diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index 5be73e669e7f..9e2a7a6731d9 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -600,6 +600,8 @@
 - New options for the declarative configuration of the user space part of ALSA have been introduced under [hardware.alsa](options.html#opt-hardware.alsa.enable), including setting the default capture and playback device, defining sound card aliases and volume controls.
   Note: these are intended for users not running a sound server like PulseAudio or PipeWire, but having ALSA as their only sound system.
 
+- `services.k3s` now provides the `autoDeployCharts` option that allows to automatically deploy Helm charts via the k3s Helm controller.
+
 - Caddy can now be built with plugins by using `caddy.withPlugins`, a `passthru` function that accepts an attribute set as a parameter. The `plugins` argument represents a list of Caddy plugins, with each Caddy plugin being a versioned module. The `hash` argument represents the `vendorHash` of the resulting Caddy source code with the plugins added.
 
   Example:
diff --git a/nixos/modules/services/cluster/k3s/default.nix b/nixos/modules/services/cluster/k3s/default.nix
index f95ee01c7503..b86b8e63f409 100644
--- a/nixos/modules/services/cluster/k3s/default.nix
+++ b/nixos/modules/services/cluster/k3s/default.nix
@@ -20,110 +20,355 @@ let
   chartDir = "/var/lib/rancher/k3s/server/static/charts";
   imageDir = "/var/lib/rancher/k3s/agent/images";
   containerdConfigTemplateFile = "/var/lib/rancher/k3s/agent/etc/containerd/config.toml.tmpl";
+  yamlFormat = pkgs.formats.yaml { };
+  yamlDocSeparator = builtins.toFile "yaml-doc-separator" "\n---\n";
+  # Manifests need a valid YAML suffix to be respected by k3s
+  mkManifestTarget =
+    name: if (lib.hasSuffix ".yaml" name || lib.hasSuffix ".yml" name) then name else name + ".yaml";
+  # Produces a list containing all duplicate manifest names
+  duplicateManifests =
+    with builtins;
+    lib.intersectLists (attrNames cfg.autoDeployCharts) (attrNames cfg.manifests);
+  # Produces a list containing all duplicate chart names
+  duplicateCharts =
+    with builtins;
+    lib.intersectLists (attrNames cfg.autoDeployCharts) (attrNames cfg.charts);
 
-  manifestModule =
-    let
-      mkTarget =
-        name: if (lib.hasSuffix ".yaml" name || lib.hasSuffix ".yml" name) then name else name + ".yaml";
-    in
-    lib.types.submodule (
-      {
-        name,
-        config,
-        options,
-        ...
-      }:
-      {
-        options = {
-          enable = lib.mkOption {
-            type = lib.types.bool;
-            default = true;
-            description = "Whether this manifest file should be generated.";
-          };
-
-          target = lib.mkOption {
-            type = lib.types.nonEmptyStr;
-            example = lib.literalExpression "manifest.yaml";
-            description = ''
-              Name of the symlink (relative to {file}`${manifestDir}`).
-              Defaults to the attribute name.
-            '';
-          };
-
-          content = lib.mkOption {
-            type = with lib.types; nullOr (either attrs (listOf attrs));
-            default = null;
-            description = ''
-              Content of the manifest file. A single attribute set will
-              generate a single document YAML file. A list of attribute sets
-              will generate multiple documents separated by `---` in a single
-              YAML file.
-            '';
-          };
-
-          source = lib.mkOption {
-            type = lib.types.path;
-            example = lib.literalExpression "./manifests/app.yaml";
-            description = ''
-              Path of the source `.yaml` file.
-            '';
-          };
-        };
-
-        config = {
-          target = lib.mkDefault (mkTarget name);
-          source = lib.mkIf (config.content != null) (
-            let
-              name' = "k3s-manifest-" + builtins.baseNameOf name;
-              docName = "k3s-manifest-doc-" + builtins.baseNameOf name;
-              yamlDocSeparator = builtins.toFile "yaml-doc-separator" "\n---\n";
-              mkYaml = name: x: (pkgs.formats.yaml { }).generate name x;
-              mkSource =
-                value:
-                if builtins.isList value then
-                  pkgs.concatText name' (
-                    lib.concatMap (x: [
-                      yamlDocSeparator
-                      (mkYaml docName x)
-                    ]) value
-                  )
-                else
-                  mkYaml name' value;
-            in
-            lib.mkDerivedConfig options.content mkSource
-          );
-        };
-      }
+  # Converts YAML -> JSON -> Nix
+  fromYaml =
+    path:
+    with builtins;
+    fromJSON (
+      readFile (
+        pkgs.runCommand "${path}-converted.json" { nativeBuildInputs = [ yq-go ]; } ''
+          yq --no-colors --output-format json ${path} > $out
+        ''
+      )
     );
 
-  enabledManifests = lib.filter (m: m.enable) (lib.attrValues cfg.manifests);
-  linkManifestEntry = m: "${pkgs.coreutils-full}/bin/ln -sfn ${m.source} ${manifestDir}/${m.target}";
-  linkImageEntry = image: "${pkgs.coreutils-full}/bin/ln -sfn ${image} ${imageDir}/${image.name}";
-  linkChartEntry =
-    let
-      mkTarget = name: if (lib.hasSuffix ".tgz" name) then name else name + ".tgz";
-    in
+  # Replace characters that are problematic in file names
+  cleanHelmChartName =
+    lib.replaceStrings
+      [
+        "/"
+        ":"
+      ]
+      [
+        "-"
+        "-"
+      ];
+
+  # Fetch a Helm chart from a public registry. This only supports a basic Helm pull.
+  fetchHelm =
+    {
+      name,
+      repo,
+      version,
+      hash ? lib.fakeHash,
+    }:
+    pkgs.runCommand (cleanHelmChartName "${lib.removePrefix "https://" repo}-${name}-${version}.tgz")
+      {
+        inherit (lib.fetchers.normalizeHash { } { inherit hash; }) outputHash outputHashAlgo;
+        impureEnvVars = lib.fetchers.proxyImpureEnvVars;
+        nativeBuildInputs = with pkgs; [
+          kubernetes-helm
+          cacert
+        ];
+      }
+      ''
+        export HOME="$PWD"
+        helm repo add repository ${repo}
+        helm pull repository/${name} --version ${version}
+        mv ./*.tgz $out
+      '';
+
+  # Returns the path to a YAML manifest file
+  mkExtraDeployManifest =
+    x:
+    # x is a derivation that provides a YAML file
+    if lib.isDerivation x then
+      x.outPath
+    # x is an attribute set that needs to be converted to a YAML file
+    else if builtins.isAttrs x then
+      (yamlFormat.generate "extra-deploy-chart-manifest" x)
+    # assume x is a path to a YAML file
+    else
+      x;
+
+  # Generate a HelmChart custom resource.
+  mkHelmChartCR =
     name: value:
-    "${pkgs.coreutils-full}/bin/ln -sfn ${value} ${chartDir}/${mkTarget (builtins.baseNameOf name)}";
+    let
+      chartValues = if (lib.isPath value.values) then fromYaml value.values else value.values;
+      # use JSON for values as it's a subset of YAML and understood by the k3s Helm controller
+      valuesContent = builtins.toJSON chartValues;
+    in
+    # merge with extraFieldDefinitions to allow setting advanced values and overwrite generated
+    # values
+    lib.recursiveUpdate {
+      apiVersion = "helm.cattle.io/v1";
+      kind = "HelmChart";
+      metadata = {
+        inherit name;
+        namespace = "kube-system";
+      };
+      spec = {
+        inherit valuesContent;
+        inherit (value) targetNamespace createNamespace;
+        chart = "https://%{KUBERNETES_API}%/static/charts/${name}.tgz";
+      };
+    } value.extraFieldDefinitions;
 
-  activateK3sContent = pkgs.writeShellScript "activate-k3s-content" ''
-    ${lib.optionalString (
-      builtins.length enabledManifests > 0
-    ) "${pkgs.coreutils-full}/bin/mkdir -p ${manifestDir}"}
-    ${lib.optionalString (cfg.charts != { }) "${pkgs.coreutils-full}/bin/mkdir -p ${chartDir}"}
-    ${lib.optionalString (
-      builtins.length cfg.images > 0
-    ) "${pkgs.coreutils-full}/bin/mkdir -p ${imageDir}"}
+  # Generate a HelmChart custom resource together with extraDeploy manifests. This
+  # generates possibly a multi document YAML file that the auto deploy mechanism of k3s
+  # deploys.
+  mkAutoDeployChartManifest = name: value: {
+    # target is the final name of the link created for the manifest file
+    target = mkManifestTarget name;
+    inherit (value) enable package;
+    # source is a store path containing the complete manifest file
+    source = pkgs.concatText "auto-deploy-chart-${name}.yaml" (
+      [
+        (yamlFormat.generate "helm-chart-manifest-${name}.yaml" (mkHelmChartCR name value))
+      ]
+      # alternate the YAML doc seperator (---) and extraDeploy manifests to create
+      # multi document YAMLs
+      ++ (lib.concatMap (x: [
+        yamlDocSeparator
+        (mkExtraDeployManifest x)
+      ]) value.extraDeploy)
+    );
+  };
 
-    ${builtins.concatStringsSep "\n" (map linkManifestEntry enabledManifests)}
-    ${builtins.concatStringsSep "\n" (lib.mapAttrsToList linkChartEntry cfg.charts)}
-    ${builtins.concatStringsSep "\n" (map linkImageEntry cfg.images)}
+  autoDeployChartsModule = lib.types.submodule (
+    { config, ... }:
+    {
+      options = {
+        enable = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+          example = false;
+          description = ''
+            Whether to enable the installation of this Helm chart. Note that setting
+            this option to `false` will not uninstall the chart from the cluster, if
+            it was previously installed. Please use the the `--disable` flag or `.skip`
+            files to delete/disable Helm charts, as mentioned in the
+            [docs](https://docs.k3s.io/installation/packaged-components#disabling-manifests).
+          '';
+        };
 
-    ${lib.optionalString (cfg.containerdConfigTemplate != null) ''
-      mkdir -p $(dirname ${containerdConfigTemplateFile})
-      ${pkgs.coreutils-full}/bin/ln -sfn ${pkgs.writeText "config.toml.tmpl" cfg.containerdConfigTemplate} ${containerdConfigTemplateFile}
-    ''}
-  '';
+        repo = lib.mkOption {
+          type = lib.types.nonEmptyStr;
+          example = "https://kubernetes.github.io/ingress-nginx";
+          description = ''
+            The repo of the Helm chart. Only has an effect if `package` is not set.
+            The Helm chart is fetched during build time and placed as a `.tgz` archive on the
+            filesystem.
+          '';
+        };
+
+        name = lib.mkOption {
+          type = lib.types.nonEmptyStr;
+          example = "ingress-nginx";
+          description = ''
+            The name of the Helm chart. Only has an effect if `package` is not set.
+            The Helm chart is fetched during build time and placed as a `.tgz` archive on the
+            filesystem.
+          '';
+        };
+
+        version = lib.mkOption {
+          type = lib.types.nonEmptyStr;
+          example = "4.7.0";
+          description = ''
+            The version of the Helm chart. Only has an effect if `package` is not set.
+            The Helm chart is fetched during build time and placed as a `.tgz` archive on the
+            filesystem.
+          '';
+        };
+
+        hash = lib.mkOption {
+          type = lib.types.str;
+          example = "sha256-ej+vpPNdiOoXsaj1jyRpWLisJgWo8EqX+Z5VbpSjsPA=";
+          description = ''
+            The hash of the packaged Helm chart. Only has an effect if `package` is not set.
+            The Helm chart is fetched during build time and placed as a `.tgz` archive on the
+            filesystem.
+          '';
+        };
+
+        package = lib.mkOption {
+          type = with lib.types; either path package;
+          example = lib.literalExpression "../my-helm-chart.tgz";
+          description = ''
+            The packaged Helm chart. Overwrites the options `repo`, `name`, `version`
+            and `hash` in case of conflicts.
+          '';
+        };
+
+        targetNamespace = lib.mkOption {
+          type = lib.types.nonEmptyStr;
+          default = "default";
+          example = "kube-system";
+          description = "The namespace in which the Helm chart gets installed.";
+        };
+
+        createNamespace = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+          example = true;
+          description = "Whether to create the target namespace if not present.";
+        };
+
+        values = lib.mkOption {
+          type = with lib.types; either path attrs;
+          default = { };
+          example = {
+            replicaCount = 3;
+            hostName = "my-host";
+            server = {
+              name = "nginx";
+              port = 80;
+            };
+          };
+          description = ''
+            Override default chart values via Nix expressions. This is equivalent to setting
+            values in a `values.yaml` file.
+
+            WARNING: The values (including secrets!) specified here are exposed unencrypted
+            in the world-readable nix store.
+          '';
+        };
+
+        extraDeploy = lib.mkOption {
+          type = with lib.types; listOf (either path attrs);
+          default = [ ];
+          example = lib.literalExpression ''
+            [
+              ../manifests/my-extra-deployment.yaml
+              {
+                apiVersion = "v1";
+                kind = "Service";
+                metadata = {
+                  name = "app-service";
+                };
+                spec = {
+                  selector = {
+                    "app.kubernetes.io/name" = "MyApp";
+                  };
+                  ports = [
+                    {
+                      name = "name-of-service-port";
+                      protocol = "TCP";
+                      port = 80;
+                      targetPort = "http-web-svc";
+                    }
+                  ];
+                };
+              }
+            ];
+          '';
+          description = "List of extra Kubernetes manifests to deploy with this Helm chart.";
+        };
+
+        extraFieldDefinitions = lib.mkOption {
+          inherit (yamlFormat) type;
+          default = { };
+          example = {
+            spec = {
+              bootstrap = true;
+              helmVersion = "v2";
+              backOffLimit = 3;
+              jobImage = "custom-helm-controller:v0.0.1";
+            };
+          };
+          description = ''
+            Extra HelmChart field definitions that are merged with the rest of the HelmChart
+            custom resource. This can be used to set advanced fields or to overwrite
+            generated fields. See https://docs.k3s.io/helm#helmchart-field-definitions
+            for possible fields.
+          '';
+        };
+      };
+
+      config.package = lib.mkDefault (fetchHelm {
+        inherit (config)
+          repo
+          name
+          version
+          hash
+          ;
+      });
+    }
+  );
+
+  manifestModule = lib.types.submodule (
+    {
+      name,
+      config,
+      options,
+      ...
+    }:
+    {
+      options = {
+        enable = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+          description = "Whether this manifest file should be generated.";
+        };
+
+        target = lib.mkOption {
+          type = lib.types.nonEmptyStr;
+          example = "manifest.yaml";
+          description = ''
+            Name of the symlink (relative to {file}`${manifestDir}`).
+            Defaults to the attribute name.
+          '';
+        };
+
+        content = lib.mkOption {
+          type = with lib.types; nullOr (either attrs (listOf attrs));
+          default = null;
+          description = ''
+            Content of the manifest file. A single attribute set will
+            generate a single document YAML file. A list of attribute sets
+            will generate multiple documents separated by `---` in a single
+            YAML file.
+          '';
+        };
+
+        source = lib.mkOption {
+          type = lib.types.path;
+          example = lib.literalExpression "./manifests/app.yaml";
+          description = ''
+            Path of the source `.yaml` file.
+          '';
+        };
+      };
+
+      config = {
+        target = lib.mkDefault (mkManifestTarget name);
+        source = lib.mkIf (config.content != null) (
+          let
+            name' = "k3s-manifest-" + builtins.baseNameOf name;
+            docName = "k3s-manifest-doc-" + builtins.baseNameOf name;
+            mkSource =
+              value:
+              if builtins.isList value then
+                pkgs.concatText name' (
+                  lib.concatMap (x: [
+                    yamlDocSeparator
+                    (yamlFormat.generate docName x)
+                  ]) value
+                )
+              else
+                yamlFormat.generate name' value;
+          in
+          lib.mkDerivedConfig options.content mkSource
+        );
+      };
+    }
+  );
 in
 {
   imports = [ (removeOption [ "docker" ] "k3s docker option is no longer supported.") ];
@@ -242,78 +487,80 @@ in
       type = lib.types.attrsOf manifestModule;
       default = { };
       example = lib.literalExpression ''
-        deployment.source = ../manifests/deployment.yaml;
-        my-service = {
-          enable = false;
-          target = "app-service.yaml";
-          content = {
-            apiVersion = "v1";
-            kind = "Service";
-            metadata = {
-              name = "app-service";
-            };
-            spec = {
-              selector = {
-                "app.kubernetes.io/name" = "MyApp";
+        {
+          deployment.source = ../manifests/deployment.yaml;
+          my-service = {
+            enable = false;
+            target = "app-service.yaml";
+            content = {
+              apiVersion = "v1";
+              kind = "Service";
+              metadata = {
+                name = "app-service";
+              };
+              spec = {
+                selector = {
+                  "app.kubernetes.io/name" = "MyApp";
+                };
+                ports = [
+                  {
+                    name = "name-of-service-port";
+                    protocol = "TCP";
+                    port = 80;
+                    targetPort = "http-web-svc";
+                  }
+                ];
               };
-              ports = [
-                {
-                  name = "name-of-service-port";
-                  protocol = "TCP";
-                  port = 80;
-                  targetPort = "http-web-svc";
-                }
-              ];
             };
-          }
-        };
+          };
 
-        nginx.content = [
-          {
-            apiVersion = "v1";
-            kind = "Pod";
-            metadata = {
-              name = "nginx";
-              labels = {
-                "app.kubernetes.io/name" = "MyApp";
+          nginx.content = [
+            {
+              apiVersion = "v1";
+              kind = "Pod";
+              metadata = {
+                name = "nginx";
+                labels = {
+                  "app.kubernetes.io/name" = "MyApp";
+                };
               };
-            };
-            spec = {
-              containers = [
-                {
-                  name = "nginx";
-                  image = "nginx:1.14.2";
-                  ports = [
-                    {
-                      containerPort = 80;
-                      name = "http-web-svc";
-                    }
-                  ];
-                }
-              ];
-            };
-          }
-          {
-            apiVersion = "v1";
-            kind = "Service";
-            metadata = {
-              name = "nginx-service";
-            };
-            spec = {
-              selector = {
-                "app.kubernetes.io/name" = "MyApp";
+              spec = {
+                containers = [
+                  {
+                    name = "nginx";
+                    image = "nginx:1.14.2";
+                    ports = [
+                      {
+                        containerPort = 80;
+                        name = "http-web-svc";
+                      }
+                    ];
+                  }
+                ];
               };
-              ports = [
-                {
-                  name = "name-of-service-port";
-                  protocol = "TCP";
-                  port = 80;
-                  targetPort = "http-web-svc";
-                }
-              ];
-            };
-          }
-        ];
+            }
+            {
+              apiVersion = "v1";
+              kind = "Service";
+              metadata = {
+                name = "nginx-service";
+              };
+              spec = {
+                selector = {
+                  "app.kubernetes.io/name" = "MyApp";
+                };
+                ports = [
+                  {
+                    name = "name-of-service-port";
+                    protocol = "TCP";
+                    port = 80;
+                    targetPort = "http-web-svc";
+                  }
+                ];
+              };
+            }
+          ];
+        };
       '';
       description = ''
         Auto-deploying manifests that are linked to {file}`${manifestDir}` before k3s starts.
@@ -337,10 +584,9 @@ in
         Packaged Helm charts that are linked to {file}`${chartDir}` before k3s starts.
         The attribute name will be used as the link target (relative to {file}`${chartDir}`).
         The specified charts will only be placed on the file system and made available to the
-        Kubernetes APIServer from within the cluster, you may use the
-        [k3s Helm controller](https://docs.k3s.io/helm#using-the-helm-controller)
-        to deploy the charts. This option only makes sense on server nodes
-        (`role = server`).
+        Kubernetes APIServer from within the cluster. See the [](#opt-services.k3s.autoDeployCharts)
+        option and the [k3s Helm controller docs](https://docs.k3s.io/helm#using-the-helm-controller)
+        to deploy Helm charts. This option only makes sense on server nodes (`role = server`).
       '';
     };
 
@@ -450,6 +696,53 @@ in
         set the `clientConnection.kubeconfig` if you want to use `extraKubeProxyConfig`.
       '';
     };
+
+    autoDeployCharts = lib.mkOption {
+      type = lib.types.attrsOf autoDeployChartsModule;
+      apply = lib.mapAttrs mkAutoDeployChartManifest;
+      default = { };
+      example = lib.literalExpression ''
+        {
+          harbor = {
+            name = "harbor";
+            repo = "https://helm.goharbor.io";
+            version = "1.14.0";
+            hash = "sha256-fMP7q1MIbvzPGS9My91vbQ1d3OJMjwc+o8YE/BXZaYU=";
+            values = {
+              existingSecretAdminPassword = "harbor-admin";
+              expose = {
+                tls = {
+                  enabled = true;
+                  certSource = "secret";
+                  secret.secretName = "my-tls-secret";
+                };
+                ingress = {
+                  hosts.core = "example.com";
+                  className = "nginx";
+                };
+              };
+            };
+          };
+
+          custom-chart = {
+            package = ../charts/my-chart.tgz;
+            values = ../values/my-values.yaml;
+            extraFieldDefinitions = {
+              spec.timeout = "60s";
+            };
+          };
+        }
+      '';
+      description = ''
+        Auto deploying Helm charts that are installed by the k3s Helm controller. Avoid to use
+        attribute names that are also used in the [](#opt-services.k3s.manifests) and
+        [](#opt-services.k3s.charts) options. Manifests with the same name will override
+        auto deploying charts with the same name. Similiarly, charts with the same name will
+        overwrite the Helm chart contained in auto deploying charts. This option only makes
+        sense on server nodes (`role = server`). See the
+        [k3s Helm documentation](https://docs.k3s.io/helm) for further information.
+      '';
+    };
   };
 
   # implementation
@@ -462,6 +755,15 @@ in
       ++ (lib.optional (cfg.role != "server" && cfg.charts != { })
         "k3s: Helm charts are only made available to the cluster on server nodes (role == server), they will be ignored by this node."
       )
+      ++ (lib.optional (cfg.role != "server" && cfg.autoDeployCharts != { })
+        "k3s: Auto deploying Helm charts are only installed on server nodes (role == server), they will be ignored by this node."
+      )
+      ++ (lib.optional (duplicateManifests != [ ])
+        "k3s: The following auto deploying charts are overriden by manifests of the same name: ${toString duplicateManifests}."
+      )
+      ++ (lib.optional (duplicateCharts != [ ])
+        "k3s: The following auto deploying charts are overriden by charts of the same name: ${toString duplicateCharts}."
+      )
       ++ (lib.optional (
         cfg.disableAgent && cfg.images != [ ]
       ) "k3s: Images are only imported on nodes with an enabled agent, they will be ignored by this node")
@@ -486,6 +788,50 @@ in
 
     environment.systemPackages = [ config.services.k3s.package ];
 
+    # Use systemd-tmpfiles to activate k3s content
+    systemd.tmpfiles.settings."10-k3s" =
+      let
+        # Merge manifest with manifests generated from auto deploying charts, keep only enabled manifests
+        enabledManifests = lib.filterAttrs (_: v: v.enable) (cfg.autoDeployCharts // cfg.manifests);
+        # Merge charts with charts contained in enabled auto deploying charts
+        helmCharts =
+          (lib.concatMapAttrs (n: v: { ${n} = v.package; }) (
+            lib.filterAttrs (_: v: v.enable) cfg.autoDeployCharts
+          ))
+          // cfg.charts;
+        # Make a systemd-tmpfiles rule for a manifest
+        mkManifestRule = manifest: {
+          name = "${manifestDir}/${manifest.target}";
+          value = {
+            "L+".argument = "${manifest.source}";
+          };
+        };
+        # Ensure that all chart targets have a .tgz suffix
+        mkChartTarget = name: if (lib.hasSuffix ".tgz" name) then name else name + ".tgz";
+        # Make a systemd-tmpfiles rule for a chart
+        mkChartRule = target: source: {
+          name = "${chartDir}/${mkChartTarget target}";
+          value = {
+            "L+".argument = "${source}";
+          };
+        };
+        # Make a systemd-tmpfiles rule for a container image
+        mkImageRule = image: {
+          name = "${imageDir}/${image.name}";
+          value = {
+            "L+".argument = "${image}";
+          };
+        };
+      in
+      (lib.mapAttrs' (_: v: mkManifestRule v) enabledManifests)
+      // (lib.mapAttrs' (n: v: mkChartRule n v) helmCharts)
+      // (builtins.listToAttrs (map mkImageRule cfg.images))
+      // (lib.optionalAttrs (cfg.containerdConfigTemplate != null) {
+        ${containerdConfigTemplateFile} = {
+          "L+".argument = "${pkgs.writeText "config.toml.tmpl" cfg.containerdConfigTemplate}";
+        };
+      });
+
     systemd.services.k3s =
       let
         kubeletParams =
@@ -533,7 +879,6 @@ in
           LimitCORE = "infinity";
           TasksMax = "infinity";
           EnvironmentFile = cfg.environmentFile;
-          ExecStartPre = activateK3sContent;
           ExecStart = lib.concatStringsSep " \\\n " (
             [ "${cfg.package}/bin/k3s ${cfg.role}" ]
             ++ (lib.optional cfg.clusterInit "--cluster-init")
diff --git a/nixos/modules/services/web-apps/changedetection-io.nix b/nixos/modules/services/web-apps/changedetection-io.nix
index 5fd340a0ead0..ff710d55d40c 100644
--- a/nixos/modules/services/web-apps/changedetection-io.nix
+++ b/nixos/modules/services/web-apps/changedetection-io.nix
@@ -73,7 +73,7 @@ in
       default = null;
       example = "/run/secrets/changedetection-io.env";
       description = ''
-        Securely pass environment variabels to changedetection-io.
+        Securely pass environment variables to changedetection-io.
 
         This can be used to set for example a frontend password reproducible via `SALTED_PASS`
         which convinetly also deactivates nags about the hosted version.
diff --git a/nixos/tests/k3s/auto-deploy-charts.nix b/nixos/tests/k3s/auto-deploy-charts.nix
new file mode 100644
index 000000000000..f64728f44f64
--- /dev/null
+++ b/nixos/tests/k3s/auto-deploy-charts.nix
@@ -0,0 +1,135 @@
+# Tests whether container images are imported and auto deploying Helm charts work
+import ../make-test-python.nix (
+  {
+    k3s,
+    lib,
+    pkgs,
+    ...
+  }:
+  let
+    testImageEnv = pkgs.buildEnv {
+      name = "k3s-pause-image-env";
+      paths = with pkgs; [
+        busybox
+        hello
+      ];
+    };
+    testImage = pkgs.dockerTools.buildImage {
+      name = "test.local/test";
+      tag = "local";
+      # Slightly reduces the time needed to import image
+      compressor = "zstd";
+      copyToRoot = testImageEnv;
+    };
+    # pack the test helm chart as a .tgz archive
+    package =
+      pkgs.runCommand "k3s-test-chart.tgz"
+        {
+          nativeBuildInputs = [ pkgs.kubernetes-helm ];
+        }
+        ''
+          helm package ${./k3s-test-chart}
+          mv ./*.tgz $out
+        '';
+    # The common Helm chart that is used in this test
+    testChart = {
+      inherit package;
+      values = {
+        runCommand = "hello";
+        image = {
+          repository = testImage.imageName;
+          tag = testImage.imageTag;
+        };
+      };
+    };
+  in
+  {
+    name = "${k3s.name}-auto-deploy-helm";
+    meta.maintainers = lib.teams.k3s.members;
+    nodes.machine =
+      { pkgs, ... }:
+      {
+        # k3s uses enough resources the default vm fails.
+        virtualisation = {
+          memorySize = 1536;
+          diskSize = 4096;
+        };
+        environment.systemPackages = [ pkgs.yq-go ];
+        services.k3s = {
+          enable = true;
+          package = k3s;
+          # Slightly reduce resource usage
+          extraFlags = [
+            "--disable coredns"
+            "--disable local-storage"
+            "--disable metrics-server"
+            "--disable servicelb"
+            "--disable traefik"
+          ];
+          images = [
+            # Provides the k3s Helm controller
+            k3s.airgapImages
+            testImage
+          ];
+          autoDeployCharts = {
+            # regular test chart that should get installed
+            hello = testChart;
+            # disabled chart that should not get installed
+            disabled = testChart // {
+              enable = false;
+            };
+            # advanced chart that should get installed in the "test" namespace with a custom
+            # timeout and overridden values
+            advanced = testChart // {
+              # create the "test" namespace via extraDeploy for testing
+              extraDeploy = [
+                {
+                  apiVersion = "v1";
+                  kind = "Namespace";
+                  metadata.name = "test";
+                }
+              ];
+              extraFieldDefinitions = {
+                spec = {
+                  # overwrite chart values
+                  valuesContent = ''
+                    runCommand: "echo 'advanced hello'"
+                    image:
+                      repository: ${testImage.imageName}
+                      tag: ${testImage.imageTag}
+                  '';
+                  # overwrite the chart namespace
+                  targetNamespace = "test";
+                  # set a custom timeout
+                  timeout = "69s";
+                };
+              };
+            };
+          };
+        };
+      };
+
+    testScript = # python
+      ''
+        import json
+
+        machine.wait_for_unit("k3s")
+        # check existence/absence of chart manifest files
+        machine.succeed("test -e /var/lib/rancher/k3s/server/manifests/hello.yaml")
+        machine.succeed("test ! -e /var/lib/rancher/k3s/server/manifests/disabled.yaml")
+        machine.succeed("test -e /var/lib/rancher/k3s/server/manifests/advanced.yaml")
+        # check that the timeout is set correctly, select only the first doc in advanced.yaml
+        advancedManifest = json.loads(machine.succeed("yq -o json 'select(di == 0)' /var/lib/rancher/k3s/server/manifests/advanced.yaml"))
+        assert advancedManifest["spec"]["timeout"] == "69s", f"unexpected value for spec.timeout: {advancedManifest["spec"]["timeout"]}"
+        # wait for test jobs to complete
+        machine.wait_until_succeeds("kubectl wait --for=condition=complete job/hello", timeout=180)
+        machine.wait_until_succeeds("kubectl -n test wait --for=condition=complete job/advanced", timeout=180)
+        # check output of test jobs
+        hello_output = machine.succeed("kubectl logs -l batch.kubernetes.io/job-name=hello")
+        advanced_output = machine.succeed("kubectl -n test logs -l batch.kubernetes.io/job-name=advanced")
+        # strip the output to remove trailing whitespaces
+        assert hello_output.rstrip() == "Hello, world!", f"unexpected output of hello job: {hello_output}"
+        assert advanced_output.rstrip() == "advanced hello", f"unexpected output of advanced job: {advanced_output}"
+      '';
+  }
+)
diff --git a/nixos/tests/k3s/default.nix b/nixos/tests/k3s/default.nix
index 7edaf6f38ed2..4ee3cb760b39 100644
--- a/nixos/tests/k3s/default.nix
+++ b/nixos/tests/k3s/default.nix
@@ -11,6 +11,9 @@ in
     _: k3s: import ./airgap-images.nix { inherit system pkgs k3s; }
   ) allK3s;
   auto-deploy = lib.mapAttrs (_: k3s: import ./auto-deploy.nix { inherit system pkgs k3s; }) allK3s;
+  auto-deploy-charts = lib.mapAttrs (
+    _: k3s: import ./auto-deploy-charts.nix { inherit system pkgs k3s; }
+  ) allK3s;
   containerd-config = lib.mapAttrs (
     _: k3s: import ./containerd-config.nix { inherit system pkgs k3s; }
   ) allK3s;
diff --git a/nixos/tests/k3s/k3s-test-chart/Chart.yaml b/nixos/tests/k3s/k3s-test-chart/Chart.yaml
new file mode 100644
index 000000000000..9cc0ae87678f
--- /dev/null
+++ b/nixos/tests/k3s/k3s-test-chart/Chart.yaml
@@ -0,0 +1,24 @@
+apiVersion: v2
+name: k3s-test-chart
+description: A Helm chart that is used in k3s NixOS tests.
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "1.16.0"
diff --git a/nixos/tests/k3s/k3s-test-chart/templates/job.yaml b/nixos/tests/k3s/k3s-test-chart/templates/job.yaml
new file mode 100644
index 000000000000..029453e56219
--- /dev/null
+++ b/nixos/tests/k3s/k3s-test-chart/templates/job.yaml
@@ -0,0 +1,14 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ .Release.Name | quote }}
+  namespace: {{ .Release.Namespace | quote }}
+spec:
+  template:
+    spec:
+      containers:
+      - name: test
+        image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+        command: ["sh"]
+        args: ["-c", "{{ .Values.runCommand }}"]
+      restartPolicy: {{ .Values.restartPolicy | quote }}
diff --git a/nixos/tests/k3s/k3s-test-chart/values.yaml b/nixos/tests/k3s/k3s-test-chart/values.yaml
new file mode 100644
index 000000000000..cca4a557fd90
--- /dev/null
+++ b/nixos/tests/k3s/k3s-test-chart/values.yaml
@@ -0,0 +1,5 @@
+restartPolicy: "Never"
+runCommand: ""
+image:
+  repository: foo
+  tag: 1.0.0
diff --git a/pkgs/applications/blockchains/lighthouse/default.nix b/pkgs/applications/blockchains/lighthouse/default.nix
index 3b91039a5b97..5fac7b05434c 100644
--- a/pkgs/applications/blockchains/lighthouse/default.nix
+++ b/pkgs/applications/blockchains/lighthouse/default.nix
@@ -7,7 +7,6 @@
 , nix-update-script
 , openssl
 , pkg-config
-, libpq
 , protobuf
 , rustPlatform
 , rust-jemalloc-sys
@@ -119,10 +118,6 @@ rustPlatform.buildRustPackage rec {
     "--skip subnet_service::tests::sync_committee_service::subscribe_and_unsubscribe"
   ];
 
-  nativeCheckInputs = [
-    libpq
-  ];
-
   passthru = {
     tests.version = testers.testVersion {
       package = lighthouse;
diff --git a/pkgs/applications/editors/emacs/elisp-packages/elpa-common-overrides.nix b/pkgs/applications/editors/emacs/elisp-packages/elpa-common-overrides.nix
index cc8c4e1caa21..d3dd6e128681 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/elpa-common-overrides.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/elpa-common-overrides.nix
@@ -210,7 +210,7 @@ in
   poke = addPackageRequires super.poke [ self.poke-mode ];
 
   pq = super.pq.overrideAttrs (old: {
-    buildInputs = old.buildInputs or [ ] ++ [ pkgs.postgresql ];
+    buildInputs = old.buildInputs or [ ] ++ [ pkgs.libpq ];
   });
 
   preview-auto = mkHome super.preview-auto;
diff --git a/pkgs/by-name/_3/_3proxy/package.nix b/pkgs/by-name/_3/_3proxy/package.nix
index 1c0c33d6c0a6..c85a8cb392c2 100644
--- a/pkgs/by-name/_3/_3proxy/package.nix
+++ b/pkgs/by-name/_3/_3proxy/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "3proxy";
-  version = "0.9.4";
+  version = "0.9.5";
 
   src = fetchFromGitHub {
     owner = "3proxy";
     repo = "3proxy";
     rev = version;
-    sha256 = "sha256-4bLlQ/ULvpjs6fr19yBBln5mRRc+yj+zVLiTs1e/Ypc=";
+    sha256 = "sha256-uy6flZ1a7o02pr5O0pgl9zCjh8mE9W5JxotJeBMB16A=";
   };
 
   # They use 'install -s', that calls the native strip instead of the cross.
@@ -42,11 +42,11 @@ stdenv.mkDerivation rec {
     smoke-test = nixosTests._3proxy;
   };
 
-  meta = with lib; {
+  meta = {
     description = "Tiny free proxy server";
     homepage = "https://github.com/3proxy/3proxy";
-    license = licenses.bsd2;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ misuzu ];
+    license = lib.licenses.bsd2;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ misuzu ];
   };
 }
diff --git a/pkgs/by-name/bi/biboumi/package.nix b/pkgs/by-name/bi/biboumi/package.nix
index cdcd493aa2f5..cf7f744e2f84 100644
--- a/pkgs/by-name/bi/biboumi/package.nix
+++ b/pkgs/by-name/bi/biboumi/package.nix
@@ -14,7 +14,7 @@
   withIDN ? true,
   libidn,
   withPostgreSQL ? false,
-  postgresql,
+  libpq,
   withSQLite ? true,
   sqlite,
   withUDNS ? true,
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
       botan2
     ]
     ++ lib.optional withIDN libidn
-    ++ lib.optional withPostgreSQL postgresql
+    ++ lib.optional withPostgreSQL libpq
     ++ lib.optional withSQLite sqlite
     ++ lib.optional withUDNS udns;
 
diff --git a/pkgs/by-name/fl/flet-client-flutter/package.nix b/pkgs/by-name/fl/flet-client-flutter/package.nix
index 65476713f703..11f86847048b 100644
--- a/pkgs/by-name/fl/flet-client-flutter/package.nix
+++ b/pkgs/by-name/fl/flet-client-flutter/package.nix
@@ -19,13 +19,13 @@
 
 flutter327.buildFlutterApplication rec {
   pname = "flet-client-flutter";
-  version = "0.27.4";
+  version = "0.27.6";
 
   src = fetchFromGitHub {
     owner = "flet-dev";
     repo = "flet";
     tag = "v${version}";
-    hash = "sha256-YwRxkubkpFHKmTzb+RKZFumey3153lAtg2NO3dDKWG4=";
+    hash = "sha256-ZtIAfLdj9209ZzgmNzTHMyzCTohxYK0Va4M8NYyie64=";
   };
 
   sourceRoot = "${src.name}/client";
diff --git a/pkgs/by-name/fl/flet-client-flutter/pubspec.lock.json b/pkgs/by-name/fl/flet-client-flutter/pubspec.lock.json
index 311272748712..ef2b7145add1 100644
--- a/pkgs/by-name/fl/flet-client-flutter/pubspec.lock.json
+++ b/pkgs/by-name/fl/flet-client-flutter/pubspec.lock.json
@@ -327,7 +327,7 @@
         "relative": true
       },
       "source": "path",
-      "version": "0.27.1"
+      "version": "0.27.5"
     },
     "flet_ads": {
       "dependency": "direct main",
diff --git a/pkgs/by-name/gl/glom/package.nix b/pkgs/by-name/gl/glom/package.nix
index a7e532ea116b..3da677d706ba 100644
--- a/pkgs/by-name/gl/glom/package.nix
+++ b/pkgs/by-name/gl/glom/package.nix
@@ -31,7 +31,7 @@
   isocodes,
   gtksourceview,
   gtksourceviewmm,
-  postgresql_15,
+  postgresql,
   gobject-introspection,
   yelp-tools,
   wrapGAppsHook3,
@@ -119,7 +119,7 @@ stdenv.mkDerivation (finalAttrs: {
     isocodes
     gtksourceview
     gtksourceviewmm
-    postgresql_15 # for postgresql utils
+    postgresql # for postgresql utils
   ];
 
   enableParallelBuilding = true;
@@ -128,7 +128,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   configureFlags = [
     "--with-boost-python=boost_python${lib.versions.major python311.version}${lib.versions.minor python311.version}"
-    "--with-postgres-utils=${lib.getBin postgresql_15}/bin"
+    "--with-postgres-utils=${lib.getBin postgresql}/bin"
   ];
 
   makeFlags = [
diff --git a/pkgs/by-name/he/heimdall-proxy/package.nix b/pkgs/by-name/he/heimdall-proxy/package.nix
index 9a8260e6ea94..03795945f2a1 100644
--- a/pkgs/by-name/he/heimdall-proxy/package.nix
+++ b/pkgs/by-name/he/heimdall-proxy/package.nix
@@ -1,12 +1,12 @@
 {
   fetchFromGitHub,
-  buildGo124Module,
+  buildGoModule,
   lib,
 }:
 let
-  version = "0.15.8";
+  version = "0.15.9";
 in
-buildGo124Module {
+buildGoModule {
   pname = "heimdall-proxy";
 
   inherit version;
@@ -15,10 +15,10 @@ buildGo124Module {
     owner = "dadrus";
     repo = "heimdall";
     tag = "v${version}";
-    hash = "sha256-UUQWYChZEb/5mc2YYwIJSQ+pCUXIwvB09KaR0FoKrA4=";
+    hash = "sha256-nrYeNVSDvGTRywhTLFLylnSz1jhR/1OSKDaRj2sDe5o=";
   };
 
-  vendorHash = "sha256-4bnVqUV3H/mZ9FiApZk6pVbRWAqpy17+/dGxXR0fjW0=";
+  vendorHash = "sha256-Rz1v2jusP9edDpoFaiwb7ZatuSeg9sqFS7j2JZtNJio=";
 
   tags = [ "sqlite" ];
 
diff --git a/pkgs/by-name/ke/kea/package.nix b/pkgs/by-name/ke/kea/package.nix
index c23db4d772d0..aa8a8a762ecd 100644
--- a/pkgs/by-name/ke/kea/package.nix
+++ b/pkgs/by-name/ke/kea/package.nix
@@ -15,7 +15,7 @@
   libmysqlclient,
   log4cplus,
   openssl,
-  postgresql,
+  libpq,
   python3,
 
   # tests
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
       "--localstatedir=/var"
       "--with-openssl=${lib.getDev openssl}"
     ]
-    ++ lib.optional withPostgres "--with-pgsql=${lib.getDev postgresql}/bin/pg_config"
+    ++ lib.optional withPostgres "--with-pgsql=${lib.getDev libpq}/bin/pg_config"
     ++ lib.optional withMysql "--with-mysql=${lib.getDev libmysqlclient}/bin/mysql_config";
 
   postConfigure = ''
diff --git a/pkgs/by-name/pa/paru/package.nix b/pkgs/by-name/pa/paru/package.nix
index 8f8780a8a548..52278491e4ed 100644
--- a/pkgs/by-name/pa/paru/package.nix
+++ b/pkgs/by-name/pa/paru/package.nix
@@ -53,9 +53,9 @@ rustPlatform.buildRustPackage rec {
 
   postInstall = ''
     installManPage man/paru.8 man/paru.conf.5
-    installShellCompletion --bash completions/bash
-    installShellCompletion --fish completions/fish
-    installShellCompletion --zsh completions/zsh
+    installShellCompletion --name paru.bash --bash completions/bash
+    installShellCompletion --name paru.fish --fish completions/fish
+    installShellCompletion --name _paru --zsh completions/zsh
     cp -r locale "$out/share/"
   '';
 
diff --git a/pkgs/by-name/pg/pg_top/package.nix b/pkgs/by-name/pg/pg_top/package.nix
index d004475f736c..4252a38283d5 100644
--- a/pkgs/by-name/pg/pg_top/package.nix
+++ b/pkgs/by-name/pg/pg_top/package.nix
@@ -4,7 +4,7 @@
   lib,
   libbsd,
   ncurses,
-  postgresql,
+  libpq,
   stdenv,
 }:
 
@@ -19,8 +19,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     libbsd
+    libpq
     ncurses
-    postgresql
   ];
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/re/redpanda-client/package.nix b/pkgs/by-name/re/redpanda-client/package.nix
index 734b4b93d1a3..10a3ca189e77 100644
--- a/pkgs/by-name/re/redpanda-client/package.nix
+++ b/pkgs/by-name/re/redpanda-client/package.nix
@@ -7,12 +7,12 @@
   stdenv,
 }:
 let
-  version = "24.3.6";
+  version = "24.3.7";
   src = fetchFromGitHub {
     owner = "redpanda-data";
     repo = "redpanda";
     rev = "v${version}";
-    sha256 = "sha256-OxaAWQKa1rmMf0F/Pu0ZH0DYG5UIEri/RBYJ4fEgkYI=";
+    sha256 = "sha256-2FpJMJau5rrKLUaW7nrE7pMf0zi2cW64+Hlk2lPvHxY=";
   };
 in
 buildGoModule rec {
@@ -20,7 +20,7 @@ buildGoModule rec {
   inherit doCheck src version;
   modRoot = "./src/go/rpk";
   runVend = false;
-  vendorHash = "sha256-VR8HvU8aPBWaKH+xjn+2CO794cipB7mOJCkXtGYGsdk=";
+  vendorHash = "sha256-MdfCc3XdoMv3nnyaCbqU7mwJSgtusw9wVWjYqqJJmHA=";
 
   ldflags = [
     ''-X "github.com/redpanda-data/redpanda/src/go/rpk/pkg/cli/cmd/version.version=${version}"''
diff --git a/pkgs/by-name/ty/typos/package.nix b/pkgs/by-name/ty/typos/package.nix
index 3ef7ed582a1e..5b4f8fa11d8c 100644
--- a/pkgs/by-name/ty/typos/package.nix
+++ b/pkgs/by-name/ty/typos/package.nix
@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "typos";
-  version = "1.30.0";
+  version = "1.30.2";
 
   src = fetchFromGitHub {
     owner = "crate-ci";
     repo = "typos";
     tag = "v${version}";
-    hash = "sha256-SFE6hieK2SU+Dmf0eDc35/INJKPoySUJBE9ES8KrCIg=";
+    hash = "sha256-Dayr+mskYmbLY0yE0OLreMjy8rbyoqY3rgREtaO3+D8=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Cnk/iLdkDyxoHU+vRxuLIyGkcqaGF8WjVOnhNoxg3T4=";
+  cargoHash = "sha256-K5ekHIfQQxjkydghoU/8pBnzt/q8hSrYFYf1c4GInBM=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/development/compilers/chicken/5/overrides.nix b/pkgs/development/compilers/chicken/5/overrides.nix
index 92b1104d9039..9f2570038e1f 100644
--- a/pkgs/development/compilers/chicken/5/overrides.nix
+++ b/pkgs/development/compilers/chicken/5/overrides.nix
@@ -146,7 +146,7 @@ in
   );
   openssl = addToBuildInputs pkgs.openssl;
   plot = addToBuildInputs pkgs.plotutils;
-  postgresql = addToBuildInputsWithPkgConfig pkgs.postgresql;
+  postgresql = addToBuildInputsWithPkgConfig pkgs.libpq;
   rocksdb = addToBuildInputs pkgs.rocksdb_8_3;
   scheme2c-compatibility = addPkgConfig;
   sdl-base =
diff --git a/pkgs/development/lisp-modules/ql.nix b/pkgs/development/lisp-modules/ql.nix
index 96baffcf3618..1080eb498a3c 100644
--- a/pkgs/development/lisp-modules/ql.nix
+++ b/pkgs/development/lisp-modules/ql.nix
@@ -59,7 +59,7 @@ let
       nativeLibs = [ pkgs.mariadb.client ];
     });
     clsql-postgresql = super.clsql-postgresql.overrideLispAttrs (o: {
-      nativeLibs = [ pkgs.postgresql.lib ];
+      nativeLibs = [ pkgs.libpq ];
     });
     clsql-sqlite3 = super.clsql-sqlite3.overrideLispAttrs (o: {
       nativeLibs = [ pkgs.sqlite ];
diff --git a/pkgs/development/python-modules/elasticsearch8/default.nix b/pkgs/development/python-modules/elasticsearch8/default.nix
index 7319090d0cd0..2e4deb6c103a 100644
--- a/pkgs/development/python-modules/elasticsearch8/default.nix
+++ b/pkgs/development/python-modules/elasticsearch8/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "elasticsearch8";
-  version = "8.17.1";
+  version = "8.17.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-u0FLfj2Dh2l5RiCPDwtuXnm88WXNAhI0sux+UgDTNpA=";
+    hash = "sha256-j6FaQWPFJ8kqoTwjIPyMDcOZBg8mOO0BbKCFn4ESCAM=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/pgsanity/default.nix b/pkgs/development/python-modules/pgsanity/default.nix
index 19c22876b93d..c9bb47e33d1e 100644
--- a/pkgs/development/python-modules/pgsanity/default.nix
+++ b/pkgs/development/python-modules/pgsanity/default.nix
@@ -2,7 +2,7 @@
   lib,
   fetchPypi,
   buildPythonPackage,
-  libpq,
+  postgresql,
   unittestCheckHook,
 }:
 
@@ -22,7 +22,10 @@ buildPythonPackage rec {
 
   unittestFlagsArray = [ "test" ];
 
-  propagatedBuildInputs = [ libpq ];
+  propagatedBuildInputs = [ postgresql ];
+
+  # To find "ecpg"
+  nativeBuildInputs = [ (lib.getDev postgresql) ];
 
   meta = with lib; {
     homepage = "https://github.com/markdrago/pgsanity";
diff --git a/pkgs/development/python-modules/primer3/default.nix b/pkgs/development/python-modules/primer3/default.nix
index bb4a9cf5d306..12fe9407cb73 100644
--- a/pkgs/development/python-modules/primer3/default.nix
+++ b/pkgs/development/python-modules/primer3/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "primer3";
-  version = "2.0.3";
+  version = "2.1.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -22,13 +22,12 @@ buildPythonPackage rec {
     owner = "libnano";
     repo = "primer3-py";
     tag = "v${version}";
-    hash = "sha256-O8BFjkjG9SfknSrK34s9EJnqTrtCf4zW9A+N+/MHl2w=";
+    hash = "sha256-Kp4JH57gEdj7SzY+7XGBzGloWuTSwUQRBK9QbgXQfUE=";
   };
 
-  nativeBuildInputs = [
-    cython
-    setuptools
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ gcc ];
+  build-system = [ setuptools ];
+
+  nativeBuildInputs = [ cython ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ gcc ];
 
   nativeCheckInputs = [
     click
@@ -48,8 +47,8 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Oligo analysis and primer design";
     homepage = "https://github.com/libnano/primer3-py";
-    changelog = "https://github.com/libnano/primer3-py/blob/v${version}/CHANGES";
-    license = with licenses; [ gpl2Only ];
+    changelog = "https://github.com/libnano/primer3-py/blob/${src.tag}/CHANGES";
+    license = licenses.gpl2Only;
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/unstructured-inference/default.nix b/pkgs/development/python-modules/unstructured-inference/default.nix
index d564aa2c6bec..8c515ef98abf 100644
--- a/pkgs/development/python-modules/unstructured-inference/default.nix
+++ b/pkgs/development/python-modules/unstructured-inference/default.nix
@@ -23,14 +23,14 @@
 
 buildPythonPackage rec {
   pname = "unstructured-inference";
-  version = "0.8.7";
+  version = "0.8.9";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "Unstructured-IO";
     repo = "unstructured-inference";
     tag = version;
-    hash = "sha256-uH7LDezHZrD1zeWMDzrZZALGf0oocIVZl68MactBFGQ=";
+    hash = "sha256-4wfZFu0551jbpeSYq6RHrDpThm+B2tygVwLlggPkbog=";
   };
 
   propagatedBuildInputs =
diff --git a/pkgs/development/python-modules/wandb/default.nix b/pkgs/development/python-modules/wandb/default.nix
index d724cc4afd6b..91f0c897aa6a 100644
--- a/pkgs/development/python-modules/wandb/default.nix
+++ b/pkgs/development/python-modules/wandb/default.nix
@@ -25,12 +25,14 @@
   platformdirs,
   protobuf,
   psutil,
+  pydantic,
   pyyaml,
   requests,
   sentry-sdk_2,
   setproctitle,
   setuptools,
   pythonOlder,
+  eval-type-backport,
   typing-extensions,
 
   # tests
@@ -56,7 +58,6 @@
   parameterized,
   pillow,
   plotly,
-  pydantic,
   pyfakefs,
   pyte,
   pytest-asyncio,
@@ -75,12 +76,12 @@
 }:
 
 let
-  version = "0.19.6";
+  version = "0.19.8";
   src = fetchFromGitHub {
     owner = "wandb";
     repo = "wandb";
     tag = "v${version}";
-    hash = "sha256-snyr0IlE4otk1ctWUrJEFAmHYsXe+k6qULCaO3aW0e4=";
+    hash = "sha256-hveMyGeu9RhdtWMbV/4GQ4KUNfjSt0CKyW7Yx8QtlLM=";
   };
 
   gpu-stats = rustPlatform.buildRustPackage {
@@ -184,6 +185,7 @@ buildPythonPackage rec {
       platformdirs
       protobuf
       psutil
+      pydantic
       pyyaml
       requests
       sentry-sdk_2
@@ -191,6 +193,9 @@ buildPythonPackage rec {
       # setuptools is necessary since pkg_resources is required at runtime.
       setuptools
     ]
+    ++ lib.optionals (pythonOlder "3.10") [
+      eval-type-backport
+    ]
     ++ lib.optionals (pythonOlder "3.12") [
       typing-extensions
     ];
@@ -220,7 +225,6 @@ buildPythonPackage rec {
     parameterized
     pillow
     plotly
-    pydantic
     pyfakefs
     pyte
     pytest-asyncio
diff --git a/pkgs/development/python-modules/weblate-language-data/default.nix b/pkgs/development/python-modules/weblate-language-data/default.nix
index b1301c6237be..bf8f780f29cc 100644
--- a/pkgs/development/python-modules/weblate-language-data/default.nix
+++ b/pkgs/development/python-modules/weblate-language-data/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "weblate-language-data";
-  version = "2025.2";
+  version = "2025.3";
   pyproject = true;
 
   src = fetchPypi {
     pname = "weblate_language_data";
     inherit version;
-    hash = "sha256-T3O107CQ01loE68vlQtcCjeytxCSiu0m5Oj5P06z2NU=";
+    hash = "sha256-1uZqqwJds+Q2yL2OP2dEEbp4sJmJN28gOYDDJ3fhBRA=";
   };
 
   build-system = [ setuptools ];
@@ -29,6 +29,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Language definitions used by Weblate";
     homepage = "https://github.com/WeblateOrg/language-data";
+    changelog = "https://github.com/WeblateOrg/language-data/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ erictapen ];
   };
diff --git a/pkgs/development/r-modules/default.nix b/pkgs/development/r-modules/default.nix
index 2322f0b02d23..34f38d1feba8 100644
--- a/pkgs/development/r-modules/default.nix
+++ b/pkgs/development/r-modules/default.nix
@@ -335,7 +335,6 @@ let
   };
 
   packagesWithNativeBuildInputs = {
-    adbcpostgresql = [ pkgs.postgresql ];
     adimpro = [ pkgs.imagemagick ];
     animation = [ pkgs.which ];
     Apollonius = with pkgs; [ pkg-config gmp.dev mpfr.dev ];
@@ -484,8 +483,7 @@ let
     RODBC = [ pkgs.libiodbc ];
     rpanel = [ pkgs.tclPackages.bwidget ];
     Rpoppler = [ pkgs.poppler ];
-    RPostgres = with pkgs; [ postgresql ];
-    RPostgreSQL = with pkgs; [ postgresql postgresql ];
+    RPostgreSQL = with pkgs; [ libpq ];
     RProtoBuf = [ pkgs.protobuf ];
     RSclient = [ pkgs.openssl.dev ];
     Rserve = [ pkgs.openssl ];
@@ -614,7 +612,7 @@ let
 
   packagesWithBuildInputs = {
     # sort -t '=' -k 2
-    adbcpostgresql = with pkgs; [ readline.dev zlib.dev openssl.dev libkrb5.dev openpam ];
+    adbcpostgresql = with pkgs; [ readline.dev zlib.dev openssl.dev libkrb5.dev openpam libpq ];
     asciicast = with pkgs; [ xz.dev bzip2.dev zlib.dev icu.dev libdeflate ];
     island = [ pkgs.gsl.dev ];
     svKomodo = [ pkgs.which ];
@@ -646,6 +644,7 @@ let
     RGtk2 = [ pkgs.pkg-config ];
     RProtoBuf = [ pkgs.pkg-config ];
     Rpoppler = [ pkgs.pkg-config ];
+    RPostgres = with pkgs; [ libpq ];
     XML = [ pkgs.pkg-config ];
     apsimx = [ pkgs.which ];
     cairoDevice = [ pkgs.pkg-config ];
@@ -1625,14 +1624,6 @@ let
       enableParallelBuilding = false;
     });
 
-    RPostgres = old.RPostgres.overrideAttrs (attrs: {
-      preConfigure = ''
-        export INCLUDE_DIR=${pkgs.postgresql}/include
-        export LIB_DIR=${pkgs.postgresql.lib}/lib
-        patchShebangs configure
-        '';
-    });
-
     OpenMx = old.OpenMx.overrideAttrs (attrs: {
       env = (attrs.env or { }) // {
         # needed to avoid "log limit exceeded" on Hydra
diff --git a/pkgs/development/tools/tora/default.nix b/pkgs/development/tools/tora/default.nix
index fde6ca673de1..88482eb91e3c 100644
--- a/pkgs/development/tools/tora/default.nix
+++ b/pkgs/development/tools/tora/default.nix
@@ -42,7 +42,7 @@ mkDerivation {
     loki
     libmysqlclient
     openssl
-    postgresql
+    postgresql # needs libecpg, which is not available in libpq package
     qscintilla
     qtbase
   ];
diff --git a/pkgs/kde/gear/akonadi/default.nix b/pkgs/kde/gear/akonadi/default.nix
index e54e8ae37e4c..6225b7e9cfda 100644
--- a/pkgs/kde/gear/akonadi/default.nix
+++ b/pkgs/kde/gear/akonadi/default.nix
@@ -7,7 +7,7 @@
   shared-mime-info,
   xz,
   mariadb,
-  postgresql,
+  libpq,
   sqlite,
   backend ? "mysql",
 }:
@@ -32,7 +32,7 @@ mkKdeDerivation {
       "-DMYSQLD_SCRIPTS_PATH=${lib.getBin mariadb}/bin"
     ]
     ++ lib.optionals (backend == "postgres") [
-      "-DPOSTGRES_PATH=${lib.getBin postgresql}/bin"
+      "-DPOSTGRES_PATH=${lib.getBin libpq}/bin"
     ];
 
   extraNativeBuildInputs = [
@@ -47,7 +47,7 @@ mkKdeDerivation {
       xz
     ]
     ++ lib.optionals (backend == "mysql") [ mariadb ]
-    ++ lib.optionals (backend == "postgres") [ postgresql ]
+    ++ lib.optionals (backend == "postgres") [ libpq ]
     ++ lib.optionals (backend == "sqlite") [ sqlite ];
 
   # Hardcoded as a QString, which is UTF-16 so Nix can't pick it up automatically
@@ -60,6 +60,6 @@ mkKdeDerivation {
       echo "${mariadb}" > $out/nix-support/depends
     ''
     + lib.optionalString (backend == "postgres") ''
-      echo "${postgresql}" > $out/nix-support/depends
+      echo "${libpq}" > $out/nix-support/depends
     '';
 }
diff --git a/pkgs/top-level/pkg-config/pkg-config-data.json b/pkgs/top-level/pkg-config/pkg-config-data.json
index 60981baa69cf..5705c8ad4c70 100644
--- a/pkgs/top-level/pkg-config/pkg-config-data.json
+++ b/pkgs/top-level/pkg-config/pkg-config-data.json
@@ -525,7 +525,7 @@
     },
     "libpq": {
       "attrPath": [
-        "postgresql"
+        "libpq"
       ]
     },
     "libpulse": {