diff --git a/nixos/modules/services/web-apps/freshrss.nix b/nixos/modules/services/web-apps/freshrss.nix
index 758807b3c9b8..2544bd846424 100644
--- a/nixos/modules/services/web-apps/freshrss.nix
+++ b/nixos/modules/services/web-apps/freshrss.nix
@@ -357,15 +357,15 @@ in
 
           script =
             let
+              isUserAuth = cfg.authType == "form" || cfg.authType == "none";
+
               userScriptArgs = ''--user ${cfg.defaultUser} ${
                 optionalString (cfg.authType == "form") ''--password "$(cat ${cfg.passwordFile})"''
               }'';
-              updateUserScript = optionalString (cfg.authType == "form" || cfg.authType == "none") ''
-                ./cli/update-user.php ${userScriptArgs}
-              '';
-              createUserScript = optionalString (cfg.authType == "form" || cfg.authType == "none") ''
-                ./cli/create-user.php ${userScriptArgs}
-              '';
+              mkUserScript = name: optionalString isUserAuth ''./cli/${name}.php ${userScriptArgs}'';
+
+              updateUserScript = mkUserScript "update-user";
+              createUserScript = mkUserScript "create-user";
             in
             ''
               # do installation or reconfigure
diff --git a/nixos/tests/freshrss/caddy-sqlite.nix b/nixos/tests/freshrss/caddy-sqlite.nix
index 3c2e60e5e3bb..ebee8a06446d 100644
--- a/nixos/tests/freshrss/caddy-sqlite.nix
+++ b/nixos/tests/freshrss/caddy-sqlite.nix
@@ -22,7 +22,7 @@
   testScript = ''
     machine.wait_for_unit("multi-user.target")
     machine.wait_for_open_port(80)
-    response = machine.succeed("curl -vvv -s -H 'Host: freshrss' http://localhost:80/i/")
+    response = machine.succeed("curl --fail-with-body --silent --header 'Host: freshrss' http://localhost:80/i/")
     assert '<title>Login · FreshRSS</title>' in response, "Login page didn't load successfully"
   '';
 }
diff --git a/nixos/tests/freshrss/extensions.nix b/nixos/tests/freshrss/extensions.nix
index bf624a6041b6..cbb033df4162 100644
--- a/nixos/tests/freshrss/extensions.nix
+++ b/nixos/tests/freshrss/extensions.nix
@@ -20,17 +20,18 @@
   ];
 
   testScript = ''
+    from lxml import etree
+
     machine.wait_for_unit("multi-user.target")
     machine.wait_for_open_port(80)
-    response = machine.succeed("curl -s http://localhost:80/i/?c=extension")
+    response = machine.succeed("curl --fail-with-body --silent http://localhost:80/i/?c=extension")
     assert '<span class="ext_name disabled">YouTube Video Feed</span>' in response, "Extension not present in extensions page."
 
     # enable Title-Wrap extension
-    from lxml import etree
     tree = etree.HTML(response)
     csrf = tree.xpath("/html/body/header/nav/form/input/@value")[0]
-    response = machine.succeed(f"curl --fail-with-body -s 'http://localhost:80/i/?c=extension&a=enable&e=Title-Wrap' -d '_csrf={csrf}'")
+    machine.succeed(f"curl --fail-with-body --silent 'http://localhost:80/i/?c=extension&a=enable&e=Title-Wrap' -d '_csrf={csrf}'")
     # verify that the Title-Wrap css is accessible.
-    machine.succeed("curl --fail-with-body -s 'http://localhost:80/ext.php?1=&f=xExtension-TitleWrap/static/title_wrap.css'")
+    machine.succeed("curl --fail-with-body --silent 'http://localhost:80/ext.php?1=&f=xExtension-TitleWrap/static/title_wrap.css'")
   '';
 }
diff --git a/nixos/tests/freshrss/http-auth.nix b/nixos/tests/freshrss/http-auth.nix
index 1f6fd1ad8e7d..c506e168bfd2 100644
--- a/nixos/tests/freshrss/http-auth.nix
+++ b/nixos/tests/freshrss/http-auth.nix
@@ -15,7 +15,7 @@
   testScript = ''
     machine.wait_for_unit("multi-user.target")
     machine.wait_for_open_port(80)
-    response = machine.succeed("curl -vvv -s -H 'Host: freshrss' -H 'Remote-User: testuser' http://localhost:80/i/")
+    response = machine.succeed("curl --fail-with-body --silent -H 'Remote-User: testuser' http://localhost:80/i/")
     assert 'Account: testuser' in response, "http_auth method didn't work."
   '';
 }
diff --git a/nixos/tests/freshrss/nginx-sqlite.nix b/nixos/tests/freshrss/nginx-sqlite.nix
index c8097465d8cd..9c025523ea6d 100644
--- a/nixos/tests/freshrss/nginx-sqlite.nix
+++ b/nixos/tests/freshrss/nginx-sqlite.nix
@@ -20,7 +20,7 @@
   testScript = ''
     machine.wait_for_unit("multi-user.target")
     machine.wait_for_open_port(80)
-    response = machine.succeed("curl -vvv -s -H 'Host: freshrss' http://localhost:80/i/")
+    response = machine.succeed("curl --fail-with-body --silent http://localhost:80/i/")
     assert '<title>Login · FreshRSS</title>' in response, "Login page didn't load successfully"
   '';
 }
diff --git a/nixos/tests/freshrss/none-auth.nix b/nixos/tests/freshrss/none-auth.nix
index 77d636f88071..b87da4522538 100644
--- a/nixos/tests/freshrss/none-auth.nix
+++ b/nixos/tests/freshrss/none-auth.nix
@@ -14,7 +14,7 @@
   testScript = ''
     machine.wait_for_unit("multi-user.target")
     machine.wait_for_open_port(80)
-    response = machine.succeed("curl -vvv -s http://localhost:80/i/")
+    response = machine.succeed("curl --fail-with-body --silent http://localhost:80/i/")
     assert '<title> · FreshRSS</title>' in response, "FreshRSS stream page didn't load successfully"
   '';
 }
diff --git a/nixos/tests/freshrss/pgsql.nix b/nixos/tests/freshrss/pgsql.nix
index 5fceb98b0efb..ec9864499fad 100644
--- a/nixos/tests/freshrss/pgsql.nix
+++ b/nixos/tests/freshrss/pgsql.nix
@@ -46,7 +46,7 @@
     machine.wait_for_unit("multi-user.target")
     machine.wait_for_open_port(5432)
     machine.wait_for_open_port(80)
-    response = machine.succeed("curl -vvv -s -H 'Host: freshrss' http://localhost:80/i/")
+    response = machine.succeed("curl --fail-with-body --silent http://localhost:80/i/")
     assert '<title>Login · FreshRSS</title>' in response, "Login page didn't load successfully"
   '';
 }
diff --git a/pkgs/servers/web-apps/freshrss/extensions/default.nix b/pkgs/servers/web-apps/freshrss/extensions/default.nix
index fc8176049fb8..8b3d2831e471 100644
--- a/pkgs/servers/web-apps/freshrss/extensions/default.nix
+++ b/pkgs/servers/web-apps/freshrss/extensions/default.nix
@@ -9,12 +9,12 @@
 let
   buildFreshRssExtension = (callPackage ./freshrss-utils.nix { }).buildFreshRssExtension;
 
-  official_extensions_version = "unstable-2024-04-27";
+  official_extensions_version = "unstable-2025-12-26";
   official_extensions_src = fetchFromGitHub {
     owner = "FreshRSS";
     repo = "Extensions";
-    rev = "71de129744ba37fd4cf363b78445f5345bc6d0b7";
-    hash = "sha256-A+hOjbGNfhwTOAMeo08MUdqfWxxetzLz865oQQDsQlg=";
+    rev = "42c32bfd9af2d816933cf310e24d25888a8e167d";
+    hash = "sha256-El488QK3xWQM01GsuyBizud6VghXsRDqiOblnMfjVxE=";
   };
 
   baseExtensions =
@@ -107,6 +107,20 @@ let
         };
       };
 
+      unsafe-auto-login = buildFreshRssExtension {
+        FreshRssExtUniqueId = "UnsafeAutologin";
+        pname = "unsafe-auto-login";
+        version = official_extensions_version;
+        src = official_extensions_src;
+        sourceRoot = "${official_extensions_src.name}/xExtension-UnsafeAutologin";
+        meta = {
+          description = "FreshRSS extension to bring back unsafe autologin functionality.";
+          homepage = "https://github.com/FreshRSS/Extensions/tree/master/xExtension-UnsafeAutologin";
+          license = lib.licenses.agpl3Only;
+          maintainers = [ lib.maintainers.stunkymonkey ];
+        };
+      };
+
       youtube = buildFreshRssExtension {
         FreshRssExtUniqueId = "YouTube";
         pname = "youtube";