- a/pkgs/by-name/sp/spacectl/package.nix
+++ b/pkgs/by-name/sp/spacectl/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "spacectl";
-  version = "1.17.3";
+  version = "1.18.0";
 
   src = fetchFromGitHub {
     owner = "spacelift-io";
     repo = "spacectl";
     rev = "v${version}";
-    hash = "sha256-kH5CVmticNZDDW97iMY+kU7m2bP44PgKvGSZzEgPoFw=";
+    hash = "sha256-DimKF1NNhScskVre70l2QKlJKLtAMuuyEpp5yyZzCk4=";
   };
 
   vendorHash = "sha256-f/09XZiaYNUZzKM0jITFdUmKt8UQy90K4PGhC6ZupCk=";
diff --git a/pkgs/by-name/ta/tailscale/package.nix b/pkgs/by-name/ta/tailscale/package.nix
index 81f74dbe0a5b..9ac585130f2f 100644
--- a/pkgs/by-name/ta/tailscale/package.nix
+++ b/pkgs/by-name/ta/tailscale/package.nix
@@ -55,7 +55,6 @@ buildGoModule (finalAttrs: {
     "cmd/derper"
     "cmd/derpprobe"
     "cmd/tailscaled"
-    "cmd/tsidp"
     "cmd/get-authkey"
   ];
 
diff --git a/pkgs/by-name/tt/ttl/package.nix b/pkgs/by-name/tt/ttl/package.nix
new file mode 100644
index 000000000000..9b3d1c22c956
--- /dev/null
+++ b/pkgs/by-name/tt/ttl/package.nix
@@ -0,0 +1,57 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  installShellFiles,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "ttl";
+  version = "0.13.0";
+
+  src = fetchFromGitHub {
+    owner = "lance0";
+    repo = "ttl";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-cHiAIWUewdUwV9PO1He2V/+FML8XSVJOlyp+J+tdB24=";
+  };
+
+  cargoHash = "sha256-6TehH3p9ikt1lx7p2Y2jM/21gASk8Taqoe/2bBfFs94=";
+
+  nativeBuildInputs = [
+    installShellFiles
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+
+  postInstall = ''
+    installShellCompletion --cmd ttl \
+      --bash <($out/bin/ttl --completions bash) \
+      --fish <($out/bin/ttl --completions fish) \
+      --zsh <($out/bin/ttl --completions zsh)
+  '';
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Modern traceroute/mtr-style TUI";
+    longDescription = ''
+      ttl provides a live traceroute interface that can trace multiple targets,
+      detect ECMP paths, run PMTUD, export JSON/CSV reports, and optionally
+      enrich hop data with DNS, ASN, geolocation, and PeeringDB information.
+    '';
+    mainProgram = "ttl";
+    homepage = "https://github.com/lance0/ttl";
+    changelog = "https://github.com/lance0/ttl/releases/tag/v${finalAttrs.version}";
+    maintainers = with lib.maintainers; [ vincentbernat ];
+    license = with lib.licenses; [
+      asl20
+      mit
+    ];
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/by-name/ve/vencord/package.nix b/pkgs/by-name/ve/vencord/package.nix
index 5dd47ea1f927..c0e521f774f9 100644
--- a/pkgs/by-name/ve/vencord/package.nix
+++ b/pkgs/by-name/ve/vencord/package.nix
@@ -19,13 +19,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "vencord";
-  version = "1.13.12";
+  version = "1.14.1";
 
   src = fetchFromGitHub {
     owner = "Vendicated";
     repo = "Vencord";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YRpDcTO0/8Pko8mNbaA4WhsnLpXoL+Pp4CMx40Bcg+A=";
+    hash = "sha256-g+zyq4KvLhn1aeziTwh3xSYvzzB8FwoxxR13mbivyh4=";
   };
 
   patches = [ ./fix-deps.patch ];
diff --git a/pkgs/development/python-modules/hightime/default.nix b/pkgs/development/python-modules/hightime/default.nix
index d04932ed4b5b..560d7708e84f 100644
--- a/pkgs/development/python-modules/hightime/default.nix
+++ b/pkgs/development/python-modules/hightime/default.nix
@@ -2,25 +2,25 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  setuptools,
+  poetry-core,
   pytestCheckHook,
   pytest-cov-stub,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "hightime";
-  version = "0.2.2";
+  version = "1.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ni";
     repo = "hightime";
-    rev = "v${version}";
-    hash = "sha256-P/ZP5smKyNg18YGYWpm/57YGFY3MrX1UIVDU5RsF+rA=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-5WEr2tOxQap+otV8DCdIi3MkfHol4TU4qZXf4u2EQhY=";
   };
 
   build-system = [
-    setuptools
+    poetry-core
   ];
 
   nativeCheckInputs = [
@@ -36,10 +36,10 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "hightime" ];
 
   meta = {
-    changelog = "https://github.com/ni/hightime/releases/tag/v${version}";
+    changelog = "https://github.com/ni/hightime/releases/tag/v${finalAttrs.version}";
     description = "Hightime Python API";
     homepage = "https://github.com/ni/hightime";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fsagbuya ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/nixpkgs-updaters-library/default.nix b/pkgs/development/python-modules/nixpkgs-updaters-library/default.nix
index fead292d58e0..e86a36b9aa61 100644
--- a/pkgs/development/python-modules/nixpkgs-updaters-library/default.nix
+++ b/pkgs/development/python-modules/nixpkgs-updaters-library/default.nix
@@ -30,7 +30,7 @@
 }:
 buildPythonPackage (finalAttrs: {
   pname = "nixpkgs-updaters-library";
-  version = "3.0.0";
+  version = "3.1.1";
   pyproject = true;
 
   disabled = pythonOlder "3.13";
@@ -39,7 +39,7 @@ buildPythonPackage (finalAttrs: {
     owner = "PerchunPak";
     repo = "nixpkgs-updaters-library";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0N88valEw+QElMjy84TBKGuqqh9anKhHdW0jQfQ4qd4=";
+    hash = "sha256-y6EVoxu/3aBRce2bQsnlt/faZY17b8Rr4hd7wsTPnjE=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pymc/default.nix b/pkgs/development/python-modules/pymc/default.nix
index feb82d14628f..b82016a48fb6 100644
--- a/pkgs/development/python-modules/pymc/default.nix
+++ b/pkgs/development/python-modules/pymc/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  writableTmpDirAsHomeHook,
 
   # build-system
   setuptools,
@@ -18,11 +19,9 @@
   scipy,
   threadpoolctl,
   typing-extensions,
-
-  writableTmpDirAsHomeHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pymc";
   version = "5.27.0";
   pyproject = true;
@@ -30,7 +29,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "pymc-devs";
     repo = "pymc";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-wBeWydrHrF+wNZnqWa2k8tCaUvjcoiSrmY85LUhrQds=";
   };
 
@@ -39,6 +38,9 @@ buildPythonPackage rec {
     versioneer
   ];
 
+  pythonRelaxDeps = [
+    "pytensor"
+  ];
   dependencies = [
     arviz
     cachetools
@@ -68,10 +70,10 @@ buildPythonPackage rec {
   meta = {
     description = "Bayesian estimation, particularly using Markov chain Monte Carlo (MCMC)";
     homepage = "https://github.com/pymc-devs/pymc";
-    changelog = "https://github.com/pymc-devs/pymc/releases/tag/v${version}";
+    changelog = "https://github.com/pymc-devs/pymc/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
       nidabdella
     ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/pytensor/default.nix b/pkgs/development/python-modules/pytensor/default.nix
index c989e510ec86..e790c04308a4 100644
--- a/pkgs/development/python-modules/pytensor/default.nix
+++ b/pkgs/development/python-modules/pytensor/default.nix
@@ -31,19 +31,19 @@
   nix-update-script,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pytensor";
-  version = "2.36.3";
+  version = "2.37.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pymc-devs";
     repo = "pytensor";
-    tag = "rel-${version}";
+    tag = "rel-${finalAttrs.version}";
     postFetch = ''
-      sed -i 's/git_refnames = "[^"]*"/git_refnames = " (tag: ${src.tag})"/' $out/pytensor/_version.py
+      sed -i 's/git_refnames = "[^"]*"/git_refnames = " (tag: ${finalAttrs.src.tag})"/' $out/pytensor/_version.py
     '';
-    hash = "sha256-FiqNE97tZw8rHF6VAQScGoiibMI+7KHzAy3tzmZBya4=";
+    hash = "sha256-N6TYK/qMux/a0ktQyCGYHZg3g8S6To8g1FXnILk9HIw=";
   };
 
   build-system = [
@@ -84,7 +84,11 @@ buildPythonPackage rec {
     rm -rf pytensor
   '';
 
-  disabledTests = lib.optionals stdenv.hostPlatform.isDarwin [
+  disabledTests = [
+    # TypeError: jax_funcified_fgraph() takes 2 positional arguments but 3 were given
+    "test_jax_Reshape_shape_graph_input"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
     # Numerical assertion error
     # tests.unittest_tools.WrongValue: WrongValue
     "test_op_sd"
@@ -174,10 +178,10 @@ buildPythonPackage rec {
     description = "Python library to define, optimize, and efficiently evaluate mathematical expressions involving multi-dimensional arrays";
     mainProgram = "pytensor-cache";
     homepage = "https://github.com/pymc-devs/pytensor";
-    changelog = "https://github.com/pymc-devs/pytensor/releases/tag/${src.tag}";
+    changelog = "https://github.com/pymc-devs/pytensor/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [
       bcdarwin
     ];
   };
-}
+})
diff --git a/pkgs/shells/fish/plugins/async-prompt.nix b/pkgs/shells/fish/plugins/async-prompt.nix
index 61285a90c84c..a548550ee6d0 100644
--- a/pkgs/shells/fish/plugins/async-prompt.nix
+++ b/pkgs/shells/fish/plugins/async-prompt.nix
@@ -19,6 +19,6 @@ buildFishPlugin rec {
     description = "Make your prompt asynchronous to improve the reactivity";
     homepage = "https://github.com/acomagu/fish-async-prompt";
     license = lib.licenses.mit;
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.samasaur ];
   };
 }