diff --git a/doc/release-notes/rl-2611.section.md b/doc/release-notes/rl-2611.section.md
index 6aa19f0952b7..1df5e6b9a01c 100644
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -19,6 +19,12 @@
 
 - `uhttpmock` providing 0.0 ABI was removed. `uhttpmock_1_0` providing 1.0 ABI was renamed to `uhttpmock` and `uhttpmock_1_0` was kept as an alias.
 
+- The ARMv5 Linux kernel build now uses a standard configuration and generates a standard compressed image instead of the deprecated legacy U‐Boot image format.
+  `lib.systems.{examples,platforms}.{sheevaplug,pogoplug4}` have been unified into `lib.systems.examples.armv5tel-multiplatform`.
+  Note that there is no official support for ARMv5 and it is not possible to build even a simple NixOS configuration out of the box.
+
+- Support for the legacy U‐Boot image format has been removed from the Linux kernel builders, as it is deprecated upstream and no longer used by any platform in Nixpkgs.
+
 - `requireFile` now sets `meta.license = lib.licenses.unfree` by default. Users of `requireFile`-based derivations that preserve this default will need to explicitly allow their evaluation as described in [](#sec-allow-unfree).
 
 - `librest` providing 0.7 ABI was removed. `librest_1_0` providing 1.0 ABI was renamed to `librest` and `librest_1_0` was kept as an alias.
diff --git a/lib/systems/examples.nix b/lib/systems/examples.nix
index 18c954ffc06e..055f727d53c9 100644
--- a/lib/systems/examples.nix
+++ b/lib/systems/examples.nix
@@ -40,10 +40,9 @@ rec {
     rust.rustcTarget = "powerpc-unknown-linux-gnu";
   };
 
-  sheevaplug = {
+  armv5tel-multiplatform = {
     config = "armv5tel-unknown-linux-gnueabi";
-  }
-  // platforms.sheevaplug;
+  };
 
   raspberryPi = {
     config = "armv6l-unknown-linux-gnueabihf";
@@ -99,11 +98,6 @@ rec {
     useLLVM = true;
   };
 
-  pogoplug4 = {
-    config = "armv5tel-unknown-linux-gnueabi";
-  }
-  // platforms.pogoplug4;
-
   ben-nanonote = {
     config = "mipsel-unknown-linux-uclibc";
   }
diff --git a/lib/systems/platforms.nix b/lib/systems/platforms.nix
index ae78b4edc9d4..b10c787728a0 100644
--- a/lib/systems/platforms.nix
+++ b/lib/systems/platforms.nix
@@ -46,138 +46,15 @@ rec {
   ## ARM
   ##
 
-  pogoplug4 = {
+  armv5tel-multiplatform = {
     linux-kernel = {
-      name = "pogoplug4";
+      name = "armv5tel-multiplatform";
 
       baseConfig = "multi_v5_defconfig";
-      autoModules = false;
-      extraConfig = ''
-        # Ubi for the mtd
-        MTD_UBI y
-        UBIFS_FS y
-        UBIFS_FS_XATTR y
-        UBIFS_FS_ADVANCED_COMPR y
-        UBIFS_FS_LZO y
-        UBIFS_FS_ZLIB y
-        UBIFS_FS_DEBUG n
-      '';
-      makeFlags = [ "LOADADDR=0x8000" ];
-      target = "uImage";
-      # TODO reenable once manual-config's config actually builds a .dtb and this is checked to be working
-      #DTB = true;
-    };
-    gcc = {
-      arch = "armv5te";
-    };
-  };
-
-  sheevaplug = {
-    linux-kernel = {
-      name = "sheevaplug";
-
-      baseConfig = "multi_v5_defconfig";
-      autoModules = false;
-      extraConfig = ''
-        BLK_DEV_RAM y
-        BLK_DEV_INITRD y
-        BLK_DEV_CRYPTOLOOP m
-        BLK_DEV_DM m
-        DM_CRYPT m
-        MD y
-        BTRFS_FS m
-        XFS_FS m
-        JFS_FS m
-        EXT4_FS m
-        USB_STORAGE_CYPRESS_ATACB m
-
-        # mv cesa requires this sw fallback, for mv-sha1
-        CRYPTO_SHA1 y
-        # Fast crypto
-        CRYPTO_TWOFISH y
-        CRYPTO_TWOFISH_COMMON y
-        CRYPTO_BLOWFISH y
-        CRYPTO_BLOWFISH_COMMON y
-
-        IP_PNP y
-        IP_PNP_DHCP y
-        NFS_FS y
-        ROOT_NFS y
-        TUN m
-        NFS_V4 y
-        NFS_V4_1 y
-        NFS_FSCACHE y
-        NFSD m
-        NFSD_V2_ACL y
-        NFSD_V3 y
-        NFSD_V3_ACL y
-        NFSD_V4 y
-        NETFILTER y
-        IP_NF_IPTABLES y
-        IP_NF_FILTER y
-        IP_NF_MATCH_ADDRTYPE y
-        IP_NF_TARGET_LOG y
-        IP_NF_MANGLE y
-        IPV6 m
-        VLAN_8021Q m
-
-        CIFS y
-        CIFS_XATTR y
-        CIFS_POSIX y
-        CIFS_FSCACHE y
-        CIFS_ACL y
-
-        WATCHDOG y
-        WATCHDOG_CORE y
-        ORION_WATCHDOG m
-
-        ZRAM m
-        NETCONSOLE m
-
-        # Disable OABI to have seccomp_filter (required for systemd)
-        # https://github.com/raspberrypi/firmware/issues/651
-        OABI_COMPAT n
-
-        # Fail to build
-        DRM n
-        SCSI_ADVANSYS n
-        USB_ISP1362_HCD n
-        SND_SOC n
-        SND_ALI5451 n
-        FB_SAVAGE n
-        SCSI_NSP32 n
-        ATA_SFF n
-        SUNGEM n
-        IRDA n
-        ATM_HE n
-        SCSI_ACARD n
-        BLK_DEV_CMD640_ENHANCED n
-
-        FUSE_FS m
-
-        # systemd uses cgroups
-        CGROUPS y
-
-        # Latencytop
-        LATENCYTOP y
-
-        # Ubi for the mtd
-        MTD_UBI y
-        UBIFS_FS y
-        UBIFS_FS_XATTR y
-        UBIFS_FS_ADVANCED_COMPR y
-        UBIFS_FS_LZO y
-        UBIFS_FS_ZLIB y
-        UBIFS_FS_DEBUG n
-
-        # Kdb, for kernel troubles
-        KGDB y
-        KGDB_SERIAL_CONSOLE y
-        KGDB_KDB y
-      '';
-      makeFlags = [ "LOADADDR=0x0200000" ];
-      target = "uImage";
-      DTB = true; # Beyond 3.10
+      DTB = true;
+      autoModules = true;
+      preferBuiltin = true;
+      target = "zImage";
     };
     gcc = {
       arch = "armv5te";
@@ -192,11 +69,6 @@ rec {
       DTB = true;
       autoModules = true;
       preferBuiltin = true;
-      extraConfig = ''
-        # Disable OABI to have seccomp_filter (required for systemd)
-        # https://github.com/raspberrypi/firmware/issues/651
-        OABI_COMPAT n
-      '';
       target = "zImage";
     };
     gcc = {
@@ -217,15 +89,6 @@ rec {
   };
 
   zero-gravitas = {
-    linux-kernel = {
-      name = "zero-gravitas";
-
-      baseConfig = "zero-gravitas_defconfig";
-      # Target verified by checking /boot on reMarkable 1 device
-      target = "zImage";
-      autoModules = false;
-      DTB = true;
-    };
     gcc = {
       fpu = "neon";
       cpu = "cortex-a9";
@@ -233,15 +96,6 @@ rec {
   };
 
   zero-sugar = {
-    linux-kernel = {
-      name = "zero-sugar";
-
-      baseConfig = "zero-sugar_defconfig";
-      DTB = true;
-      autoModules = false;
-      preferBuiltin = true;
-      target = "zImage";
-    };
     gcc = {
       cpu = "cortex-a7";
       fpu = "neon-vfpv4";
@@ -249,49 +103,6 @@ rec {
     };
   };
 
-  utilite = {
-    linux-kernel = {
-      name = "utilite";
-      maseConfig = "multi_v7_defconfig";
-      autoModules = false;
-      extraConfig = ''
-        # Ubi for the mtd
-        MTD_UBI y
-        UBIFS_FS y
-        UBIFS_FS_XATTR y
-        UBIFS_FS_ADVANCED_COMPR y
-        UBIFS_FS_LZO y
-        UBIFS_FS_ZLIB y
-        UBIFS_FS_DEBUG n
-      '';
-      makeFlags = [ "LOADADDR=0x10800000" ];
-      target = "uImage";
-      DTB = true;
-    };
-    gcc = {
-      cpu = "cortex-a9";
-      fpu = "neon";
-    };
-  };
-
-  guruplug = lib.recursiveUpdate sheevaplug {
-    # Define `CONFIG_MACH_GURUPLUG' (see
-    # <http://kerneltrap.org/mailarchive/git-commits-head/2010/5/19/33618>)
-    # and other GuruPlug-specific things.  Requires the `guruplug-defconfig'
-    # patch.
-    linux-kernel.baseConfig = "guruplug_defconfig";
-  };
-
-  beaglebone = lib.recursiveUpdate armv7l-hf-multiplatform {
-    linux-kernel = {
-      name = "beaglebone";
-      baseConfig = "bb.org_defconfig";
-      autoModules = false;
-      extraConfig = ""; # TBD kernel config
-      target = "zImage";
-    };
-  };
-
   # https://developer.android.com/ndk/guides/abis#v7a
   armv7a-android = {
     linux-kernel.name = "armeabi-v7a";
@@ -305,32 +116,11 @@ rec {
   armv7l-hf-multiplatform = {
     linux-kernel = {
       name = "armv7l-hf-multiplatform";
-      Major = "2.6"; # Using "2.6" enables 2.6 kernel syscalls in glibc.
-      baseConfig = "multi_v7_defconfig";
+      baseConfig = "defconfig";
       DTB = true;
       autoModules = true;
       preferBuiltin = true;
       target = "zImage";
-      extraConfig = ''
-        # Serial port for Raspberry Pi 3. Wasn't included in ARMv7 defconfig
-        # until 4.17.
-        SERIAL_8250_BCM2835AUX y
-        SERIAL_8250_EXTENDED y
-        SERIAL_8250_SHARE_IRQ y
-
-        # Hangs ODROID-XU4
-        ARM_BIG_LITTLE_CPUIDLE n
-
-        # Disable OABI to have seccomp_filter (required for systemd)
-        # https://github.com/raspberrypi/firmware/issues/651
-        OABI_COMPAT n
-
-        # >=5.12 fails with:
-        # drivers/net/ethernet/micrel/ks8851_common.o: in function `ks8851_probe_common':
-        # ks8851_common.c:(.text+0x179c): undefined reference to `__this_module'
-        # See: https://lore.kernel.org/netdev/20210116164828.40545-1-marex@denx.de/T/
-        KS8851_MLL y
-      '';
     };
     gcc = {
       # Some table about fpu flags:
@@ -363,22 +153,6 @@ rec {
       autoModules = true;
       preferBuiltin = true;
       extraConfig = ''
-        # Raspberry Pi 3 stuff. Not needed for   s >= 4.10.
-        ARCH_BCM2835 y
-        BCM2835_MBOX y
-        BCM2835_WDT y
-        RASPBERRYPI_FIRMWARE y
-        RASPBERRYPI_POWER y
-        SERIAL_8250_BCM2835AUX y
-        SERIAL_8250_EXTENDED y
-        SERIAL_8250_SHARE_IRQ y
-
-        # Cavium ThunderX stuff.
-        PCI_HOST_THUNDER_ECAM y
-
-        # Nvidia Tegra stuff.
-        PCI_TEGRA y
-
         # The default (=y) forces us to have the XHCI firmware available in initrd,
         # which our initrd builder can't currently do easily.
         USB_XHCI_TEGRA m
@@ -412,74 +186,6 @@ rec {
   };
 
   fuloong2f_n32 = {
-    linux-kernel = {
-      name = "fuloong2f_n32";
-      baseConfig = "lemote2f_defconfig";
-      autoModules = false;
-      extraConfig = ''
-        MIGRATION n
-        COMPACTION n
-
-        # nixos mounts some cgroup
-        CGROUPS y
-
-        BLK_DEV_RAM y
-        BLK_DEV_INITRD y
-        BLK_DEV_CRYPTOLOOP m
-        BLK_DEV_DM m
-        DM_CRYPT m
-        MD y
-        EXT4_FS m
-        USB_STORAGE_CYPRESS_ATACB m
-
-        IP_PNP y
-        IP_PNP_DHCP y
-        IP_PNP_BOOTP y
-        NFS_FS y
-        ROOT_NFS y
-        TUN m
-        NFS_V4 y
-        NFS_V4_1 y
-        NFS_FSCACHE y
-        NFSD m
-        NFSD_V2_ACL y
-        NFSD_V3 y
-        NFSD_V3_ACL y
-        NFSD_V4 y
-
-        # Fail to build
-        DRM n
-        SCSI_ADVANSYS n
-        USB_ISP1362_HCD n
-        SND_SOC n
-        SND_ALI5451 n
-        FB_SAVAGE n
-        SCSI_NSP32 n
-        ATA_SFF n
-        SUNGEM n
-        IRDA n
-        ATM_HE n
-        SCSI_ACARD n
-        BLK_DEV_CMD640_ENHANCED n
-
-        FUSE_FS m
-
-        # Needed for udev >= 150
-        SYSFS_DEPRECATED_V2 n
-
-        VGA_CONSOLE n
-        VT_HW_CONSOLE_BINDING y
-        SERIAL_8250_CONSOLE y
-        FRAMEBUFFER_CONSOLE y
-        EXT2_FS y
-        EXT3_FS y
-        MAGIC_SYSRQ y
-
-        # The kernel doesn't boot at all, with FTRACE
-        FTRACE n
-      '';
-      target = "vmlinux";
-    };
     gcc = {
       arch = "loongson2f";
       float = "hard";
@@ -525,35 +231,6 @@ rec {
     };
   };
 
-  # based on:
-  #   https://www.mail-archive.com/qemu-discuss@nongnu.org/msg05179.html
-  #   https://gmplib.org/~tege/qemu.html#mips64-debian
-  mips64el-qemu-linux-gnuabi64 = {
-    linux-kernel = {
-      name = "mips64el";
-      baseConfig = "64r2el_defconfig";
-      target = "vmlinuz";
-      autoModules = false;
-      DTB = true;
-      # for qemu 9p passthrough filesystem
-      extraConfig = ''
-        MIPS_MALTA y
-        PAGE_SIZE_4KB y
-        CPU_LITTLE_ENDIAN y
-        CPU_MIPS64_R2 y
-        64BIT y
-        CPU_MIPS64_R2 y
-
-        NET_9P y
-        NET_9P_VIRTIO y
-        9P_FS y
-        9P_FS_POSIX_ACL y
-        PCI y
-        VIRTIO_PCI y
-      '';
-    };
-  };
-
   ##
   ## Other
   ##
@@ -607,7 +284,7 @@ rec {
       if version == null then
         pc
       else if lib.versionOlder version "6" then
-        sheevaplug
+        armv5tel-multiplatform
       else if lib.versionOlder version "7" then
         raspberrypi
       else
diff --git a/maintainers/github-teams.json b/maintainers/github-teams.json
index 6ef8ff8e70a9..baa4550e5f8a 100644
--- a/maintainers/github-teams.json
+++ b/maintainers/github-teams.json
@@ -935,6 +935,7 @@
       "infinisil": 20525370
     },
     "members": {
+      "andir": 638836,
       "pyrox0": 35778371
     },
     "name": "Security review"
diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index 798e204a578d..bb2058d6b4ac 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -18,10 +18,12 @@
 
 - `boot.vesa` has been removed. It was deprecated in 2020 because Xorg now works better with kernel modesetting. If you still need the legacy VESA 800x600 fallback, set `boot.kernelParams = [ "vga=0x317" "nomodeset" ];` directly.
 
+- Support for the legacy U‐Boot image format has been removed from the initrd generators, as it is deprecated upstream and no longer used by any platform in Nixpkgs.
+
 - Python 2 has been removed from the top-level package set, as it is long past end-of-life. The `python2`, `python27`, `python2Full`, `python27Full`, `python2Packages`, and `python27Packages` attributes, along with the legacy `python`, `pythonFull`, and `pythonPackages` aliases, now throw an error directing you to `python3`. The `isPy2` and `isPy27` package flags have been removed accordingly. The only remaining Python 2 interpreter is vendored inside the `resholve` package for its `oil` dependency and is not exposed for general use.
 
 ## Other Notable Changes {#sec-release-26.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- Create the first release note entry in this section!
+- The `newuidmap` and `newgidmap` security wrappers are now installed with `cap_setuid`/`cap_setgid` file capabilities instead of the setuid-root bit, matching shadow's `--with-fcaps` install mode and other major distributions. Rootless containers (podman, docker-rootless, unprivileged user namespaces) are unaffected. The only behavioural change is that mapping host uid 0 via `/etc/subuid` (which NixOS never configures by default) additionally requires `cap_setfcap`; users who explicitly grant uid 0 in a subuid range can restore the previous behaviour with `security.wrappers.newuidmap.capabilities = lib.mkForce "cap_setuid,cap_setfcap+ep";`.
diff --git a/nixos/lib/test-driver/src/test_driver/machine/__init__.py b/nixos/lib/test-driver/src/test_driver/machine/__init__.py
index 790da705cf4f..db96445af912 100644
--- a/nixos/lib/test-driver/src/test_driver/machine/__init__.py
+++ b/nixos/lib/test-driver/src/test_driver/machine/__init__.py
@@ -1031,6 +1031,7 @@ class QemuMachine(BaseMachine):
             As soon as we read some data from the socket here, we assume that
             our root shell is operational.
             """
+            assert self.shell
             (ready, _, _) = select.select([self.shell], [], [], timeout_secs)
             return bool(ready)
 
diff --git a/nixos/modules/config/fonts/packages.nix b/nixos/modules/config/fonts/packages.nix
index 0e4bf4a886a1..aca8a1af3ffc 100644
--- a/nixos/modules/config/fonts/packages.nix
+++ b/nixos/modules/config/fonts/packages.nix
@@ -47,6 +47,8 @@ in
         gyre-fonts # TrueType substitutes for standard PostScript fonts
         liberation_ttf
         unifont
+        noto-fonts-cjk-sans
+        noto-fonts-cjk-serif
         noto-fonts-color-emoji
       ]
     );
diff --git a/nixos/modules/installer/tools/tools.nix b/nixos/modules/installer/tools/tools.nix
index 54910897326f..af1c6be7021a 100644
--- a/nixos/modules/installer/tools/tools.nix
+++ b/nixos/modules/installer/tools/tools.nix
@@ -319,6 +319,27 @@ in
         name = "nixos-rebuild";
         package = config.system.build.nixos-rebuild;
       })
+      (
+        { config, ... }:
+        {
+          options.system.tools.nixos-rebuild.enableRun0Elevation = lib.mkEnableOption ''
+            support for being targeted by `nixos-rebuild --elevate=run0
+            --ask-elevate-password`.
+
+            This enables polkit and adds {command}`polkit-stdin-agent` to
+            {option}`environment.systemPackages` so that a deploying host
+            can find a target-architecture agent at
+            {file}`<toplevel>/sw/bin/polkit-stdin-agent` after copying the
+            closure (which is required for cross-architecture deploys and
+            mismatched nixpkgs revisions to work).
+          '';
+
+          config = lib.mkIf config.system.tools.nixos-rebuild.enableRun0Elevation {
+            security.polkit.enable = lib.mkDefault true;
+            environment.systemPackages = [ pkgs.polkit-stdin-agent ];
+          };
+        }
+      )
       (mkToolModule {
         name = "nixos-version";
         package = nixos-version;
diff --git a/nixos/modules/programs/shadow.nix b/nixos/modules/programs/shadow.nix
index d179283ac559..3c53531d90f7 100644
--- a/nixos/modules/programs/shadow.nix
+++ b/nixos/modules/programs/shadow.nix
@@ -267,13 +267,22 @@ in
             group = "root";
             inherit source;
           };
+          mkCapRoot = capabilities: source: {
+            inherit capabilities source;
+            owner = "root";
+            group = "root";
+          };
         in
         {
           su = mkSetuidRoot "${config.security.shadow.su.package}/bin/su";
           sg = mkSetuidRoot "${cfg.package.out}/bin/sg";
           newgrp = mkSetuidRoot "${cfg.package.out}/bin/newgrp";
-          newuidmap = mkSetuidRoot "${cfg.package.out}/bin/newuidmap";
-          newgidmap = mkSetuidRoot "${cfg.package.out}/bin/newgidmap";
+          # File capabilities instead of setuid root, mirroring shadow's
+          # own --with-fcaps install mode and what Arch/Fedora/Debian ship.
+          # The kernel only requires CAP_SETUID/CAP_SETGID over the parent
+          # userns to write a multi-line /proc/<pid>/[ug]id_map.
+          newuidmap = mkCapRoot "cap_setuid+ep" "${cfg.package.out}/bin/newuidmap";
+          newgidmap = mkCapRoot "cap_setgid+ep" "${cfg.package.out}/bin/newgidmap";
         }
         // lib.optionalAttrs config.users.mutableUsers {
           chsh = mkSetuidRoot "${cfg.package.out}/bin/chsh";
diff --git a/nixos/modules/security/pam_mount.nix b/nixos/modules/security/pam_mount.nix
index d6459c2598f9..e4714b6079d1 100644
--- a/nixos/modules/security/pam_mount.nix
+++ b/nixos/modules/security/pam_mount.nix
@@ -179,10 +179,10 @@ in
           }" />
           <!-- specify the binaries to be called -->
           <!-- the comma in front of the options is necessary for empty options -->
-          <fusemount>${pkgs.fuse}/bin/mount.fuse %(VOLUME) %(MNTPT) -o ,${
+          <fusemount>${pkgs.fuse3}/bin/mount.fuse3 %(VOLUME) %(MNTPT) -o ,${
             lib.concatStringsSep "," (cfg.fuseMountOptions ++ [ "%(OPTIONS)" ])
           }'</fusemount>
-          <fuseumount>${pkgs.fuse}/bin/fusermount -u %(MNTPT)</fuseumount>
+          <fuseumount>${pkgs.fuse3}/bin/fusermount3 -u %(MNTPT)</fuseumount>
           <!-- the comma in front of the options is necessary for empty options -->
           <cryptmount>${pkgs.pam_mount}/bin/mount.crypt -o ,${
             lib.concatStringsSep "," (cfg.cryptMountOptions ++ [ "%(OPTIONS)" ])
diff --git a/nixos/modules/system/activation/activation-script.nix b/nixos/modules/system/activation/activation-script.nix
index 8fd274276a61..338fc1911c01 100644
--- a/nixos/modules/system/activation/activation-script.nix
+++ b/nixos/modules/system/activation/activation-script.nix
@@ -322,6 +322,9 @@ in
         description = "Run user-specific NixOS activation";
         script = config.system.userActivationScripts.script;
         unitConfig.ConditionUser = "!@system";
+        # switch-to-configuration restarts this explicitly on every switch.
+        restartIfChanged = false;
+        serviceConfig.RemainAfterExit = true;
         serviceConfig.Type = "oneshot";
         wantedBy = [ "default.target" ];
       };
diff --git a/nixos/modules/virtualisation/lxcfs.nix b/nixos/modules/virtualisation/lxcfs.nix
index 711bcf655d22..999ebb53d7d4 100644
--- a/nixos/modules/virtualisation/lxcfs.nix
+++ b/nixos/modules/virtualisation/lxcfs.nix
@@ -41,7 +41,7 @@ in
       serviceConfig = {
         ExecStartPre = "${pkgs.coreutils}/bin/mkdir -p /var/lib/lxcfs";
         ExecStart = "${pkgs.lxcfs}/bin/lxcfs /var/lib/lxcfs";
-        ExecStopPost = "-${pkgs.fuse}/bin/fusermount -u /var/lib/lxcfs";
+        ExecStopPost = "-${pkgs.fuse3}/bin/fusermount3 -u /var/lib/lxcfs";
         KillMode = "process";
         Restart = "on-failure";
       };
diff --git a/nixos/modules/virtualisation/nspawn-container/run-nspawn/package.nix b/nixos/modules/virtualisation/nspawn-container/run-nspawn/package.nix
index 4f7a0e68748b..9177cd54825d 100644
--- a/nixos/modules/virtualisation/nspawn-container/run-nspawn/package.nix
+++ b/nixos/modules/virtualisation/nspawn-container/run-nspawn/package.nix
@@ -3,10 +3,10 @@
   e2fsprogs,
   iproute2,
   lib,
-  mypy,
   ruff,
   setuptools,
   systemd,
+  ty,
 }:
 
 buildPythonApplication {
@@ -35,13 +35,13 @@ buildPythonApplication {
   doCheck = true;
 
   nativeCheckInputs = [
-    mypy
     ruff
+    ty
   ];
 
   checkPhase = ''
-    echo -e "\x1b[32m## run mypy\x1b[0m"
-    mypy run_nspawn
+    echo -e "\x1b[32m## run ty\x1b[0m"
+    ty check --error-on-warning run_nspawn
     echo -e "\x1b[32m## run ruff check\x1b[0m"
     ruff check .
     echo -e "\x1b[32m## run ruff format\x1b[0m"
diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix
index 01d0c6cca8c8..4fe5ed1e56c0 100644
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -551,7 +551,7 @@ in
         y = 768;
       };
       description = ''
-        The resolution of the virtual machine display.
+        The resolution of the virtual machine display (relevant only if virtualised machine uses grub bootloader).
       '';
     };
 
@@ -1379,7 +1379,6 @@ in
         "-device usb-tablet,bus=usb-bus.0"
       ])
       (mkIf pkgs.stdenv.hostPlatform.isAarch [
-        "-device virtio-gpu-pci"
         "-device usb-ehci,id=usb0"
         "-device usb-kbd"
         "-device usb-tablet"
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index aaff787d6c4a..a4c63fcbc368 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -674,6 +674,7 @@ in
   gobgpd = runTest ./gobgpd.nix;
   gocd-agent = runTest ./gocd-agent.nix;
   gocd-server = runTest ./gocd-server.nix;
+  gocryptfs = runTest ./gocryptfs.nix;
   gokapi = runTest ./gokapi.nix;
   gollum = runTest ./gollum.nix;
   gonic = runTest ./gonic.nix;
diff --git a/nixos/tests/gocryptfs.nix b/nixos/tests/gocryptfs.nix
new file mode 100644
index 000000000000..7474bdd56f23
--- /dev/null
+++ b/nixos/tests/gocryptfs.nix
@@ -0,0 +1,57 @@
+{
+  name = "gocryptfs";
+  meta = {
+    maintainers = [ ];
+  };
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+
+      environment.systemPackages = [
+        pkgs.gocryptfs
+        pkgs.openssl
+      ];
+
+      specialisation.fstab-test.configuration = {
+        fileSystems."/plain" = {
+          device = "/encrypted";
+          fsType = "fuse.gocryptfs";
+          options = [
+            "nofail"
+            "allow_other"
+            "passfile=/tmp/password.txt"
+          ];
+        };
+      };
+    };
+
+  testScript = ''
+
+    # Generate a password
+    machine.execute("openssl rand -base64 32 > /tmp/password.txt")
+
+    # Initialize an encrypted vault
+    machine.execute("mkdir -p /encrypted /plain")
+    machine.execute("gocryptfs -init /encrypted  -passfile /password.txt -quiet")
+
+    # Open and mount vault
+    machine.execute("gocryptfs /encrypted /plain  -passfile /tmp/password.txt -quiet")
+
+    machine.execute("echo test > /plain/data.txt")
+    machine.execute("echo test > /tmp/data.txt")
+
+    # Unmount
+    machine.execute("fusermount -u /plain")
+
+    # Switch to the specialisation
+    machine.succeed("/run/current-system/specialisation/fstab-test/bin/switch-to-configuration test")
+
+    # Wait for mount
+    machine.wait_for_unit("local-fs.target")
+
+    # Check data
+    machine.succeed("diff /plain/data.txt /tmp/data.txt")
+
+  '';
+}
diff --git a/nixos/tests/nixos-rebuild-target-host.nix b/nixos/tests/nixos-rebuild-target-host.nix
index c37c4ce2ee76..ae872a205a0e 100644
--- a/nixos/tests/nixos-rebuild-target-host.nix
+++ b/nixos/tests/nixos-rebuild-target-host.nix
@@ -22,6 +22,8 @@
         };
 
         system.includeBuildDependencies = true;
+        # Needed so the offline build of the target config succeeds.
+        system.extraDependencies = [ pkgs.polkit-stdin-agent ];
 
         virtualisation = {
           cores = 2;
@@ -49,6 +51,11 @@
           users.users.alice.extraGroups = [ "wheel" ];
           users.users.bob.extraGroups = [ "wheel" ];
 
+          # Needed for --elevate=run0. NixOS's default polkit admin rule is
+          # `unix-group:wheel`, so bob (in wheel) can authenticate with his
+          # own password via polkit-stdin-agent.
+          system.tools.nixos-rebuild.enableRun0Elevation = true;
+
           # Disable sudo for root to ensure sudo isn't called without `--sudo`
           security.sudo.extraRules = lib.mkForce [
             {
@@ -142,6 +149,7 @@
       deployer.copy_from_host("${configFile "config-1-deployed"}", "/root/configuration-1.nix")
       deployer.copy_from_host("${configFile "config-2-deployed"}", "/root/configuration-2.nix")
       deployer.copy_from_host("${configFile "config-3-deployed"}", "/root/configuration-3.nix")
+      deployer.copy_from_host("${configFile "config-4-deployed"}", "/root/configuration-4.nix")
       deployer.copy_from_host("${targetNetworkJSON}", "/root/target-network.json")
       deployer.copy_from_host("${targetConfigJSON}", "/root/target-configuration.json")
 
@@ -168,6 +176,20 @@
         target_hostname = deployer.succeed("ssh alice@target cat /etc/hostname").rstrip()
         assert target_hostname == "config-3-deployed", f"{target_hostname=}"
 
+      with subtest("Deploy to bob@target with run0 and password"):
+        # polkit-stdin-agent registers an agent for systemd-run on the
+        # target and answers the PAM conversation with the password we
+        # supply locally. The agent is resolved on the target from
+        # <toplevel>/sw/bin (see Run0Elevator._remote_agent_argv).
+        deployer.send_chars("nixos-rebuild switch -I nixos-config=/root/configuration-4.nix --target-host bob@target --elevate=run0 --ask-elevate-password\n")
+        deployer.wait_until_tty_matches("1", "\\[run0\\] password for bob@target")
+        deployer.send_chars("${nodes.target.users.users.bob.password}\n")
+        deployer.wait_until_tty_matches("1", "Done. The new configuration is /nix/store/.*config-4-deployed")
+        target_hostname = deployer.succeed("ssh alice@target cat /etc/hostname").rstrip()
+        assert target_hostname == "config-4-deployed", f"{target_hostname=}"
+        # The target-arch agent is reachable at the stable sw/bin path.
+        target.succeed("test -x /run/current-system/sw/bin/polkit-stdin-agent")
+
       with subtest("Deploy works with very long TMPDIR"):
         tmp_dir = "/var/folder/veryveryveryveryverylongpathnamethatdoesnotworkwithcontrolpath"
         deployer.succeed(f"mkdir -p {tmp_dir}")
diff --git a/nixos/tests/switch-test.nix b/nixos/tests/switch-test.nix
index 480d284ada1d..256c25108593 100644
--- a/nixos/tests/switch-test.nix
+++ b/nixos/tests/switch-test.nix
@@ -739,6 +739,22 @@ in
             '';
           };
 
+          # As above, but with reloadIfChanged: pass 2 must reload, not
+          # restart.
+          userServiceMigratedToNixosReloadOnly.configuration = {
+            imports = [ userServiceMigratedToNixosNoStop.configuration ];
+            systemd.user.services.migrated = {
+              reloadIfChanged = true;
+              serviceConfig.ExecReload = "${pkgs.coreutils}/bin/true";
+            };
+          };
+
+          # As above, but with restartIfChanged = false: pass 2 must skip it.
+          userServiceMigratedToNixosNoRestart.configuration = {
+            imports = [ userServiceMigratedToNixosNoStop.configuration ];
+            systemd.user.services.migrated.restartIfChanged = false;
+          };
+
           no_inhibitors.configuration.system.switch.inhibitors = lib.mkForce { };
 
           inhibitors.configuration.system.switch.inhibitors = lib.mkForce {
@@ -810,6 +826,15 @@ in
         RemainAfterExit=true
         ExecStart=${pkgs.runtimeShell} -c 'echo home > %t/migrated-owner'
       '';
+
+      # Unit file placed in ~/.local/share/systemd/user (lower priority than
+      # /etc) to simulate a package-shipped unit.
+      dataMigratedUnit = pkgs.writeText "migrated.service" ''
+        [Service]
+        Type=oneshot
+        RemainAfterExit=true
+        ExecStart=${pkgs.runtimeShell} -c 'echo data > %t/migrated-owner'
+      '';
     in
     # python
     ''
@@ -1729,9 +1754,10 @@ in
           out = switch_to_specialisation("${machine}", "simpleUserService")
           user_systemctl("is-active usertest.service")
 
-          # No-op switch does nothing
+          # No-op switch leaves the test unit alone.
           out = switch_to_specialisation("${machine}", "simpleUserService")
-          assert_lacks(out, "user units:")
+          assert_lacks(out, "usertest.service")
+          assert_contains(out, "restarting the following user units: nixos-activation.service")
 
           # Modifying the unit stop-starts it (default stopIfChanged=true)
           out = switch_to_specialisation("${machine}", "simpleUserServiceModified")
@@ -1748,7 +1774,7 @@ in
           # reloadIfChanged=true reloads instead
           out = switch_to_specialisation("${machine}", "simpleUserServiceReload")
           assert_lacks(out, "stopping the following user units:")
-          assert_lacks(out, "restarting the following user units:")
+          assert_lacks(out, "restarting the following user units: usertest.service")
           assert_contains(out, "reloading the following user units: usertest.service")
           user_systemctl("is-active usertest.service")
 
@@ -1818,6 +1844,59 @@ in
           out = machine.succeed(f"sudo -u usertest {user_env} cat /run/user/1001/migrated-owner")
           assert_contains(out, "nixos")
 
+          # Pass 2 must honour reloadIfChanged.
+          switch_to_specialisation("${machine}", "")
+          machine.fail(f"sudo -u usertest {user_env} systemctl --user is-active migrated.service")
+          seed_home_unit()
+          out = switch_to_specialisation("${machine}", "userServiceMigratedToNixosReloadOnly")
+          assert_lacks(out, "restarting (post-activation) the following user units: migrated.service")
+          assert_contains(out, "reloading (post-activation) the following user units: migrated.service")
+          user_systemctl("is-active migrated.service")
+          # Reloaded only, so the home ExecStart never re-ran.
+          out = machine.succeed(f"sudo -u usertest {user_env} cat /run/user/1001/migrated-owner")
+          assert_contains(out, "home")
+
+          # Pass 2 must honour restartIfChanged = false.
+          switch_to_specialisation("${machine}", "")
+          machine.fail(f"sudo -u usertest {user_env} systemctl --user is-active migrated.service")
+          seed_home_unit()
+          out = switch_to_specialisation("${machine}", "userServiceMigratedToNixosNoRestart")
+          assert_lacks(out, "\nrestarting (post-activation) the following user units: migrated.service")
+          assert_contains(out, "NOT restarting (post-activation) the following user units: migrated.service")
+          user_systemctl("is-active migrated.service")
+          out = machine.succeed(f"sudo -u usertest {user_env} cat /run/user/1001/migrated-owner")
+          assert_contains(out, "home")
+
+          # Migration from a lower-priority search-path entry ($XDG_DATA_HOME
+          # here, standing in for ~/.nix-profile/share etc.). /etc outranks
+          # these, so pass 2 must restart onto the /etc definition.
+          switch_to_specialisation("${machine}", "")
+          machine.fail(f"sudo -u usertest {user_env} systemctl --user is-active migrated.service")
+          machine.succeed(
+              "sudo -u usertest mkdir -p ~usertest/.local/share/systemd/user",
+              "sudo -u usertest cp ${dataMigratedUnit} ~usertest/.local/share/systemd/user/migrated.service",
+          )
+          user_systemctl("daemon-reload")
+          user_systemctl("start migrated.service")
+          user_systemctl("is-active migrated.service")
+          out = machine.succeed(f"sudo -u usertest {user_env} cat /run/user/1001/migrated-owner")
+          assert_contains(out, "data")
+          out = user_systemctl("show -p FragmentPath migrated.service")
+          assert_contains(out, "/.local/share/systemd/user/migrated.service")
+          out = switch_to_specialisation("${machine}", "userServiceMigratedShadowed")
+          assert_contains(out, "restarting (post-activation) the following user units: migrated.service")
+          user_systemctl("is-active migrated.service")
+          out = user_systemctl("show -p FragmentPath migrated.service")
+          assert_contains(out, "/etc/systemd/user/migrated.service")
+          out = machine.succeed(f"sudo -u usertest {user_env} cat /run/user/1001/migrated-owner")
+          assert_contains(out, "nixos")
+          # Switching again must NOT touch it: /etc already had it, so it is
+          # not a candidate even though the lower-priority copy is still there.
+          out = switch_to_specialisation("${machine}", "userServiceMigratedShadowed")
+          assert_lacks(out, "migrated.service")
+          machine.succeed("sudo -u usertest rm -rf ~usertest/.local/share/systemd")
+          user_systemctl("daemon-reload")
+
           # Units that remain shadowed by ~/.config must be left alone in both
           # passes even though /etc now also defines them.
           switch_to_specialisation("${machine}", "")
diff --git a/nixos/tests/user-activation-scripts.nix b/nixos/tests/user-activation-scripts.nix
index e8ea2d05c465..f43332af033f 100644
--- a/nixos/tests/user-activation-scripts.nix
+++ b/nixos/tests/user-activation-scripts.nix
@@ -13,12 +13,14 @@
       isNormalUser = true;
     };
     systemd.user.tmpfiles.users.alice.rules = [ "r %h/file-to-remove" ];
+    specialisation.changed.configuration.system.userActivationScripts.bar = "true";
   };
 
   testScript = ''
     def verify_user_activation_run_count(n):
-        machine.succeed(
-            '[[ "$(find /home/alice/ -name user-activation-ran.\\* | wc -l)" == %s ]]' % n
+        t.assertEqual(
+            n,
+            int(machine.succeed('find /home/alice/ -name user-activation-ran.\\* | wc -l').rstrip())
         )
 
 
@@ -36,5 +38,12 @@
     machine.succeed("/run/current-system/bin/switch-to-configuration test")
     verify_user_activation_run_count(2)
     machine.succeed("[[ ! -f /home/alice/file-to-remove ]] || false")
+    # Activation must not be killed while running.
+    machine.fail("journalctl -b _SYSTEMD_USER_UNIT=nixos-activation.service | grep -q 'code=killed'")
+
+    # Changed activation script: still exactly one run.
+    machine.succeed("/run/current-system/specialisation/changed/bin/switch-to-configuration test")
+    verify_user_activation_run_count(3)
+    machine.fail("journalctl -b _SYSTEMD_USER_UNIT=nixos-activation.service | grep -q 'code=killed'")
   '';
 }
diff --git a/pkgs/applications/audio/mopidy/soundcloud.nix b/pkgs/applications/audio/mopidy/soundcloud.nix
index edd172d40d16..24fb170ecb4c 100644
--- a/pkgs/applications/audio/mopidy/soundcloud.nix
+++ b/pkgs/applications/audio/mopidy/soundcloud.nix
@@ -32,6 +32,7 @@ pythonPackages.buildPythonApplication (finalAttrs: {
 
   meta = {
     description = "Mopidy extension for playing music from SoundCloud";
+    homepage = "https://github.com/mopidy/mopidy-soundcloud";
     license = lib.licenses.mit;
     maintainers = [ ];
   };
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 2c8ffe8940b0..e6fa410221a4 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1145,8 +1145,8 @@ let
         mktplcRef = {
           name = "vscode-database-client2";
           publisher = "cweijan";
-          version = "8.4.6";
-          hash = "sha256-GBz0hS75VgfuGuHY/K/VHxp5sFptUCJaz/CXrm6wFPc=";
+          version = "8.4.7";
+          hash = "sha256-HiyLNVtdJgzwn6BSR4ojHOkLrQ49PhRQa4twst69j7Q=";
         };
         meta = {
           description = "Database Client For Visual Studio Code";
@@ -1760,8 +1760,8 @@ let
         mktplcRef = {
           name = "foam-vscode";
           publisher = "foam";
-          version = "0.40.4";
-          hash = "sha256-WqFIWt3c3XtdsXys+V4tQWxzDMefYOQ88MzTSPDHOKE=";
+          version = "0.42.0";
+          hash = "sha256-mk4ZgaBxLFPvrm3EU+hdidorhdWp7EGfRP0e/kARd1A=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/foam.foam-vscode/changelog";
diff --git a/pkgs/applications/editors/vscode/extensions/detachhead.basedpyright/default.nix b/pkgs/applications/editors/vscode/extensions/detachhead.basedpyright/default.nix
index 68f9f7bbe333..f21f58fc6b29 100644
--- a/pkgs/applications/editors/vscode/extensions/detachhead.basedpyright/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/detachhead.basedpyright/default.nix
@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "basedpyright";
     publisher = "detachhead";
-    version = "1.39.3";
-    hash = "sha256-uuWkSxjsY7ZL1QUwqkiwPTN8oGUktfm7/Hgv3Enmgqc=";
+    version = "1.39.6";
+    hash = "sha256-shxV0g1XDu7qjrGiwyHGpY2qBCJt23tz7SuDbm5AXws=";
   };
   meta = {
     changelog = "https://github.com/detachhead/basedpyright/releases";
diff --git a/pkgs/applications/editors/vscode/extensions/fstarlang.fstar-vscode-assistant/default.nix b/pkgs/applications/editors/vscode/extensions/fstarlang.fstar-vscode-assistant/default.nix
index 02df798f5c49..55f7767f06b4 100644
--- a/pkgs/applications/editors/vscode/extensions/fstarlang.fstar-vscode-assistant/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/fstarlang.fstar-vscode-assistant/default.nix
@@ -4,8 +4,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "fstar-vscode-assistant";
     publisher = "FStarLang";
-    version = "0.24.0";
-    hash = "sha256-2XFisNp/TvkBNytzs56kdMnaZTX6f1qWp1k59uLwcuE=";
+    version = "0.25.0";
+    hash = "sha256-sya3P9Kn3DM/z5p8xF6TLEUPgrCs5+jgD89Y1KSJAgY=";
   };
   meta = {
     description = "Interactive editing mode VS Code extension for F*";
diff --git a/pkgs/applications/editors/vscode/extensions/ms-python.mypy-type-checker/default.nix b/pkgs/applications/editors/vscode/extensions/ms-python.mypy-type-checker/default.nix
index 5daf4054b0ea..18b76d350a86 100644
--- a/pkgs/applications/editors/vscode/extensions/ms-python.mypy-type-checker/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-python.mypy-type-checker/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "ms-python";
     name = "mypy-type-checker";
-    version = "2026.4.0";
-    hash = "sha256-N0zml16XSBwjGHzCR1L0W9WiSgqD/375VIQGpGfCkFE=";
+    version = "2026.6.0";
+    hash = "sha256-Sis9Tm5uWTyAIJnHvdh/dwOs580YprqDQ3XP8FhWvw0=";
   };
 
   meta = {
diff --git a/pkgs/applications/emulators/cdemu/vhba.nix b/pkgs/applications/emulators/cdemu/vhba.nix
index e0e836f2c08f..844c56088162 100644
--- a/pkgs/applications/emulators/cdemu/vhba.nix
+++ b/pkgs/applications/emulators/cdemu/vhba.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vhba";
-  version = "20250329";
+  version = "20260313";
 
   src = fetchurl {
     url = "mirror://sourceforge/cdemu/vhba-module-${finalAttrs.version}.tar.xz";
-    hash = "sha256-piog1yDd8M/lpTIo9FE9SY2JwurZ6a8LG2lZ/4EmB14=";
+    hash = "sha256-KTADv12dwrOG2w0F9ZXFVINVpTXW38Bv03n9mLsZAXQ=";
   };
 
   makeFlags = kernelModuleMakeFlags ++ [
diff --git a/pkgs/applications/emulators/libretro/cores/yabause.nix b/pkgs/applications/emulators/libretro/cores/yabause.nix
index 611196f73712..df0e6ae2a15e 100644
--- a/pkgs/applications/emulators/libretro/cores/yabause.nix
+++ b/pkgs/applications/emulators/libretro/cores/yabause.nix
@@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
   core = "yabause";
-  version = "0-unstable-2026-04-20";
+  version = "0-unstable-2026-05-30";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "yabause";
-    rev = "7cb15b8f9eea5a6fa7cae34468a6989522bcba75";
-    hash = "sha256-UWZgt0vdjncM7JCzdSWa4XZMJBJ/pnk4QpSKz459Fq0=";
+    rev = "8926b0c6c347f8c5c755911ddb0ac695420ffbf8";
+    hash = "sha256-6MTUq1p3PWNwPqFmLu21BVOrHBl1koEQ98d9+B8qYq8=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/graphics/gimp/plugins/default.nix b/pkgs/applications/graphics/gimp/plugins/default.nix
index aa2a2e442fd7..cdbac84aaf3d 100644
--- a/pkgs/applications/graphics/gimp/plugins/default.nix
+++ b/pkgs/applications/graphics/gimp/plugins/default.nix
@@ -264,6 +264,7 @@ lib.makeScope pkgs.newScope (
 
       meta = {
         broken = gimp.apiVersion != "2.0";
+        homepage = "https://github.com/lmanul/gimp-texturize";
       };
     };
 
@@ -321,6 +322,7 @@ lib.makeScope pkgs.newScope (
 
       meta = {
         broken = gimp.apiVersion != "2.0";
+        homepage = "https://github.com/carlobaldassi/gimp-lqr-plugin";
       };
     };
 
diff --git a/pkgs/applications/misc/ape/clex.nix b/pkgs/applications/misc/ape/clex.nix
index dc199c9b81e8..b8ecc586be7c 100644
--- a/pkgs/applications/misc/ape/clex.nix
+++ b/pkgs/applications/misc/ape/clex.nix
@@ -22,6 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Large lexicon for APE (~100,000 entries)";
+    homepage = "https://github.com/Attempto/Clex";
     license = lib.licenses.gpl3;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ yrashk ];
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 7a1371da42e1..3ee9ec16f3af 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -535,11 +535,11 @@
     "vendorHash": null
   },
   "hashicorp_azurerm": {
-    "hash": "sha256-1WglgZrVUQXMLI/01QxhJ19Nv5+SdR3eEjOJ3PKEwCI=",
+    "hash": "sha256-DR68u61zP/eyllRkwNqKSXktAKjJJ0psXd9WWa2zA20=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/azurerm",
     "owner": "hashicorp",
     "repo": "terraform-provider-azurerm",
-    "rev": "v4.73.0",
+    "rev": "v4.75.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
diff --git a/pkgs/applications/networking/irc/weechat/scripts/edit/default.nix b/pkgs/applications/networking/irc/weechat/scripts/edit/default.nix
index 983f635010fb..fb2dfe072ef6 100644
--- a/pkgs/applications/networking/irc/weechat/scripts/edit/default.nix
+++ b/pkgs/applications/networking/irc/weechat/scripts/edit/default.nix
@@ -29,6 +29,7 @@ stdenv.mkDerivation rec {
   meta = {
     inherit (weechat.meta) platforms;
     description = "This simple weechat plugin allows you to compose messages in your $EDITOR";
+    homepage = "https://github.com/keith/edit-weechat";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ eraserhd ];
   };
diff --git a/pkgs/applications/version-management/monotone/default.nix b/pkgs/applications/version-management/monotone/default.nix
index d72a5d37a394..0bc7b6a2044e 100644
--- a/pkgs/applications/version-management/monotone/default.nix
+++ b/pkgs/applications/version-management/monotone/default.nix
@@ -109,6 +109,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Free distributed version control system";
+    homepage = "https://github.com/7c6f434c/monotone-mirror";
     maintainers = [ lib.maintainers.raskin ];
     platforms = lib.platforms.unix;
     license = lib.licenses.gpl2Plus;
diff --git a/pkgs/applications/video/kodi/addons/bluetooth-manager/default.nix b/pkgs/applications/video/kodi/addons/bluetooth-manager/default.nix
index bbfd17ead73e..7a55e140ebe8 100644
--- a/pkgs/applications/video/kodi/addons/bluetooth-manager/default.nix
+++ b/pkgs/applications/video/kodi/addons/bluetooth-manager/default.nix
@@ -17,6 +17,7 @@ buildKodiAddon rec {
 
   meta = {
     description = "Addon that allows to manage bluetooth devices from within a Linux based Kodi";
+    homepage = "https://github.com/wastis/BluetoothManager";
     platforms = lib.platforms.all;
     maintainers = lib.teams.kodi.members;
     license = lib.licenses.gpl3Plus;
diff --git a/pkgs/applications/video/kodi/addons/joystick/default.nix b/pkgs/applications/video/kodi/addons/joystick/default.nix
index 4fbe911df2c5..7397ec97f395 100644
--- a/pkgs/applications/video/kodi/addons/joystick/default.nix
+++ b/pkgs/applications/video/kodi/addons/joystick/default.nix
@@ -25,6 +25,7 @@ buildKodiBinaryAddon rec {
 
   meta = {
     description = "Binary addon for raw joystick input";
+    homepage = "https://github.com/xbmc/peripheral.joystick";
     platforms = lib.platforms.all;
     license = lib.licenses.gpl2Only;
     teams = [ lib.teams.kodi ];
diff --git a/pkgs/applications/video/kodi/addons/kodi-platform/default.nix b/pkgs/applications/video/kodi/addons/kodi-platform/default.nix
index 7bf24912818a..21fa17f4b45a 100644
--- a/pkgs/applications/video/kodi/addons/kodi-platform/default.nix
+++ b/pkgs/applications/video/kodi/addons/kodi-platform/default.nix
@@ -26,6 +26,7 @@ stdenv.mkDerivation rec {
   ];
 
   meta = {
+    homepage = "https://github.com/xbmc/kodi-platform";
     license = lib.licenses.gpl2Plus;
   };
 }
diff --git a/pkgs/applications/video/kodi/addons/steam-controller/default.nix b/pkgs/applications/video/kodi/addons/steam-controller/default.nix
index 4a39639a5b75..11c3c645c852 100644
--- a/pkgs/applications/video/kodi/addons/steam-controller/default.nix
+++ b/pkgs/applications/video/kodi/addons/steam-controller/default.nix
@@ -20,6 +20,7 @@ buildKodiBinaryAddon rec {
 
   meta = {
     description = "Binary addon for steam controller";
+    homepage = "https://github.com/kodi-game/peripheral.steamcontroller";
     platforms = lib.platforms.all;
     teams = [ lib.teams.kodi ];
     license = lib.licenses.gpl2Only;
diff --git a/pkgs/applications/video/kodi/addons/vfs-libarchive/default.nix b/pkgs/applications/video/kodi/addons/vfs-libarchive/default.nix
index 623eaab5031a..ce4b788dae17 100644
--- a/pkgs/applications/video/kodi/addons/vfs-libarchive/default.nix
+++ b/pkgs/applications/video/kodi/addons/vfs-libarchive/default.nix
@@ -35,6 +35,7 @@ buildKodiBinaryAddon rec {
 
   meta = {
     description = "LibArchive Virtual Filesystem add-on for Kodi";
+    homepage = "https://github.com/xbmc/vfs.libarchive";
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.all;
     teams = [ lib.teams.kodi ];
diff --git a/pkgs/applications/video/kodi/addons/vfs-rar/default.nix b/pkgs/applications/video/kodi/addons/vfs-rar/default.nix
index 37a056096942..1f3a265295f3 100644
--- a/pkgs/applications/video/kodi/addons/vfs-rar/default.nix
+++ b/pkgs/applications/video/kodi/addons/vfs-rar/default.nix
@@ -21,6 +21,7 @@ buildKodiBinaryAddon rec {
 
   meta = {
     description = "RAR archive Virtual Filesystem add-on for Kodi";
+    homepage = "https://github.com/xbmc/vfs.rar";
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.all;
     teams = [ lib.teams.kodi ];
diff --git a/pkgs/applications/video/kodi/addons/vfs-sftp/default.nix b/pkgs/applications/video/kodi/addons/vfs-sftp/default.nix
index 6ab37f4a3280..585a2d809637 100644
--- a/pkgs/applications/video/kodi/addons/vfs-sftp/default.nix
+++ b/pkgs/applications/video/kodi/addons/vfs-sftp/default.nix
@@ -27,6 +27,7 @@ buildKodiBinaryAddon rec {
 
   meta = {
     description = "SFTP Virtual Filesystem add-on for Kodi";
+    homepage = "https://github.com/xbmc/vfs.sftp";
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.all;
     teams = [ lib.teams.kodi ];
diff --git a/pkgs/applications/video/vdr/plugins.nix b/pkgs/applications/video/vdr/plugins.nix
index 6108fe01baee..12f59e05d2ea 100644
--- a/pkgs/applications/video/vdr/plugins.nix
+++ b/pkgs/applications/video/vdr/plugins.nix
@@ -19,6 +19,9 @@ let
       buildInputs = [ vdr ];
       preConfigure = "cd PLUGINS/src/${name}";
       installFlags = [ "DESTDIR=$(out)" ];
+      meta = {
+        homepage = "https://git.tvdr.de/?p=vdr.git";
+      };
     };
 in
 {
diff --git a/pkgs/build-support/kernel/initrd-compressor-meta.nix b/pkgs/build-support/kernel/initrd-compressor-meta.nix
index 52e009967b50..728b9291627f 100644
--- a/pkgs/build-support/kernel/initrd-compressor-meta.nix
+++ b/pkgs/build-support/kernel/initrd-compressor-meta.nix
@@ -1,18 +1,15 @@
 rec {
   cat = {
     executable = pkgs: "cat";
-    ubootName = "none";
     extension = ".cpio";
   };
   gzip = {
     executable = pkgs: "${pkgs.gzip}/bin/gzip";
     defaultArgs = [ "-9n" ];
-    ubootName = "gzip";
     extension = ".gz";
   };
   bzip2 = {
     executable = pkgs: "${pkgs.bzip2}/bin/bzip2";
-    ubootName = "bzip2";
     extension = ".bz2";
   };
   xz = {
@@ -29,24 +26,20 @@ rec {
       "--check=crc32"
       "--lzma1=dict=512KiB"
     ];
-    ubootName = "lzma";
     extension = ".lzma";
   };
   lz4 = {
     executable = pkgs: "${pkgs.lz4}/bin/lz4";
     defaultArgs = [ "-l" ];
-    ubootName = "lz4";
     extension = ".lz4";
   };
   lzop = {
     executable = pkgs: "${pkgs.lzop}/bin/lzop";
-    ubootName = "lzo";
     extension = ".lzo";
   };
   zstd = {
     executable = pkgs: "${pkgs.zstd}/bin/zstd";
     defaultArgs = [ "-10" ];
-    ubootName = "zstd";
     extension = ".zst";
   };
   pigz = gzip // {
diff --git a/pkgs/build-support/kernel/make-initrd-ng.nix b/pkgs/build-support/kernel/make-initrd-ng.nix
index 768af8f5c48d..8fe1f553c9ed 100644
--- a/pkgs/build-support/kernel/make-initrd-ng.nix
+++ b/pkgs/build-support/kernel/make-initrd-ng.nix
@@ -4,14 +4,13 @@ let
   # from it.
   compressors = import ./initrd-compressor-meta.nix;
   # Get the basename of the actual compression program from the whole
-  # compression command, for the purpose of guessing the u-boot
+  # compression command, for the purpose of guessing the
   # compression type and filename extension.
   compressorName = fullCommand: builtins.elemAt (builtins.match "([^ ]*/)?([^ ]+).*" fullCommand) 1;
 in
 {
   stdenvNoCC,
   cpio,
-  ubootTools,
   lib,
   pkgsBuildHost,
   makeInitrdNGTool,
@@ -57,22 +56,13 @@ in
   # symlinks to store paths.
   prepend ? [ ],
 
-  # Whether to wrap the initramfs in a u-boot image.
-  makeUInitrd ? stdenvNoCC.hostPlatform.linux-kernel.target == "uImage",
-
-  # If generating a u-boot image, the architecture to use. The default
-  # guess may not align with u-boot's nomenclature correctly, so it can
-  # be overridden.
-  # See https://gitlab.denx.de/u-boot/u-boot/-/blob/9bfb567e5f1bfe7de8eb41f8c6d00f49d2b9a426/common/image.c#L81-106 for a list.
-  uInitrdArch ? stdenvNoCC.hostPlatform.ubootArch,
-
-  # The name of the compression, as recognised by u-boot.
-  # See https://gitlab.denx.de/u-boot/u-boot/-/blob/9bfb567e5f1bfe7de8eb41f8c6d00f49d2b9a426/common/image.c#L195-204 for a list.
-  # If this isn't guessed, you may want to complete the metadata above and send a PR :)
-  uInitrdCompression ?
-    _compressorMeta.ubootName
-      or (throw "Unrecognised compressor ${_compressorName}, please specify uInitrdCompression"),
+  # Deprecated; remove in 27.05.
+  makeUInitrd ? null,
+  uInitrdArch ? null,
+  uInitrdCompression ? null,
 }:
+assert lib.assertMsg (makeUInitrd == null && uInitrdArch == null && uInitrdCompression == null)
+  "makeInitrdNg: U‐Boot legacy image support has been removed as it is deprecated upstream and ARMv5 kernels no longer default to uImage";
 stdenvNoCC.mkDerivation (finalAttrs: {
   __structuredAttrs = true;
 
@@ -83,11 +73,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   inherit
     name
     extension
-    makeUInitrd
-    uInitrdArch
     prepend
     ;
-  ${if makeUInitrd then "uInitrdCompression" else null} = uInitrdCompression;
 
   compress = "${_compressorExecutable} ${lib.escapeShellArgs _compressorArgsReal}";
   contentsJSON = builtins.toJSON contents;
@@ -95,8 +82,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     makeInitrdNGTool
     cpio
-  ]
-  ++ lib.optional makeUInitrd ubootTools;
+  ];
 
   buildCommand = ''
     mkdir -p ./root/{run,tmp,var/empty}
@@ -109,13 +95,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     done
     (cd root && find . -print0 | sort -z | cpio --quiet -o -H newc -R +0:+0 --reproducible --null | eval -- $compress >> "$out/initrd")
 
-    if [ -n "$makeUInitrd" ]; then
-      mkimage -A "$uInitrdArch" -O linux -T ramdisk -C "$uInitrdCompression" -d "$out/initrd" $out/initrd.img
-      # Compatibility symlink
-      ln -sf "initrd.img" "$out/initrd"
-    else
-      ln -s "initrd" "$out/initrd$extension"
-    fi
+    ln -s "initrd" "$out/initrd$extension"
   '';
 
   passthru = {
diff --git a/pkgs/build-support/kernel/make-initrd.nix b/pkgs/build-support/kernel/make-initrd.nix
index 364507ba8e7e..a6624486ffbe 100644
--- a/pkgs/build-support/kernel/make-initrd.nix
+++ b/pkgs/build-support/kernel/make-initrd.nix
@@ -10,18 +10,16 @@
 # of algorithms.
 let
   # Some metadata on various compression programs, relevant to naming
-  # the initramfs file and, if applicable, generating a u-boot image
-  # from it.
+  # the initramfs file.
   compressors = import ./initrd-compressor-meta.nix;
   # Get the basename of the actual compression program from the whole
-  # compression command, for the purpose of guessing the u-boot
+  # compression command, for the purpose of guessing the
   # compression type and filename extension.
   compressorName = fullCommand: builtins.elemAt (builtins.match "([^ ]*/)?([^ ]+).*" fullCommand) 1;
 in
 {
   stdenvNoCC,
   cpio,
-  ubootTools,
   lib,
   pkgsBuildHost,
   # Name of the derivation (not of the resulting file!)
@@ -65,22 +63,13 @@ in
   # symlinks to store paths.
   prepend ? [ ],
 
-  # Whether to wrap the initramfs in a u-boot image.
-  makeUInitrd ? stdenvNoCC.hostPlatform.linux-kernel.target or "dummy" == "uImage",
-
-  # If generating a u-boot image, the architecture to use. The default
-  # guess may not align with u-boot's nomenclature correctly, so it can
-  # be overridden.
-  # See https://gitlab.denx.de/u-boot/u-boot/-/blob/9bfb567e5f1bfe7de8eb41f8c6d00f49d2b9a426/common/image.c#L81-106 for a list.
-  uInitrdArch ? stdenvNoCC.hostPlatform.linuxArch,
-
-  # The name of the compression, as recognised by u-boot.
-  # See https://gitlab.denx.de/u-boot/u-boot/-/blob/9bfb567e5f1bfe7de8eb41f8c6d00f49d2b9a426/common/image.c#L195-204 for a list.
-  # If this isn't guessed, you may want to complete the metadata above and send a PR :)
-  uInitrdCompression ?
-    _compressorMeta.ubootName
-      or (throw "Unrecognised compressor ${_compressorName}, please specify uInitrdCompression"),
+  # Deprecated; remove in 27.05.
+  makeUInitrd ? null,
+  uInitrdArch ? null,
+  uInitrdCompression ? null,
 }:
+assert lib.assertMsg (makeUInitrd == null && uInitrdArch == null && uInitrdCompression == null)
+  "makeInitrd: U‐Boot legacy image support has been removed as it is deprecated upstream and ARMv5 kernels no longer default to uImage";
 stdenvNoCC.mkDerivation (finalAttrs: {
   __structuredAttrs = true;
 
@@ -91,18 +80,14 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   inherit
     name
     extension
-    makeUInitrd
-    uInitrdArch
     prepend
     ;
-  ${if makeUInitrd then "uInitrdCompression" else null} = uInitrdCompression;
 
   builder = ./make-initrd.sh;
 
   nativeBuildInputs = [
     cpio
-  ]
-  ++ lib.optional makeUInitrd ubootTools;
+  ];
 
   compress = "${_compressorExecutable} ${lib.escapeShellArgs _compressorArgsReal}";
 
diff --git a/pkgs/build-support/kernel/make-initrd.sh b/pkgs/build-support/kernel/make-initrd.sh
index f3bc977279b5..cc30ba0175db 100644
--- a/pkgs/build-support/kernel/make-initrd.sh
+++ b/pkgs/build-support/kernel/make-initrd.sh
@@ -36,10 +36,4 @@ done
 (cd root && find * .[^.*] -exec touch -h -d '@1' '{}' +)
 (cd root && find * .[^.*] -print0 | sort -z | cpio --quiet -o -H newc -R +0:+0 --reproducible --null | eval -- $compress >> "$out/initrd")
 
-if [ -n "$makeUInitrd" ]; then
-  mkimage -A "$uInitrdArch" -O linux -T ramdisk -C "$uInitrdCompression" -d "$out/initrd" $out/initrd.img
-  # Compatibility symlink
-  ln -sf "initrd.img" "$out/initrd"
-else
-  ln -s "initrd" "$out/initrd$extension"
-fi
+ln -s "initrd" "$out/initrd$extension"
diff --git a/pkgs/by-name/_9/_90secondportraits/package.nix b/pkgs/by-name/_9/_90secondportraits/package.nix
index c2e1017602e7..1639f6cada32 100644
--- a/pkgs/by-name/_9/_90secondportraits/package.nix
+++ b/pkgs/by-name/_9/_90secondportraits/package.nix
@@ -77,6 +77,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Silly speed painting game";
+    homepage = "https://github.com/SimonLarsen/90-Second-Portraits";
     mainProgram = "90secondportraits";
     platforms = love.meta.platforms;
     license = with lib.licenses; [
diff --git a/pkgs/by-name/ai/aitrack/package.nix b/pkgs/by-name/ai/aitrack/package.nix
index d84af9229587..0209263988b7 100644
--- a/pkgs/by-name/ai/aitrack/package.nix
+++ b/pkgs/by-name/ai/aitrack/package.nix
@@ -44,6 +44,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "6DoF Head tracking software";
+    homepage = "https://github.com/mdk97/aitrack-linux";
     mainProgram = "aitrack";
     maintainers = with lib.maintainers; [ ck3d ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/al/alkimia/package.nix b/pkgs/by-name/al/alkimia/package.nix
index 6fff009eac5d..05ce294b85cf 100644
--- a/pkgs/by-name/al/alkimia/package.nix
+++ b/pkgs/by-name/al/alkimia/package.nix
@@ -50,6 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Library used by KDE finance applications";
+    homepage = "https://invent.kde.org/office/alkimia";
     mainProgram = "onlinequoteseditor5";
     longDescription = ''
       Alkimia is the infrastructure for common storage and business
diff --git a/pkgs/by-name/al/alpaca-proxy/package.nix b/pkgs/by-name/al/alpaca-proxy/package.nix
index 04122e8912a0..9db4f78d4720 100644
--- a/pkgs/by-name/al/alpaca-proxy/package.nix
+++ b/pkgs/by-name/al/alpaca-proxy/package.nix
@@ -5,16 +5,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "alpaca-proxy";
-  version = "2.0.12";
+  version = "2.0.13";
 
   src = fetchFromGitHub {
     owner = "samuong";
     repo = "alpaca";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Yz90kJGyf2iA3LCj9d/oG5rLVUZVI//cqI6w67iV9Tc=";
+    hash = "sha256-dzTWruf/1eU34UeLzZkTSxbAqhCfxRuXMPYuKPGImUc=";
   };
 
-  vendorHash = "sha256-3A88gc8j0OrxBIAFBNlz3Np5CV9xpwwIDCnnfXyBj4Q=";
+  vendorHash = "sha256-pxCMomMmHqPWdjLi7C4LfcjbgdjMzJVvyhOd1YmHWTU=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ap/apidog/package.nix b/pkgs/by-name/ap/apidog/package.nix
index 9abfb1a8c63b..e350b2a792f7 100644
--- a/pkgs/by-name/ap/apidog/package.nix
+++ b/pkgs/by-name/ap/apidog/package.nix
@@ -7,11 +7,11 @@
 
 let
   pname = "apidog";
-  version = "2.8.30";
+  version = "2.8.32";
 
   src = fetchurl {
     url = "https://file-assets.apidog.com/download/${version}/Apidog-${version}.AppImage";
-    hash = "sha256-h5h/zhUbnYYtYVyWySLZk3QISd4VWs5Gl/JdhgMJKh8=";
+    hash = "sha256-7MaDC9VsiC+iHe83Vd4vDJQPoDLwUFmCu3R1OwVcTjM=";
   };
 
   appimageContents = appimageTools.extract {
diff --git a/pkgs/by-name/aq/aquamarine/package.nix b/pkgs/by-name/aq/aquamarine/package.nix
index 03774520b95c..7b7fa7a2cd2d 100644
--- a/pkgs/by-name/aq/aquamarine/package.nix
+++ b/pkgs/by-name/aq/aquamarine/package.nix
@@ -23,13 +23,13 @@
 }:
 gcc15Stdenv.mkDerivation (finalAttrs: {
   pname = "aquamarine";
-  version = "0.11.0";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "aquamarine";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nGiqEpbQK/tg7Mzyb8kIik9uDcm3cInWDcHRquFAOS4=";
+    hash = "sha256-TtAhxedbRAl1u6OyT+4eRxZ417G2NMJNoqEbIhjvWo0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ar/archivemount/package.nix b/pkgs/by-name/ar/archivemount/package.nix
index feebb2c9245b..eeee1af090e3 100644
--- a/pkgs/by-name/ar/archivemount/package.nix
+++ b/pkgs/by-name/ar/archivemount/package.nix
@@ -38,6 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Gateway between FUSE and libarchive: allows mounting of cpio, .tar.gz, .tar.bz2 archives";
+    homepage = "https://git.sr.ht/~nabijaczleweli/archivemount-ng";
     changelog = "https://git.sr.ht/~nabijaczleweli/archivemount-ng/refs/${finalAttrs.version}";
     mainProgram = "archivemount";
     license = [
diff --git a/pkgs/by-name/ar/argpp/package.nix b/pkgs/by-name/ar/argpp/package.nix
index 131a31a75a89..d53a9e7ea892 100644
--- a/pkgs/by-name/ar/argpp/package.nix
+++ b/pkgs/by-name/ar/argpp/package.nix
@@ -31,6 +31,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Argument Parser for C++";
+    homepage = "https://github.com/Grumbel/argpp";
     maintainers = [ lib.maintainers.SchweGELBin ];
     platforms = lib.platforms.linux;
     license = lib.licenses.free;
diff --git a/pkgs/by-name/as/asterisk-module-sccp/package.nix b/pkgs/by-name/as/asterisk-module-sccp/package.nix
index 3c99f0030cc5..32952fc436b2 100644
--- a/pkgs/by-name/as/asterisk-module-sccp/package.nix
+++ b/pkgs/by-name/as/asterisk-module-sccp/package.nix
@@ -38,6 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Replacement for the SCCP channel driver in Asterisk";
+    homepage = "https://github.com/chan-sccp/chan-sccp";
     license = lib.licenses.gpl1Only;
     maintainers = with lib.maintainers; [ das_j ];
     # https://github.com/chan-sccp/chan-sccp/issues/609
diff --git a/pkgs/by-name/au/augustus-go/package.nix b/pkgs/by-name/au/augustus-go/package.nix
index 8c83b2a26469..608bfc8e5f4e 100644
--- a/pkgs/by-name/au/augustus-go/package.nix
+++ b/pkgs/by-name/au/augustus-go/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "augustus-go";
-  version = "0.0.8";
+  version = "0.0.10";
 
   src = fetchFromGitHub {
     owner = "praetorian-inc";
     repo = "augustus";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yC7Wxx7PCWLpIMdXieks7oTdW5Ot6e6zIJHnRyZUOlo=";
+    hash = "sha256-Lh0N2wWTPCsWWaiIcntCqeMIo9ZPGhMEwy0pP42iLzY=";
   };
 
-  vendorHash = "sha256-4PQX87yICvP6h4IPjFTWnhbftPBx53im95V0oiL3v6E=";
+  vendorHash = "sha256-LPBv1i2F5hgJBXBcuZiBwgY0S5OGi0B9Nmy488mbaBQ=";
 
   ldflags = [ "-s" ];
 
diff --git a/pkgs/by-name/ba/bacnet-stack/package.nix b/pkgs/by-name/ba/bacnet-stack/package.nix
index e70700ee7c32..5f5e744a2f33 100644
--- a/pkgs/by-name/ba/bacnet-stack/package.nix
+++ b/pkgs/by-name/ba/bacnet-stack/package.nix
@@ -28,6 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "BACnet open source protocol stack for embedded systems, Linux, and Windows";
+    homepage = "https://github.com/bacnet-stack/bacnet-stack";
     platforms = lib.platforms.linux;
     license = lib.licenses.gpl2Plus;
     maintainers = with lib.maintainers; [ WhittlesJr ];
diff --git a/pkgs/by-name/ba/badvpn/package.nix b/pkgs/by-name/ba/badvpn/package.nix
index 5d6f80fabb2c..9d3176914abe 100644
--- a/pkgs/by-name/ba/badvpn/package.nix
+++ b/pkgs/by-name/ba/badvpn/package.nix
@@ -45,6 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Set of network-related (mostly VPN-related) tools";
+    homepage = "https://github.com/ambrop72/badvpn";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ raskin ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/ba/bam/package.nix b/pkgs/by-name/ba/bam/package.nix
index 74b34c555f6e..3d4dfa1cfb58 100644
--- a/pkgs/by-name/ba/bam/package.nix
+++ b/pkgs/by-name/ba/bam/package.nix
@@ -37,6 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Yet another build manager";
+    homepage = "https://github.com/matricks/bam";
     mainProgram = "bam";
     maintainers = with lib.maintainers; [
       raskin
diff --git a/pkgs/by-name/ba/bash_unit/package.nix b/pkgs/by-name/ba/bash_unit/package.nix
index 2eba0309bea8..5f6504362ac9 100644
--- a/pkgs/by-name/ba/bash_unit/package.nix
+++ b/pkgs/by-name/ba/bash_unit/package.nix
@@ -46,6 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Bash unit testing enterprise edition framework for professionals";
+    homepage = "https://github.com/bash-unit/bash_unit";
     maintainers = with lib.maintainers; [ pamplemousse ];
     platforms = lib.platforms.all;
     license = lib.licenses.gpl3Plus;
diff --git a/pkgs/by-name/bg/bgs/package.nix b/pkgs/by-name/bg/bgs/package.nix
index 905576f50795..5eb863d8c2f9 100644
--- a/pkgs/by-name/bg/bgs/package.nix
+++ b/pkgs/by-name/bg/bgs/package.nix
@@ -32,6 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Extremely fast and small background setter for X";
+    homepage = "https://github.com/Gottox/bgs";
     license = lib.licenses.mit;
     platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [ pSub ];
diff --git a/pkgs/by-name/bi/bigpemu/package.nix b/pkgs/by-name/bi/bigpemu/package.nix
index cb270a44c39d..d3e988210d3c 100644
--- a/pkgs/by-name/bi/bigpemu/package.nix
+++ b/pkgs/by-name/bi/bigpemu/package.nix
@@ -11,12 +11,12 @@
 let
   bigpemu-unwrapped = stdenv.mkDerivation rec {
     pname = "BigPEmu";
-    version = "1.22";
+    version = "1.221";
     src = fetchurl {
       url = "https://www.richwhitehouse.com/jaguar/builds/BigPEmu_Linux64_v${
         builtins.replaceStrings [ "." ] [ "" ] version
       }.tar.gz";
-      hash = "sha256-z1r04qdZ6LNqGb3HwpCMeyKP6vYJz2hAVsIyHAfJsbU=";
+      hash = "sha256-wP9hDyHV9VwBxATvmR2J92mls7iTyFcMAzvO9EEh7lc=";
     };
 
     installPhase = ''
diff --git a/pkgs/by-name/bi/biosdevname/package.nix b/pkgs/by-name/bi/biosdevname/package.nix
index db07553b8a77..8b3ddc57e646 100644
--- a/pkgs/by-name/bi/biosdevname/package.nix
+++ b/pkgs/by-name/bi/biosdevname/package.nix
@@ -31,6 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Udev helper for naming devices per BIOS names";
+    homepage = "https://github.com/dell/biosdevname";
     license = lib.licenses.gpl2Only;
     platforms = [
       "x86_64-linux"
diff --git a/pkgs/by-name/bl/blobfuse/package.nix b/pkgs/by-name/bl/blobfuse/package.nix
index c7c85ed93ff6..a531043641c2 100644
--- a/pkgs/by-name/bl/blobfuse/package.nix
+++ b/pkgs/by-name/bl/blobfuse/package.nix
@@ -36,6 +36,7 @@ buildGoModule {
 
   meta = {
     description = "Mount an Azure Blob storage as filesystem through FUSE";
+    homepage = "https://github.com/Azure/azure-storage-fuse";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ jbgi ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/bo/boring/package.nix b/pkgs/by-name/bo/boring/package.nix
index 42ecfdb879cd..ab25fc9021b5 100644
--- a/pkgs/by-name/bo/boring/package.nix
+++ b/pkgs/by-name/bo/boring/package.nix
@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "boring";
-  version = "0.14.0";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "alebeck";
     repo = "boring";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cyRy7lF2wGupzDnW4zPKEuM0X0aaHrWbF/3p13xb2DA=";
+    hash = "sha256-WdohrSeq2N1zDQlYnwIMn1FF3IIb3zAiLSuOOf2GioU=";
   };
 
   nativeBuildInputs = [
@@ -26,7 +26,7 @@ buildGoModule (finalAttrs: {
 
   subPackages = [ "cmd/boring" ];
 
-  vendorHash = "sha256-4YU0l2YhlMQzcKSMhXt3oEeCk87Yu90esiPelRs5/OQ=";
+  vendorHash = "sha256-yjqJ7G9n3c1ABLWynswzLP7B6bSwH1dIYKfVZqJX30g=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/bo/boxed-cpp/package.nix b/pkgs/by-name/bo/boxed-cpp/package.nix
index 1645b5aa5121..38361ee764fe 100644
--- a/pkgs/by-name/bo/boxed-cpp/package.nix
+++ b/pkgs/by-name/bo/boxed-cpp/package.nix
@@ -23,6 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Boxing primitive types in C++";
+    homepage = "https://github.com/contour-terminal/boxed-cpp";
     license = lib.licenses.asl20;
     platforms = lib.platforms.unix;
     maintainers = [ lib.maintainers.moni ];
diff --git a/pkgs/by-name/bp/bpftrace/package.nix b/pkgs/by-name/bp/bpftrace/package.nix
index 4a4ef8bfae93..6aa70674c9b9 100644
--- a/pkgs/by-name/bp/bpftrace/package.nix
+++ b/pkgs/by-name/bp/bpftrace/package.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "bpftrace";
-  version = "0.25.1";
+  version = "0.26.0";
 
   src = fetchFromGitHub {
     owner = "bpftrace";
     repo = "bpftrace";
     rev = "v${version}";
-    hash = "sha256-nVBIS6cgCY9ZhzVrWBY6hXI0se9zAWMKnvHuJap3x3c=";
+    hash = "sha256-NYMMQKOWCLbECQX1FPYaLcQyO3H+LHCw02bF1sWsMuY=";
   };
 
   buildInputs = with llvmPackages; [
diff --git a/pkgs/by-name/bt/btrfs-progs/package.nix b/pkgs/by-name/bt/btrfs-progs/package.nix
index 80f500c9ad30..e5034da09c2e 100644
--- a/pkgs/by-name/bt/btrfs-progs/package.nix
+++ b/pkgs/by-name/bt/btrfs-progs/package.nix
@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "btrfs-progs";
-  version = "6.19.1";
+  version = "7.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${finalAttrs.version}.tar.xz";
-    hash = "sha256-uyfh7FTnw8C3suWW+FOnPAej1y8hvJQEIHPCTb8EV5Y=";
+    hash = "sha256-wobWh2y81yMnoLQX5M/SgDU+wj43tUn9vNeACoMtmpk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ca/capstone/package.nix b/pkgs/by-name/ca/capstone/package.nix
index 2f0bb919d37c..b464b9d53885 100644
--- a/pkgs/by-name/ca/capstone/package.nix
+++ b/pkgs/by-name/ca/capstone/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "capstone";
-  version = "5.0.7";
+  version = "5.0.9";
 
   src = fetchFromGitHub {
     owner = "capstone-engine";
     repo = "capstone";
     rev = finalAttrs.version;
-    hash = "sha256-+6QReHZK+iIXspizy6Kvk7cj016HOKgiaKSaP4h7mao=";
+    hash = "sha256-uAiiKWKGjEATPE0Xc3g+aOLCz5ffIlDmf+7jaGwaZ4I=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/by-name/ch/chroma/package.nix b/pkgs/by-name/ch/chroma/package.nix
index 8c80771e80ee..965c5eb69add 100644
--- a/pkgs/by-name/ch/chroma/package.nix
+++ b/pkgs/by-name/ch/chroma/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "chroma";
-  version = "2.25.0";
+  version = "2.26.1";
 
   src = fetchFromGitHub {
     owner = "alecthomas";
     repo = "chroma";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-K2r863R1ckroKVsxMXZanxfTnMrkFtch1ZFYLUb0mMc=";
+    hash = "sha256-kOhPaiqtFU3H43jz+GjfOOIVEy5acpP9SwQ1/2xsMQc=";
   };
 
-  vendorHash = "sha256-lamMRKrGF0b5mfXMCsQid/UO6AyuKryJX7cKIRJho1c=";
+  vendorHash = "sha256-mPB7qPPMIQLjmyN2T7qX/X1Ip0E4X0jNv5h+UfVEHrY=";
 
   modRoot = "./cmd/chroma";
 
diff --git a/pkgs/by-name/ci/cidrgrep/package.nix b/pkgs/by-name/ci/cidrgrep/package.nix
index 9047a4e9b54b..4138935d5b4f 100644
--- a/pkgs/by-name/ci/cidrgrep/package.nix
+++ b/pkgs/by-name/ci/cidrgrep/package.nix
@@ -23,6 +23,7 @@ buildGoModule {
 
   meta = {
     description = "Like grep but for IPv4 CIDRs";
+    homepage = "https://github.com/tomdoherty/cidrgrep";
     mainProgram = "cidrgrep";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ das_j ];
diff --git a/pkgs/by-name/ck/ckdl/package.nix b/pkgs/by-name/ck/ckdl/package.nix
index 65254375c634..130287c9dc31 100644
--- a/pkgs/by-name/ck/ckdl/package.nix
+++ b/pkgs/by-name/ck/ckdl/package.nix
@@ -59,6 +59,7 @@ pkgs.stdenv.mkDerivation {
 
   meta = {
     description = "C library that implements reading and writing the KDL Document Language";
+    homepage = "https://github.com/tjol/ckdl";
     license = lib.licenses.mit;
     platforms = lib.platforms.all;
   };
diff --git a/pkgs/by-name/co/coc-cmake/package.nix b/pkgs/by-name/co/coc-cmake/package.nix
index 22379cc0709c..303a1f73fef2 100644
--- a/pkgs/by-name/co/coc-cmake/package.nix
+++ b/pkgs/by-name/co/coc-cmake/package.nix
@@ -56,6 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = {
+    homepage = "https://github.com/voldikss/coc-extensions";
     license = lib.licenses.mit;
   };
 })
diff --git a/pkgs/by-name/co/convchain/package.nix b/pkgs/by-name/co/convchain/package.nix
index c6bc8559fac8..e1d6d4ba95bd 100644
--- a/pkgs/by-name/co/convchain/package.nix
+++ b/pkgs/by-name/co/convchain/package.nix
@@ -37,6 +37,7 @@ stdenv.mkDerivation {
   buildInputs = [ mono ];
   meta = {
     description = "Bitmap generation from a single example with convolutions and MCMC";
+    homepage = "https://github.com/mxgmn/ConvChain";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.raskin ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/applications/virtualization/cri-o/default.nix b/pkgs/by-name/cr/cri-o-unwrapped/package.nix
similarity index 100%
rename from pkgs/applications/virtualization/cri-o/default.nix
rename to pkgs/by-name/cr/cri-o-unwrapped/package.nix
diff --git a/pkgs/applications/virtualization/cri-o/wrapper.nix b/pkgs/by-name/cr/cri-o/package.nix
similarity index 100%
rename from pkgs/applications/virtualization/cri-o/wrapper.nix
rename to pkgs/by-name/cr/cri-o/package.nix
diff --git a/pkgs/by-name/cr/crystal2nix/package.nix b/pkgs/by-name/cr/crystal2nix/package.nix
index 18c23623e85e..313e07127085 100644
--- a/pkgs/by-name/cr/crystal2nix/package.nix
+++ b/pkgs/by-name/cr/crystal2nix/package.nix
@@ -37,6 +37,7 @@ crystal.buildCrystalPackage rec {
 
   meta = {
     description = "Utility to convert Crystal's shard.lock files to a Nix file";
+    homepage = "https://github.com/nix-community/crystal2nix";
     mainProgram = "crystal2nix";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
diff --git a/pkgs/by-name/ct/ctrtool/package.nix b/pkgs/by-name/ct/ctrtool/package.nix
index eabfba7e4c8e..251cba277c33 100644
--- a/pkgs/by-name/ct/ctrtool/package.nix
+++ b/pkgs/by-name/ct/ctrtool/package.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation (finalAttrs: {
   version = "1.3.0";
 
   src = fetchFromGitHub {
-    owner = "jakcron";
+    owner = "3DSGuy";
     repo = "Project_CTR";
     rev = "ctrtool-v${finalAttrs.version}";
     sha256 = "GvEzv97DqCsaDWVqDpajQRWYe+WM8xCYmGE0D3UcSrM=";
@@ -37,6 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     license = lib.licenses.mit;
     description = "Tool to extract data from a 3ds rom";
+    homepage = "https://github.com/3DSGuy/Project_CTR";
     platforms = with lib.platforms; linux ++ darwin;
     maintainers = with lib.maintainers; [ marius851000 ];
     mainProgram = "ctrtool";
diff --git a/pkgs/by-name/de/debian-devscripts/package.nix b/pkgs/by-name/de/debian-devscripts/package.nix
index 0637f01e2d7c..62971a600963 100644
--- a/pkgs/by-name/de/debian-devscripts/package.nix
+++ b/pkgs/by-name/de/debian-devscripts/package.nix
@@ -258,6 +258,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Debian package maintenance scripts";
+    homepage = "https://salsa.debian.org/debian/devscripts";
     license = lib.licenses.free; # Mix of public domain, Artistic+GPL, GPL1+, GPL2+, GPL3+, and GPL2-only... TODO
     maintainers = with lib.maintainers; [ raskin ];
     platforms = lib.platforms.unix;
diff --git a/pkgs/by-name/de/delly/package.nix b/pkgs/by-name/de/delly/package.nix
index 9ddef424e0ed..5d46510ee21e 100644
--- a/pkgs/by-name/de/delly/package.nix
+++ b/pkgs/by-name/de/delly/package.nix
@@ -61,6 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Structural variant caller for mapped DNA sequenced data";
+    homepage = "https://github.com/dellytools/delly";
     mainProgram = "delly";
     license = lib.licenses.bsd3;
     platforms = lib.platforms.unix;
diff --git a/pkgs/by-name/de/depotdownloader/package.nix b/pkgs/by-name/de/depotdownloader/package.nix
index bd5e7010be7c..43768226ed97 100644
--- a/pkgs/by-name/de/depotdownloader/package.nix
+++ b/pkgs/by-name/de/depotdownloader/package.nix
@@ -25,6 +25,7 @@ buildDotnetModule rec {
 
   meta = {
     description = "Steam depot downloader utilizing the SteamKit2 library";
+    homepage = "https://github.com/SteamRE/DepotDownloader";
     changelog = "https://github.com/SteamRE/DepotDownloader/releases/tag/DepotDownloader_${version}";
     license = lib.licenses.gpl2Only;
     maintainers = [ lib.maintainers.babbaj ];
diff --git a/pkgs/by-name/dh/dhcpcd/package.nix b/pkgs/by-name/dh/dhcpcd/package.nix
index fd0119918706..b7ef86a31b75 100644
--- a/pkgs/by-name/dh/dhcpcd/package.nix
+++ b/pkgs/by-name/dh/dhcpcd/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dhcpcd";
-  version = "10.3.1";
+  version = "10.3.2";
 
   src = fetchFromGitHub {
     owner = "NetworkConfiguration";
     repo = "dhcpcd";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-L2rR6/qMHWVth2GR3VAoBZmhA6lmCLddbi0VvEG5r70=";
+    sha256 = "sha256-tJV533j/nQT/PP5KVPJCgTo0Lu8NNMIGnJBvYUG8ufw=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/by-name/di/diod/package.nix b/pkgs/by-name/di/diod/package.nix
index 1645cc6a8ed1..32b3748bed52 100644
--- a/pkgs/by-name/di/diod/package.nix
+++ b/pkgs/by-name/di/diod/package.nix
@@ -48,6 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "I/O forwarding server that implements a variant of the 9P protocol";
+    homepage = "https://github.com/chaos/diod";
     maintainers = with lib.maintainers; [ rnhmjoj ];
     platforms = lib.platforms.linux;
     license = lib.licenses.gpl2Plus;
diff --git a/pkgs/by-name/di/disorderfs/package.nix b/pkgs/by-name/di/disorderfs/package.nix
index 48f79c65e24a..722c5ed52d5a 100644
--- a/pkgs/by-name/di/disorderfs/package.nix
+++ b/pkgs/by-name/di/disorderfs/package.nix
@@ -34,6 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Overlay FUSE filesystem that introduces non-determinism into filesystem metadata";
+    homepage = "https://salsa.debian.org/reproducible-builds/disorderfs";
     mainProgram = "disorderfs";
     license = lib.licenses.gpl3;
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/dn/dnsviz/package.nix b/pkgs/by-name/dn/dnsviz/package.nix
index c1c40906f782..60f44a3afc0e 100644
--- a/pkgs/by-name/dn/dnsviz/package.nix
+++ b/pkgs/by-name/dn/dnsviz/package.nix
@@ -50,6 +50,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
       This tool suite powers the Web-based analysis available at https://dnsviz.net/
     '';
+    homepage = "https://github.com/dnsviz/dnsviz";
     license = lib.licenses.gpl2Plus;
     maintainers = with lib.maintainers; [ jojosch ];
   };
diff --git a/pkgs/by-name/do/domine/package.nix b/pkgs/by-name/do/domine/package.nix
index ea4d2c2e777e..f33637e36c52 100644
--- a/pkgs/by-name/do/domine/package.nix
+++ b/pkgs/by-name/do/domine/package.nix
@@ -16,5 +16,9 @@ buildDartApplication {
   };
 
   pubspecLock = lib.importJSON ./pubspec.lock.json;
-  meta.mainProgram = "domine";
+
+  meta = {
+    homepage = "https://github.com/breitburg/domine";
+    mainProgram = "domine";
+  };
 }
diff --git a/pkgs/by-name/dr/drone-cli/package.nix b/pkgs/by-name/dr/drone-cli/package.nix
index 808ce7c85d77..a1081bbc9e0a 100644
--- a/pkgs/by-name/dr/drone-cli/package.nix
+++ b/pkgs/by-name/dr/drone-cli/package.nix
@@ -31,5 +31,6 @@ buildGoModule rec {
     maintainers = with lib.maintainers; [ techknowlogick ];
     license = lib.licenses.asl20;
     description = "Command line client for the Drone continuous integration server";
+    homepage = "https://github.com/harness/drone-cli";
   };
 }
diff --git a/pkgs/by-name/du/duckmarines/package.nix b/pkgs/by-name/du/duckmarines/package.nix
index f2f345236445..436023074cce 100644
--- a/pkgs/by-name/du/duckmarines/package.nix
+++ b/pkgs/by-name/du/duckmarines/package.nix
@@ -74,6 +74,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Duck-themed action puzzle video game";
+    homepage = "https://github.com/SimonLarsen/duckmarines";
     platforms = love.meta.platforms;
     hydraPlatforms = [ ];
     license = with lib.licenses; [
diff --git a/pkgs/by-name/dy/dydisnix/package.nix b/pkgs/by-name/dy/dydisnix/package.nix
index 88ed04017393..3fdd9bb9d350 100644
--- a/pkgs/by-name/dy/dydisnix/package.nix
+++ b/pkgs/by-name/dy/dydisnix/package.nix
@@ -53,6 +53,7 @@ stdenv.mkDerivation {
     longDescription = ''
       Dynamic Disnix is a (very experimental!) prototype extension framework for Disnix supporting dynamic (re)deployment of service-oriented systems.
     '';
+    homepage = "https://github.com/svanderburg/dydisnix";
     license = lib.licenses.lgpl21Plus;
     maintainers = [ lib.maintainers.tomberek ];
     platforms = lib.platforms.unix;
diff --git a/pkgs/by-name/en/envio/package.nix b/pkgs/by-name/en/envio/package.nix
index 1e5edb2e598f..9cf6e4411cf4 100644
--- a/pkgs/by-name/en/envio/package.nix
+++ b/pkgs/by-name/en/envio/package.nix
@@ -44,6 +44,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   passthru.updateScript = nix-update-script { };
 
   meta = {
+    homepage = "https://github.com/humblepenguinn/envio";
     changelog = "https://github.com/humblepenguinn/envio/blob/v${finalAttrs.version}/CHANGELOG.md";
     description = "Modern and secure CLI tool for managing environment variables";
     mainProgram = "envio";
diff --git a/pkgs/by-name/es/essh/package.nix b/pkgs/by-name/es/essh/package.nix
new file mode 100644
index 000000000000..1ec379dc7fe6
--- /dev/null
+++ b/pkgs/by-name/es/essh/package.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  fetchFromGitHub,
+  pkg-config,
+  rustPlatform,
+  sqlite,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "essh";
+  version = "0.2.8";
+
+  src = fetchFromGitHub {
+    owner = "matthart1983";
+    repo = "essh";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-njBhA3CSTAlWjcgY3y+hvl19By2QGy2tHP8+FxgycIA=";
+  };
+
+  __structuredAttrs = true;
+
+  cargoHash = "sha256-TlvUdlKnRA/L5oePn+YWum1wy3ktHFuXP5V+nH2QNnc=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ sqlite ];
+
+  nativeCheckInputs = [ versionCheckHook ];
+
+  doInstallCheck = true;
+
+  versionCheckProgramArg = [ "-V" ];
+
+  checkFlags = [
+    "--skip=mock_ssh_server_drives_real_connect_flow_end_to_end"
+  ];
+
+  meta = {
+    description = "SSH client to manage connections, keys and sessions";
+    homepage = "https://github.com/matthart1983/essh";
+    changelog = "https://github.com/matthart1983/essh/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "essh";
+  };
+})
diff --git a/pkgs/by-name/ev/evdev-proto/package.nix b/pkgs/by-name/ev/evdev-proto/package.nix
index db41ff6b7ac8..c9e0bb879007 100644
--- a/pkgs/by-name/ev/evdev-proto/package.nix
+++ b/pkgs/by-name/ev/evdev-proto/package.nix
@@ -66,6 +66,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Input event device header files for FreeBSD";
+    homepage = "https://cgit.freebsd.org/ports";
     maintainers = with lib.maintainers; [ qyliss ];
     platforms = lib.platforms.freebsd;
     license = lib.licenses.gpl2Only;
diff --git a/pkgs/by-name/ev/evtest/package.nix b/pkgs/by-name/ev/evtest/package.nix
index d4be04e8b00f..deb874269d2c 100644
--- a/pkgs/by-name/ev/evtest/package.nix
+++ b/pkgs/by-name/ev/evtest/package.nix
@@ -27,6 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Simple tool for input event debugging";
+    homepage = "https://gitlab.freedesktop.org/libevdev/evtest";
     license = lib.licenses.gpl2;
     platforms = lib.platforms.linux;
     maintainers = [ lib.maintainers.bjornfor ];
diff --git a/pkgs/by-name/ex/expenses/package.nix b/pkgs/by-name/ex/expenses/package.nix
index fbca8e350f87..4e444ee02d64 100644
--- a/pkgs/by-name/ex/expenses/package.nix
+++ b/pkgs/by-name/ex/expenses/package.nix
@@ -42,6 +42,7 @@ buildGoModule (finalAttrs: {
 
   meta = {
     description = "Interactive command line expense logger";
+    homepage = "https://github.com/manojkarthick/expenses";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.manojkarthick ];
     mainProgram = "expenses";
diff --git a/pkgs/by-name/fa/falcon/package.nix b/pkgs/by-name/fa/falcon/package.nix
index 1f6835a67ab9..26c8c902fba9 100644
--- a/pkgs/by-name/fa/falcon/package.nix
+++ b/pkgs/by-name/fa/falcon/package.nix
@@ -37,6 +37,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Programming language with macros and syntax at once";
+    homepage = "https://github.com/falconpl/falcon";
     license = lib.licenses.gpl2Only;
     maintainers = with lib.maintainers; [ pSub ];
     platforms = with lib.platforms; unix;
diff --git a/pkgs/by-name/fi/figurine/package.nix b/pkgs/by-name/fi/figurine/package.nix
index 51b850c51a4b..5007a27b0d69 100644
--- a/pkgs/by-name/fi/figurine/package.nix
+++ b/pkgs/by-name/fi/figurine/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "figurine";
-  version = "2.0.0";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "arsham";
     repo = "figurine";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-U25nbXr8SuSgMq1Nqk/7Ci4tKoWAyccv8j4aTIEox3k=";
+    hash = "sha256-5UCvC3gweOqEzJdTob0mgmljMneYZ4m3G9SD03Xg9tM=";
   };
 
-  vendorHash = "sha256-CdiHPN0zfOedsz2M6JWFMQpG70vxLbKj//WkKyN58AQ=";
+  vendorHash = "sha256-4A40TbUeqsw7RHO/1qbAURE1ntarh2GmtPgE7dglGoc=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/fi/filter-audio/package.nix b/pkgs/by-name/fi/filter-audio/package.nix
index 5239a915e199..2e252117398d 100644
--- a/pkgs/by-name/fi/filter-audio/package.nix
+++ b/pkgs/by-name/fi/filter-audio/package.nix
@@ -21,6 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Lightweight audio filtering library made from webrtc code";
+    homepage = "https://github.com/irungentoo/filter_audio";
     license = lib.licenses.bsd3;
     maintainers = [ ];
     platforms = lib.platforms.all;
diff --git a/pkgs/by-name/fl/flip/package.nix b/pkgs/by-name/fl/flip/package.nix
index 415363fd146b..03e8f0601ec2 100644
--- a/pkgs/by-name/fl/flip/package.nix
+++ b/pkgs/by-name/fl/flip/package.nix
@@ -24,6 +24,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Tool for visualizing and communicating the errors in rendered images";
+    homepage = "https://github.com/NVlabs/flip";
     license = lib.licenses.bsd3;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ zmitchell ];
diff --git a/pkgs/by-name/fp/fplll/package.nix b/pkgs/by-name/fp/fplll/package.nix
index 1e1795c34b79..496a22d76fdf 100644
--- a/pkgs/by-name/fp/fplll/package.nix
+++ b/pkgs/by-name/fp/fplll/package.nix
@@ -33,6 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Lattice algorithms using floating-point arithmetic";
+    homepage = "https://github.com/fplll/fplll";
     changelog = [
       # Some release notes are added to the github tags, though they are not
       # always complete.
diff --git a/pkgs/by-name/fp/fplll_20160331/package.nix b/pkgs/by-name/fp/fplll_20160331/package.nix
index f3560ed20a04..09fcedb80430 100644
--- a/pkgs/by-name/fp/fplll_20160331/package.nix
+++ b/pkgs/by-name/fp/fplll_20160331/package.nix
@@ -32,6 +32,7 @@ stdenv.mkDerivation {
   ];
   meta = {
     description = "Lattice algorithms using floating-point arithmetic";
+    homepage = "https://github.com/fplll/fplll";
     license = lib.licenses.lgpl21Plus;
     maintainers = [ lib.maintainers.raskin ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/gb/gbsplay/package.nix b/pkgs/by-name/gb/gbsplay/package.nix
index 3c1eae01e586..2f83334f1596 100644
--- a/pkgs/by-name/gb/gbsplay/package.nix
+++ b/pkgs/by-name/gb/gbsplay/package.nix
@@ -35,6 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Gameboy sound player";
+    homepage = "https://github.com/mmitch/gbsplay";
     license = lib.licenses.gpl1Plus;
     platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [ sigmanificient ];
diff --git a/pkgs/by-name/ge/gearboy/package.nix b/pkgs/by-name/ge/gearboy/package.nix
index 2cbc8b2c277f..c1c19d8a3a2f 100644
--- a/pkgs/by-name/ge/gearboy/package.nix
+++ b/pkgs/by-name/ge/gearboy/package.nix
@@ -16,13 +16,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gearboy";
-  version = "3.8.4";
+  version = "3.8.6";
 
   src = fetchFromGitHub {
     owner = "drhelius";
     repo = "Gearboy";
     tag = finalAttrs.version;
-    hash = "sha256-wgiUHOL55P9N/wXMy8ZOPq4KcAomPJoWEwukXuYRbGo=";
+    hash = "sha256-HdTypXuIVMl3y83RbjNviAtgl2KwCU+faI6ZcG2P/LY=";
   };
 
   __structuredAttrs = true;
diff --git a/pkgs/by-name/ge/geomcpp/package.nix b/pkgs/by-name/ge/geomcpp/package.nix
index 8b6f70498e80..1c89777b5ed1 100644
--- a/pkgs/by-name/ge/geomcpp/package.nix
+++ b/pkgs/by-name/ge/geomcpp/package.nix
@@ -40,6 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Collection of point, size and rect classes";
+    homepage = "https://github.com/Grumbel/geomcpp";
     maintainers = [ lib.maintainers.SchweGELBin ];
     platforms = lib.platforms.linux;
     license = lib.licenses.free;
diff --git a/pkgs/by-name/gf/gfxtablet/package.nix b/pkgs/by-name/gf/gfxtablet/package.nix
index bf42a69562d4..2aef4702d7cc 100644
--- a/pkgs/by-name/gf/gfxtablet/package.nix
+++ b/pkgs/by-name/gf/gfxtablet/package.nix
@@ -31,6 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Uinput driver for Android GfxTablet tablet-as-input-device app";
+    homepage = "https://github.com/rfc2822/GfxTablet";
     mainProgram = "networktablet";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.raskin ];
diff --git a/pkgs/by-name/gh/gh-gei/package.nix b/pkgs/by-name/gh/gh-gei/package.nix
index bf79aa6eb2cf..7f552b939092 100644
--- a/pkgs/by-name/gh/gh-gei/package.nix
+++ b/pkgs/by-name/gh/gh-gei/package.nix
@@ -7,13 +7,13 @@
 
 buildDotnetModule rec {
   pname = "gh-gei";
-  version = "1.29.1";
+  version = "1.30.0";
 
   src = fetchFromGitHub {
     owner = "github";
     repo = "gh-gei";
     rev = "v${version}";
-    hash = "sha256-Ykd2/Y5Duw2yDO0uKhdt8mYLG85SeolByj/UK7ACJCo=";
+    hash = "sha256-dmou1CGsx7QLlDI3W1x0Sen35okUNQ4ofe8RMLQDP34=";
   };
 
   dotnet-sdk = dotnetCorePackages.sdk_8_0_4xx;
diff --git a/pkgs/by-name/gi/git/package.nix b/pkgs/by-name/gi/git/package.nix
index fa7bcc7cd054..072fe282a3e3 100644
--- a/pkgs/by-name/gi/git/package.nix
+++ b/pkgs/by-name/gi/git/package.nix
@@ -157,7 +157,7 @@ stdenv.mkDerivation (finalAttrs: {
     substituteInPlace contrib/credential/libsecret/Makefile \
         --replace-fail 'pkg-config' "$PKG_CONFIG"
   ''
-  + lib.optionalString doInstallCheck ''
+  + lib.optionalString finalAttrs.doInstallCheck ''
     # ensure we are using the correct shell when executing the test scripts
     patchShebangs t/*.sh
   ''
diff --git a/pkgs/by-name/gi/gitlab-container-registry/package.nix b/pkgs/by-name/gi/gitlab-container-registry/package.nix
index 49a9c7bcf156..6f7021ae3974 100644
--- a/pkgs/by-name/gi/gitlab-container-registry/package.nix
+++ b/pkgs/by-name/gi/gitlab-container-registry/package.nix
@@ -40,6 +40,7 @@ buildGo125Module rec {
 
   meta = {
     description = "GitLab Docker toolset to pack, ship, store, and deliver content";
+    homepage = "https://gitlab.com/gitlab-org/container-registry";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ e1mo ];
     teams = with lib.teams; [ gitlab ];
diff --git a/pkgs/by-name/gi/gitlab-elasticsearch-indexer/package.nix b/pkgs/by-name/gi/gitlab-elasticsearch-indexer/package.nix
index 8fe4d80326c1..fe56f1aefbcc 100644
--- a/pkgs/by-name/gi/gitlab-elasticsearch-indexer/package.nix
+++ b/pkgs/by-name/gi/gitlab-elasticsearch-indexer/package.nix
@@ -52,6 +52,7 @@ buildGoModule (finalAttrs: {
 
   meta = {
     description = "Indexes Git repositories into Elasticsearch for GitLab";
+    homepage = "https://gitlab.com/gitlab-org/gitlab-elasticsearch-indexer";
     mainProgram = "gitlab-elasticsearch-indexer";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
diff --git a/pkgs/by-name/gl/glslang/package.nix b/pkgs/by-name/gl/glslang/package.nix
index 0d7fe92908c8..c8b19772c622 100644
--- a/pkgs/by-name/gl/glslang/package.nix
+++ b/pkgs/by-name/gl/glslang/package.nix
@@ -78,6 +78,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     inherit (finalAttrs.src.meta) homepage;
+    changelog = "https://github.com/KhronosGroup/glslang/blob/${finalAttrs.src.tag}/CHANGES.md";
     description = "Khronos reference front-end for GLSL and ESSL";
     license = lib.licenses.asl20;
     platforms = lib.platforms.unix;
diff --git a/pkgs/by-name/gl/glui/package.nix b/pkgs/by-name/gl/glui/package.nix
index d3569d97177d..120c53b89235 100644
--- a/pkgs/by-name/gl/glui/package.nix
+++ b/pkgs/by-name/gl/glui/package.nix
@@ -43,6 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "User interface library using OpenGL";
+    homepage = "https://github.com/libglui/glui";
     license = lib.licenses.zlib;
     maintainers = [ lib.maintainers.raskin ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/gn/gnss-share/package.nix b/pkgs/by-name/gn/gnss-share/package.nix
index 6a95b9110999..c56c76e656f0 100644
--- a/pkgs/by-name/gn/gnss-share/package.nix
+++ b/pkgs/by-name/gn/gnss-share/package.nix
@@ -24,6 +24,7 @@ buildGoModule (finalAttrs: {
       with geoclue* or other clients that support fetching NMEA location data over
       sockets.
     '';
+    homepage = "https://gitlab.com/postmarketOS/gnss-share";
     license = lib.licenses.gpl3;
     maintainers = with lib.maintainers; [ balsoft ];
     mainProgram = "gnss-share";
diff --git a/pkgs/by-name/go/go-bindata-assetfs/package.nix b/pkgs/by-name/go/go-bindata-assetfs/package.nix
index 31f199cab1ff..0566b29f7676 100644
--- a/pkgs/by-name/go/go-bindata-assetfs/package.nix
+++ b/pkgs/by-name/go/go-bindata-assetfs/package.nix
@@ -24,6 +24,7 @@ buildGoModule {
 
   meta = {
     description = "Serve embedded files from jteeuwen/go-bindata";
+    homepage = "https://github.com/elazarl/go-bindata-assetfs";
     mainProgram = "go-bindata-assetfs";
     license = lib.licenses.bsd2;
     maintainers = with lib.maintainers; [ avnik ];
diff --git a/pkgs/by-name/go/go-car/package.nix b/pkgs/by-name/go/go-car/package.nix
index e53a218e8441..ba009f93d194 100644
--- a/pkgs/by-name/go/go-car/package.nix
+++ b/pkgs/by-name/go/go-car/package.nix
@@ -7,19 +7,19 @@
 
 buildGoModule (finalAttrs: {
   pname = "go-car";
-  version = "2.16.0";
+  version = "2.17.0";
 
   src = fetchFromGitHub {
     owner = "ipld";
     repo = "go-car";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ams0SK9Dz9McW3GLwyndCrRluvaaJiychbZX1pSW3Nw=";
+    hash = "sha256-votPngF8qpX/6vZcsmDM/I5Vb3wASvuKduBjJi0eQ2w=";
   };
 
   modRoot = "cmd";
   subPackages = [ "car" ];
 
-  vendorHash = "sha256-ZbMhX4H1rHdkdK6YIGDmSzro9q9PmkYvx9UhBaJ/i4M=";
+  vendorHash = "sha256-uzzSw51FoAdHPqqoMY2C/zx1nHbbii6izzTjguYYghs=";
 
   buildInputs = [ libpcap ];
 
diff --git a/pkgs/by-name/go/gobgp/package.nix b/pkgs/by-name/go/gobgp/package.nix
index 00828ef47238..025e1cc35c7a 100644
--- a/pkgs/by-name/go/gobgp/package.nix
+++ b/pkgs/by-name/go/gobgp/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gobgp";
-  version = "4.5.0";
+  version = "4.6.0";
 
   src = fetchFromGitHub {
     owner = "osrg";
     repo = "gobgp";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-XbErKP/F7E/e03b1rNTfpnAqkqcu2TwPtj2rV65HCnI=";
+    sha256 = "sha256-O+jKCckHAM7KCPvWpC0ZofJx2RR+GwAK8qz8tJXtsZQ=";
   };
 
-  vendorHash = "sha256-XZIcjBMNZbNDYmZLiH5s5kFoSi62n5JruqnsnlQFP4I=";
+  vendorHash = "sha256-fGDjeWmIe0GNZTDCXDBU4b286rMdCnPgRBInLZsFWxQ=";
 
   postConfigure = ''
     export CGO_ENABLED=0
diff --git a/pkgs/by-name/go/gobgpd/package.nix b/pkgs/by-name/go/gobgpd/package.nix
index cf7f3a44af39..ca13175dfadf 100644
--- a/pkgs/by-name/go/gobgpd/package.nix
+++ b/pkgs/by-name/go/gobgpd/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gobgpd";
-  version = "4.5.0";
+  version = "4.6.0";
 
   src = fetchFromGitHub {
     owner = "osrg";
     repo = "gobgp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XbErKP/F7E/e03b1rNTfpnAqkqcu2TwPtj2rV65HCnI=";
+    hash = "sha256-O+jKCckHAM7KCPvWpC0ZofJx2RR+GwAK8qz8tJXtsZQ=";
   };
 
-  vendorHash = "sha256-XZIcjBMNZbNDYmZLiH5s5kFoSi62n5JruqnsnlQFP4I=";
+  vendorHash = "sha256-fGDjeWmIe0GNZTDCXDBU4b286rMdCnPgRBInLZsFWxQ=";
 
   postConfigure = ''
     export CGO_ENABLED=0
diff --git a/pkgs/by-name/go/golden-cheetah/package.nix b/pkgs/by-name/go/golden-cheetah/package.nix
index 2640f13d4df4..193eef957c5a 100644
--- a/pkgs/by-name/go/golden-cheetah/package.nix
+++ b/pkgs/by-name/go/golden-cheetah/package.nix
@@ -118,6 +118,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Performance software for cyclists, runners and triathletes. Built from source and without API tokens";
+    homepage = "https://github.com/GoldenCheetah/GoldenCheetah";
     mainProgram = "GoldenCheetah";
     platforms = with lib.platforms; darwin ++ linux;
     maintainers = with lib.maintainers; [ adamcstephens ];
diff --git a/pkgs/by-name/go/google-chrome/package.nix b/pkgs/by-name/go/google-chrome/package.nix
index 9d4a2a7506e8..b7d9d7033ef4 100644
--- a/pkgs/by-name/go/google-chrome/package.nix
+++ b/pkgs/by-name/go/google-chrome/package.nix
@@ -79,11 +79,6 @@
   bzip2,
   libcap,
 
-  # Fonts (See issue #463615)
-  makeFontsConf,
-  noto-fonts-cjk-sans,
-  noto-fonts-cjk-serif,
-
   # Necessary for USB audio devices.
   libpulseaudio,
   pulseSupport ? true,
@@ -220,13 +215,6 @@ let
     rpath = lib.makeLibraryPath deps + ":" + lib.makeSearchPathOutput "lib" "lib64" deps;
     binpath = lib.makeBinPath deps;
 
-    fontsConf = makeFontsConf {
-      fontDirectories = [
-        noto-fonts-cjk-sans
-        noto-fonts-cjk-serif
-      ];
-    };
-
     installPhase = ''
       runHook preInstall
 
@@ -278,7 +266,6 @@ let
         --prefix PATH            : "$binpath" \
         --suffix PATH            : "${lib.makeBinPath [ xdg-utils ]}" \
         --prefix XDG_DATA_DIRS   : "$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH:${addDriverRunpath.driverLink}/share" \
-        --set FONTCONFIG_FILE "${finalAttrs.fontsConf}" \
         --set CHROME_WRAPPER  "google-chrome-$dist" \
         --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
         --add-flags "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" \
diff --git a/pkgs/by-name/go/gopro-tool/package.nix b/pkgs/by-name/go/gopro-tool/package.nix
index 475d2df02067..04e558c59b63 100644
--- a/pkgs/by-name/go/gopro-tool/package.nix
+++ b/pkgs/by-name/go/gopro-tool/package.nix
@@ -50,6 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Tool to control GoPro webcam mode in Linux (requires v4l2loopback kernel module and a firewall rule)";
+    homepage = "https://github.com/juchem/gopro-tool";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ ZMon3y ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/go/gotemplate/package.nix b/pkgs/by-name/go/gotemplate/package.nix
index f37217e3315a..99f71a72ef27 100644
--- a/pkgs/by-name/go/gotemplate/package.nix
+++ b/pkgs/by-name/go/gotemplate/package.nix
@@ -23,6 +23,7 @@ buildGoModule (finalAttrs: {
 
   meta = {
     description = "CLI for go text/template";
+    homepage = "https://github.com/coveooss/gotemplate";
     mainProgram = "gotemplate";
     changelog = "https://github.com/coveooss/gotemplate/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
diff --git a/pkgs/by-name/gr/grimblast/package.nix b/pkgs/by-name/gr/grimblast/package.nix
index 37cb9323a0a6..145eefc82620 100644
--- a/pkgs/by-name/gr/grimblast/package.nix
+++ b/pkgs/by-name/gr/grimblast/package.nix
@@ -66,6 +66,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Helper for screenshots within Hyprland, based on grimshot";
+    homepage = "https://github.com/hyprwm/contrib";
     license = lib.licenses.mit;
     platforms = lib.platforms.unix;
     teams = [ lib.teams.hyprland ];
diff --git a/pkgs/by-name/gt/gt/package.nix b/pkgs/by-name/gt/gt/package.nix
index 8d0aedb32a20..fd62a2b45d99 100644
--- a/pkgs/by-name/gt/gt/package.nix
+++ b/pkgs/by-name/gt/gt/package.nix
@@ -45,6 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Linux command line tool for setting up USB gadgets using configfs";
+    homepage = "https://github.com/linux-usb-gadgets/gt";
     mainProgram = "gt";
     license = with lib.licenses; [ asl20 ];
     maintainers = [ ];
diff --git a/pkgs/by-name/gt/gtk-sharp-beans/package.nix b/pkgs/by-name/gt/gtk-sharp-beans/package.nix
index c1e51246fe2a..a7d4d16bdeba 100644
--- a/pkgs/by-name/gt/gtk-sharp-beans/package.nix
+++ b/pkgs/by-name/gt/gtk-sharp-beans/package.nix
@@ -37,6 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Binds some API from GTK that isn't in GTK# 2.12.x";
+    homepage = "https://github.com/mono/gtk-sharp-beans";
     platforms = lib.platforms.linux;
     license = lib.licenses.lgpl21;
   };
diff --git a/pkgs/by-name/gt/gtk4-layer-shell/package.nix b/pkgs/by-name/gt/gtk4-layer-shell/package.nix
index cb9f617116a0..d9504df82901 100644
--- a/pkgs/by-name/gt/gtk4-layer-shell/package.nix
+++ b/pkgs/by-name/gt/gtk4-layer-shell/package.nix
@@ -67,6 +67,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Library to create panels and other desktop components for Wayland using the Layer Shell protocol and GTK4";
+    homepage = "https://github.com/wmww/gtk4-layer-shell";
     mainProgram = "gtk4-layer-demo";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ donovanglover ];
diff --git a/pkgs/by-name/gt/gtkclipblock/package.nix b/pkgs/by-name/gt/gtkclipblock/package.nix
index 528b623f0857..b3ceeb108e48 100644
--- a/pkgs/by-name/gt/gtkclipblock/package.nix
+++ b/pkgs/by-name/gt/gtkclipblock/package.nix
@@ -54,6 +54,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "LD_PRELOAD hack to prevent GTK programs from interacting with the primary clipboard";
+    homepage = "https://github.com/notpeelz/gtkclipblock";
     license = lib.licenses.lgpl3Only;
     maintainers = with lib.maintainers; [ uartman ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/by-name/hf/hfsprogs/package.nix b/pkgs/by-name/hf/hfsprogs/package.nix
index ea4399cb710d..11fe8435a853 100644
--- a/pkgs/by-name/hf/hfsprogs/package.nix
+++ b/pkgs/by-name/hf/hfsprogs/package.nix
@@ -34,6 +34,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "HFS/HFS+ user space utils";
+    homepage = "https://github.com/glaubitz/hfs";
     license = lib.licenses.apple-psl20;
     platforms = lib.platforms.linux;
   };
diff --git a/pkgs/by-name/hh/hhpc/package.nix b/pkgs/by-name/hh/hhpc/package.nix
index 6547ff2315bb..cd505e128105 100644
--- a/pkgs/by-name/hh/hhpc/package.nix
+++ b/pkgs/by-name/hh/hhpc/package.nix
@@ -27,6 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Hides the mouse pointer in X11";
+    homepage = "https://github.com/aktau/hhpc";
     maintainers = with lib.maintainers; [ nico202 ];
     platforms = lib.platforms.unix;
     license = lib.licenses.bsd3;
diff --git a/pkgs/by-name/hi/hiraeth/package.nix b/pkgs/by-name/hi/hiraeth/package.nix
index 7ae714bacc20..15db36dae618 100644
--- a/pkgs/by-name/hi/hiraeth/package.nix
+++ b/pkgs/by-name/hi/hiraeth/package.nix
@@ -18,6 +18,7 @@ buildGoModule (finalAttrs: {
 
   meta = {
     description = "Share files with an expiration date";
+    homepage = "https://github.com/lukaswrz/hiraeth";
     license = lib.licenses.agpl3Plus;
     maintainers = [ lib.maintainers.lukaswrz ];
     mainProgram = "hiraeth";
diff --git a/pkgs/by-name/ho/hostess/package.nix b/pkgs/by-name/ho/hostess/package.nix
index 1ba92b49cfed..df56822cc9b5 100644
--- a/pkgs/by-name/ho/hostess/package.nix
+++ b/pkgs/by-name/ho/hostess/package.nix
@@ -21,6 +21,7 @@ buildGoModule (finalAttrs: {
 
   meta = {
     description = "Idempotent command-line utility for managing your /etc/hosts* file";
+    homepage = "https://github.com/cbednarski/hostess";
     mainProgram = "hostess";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ edlimerkaj ];
diff --git a/pkgs/by-name/ht/https-dns-proxy/package.nix b/pkgs/by-name/ht/https-dns-proxy/package.nix
index 1c3b045bacdf..8e6aefc4b2b2 100644
--- a/pkgs/by-name/ht/https-dns-proxy/package.nix
+++ b/pkgs/by-name/ht/https-dns-proxy/package.nix
@@ -53,6 +53,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "DNS to DNS over HTTPS (DoH) proxy";
+    homepage = "https://github.com/aarond10/https_dns_proxy";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ peterhoeg ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/hy/hyprprop/package.nix b/pkgs/by-name/hy/hyprprop/package.nix
index 2a63d6d1f9e7..4c3c9f3dbab9 100644
--- a/pkgs/by-name/hy/hyprprop/package.nix
+++ b/pkgs/by-name/hy/hyprprop/package.nix
@@ -63,6 +63,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
   meta = {
     description = "Xprop replacement for Hyprland";
+    homepage = "https://github.com/hyprwm/contrib";
     license = lib.licenses.mit;
     platforms = lib.platforms.unix;
     teams = [ lib.teams.hyprland ];
diff --git a/pkgs/by-name/in/intel-media-sdk/package.nix b/pkgs/by-name/in/intel-media-sdk/package.nix
index 838f3dfbe2b5..12b89950abda 100644
--- a/pkgs/by-name/in/intel-media-sdk/package.nix
+++ b/pkgs/by-name/in/intel-media-sdk/package.nix
@@ -63,6 +63,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Intel Media SDK";
+    homepage = "https://github.com/Intel-Media-SDK/MediaSDK";
     mainProgram = "mfx-tracer-config";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
diff --git a/pkgs/by-name/io/ioq3-scion/package.nix b/pkgs/by-name/io/ioq3-scion/package.nix
index c054f1cc3b50..c5e07544da3d 100644
--- a/pkgs/by-name/io/ioq3-scion/package.nix
+++ b/pkgs/by-name/io/ioq3-scion/package.nix
@@ -22,6 +22,7 @@ ioquake3.overrideAttrs (old: {
   env.NIX_CFLAGS_COMPILE = "-std=gnu17";
   meta = {
     description = "ioquake3 with support for path aware networking";
+    homepage = "https://github.com/lschulz/ioq3-scion";
     maintainers = with lib.maintainers; [ matthewcroughan ];
     platforms = lib.platforms.linux;
   };
diff --git a/pkgs/by-name/ip/ipgrep/package.nix b/pkgs/by-name/ip/ipgrep/package.nix
index 00d47caca389..010011bbc570 100644
--- a/pkgs/by-name/ip/ipgrep/package.nix
+++ b/pkgs/by-name/ip/ipgrep/package.nix
@@ -39,6 +39,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
       ipgrep extracts possibly obfuscated host names and IP addresses
       from text, resolves host names, and prints them, sorted by ASN.
     '';
+    homepage = "https://github.com/jedisct1/ipgrep";
     license = lib.licenses.mit;
     platforms = lib.platforms.all;
   };
diff --git a/pkgs/by-name/ja/jack-passthrough/package.nix b/pkgs/by-name/ja/jack-passthrough/package.nix
index 7ddef896944a..4725c4c63e2f 100644
--- a/pkgs/by-name/ja/jack-passthrough/package.nix
+++ b/pkgs/by-name/ja/jack-passthrough/package.nix
@@ -39,6 +39,7 @@ stdenv.mkDerivation {
       more ports than they normally would or to prevent them from
       auto-connecting to certain things.
     '';
+    homepage = "https://github.com/guysherman/jack-passthrough";
     # license unknown: https://github.com/guysherman/jack-passthrough/issues/2
     license = lib.licenses.unfree;
     maintainers = [ lib.maintainers.PowerUser64 ];
diff --git a/pkgs/by-name/km/kminion/package.nix b/pkgs/by-name/km/kminion/package.nix
index cd72491a7be5..db72214b1125 100644
--- a/pkgs/by-name/km/kminion/package.nix
+++ b/pkgs/by-name/km/kminion/package.nix
@@ -36,6 +36,7 @@ buildGoModule (finalAttrs: {
 
   meta = {
     description = "Feature-rich Prometheus exporter for Apache Kafka written in Go";
+    homepage = "https://github.com/redpanda-data/kminion";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ cafkafk ];
     mainProgram = "kminion";
diff --git a/pkgs/by-name/ks/kstars/package.nix b/pkgs/by-name/ks/kstars/package.nix
index 602fbc70ce84..b4ab87c637b7 100644
--- a/pkgs/by-name/ks/kstars/package.nix
+++ b/pkgs/by-name/ks/kstars/package.nix
@@ -24,11 +24,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "kstars";
-  version = "3.8.2";
+  version = "3.8.3";
 
   src = fetchurl {
     url = "mirror://kde/stable/kstars/${finalAttrs.version}/kstars-${finalAttrs.version}.tar.xz";
-    hash = "sha256-rKP2YsBjccPu/NVTo6aHyUulinrkYNDGOQf2y59pztk=";
+    hash = "sha256-xez++JWHcQIx5Mk+TUeBrhcnbQNE4tqX31T9bthqGdU=";
   };
 
   nativeBuildInputs = with kdePackages; [
diff --git a/pkgs/by-name/ks/kstart/package.nix b/pkgs/by-name/ks/kstart/package.nix
index 56904bdcf4fa..73973607ad89 100644
--- a/pkgs/by-name/ks/kstart/package.nix
+++ b/pkgs/by-name/ks/kstart/package.nix
@@ -61,6 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
       "man"
     ];
     description = "Modified version of kerberos tools that support automatic ticket refresh";
+    homepage = "https://github.com/rra/kstart";
     license = lib.licenses.mit;
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };
diff --git a/pkgs/by-name/kw/kwakd/package.nix b/pkgs/by-name/kw/kwakd/package.nix
index e26f7d5bbff7..f5f2ee38a050 100644
--- a/pkgs/by-name/kw/kwakd/package.nix
+++ b/pkgs/by-name/kw/kwakd/package.nix
@@ -25,6 +25,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Super small webserver that serves blank pages";
+    homepage = "https://github.com/fetchinson/kwakd";
     mainProgram = "kwakd";
     license = lib.licenses.gpl2Only;
     maintainers = [ lib.maintainers.nicknovitski ];
diff --git a/pkgs/by-name/li/libabw/package.nix b/pkgs/by-name/li/libabw/package.nix
index f2f91e72f382..fee5c763aaf8 100644
--- a/pkgs/by-name/li/libabw/package.nix
+++ b/pkgs/by-name/li/libabw/package.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libabw";
-  version = "0.1.3";
+  version = "0.1.4";
 
   src = fetchurl {
     url = "https://dev-www.libreoffice.org/src/libabw/libabw-${finalAttrs.version}.tar.xz";
-    sha256 = "1vbfrmnvib3cym0yyyabnd8xpx4f7wp20vnn09s6dln347fajqz7";
+    sha256 = "sha256-+iaFo0QNpuA6Zqd4SA2Ty5X2Bk5FQeWONzl2gHYP1qA=";
   };
 
   # Boost 1.59 compatibility fix
diff --git a/pkgs/by-name/li/libblockdev/package.nix b/pkgs/by-name/li/libblockdev/package.nix
index cee436a7c3de..e0c73ed21e7b 100644
--- a/pkgs/by-name/li/libblockdev/package.nix
+++ b/pkgs/by-name/li/libblockdev/package.nix
@@ -35,13 +35,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "libblockdev";
-  version = "3.4.0";
+  version = "3.5.0";
 
   src = fetchFromGitHub {
     owner = "storaged-project";
     repo = "libblockdev";
     tag = finalAttrs.version;
-    hash = "sha256-KvcGvMsASgEKTerhh/lSPjQoXYDMBvbaPSdc6f5p7wc=";
+    hash = "sha256-loll5MYRXBrBSSLCIXuQ0sQCpwSn7yS1Po9ppYnEorY=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/li/libcdada/package.nix b/pkgs/by-name/li/libcdada/package.nix
index 4031d35844c5..a9b01e438d20 100644
--- a/pkgs/by-name/li/libcdada/package.nix
+++ b/pkgs/by-name/li/libcdada/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libcdada";
-  version = "0.6.1";
+  version = "0.6.4";
 
   src = fetchFromGitHub {
     owner = "msune";
     repo = "libcdada";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-x//22FvgxIGL9H2whMAVCTyI9gAjlMWkEmpOAcoeOgE=";
+    hash = "sha256-z4Nr0jE+nuBmLirbHnC98GlXV0n9j09ps7uWgOLN9nM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/libgit2/package.nix b/pkgs/by-name/li/libgit2/package.nix
index bfac9149df06..568fa09201aa 100644
--- a/pkgs/by-name/li/libgit2/package.nix
+++ b/pkgs/by-name/li/libgit2/package.nix
@@ -22,7 +22,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libgit2";
-  version = "1.9.3";
+  version = "1.9.4";
   # also check the following packages for updates: python3Packages.pygit2 and libgit2-glib
 
   outputs = [
@@ -35,7 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "libgit2";
     repo = "libgit2";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nJrRdPs86oGNL4W2CJb16oSUgfzYr9A2i5sw9BAehME=";
+    hash = "sha256-ZKUiz3pdFE2SKxh53X2oyr7hs32Njj5YVA0OXDXz7h0=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/by-name/li/libloragw-2g4/package.nix b/pkgs/by-name/li/libloragw-2g4/package.nix
index a68ffa732f47..fb7ea1b9a4a4 100644
--- a/pkgs/by-name/li/libloragw-2g4/package.nix
+++ b/pkgs/by-name/li/libloragw-2g4/package.nix
@@ -39,6 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "LoRa 2.4Ghz Gateway - Linux host Hardware Abstraction Layer, and tools (Packet Forwarder...)";
+    homepage = "https://github.com/Lora-net/gateway_2g4_hal";
     license = [
       lib.licenses.bsd3
       lib.licenses.mit
diff --git a/pkgs/by-name/li/libloragw-sx1301/package.nix b/pkgs/by-name/li/libloragw-sx1301/package.nix
index aa9c8c3da07a..48c78ef6cda4 100644
--- a/pkgs/by-name/li/libloragw-sx1301/package.nix
+++ b/pkgs/by-name/li/libloragw-sx1301/package.nix
@@ -35,6 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Driver/HAL to build a gateway using a concentrator board based on Semtech SX1301 multi-channel modem and SX1257/SX1255 RF transceivers";
+    homepage = "https://github.com/brocaar/lora_gateway";
     license = [
       lib.licenses.bsd3
       lib.licenses.mit
diff --git a/pkgs/by-name/li/libloragw-sx1302/package.nix b/pkgs/by-name/li/libloragw-sx1302/package.nix
index 47f4629b2fc9..c04f3eba309a 100644
--- a/pkgs/by-name/li/libloragw-sx1302/package.nix
+++ b/pkgs/by-name/li/libloragw-sx1302/package.nix
@@ -41,6 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "SX1302 Hardware Abstraction Layer and Tools (packet forwarder...)";
+    homepage = "https://github.com/brocaar/sx1302_hal";
     license = [
       lib.licenses.bsd3
       lib.licenses.mit
diff --git a/pkgs/by-name/li/libunicode/package.nix b/pkgs/by-name/li/libunicode/package.nix
index 255c97a81dbc..b6a4661d0b34 100644
--- a/pkgs/by-name/li/libunicode/package.nix
+++ b/pkgs/by-name/li/libunicode/package.nix
@@ -49,6 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Modern C++20 Unicode library";
+    homepage = "https://github.com/contour-terminal/libunicode";
     mainProgram = "unicode-query";
     license = lib.licenses.asl20;
     platforms = lib.platforms.unix;
diff --git a/pkgs/by-name/li/libusbgx/package.nix b/pkgs/by-name/li/libusbgx/package.nix
index fa119c947744..81f68f5b28c4 100644
--- a/pkgs/by-name/li/libusbgx/package.nix
+++ b/pkgs/by-name/li/libusbgx/package.nix
@@ -22,6 +22,7 @@ stdenv.mkDerivation {
   buildInputs = [ libconfig ];
   meta = {
     description = "C library encapsulating the kernel USB gadget-configfs userspace API functionality";
+    homepage = "https://github.com/linux-usb-gadgets/libusbgx";
     license = with lib.licenses; [
       lgpl21Plus # library
       gpl2Plus # examples
diff --git a/pkgs/by-name/li/libxo/package.nix b/pkgs/by-name/li/libxo/package.nix
index f8747a754e0e..84f8e3a281a3 100644
--- a/pkgs/by-name/li/libxo/package.nix
+++ b/pkgs/by-name/li/libxo/package.nix
@@ -63,6 +63,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Library to generate text, XML, JSON, and HTML";
+    homepage = "https://github.com/Juniper/libxo";
     license = lib.licenses.bsd2;
     maintainers = [ lib.maintainers.reckenrode ];
     platforms = lib.platforms.unix;
diff --git a/pkgs/by-name/lo/loadwatch/package.nix b/pkgs/by-name/lo/loadwatch/package.nix
index 2b71539c1fb0..dd275ec43cf5 100644
--- a/pkgs/by-name/lo/loadwatch/package.nix
+++ b/pkgs/by-name/lo/loadwatch/package.nix
@@ -19,6 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Run a program using only idle cycles";
+    homepage = "https://git.sr.ht/~woffs/loadwatch";
     license = lib.licenses.gpl2Only;
     maintainers = with lib.maintainers; [ woffs ];
     platforms = lib.platforms.all;
diff --git a/pkgs/by-name/lo/logmich/package.nix b/pkgs/by-name/lo/logmich/package.nix
index b334e503b549..a0182ff78c19 100644
--- a/pkgs/by-name/lo/logmich/package.nix
+++ b/pkgs/by-name/lo/logmich/package.nix
@@ -24,6 +24,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "A trivial logging library";
+    homepage = "https://github.com/logmich/logmich";
     maintainers = [ lib.maintainers.SchweGELBin ];
     platforms = lib.platforms.linux;
     license = lib.licenses.zlib;
diff --git a/pkgs/by-name/ma/mangareader/package.nix b/pkgs/by-name/ma/mangareader/package.nix
index 25885f446d37..45798c2d9484 100644
--- a/pkgs/by-name/ma/mangareader/package.nix
+++ b/pkgs/by-name/ma/mangareader/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mangareader";
-  version = "2.5.0";
+  version = "2.5.1";
 
   src = fetchFromGitHub {
     owner = "g-fb";
     repo = "mangareader";
     rev = finalAttrs.version;
-    hash = "sha256-jBBij57n5XWUA5K5DgTZnzuZABur13OxEbp6FzWcf30=";
+    hash = "sha256-zOAorzUyGPTJr1xfskDoMhN7SsLPH3XFcmAwEfNIRnc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ma/mari0/package.nix b/pkgs/by-name/ma/mari0/package.nix
index cfe426771ffa..7c608693ddc7 100644
--- a/pkgs/by-name/ma/mari0/package.nix
+++ b/pkgs/by-name/ma/mari0/package.nix
@@ -51,6 +51,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Crossover between Super Mario Bros. and Portal";
+    homepage = "https://github.com/Stabyourself/mari0";
     mainProgram = "mari0";
     platforms = love.meta.platforms;
     license = lib.licenses.mit;
diff --git a/pkgs/by-name/ma/mautrix-meta/package.nix b/pkgs/by-name/ma/mautrix-meta/package.nix
index 437f5622a114..2d264f144cd0 100644
--- a/pkgs/by-name/ma/mautrix-meta/package.nix
+++ b/pkgs/by-name/ma/mautrix-meta/package.nix
@@ -15,8 +15,8 @@
 
 buildGoModule rec {
   pname = "mautrix-meta";
-  version = "26.05";
-  tag = "v0.2605.0";
+  version = "26.05.1";
+  tag = "v0.2605.1";
 
   subPackages = [ "cmd/mautrix-meta" ];
 
@@ -24,7 +24,7 @@ buildGoModule rec {
     owner = "mautrix";
     repo = "meta";
     inherit tag;
-    hash = "sha256-zpolDtwGulDTiojJPnkj9O0D5b4rgPYQX6A28rvuvM0=";
+    hash = "sha256-Lc4DfZ1lznbTIKWi3SMbdOAefCoa9unUvvQlsP6ZdRo=";
   };
 
   buildInputs = lib.optional (!withGoolm) olm;
diff --git a/pkgs/by-name/mi/microsoft-edge/package.nix b/pkgs/by-name/mi/microsoft-edge/package.nix
index 0ebcecd5cdc5..3bc1ca762a34 100644
--- a/pkgs/by-name/mi/microsoft-edge/package.nix
+++ b/pkgs/by-name/mi/microsoft-edge/package.nix
@@ -90,12 +90,6 @@
   libsecret,
   # Edge Specific
   libuuid,
-
-  # Fonts (See issue #463615)
-  makeFontsConf,
-  noto-fonts-cjk-sans,
-  noto-fonts-cjk-serif,
-
   # Create a symlink at $out/bin/microsoft-edge-stable
   withSymlink ? true,
 }:
@@ -200,13 +194,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   rpath = lib.makeLibraryPath deps + ":" + lib.makeSearchPathOutput "lib" "lib64" deps;
   binpath = lib.makeBinPath deps;
 
-  fontsConf = makeFontsConf {
-    fontDirectories = [
-      noto-fonts-cjk-sans
-      noto-fonts-cjk-serif
-    ];
-  };
-
   installPhase = ''
     runHook preInstall
 
@@ -254,7 +241,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       --prefix PATH            : "$binpath" \
       --suffix PATH            : "${lib.makeBinPath [ xdg-utils ]}" \
       --prefix XDG_DATA_DIRS   : "$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH:${addDriverRunpath.driverLink}/share" \
-      --set FONTCONFIG_FILE "${finalAttrs.fontsConf}" \
       --set SSL_CERT_FILE "${cacert}/etc/ssl/certs/ca-bundle.crt" \
       --set CHROME_WRAPPER  "microsoft-edge-$dist" \
       --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true --wayland-text-input-version=3}}" \
diff --git a/pkgs/by-name/mi/minio-certgen/package.nix b/pkgs/by-name/mi/minio-certgen/package.nix
index 1896ed524dd1..a61e7d43257a 100644
--- a/pkgs/by-name/mi/minio-certgen/package.nix
+++ b/pkgs/by-name/mi/minio-certgen/package.nix
@@ -19,6 +19,7 @@ buildGoModule (finalAttrs: {
 
   meta = {
     description = "Simple Minio tool to generate self-signed certificates, and provides SAN certificates with DNS and IP entries";
+    homepage = "https://github.com/minio/certgen";
     downloadPage = "https://github.com/minio/certgen";
     license = lib.licenses.bsd3;
     maintainers = [ ];
diff --git a/pkgs/by-name/mi/mirakurun/package.nix b/pkgs/by-name/mi/mirakurun/package.nix
index 4317d296276b..37e7c70f2be4 100644
--- a/pkgs/by-name/mi/mirakurun/package.nix
+++ b/pkgs/by-name/mi/mirakurun/package.nix
@@ -73,6 +73,7 @@ buildNpmPackage rec {
 
   meta = {
     description = "Resource manager for TV tuners";
+    homepage = "https://github.com/Chinachu/Mirakurun";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ midchildan ];
   };
diff --git a/pkgs/by-name/mi/mistral-rs/package.nix b/pkgs/by-name/mi/mistral-rs/package.nix
index 79b3ae825d7c..760ba33786d0 100644
--- a/pkgs/by-name/mi/mistral-rs/package.nix
+++ b/pkgs/by-name/mi/mistral-rs/package.nix
@@ -20,7 +20,6 @@
 
   versionCheckHook,
 
-  testers,
   mistral-rs,
   nix-update-script,
 
@@ -74,13 +73,14 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mistral-rs";
-  version = "0.8.0";
+  version = "0.8.3";
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "EricLBuehler";
     repo = "mistral.rs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WuDvD2ifk0AtB4fpgLqQSiXVfb/50M9oIuz738pdsis=";
+    hash = "sha256-Ohkr45VXuXB7Ms8igZxQ7shrJa3+WBVT1fNYlc6JvZQ=";
   };
 
   patches = [
@@ -96,7 +96,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
           "lto = false"
     '';
 
-  cargoHash = "sha256-MzGU62v6ZvVzTN7Ra+zz1uNlk4ul09YG5Hbj2A7hZbY=";
+  cargoHash = "sha256-ZwUCzbRpDgT7KwsT9kPGsGp4iU/0I+lrMFqM3UCwkYw=";
 
   nativeBuildInputs = [
     pkg-config
@@ -185,6 +185,17 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "--skip=gguf::gguf_tokenizer::tests::test_encode_decode_llama"
     "--skip=util::tests::test_parse_image_url"
     "--skip=utils::tiktoken::tests::test_tiktoken_conversion"
+
+    # Spawn a nested sandbox (bubblewrap-like) which fails inside the nix build sandbox
+    "--skip=callbacks_outlive_manager_executor_tempdir"
+    "--skip=sandboxed_session_can_execute_python"
+    "--skip=sandboxed_session_default_policy_can_execute_python"
+
+    # Linux namespace / seccomp tests require capabilities the nix build sandbox blocks
+    "--skip=network_none_blocks_socket"
+    "--skip=rlimit_nproc_caps_processes"
+    "--skip=seccomp_blocks_ptrace"
+    "--skip=unshare_is_denied_inside_child"
   ];
 
   nativeInstallCheckInputs = [
diff --git a/pkgs/by-name/mi/mistral-vibe/package.nix b/pkgs/by-name/mi/mistral-vibe/package.nix
index 3c8025e22034..04442dfcfe9c 100644
--- a/pkgs/by-name/mi/mistral-vibe/package.nix
+++ b/pkgs/by-name/mi/mistral-vibe/package.nix
@@ -28,7 +28,7 @@ let
 in
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "mistral-vibe";
-  version = "2.12.1";
+  version = "2.13.0";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -36,7 +36,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "mistralai";
     repo = "mistral-vibe";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-aMh1gVTsK8rDe9DVGjFci40OizCln4lDKCN/Vz+6vAs=";
+    hash = "sha256-N4VkqsqcjJfRJwShs5JGyoeGXgc8Ioa0M3UZbO68z0A=";
   };
 
   build-system = with python3Packages; [
@@ -128,6 +128,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
       tomli-w
       tree-sitter
       tree-sitter-bash
+      truststore
       typing-extensions
       typing-inspection
       uc-micro-py
@@ -159,6 +160,10 @@ python3Packages.buildPythonApplication (finalAttrs: {
   versionCheckKeepEnvironment = [ "HOME" ];
 
   disabledTests = [
+    # vibe.core.llm.exceptions.BackendError: LLM backend error [mock-provider]
+    # reason: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key Identifier (_ssl.c:1032)
+    "test_generic_backend_streaming_uses_ssl_cert_file"
+
     # Fail in the sandbox
     # vibe.core.audio_recorder.audio_recorder_port.NoAudioInputDeviceError: No audio input device available
     "test_audio_stream_yields_chunks"
diff --git a/pkgs/by-name/mi/mix2nix/package.nix b/pkgs/by-name/mi/mix2nix/package.nix
index b15d6855a9b6..1b3084aebe0e 100644
--- a/pkgs/by-name/mi/mix2nix/package.nix
+++ b/pkgs/by-name/mi/mix2nix/package.nix
@@ -24,6 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Generate nix expressions from mix.lock file";
+    homepage = "https://github.com/ydlr/mix2nix";
     mainProgram = "mix2nix";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ ydlr ];
diff --git a/pkgs/by-name/mo/moosefs/package.nix b/pkgs/by-name/mo/moosefs/package.nix
index 3995293b1d54..f7744c5edc44 100644
--- a/pkgs/by-name/mo/moosefs/package.nix
+++ b/pkgs/by-name/mo/moosefs/package.nix
@@ -3,7 +3,7 @@
   stdenv,
   fetchFromGitHub,
   python3,
-  fuse,
+  fuse3,
   pkg-config,
   libpcap,
   zlib,
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
-    fuse
+    fuse3
     libpcap
     zlib
     python3
diff --git a/pkgs/by-name/mp/mpv/scripts/videoclip.nix b/pkgs/by-name/mp/mpv/scripts/videoclip.nix
index 2669a7831aef..762bc7400eca 100644
--- a/pkgs/by-name/mp/mpv/scripts/videoclip.nix
+++ b/pkgs/by-name/mp/mpv/scripts/videoclip.nix
@@ -10,13 +10,13 @@
 }:
 buildLua {
   pname = "videoclip";
-  version = "0.2-unstable-2026-01-22";
+  version = "0.2-unstable-2026-05-31";
 
   src = fetchFromGitHub {
     owner = "Ajatt-Tools";
     repo = "videoclip";
-    rev = "4856934684e4490fc0cab0b58054eac5f07754d7";
-    hash = "sha256-JQGPiVRMPZa4AkxqrNlTzC2QnJ4/kQov01nIcUuFy6I=";
+    rev = "d9a3e0966b238b824b86767956eb44a11ac367c6";
+    hash = "sha256-NZaflGehxoIf9eY3/p9WrKXXQj3x6GDZ6iMLeu5BhPc=";
   };
 
   patchPhase = ''
diff --git a/pkgs/by-name/mq/mqttmultimeter/package.nix b/pkgs/by-name/mq/mqttmultimeter/package.nix
index a860c28d954e..8097f64ee461 100644
--- a/pkgs/by-name/mq/mqttmultimeter/package.nix
+++ b/pkgs/by-name/mq/mqttmultimeter/package.nix
@@ -60,6 +60,7 @@ buildDotnetModule rec {
   meta = {
     mainProgram = builtins.head executables;
     description = "MQTT traffic monitor";
+    homepage = "https://github.com/chkr1011/mqttMultimeter";
     license = lib.licenses.free;
     maintainers = with lib.maintainers; [ peterhoeg ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/mr/mrrescue/package.nix b/pkgs/by-name/mr/mrrescue/package.nix
index 370a2c7eed04..f765f4c6c75f 100644
--- a/pkgs/by-name/mr/mrrescue/package.nix
+++ b/pkgs/by-name/mr/mrrescue/package.nix
@@ -70,6 +70,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Arcade-style fire fighting game";
+    homepage = "https://github.com/SimonLarsen/mrrescue";
     mainProgram = "mrrescue";
     maintainers = [ ];
     platforms = love.meta.platforms;
diff --git a/pkgs/by-name/ms/mscompress/package.nix b/pkgs/by-name/ms/mscompress/package.nix
index d639f68949c1..dbfb27911966 100644
--- a/pkgs/by-name/ms/mscompress/package.nix
+++ b/pkgs/by-name/ms/mscompress/package.nix
@@ -26,6 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = ''Microsoft "compress.exe/expand.exe" compatible (de)compressor'';
+    homepage = "https://github.com/stapelberg/mscompress";
     license = lib.licenses.gpl2Only;
     maintainers = with lib.maintainers; [ peterhoeg ];
     platforms = lib.platforms.all;
diff --git a/pkgs/by-name/ms/msr-tools/package.nix b/pkgs/by-name/ms/msr-tools/package.nix
index 8e6b0c1dd1e3..a6d8e40a9fd9 100644
--- a/pkgs/by-name/ms/msr-tools/package.nix
+++ b/pkgs/by-name/ms/msr-tools/package.nix
@@ -20,6 +20,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Tools to read/write from/to MSR CPU registers on Linux";
+    homepage = "https://github.com/intel/msr-tools";
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [ peterhoeg ];
diff --git a/pkgs/by-name/mu/munge/package.nix b/pkgs/by-name/mu/munge/package.nix
index f7893063482b..7fc62723aa80 100644
--- a/pkgs/by-name/mu/munge/package.nix
+++ b/pkgs/by-name/mu/munge/package.nix
@@ -75,6 +75,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = ''
       An authentication service for creating and validating credentials
     '';
+    homepage = "https://github.com/dun/munge";
     license = [
       # MUNGE
       lib.licenses.gpl3Plus
diff --git a/pkgs/by-name/mv/mvebu64boot/package.nix b/pkgs/by-name/mv/mvebu64boot/package.nix
index d33974f73a7e..f7e1b6ced1c1 100644
--- a/pkgs/by-name/mv/mvebu64boot/package.nix
+++ b/pkgs/by-name/mv/mvebu64boot/package.nix
@@ -28,6 +28,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Boot 64-bit Marvell EBU SoC over UART";
+    homepage = "https://github.com/pali/mvebu64boot";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ lukegb ];
     platforms = lib.platforms.all;
diff --git a/pkgs/by-name/na/namespace-cli/package.nix b/pkgs/by-name/na/namespace-cli/package.nix
index 9a68a0749167..971f04edea95 100644
--- a/pkgs/by-name/na/namespace-cli/package.nix
+++ b/pkgs/by-name/na/namespace-cli/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "namespace-cli";
-  version = "0.0.516";
+  version = "0.0.517";
 
   src = fetchFromGitHub {
     owner = "namespacelabs";
     repo = "foundation";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-IVKqyANGPLbeogh058fy1/mr/jWbceuQml4qKdDUwFQ=";
+    hash = "sha256-hYgfmWTDiJgwoVMz6yUgkn/RKOFzHEDnN/wpZ7EYWCQ=";
   };
 
-  vendorHash = "sha256-XNCogbQkG/BQPWW04Lpzca2sEXeIvp2XC//BILbshwQ=";
+  vendorHash = "sha256-rLP+djBDM1EJWFfC8s9e34Wz8EUDCzU23iJel5gscUs=";
 
   subPackages = [
     "cmd/nsc"
diff --git a/pkgs/by-name/nb/nbxplorer/package.nix b/pkgs/by-name/nb/nbxplorer/package.nix
index 41e649390c39..0bab98085f76 100644
--- a/pkgs/by-name/nb/nbxplorer/package.nix
+++ b/pkgs/by-name/nb/nbxplorer/package.nix
@@ -10,7 +10,7 @@ buildDotnetModule rec {
   version = "2.6.0";
 
   src = fetchFromGitHub {
-    owner = "dgarage";
+    owner = "btcpayserver";
     repo = "NBXplorer";
     tag = "v${version}";
     hash = "sha256-X1+UdsKVOC3QpES22p0MG1Rz1oresilBM+b/4I1nCyI=";
@@ -29,6 +29,7 @@ buildDotnetModule rec {
 
   meta = {
     description = "Minimalist UTXO tracker for HD Cryptocurrency Wallets";
+    homepage = "https://github.com/btcpayserver/NBXplorer";
     maintainers = with lib.maintainers; [
       kcalvinalvin
       erikarvstedt
diff --git a/pkgs/by-name/ne/netris/package.nix b/pkgs/by-name/ne/netris/package.nix
index 60dffc6036f7..fe54b8eaf795 100644
--- a/pkgs/by-name/ne/netris/package.nix
+++ b/pkgs/by-name/ne/netris/package.nix
@@ -41,6 +41,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Free networked version of T*tris";
+    homepage = "https://github.com/naclander/netris";
     mainProgram = "netris";
     license = lib.licenses.gpl2Plus;
     maintainers = with lib.maintainers; [ patryk27 ];
diff --git a/pkgs/by-name/ne/networkmanager-iodine/package.nix b/pkgs/by-name/ne/networkmanager-iodine/package.nix
index 0dafad3b66af..fc18072a8f3a 100644
--- a/pkgs/by-name/ne/networkmanager-iodine/package.nix
+++ b/pkgs/by-name/ne/networkmanager-iodine/package.nix
@@ -72,6 +72,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "NetworkManager's iodine plugin";
+    homepage = "https://gitlab.gnome.org/GNOME/network-manager-iodine";
     inherit (networkmanager.meta) maintainers teams platforms;
     license = lib.licenses.gpl2Plus;
   };
diff --git a/pkgs/by-name/ne/newtonwars/package.nix b/pkgs/by-name/ne/newtonwars/package.nix
index cfef73d2a03b..e511baf0b92f 100644
--- a/pkgs/by-name/ne/newtonwars/package.nix
+++ b/pkgs/by-name/ne/newtonwars/package.nix
@@ -45,6 +45,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Space battle game with gravity as the main theme";
+    homepage = "https://github.com/Draradech/NewtonWars";
     mainProgram = "nw";
     maintainers = with lib.maintainers; [ pSub ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/ni/nilfs-utils/package.nix b/pkgs/by-name/ni/nilfs-utils/package.nix
index 9a4c6d54ab51..4b5679c33a95 100644
--- a/pkgs/by-name/ni/nilfs-utils/package.nix
+++ b/pkgs/by-name/ni/nilfs-utils/package.nix
@@ -59,6 +59,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "NILFS utilities";
+    homepage = "https://github.com/nilfs-dev/nilfs-utils";
     maintainers = [ lib.maintainers.raskin ];
     platforms = lib.platforms.linux;
     license = with lib.licenses; [
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd b/pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd
index d4f83ac9d803..7ec6def5ca21 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd
@@ -21,7 +21,7 @@ nixos-rebuild - reconfigure a NixOS machine
 _nixos-rebuild_ \[--verbose] [--quiet] [--max-jobs MAX_JOBS] [--cores CORES] [--log-format LOG_FORMAT] [--keep-going] [--keep-failed] [--fallback] [--repair] [--option OPTION OPTION] [--builders BUILDERS] [--include INCLUDE]++
 	\[--print-build-logs] [--show-trace] [--accept-flake-config] [--refresh] [--impure] [--offline] [--no-net] [--recreate-lock-file] [--no-update-lock-file] [--no-write-lock-file] [--no-registries] [--commit-lock-file]++
 	\[--update-input UPDATE_INPUT] [--override-input OVERRIDE_INPUT OVERRIDE_INPUT] [--no-build-output] [--use-substitutes] [--help] [--debug] [--file FILE] [--attr ATTR] [--flake [FLAKE]] [--no-flake] [--install-bootloader]++
-	\[--profile-name PROFILE_NAME] [--specialisation SPECIALISATION] [--rollback] [--store-path STORE_PATH] [--upgrade] [--upgrade-all] [--json] [--ask-sudo-password] [--sudo] [--no-reexec]++
+	\[--profile-name PROFILE_NAME] [--specialisation SPECIALISATION] [--rollback] [--store-path STORE_PATH] [--upgrade] [--upgrade-all] [--json] [--elevate {none,sudo,run0}] [--ask-elevate-password] [--no-reexec]++
 	\[--build-host BUILD_HOST] [--target-host TARGET_HOST] [--no-build-nix] [--image-variant IMAGE_VARIANT]++
 	\[{switch,boot,test,build,edit,repl,dry-build,dry-run,dry-activate,build-image,build-vm,build-vm-with-bootloader,list-generations}]
 
@@ -269,17 +269,41 @@ It must be one of the following:
 	target-host connection to cache.nixos.org is faster than the connection
 	between hosts.
 
+*--elevate* {none,sudo,run0}
+	Privilege-elevation method used for activation commands. Setting this
+	option allows deploying as a non-root user.
+
+	_sudo_ prefixes commands with *sudo*. Additional sudo options can be
+	passed via the NIX_SUDOOPTS environment variable.
+
+	_run0_ uses systemd's polkit-based elevation. Locally this runs *run0*
+	directly so the user's normal polkit agent handles any prompts. With
+	*--target-host* the equivalent _systemd-run --uid=0 --pipe_ form is
+	used (no remote TTY is allocated). Unless *--ask-elevate-password* is
+	also passed, the deploying user must be granted the polkit action
+	_org.freedesktop.systemd1.manage-units_ on the target host without
+	authentication, e.g. via _security.polkit.extraConfig_.
+
+*--ask-elevate-password*, *-S*
+	Prompt locally for a password and feed it to the elevation method.
+	Implies *--elevate=sudo* if *--elevate* is not given.
+
+	For _sudo_ this uses *sudo --stdin*. For _run0_ the command is wrapped
+	in *polkit-stdin-agent*, which registers a per-process polkit agent
+	and answers the PAM conversation from the supplied password. The
+	machine performing the elevation (the local host, or the target host
+	with *--target-host*) must set
+	_system.tools.nixos-rebuild.enableRun0Elevation = true_.
+	*--elevate=run0 --ask-elevate-password* is not usable otherwise.
+
 *--sudo*
-	When set, *nixos-rebuild* prefixes activation commands with sudo.
-	Setting this option allows deploying as a non-root user.
+	Alias for *--elevate=sudo*.
 
-	You can set sudo options by defining the NIX_SUDOOPTS environment
-	variable.
+*--ask-sudo-password*
+	Alias for *--elevate=sudo --ask-elevate-password*.
 
-*--ask-sudo-password*, *-S*
-	When set, *nixos-rebuild* will ask for sudo password for remote
-	activation (i.e.: on *--target-host*) at the start of the build process.
-	Implies *--sudo*.
+*--use-remote-sudo*
+	Deprecated, use *--elevate=sudo* instead.
 
 *--file* _path_, *-f* _path_
 	Build the NixOS system from the specified file. The file must
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/package.nix b/pkgs/by-name/ni/nixos-rebuild-ng/package.nix
index 136962b1b7a9..8112f3d867f8 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/package.nix
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/package.nix
@@ -1,6 +1,5 @@
 {
   lib,
-  stdenv,
   callPackage,
   installShellFiles,
   mkShell,
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
index 71480548fb50..c1ad2bde3d00 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
@@ -6,6 +6,7 @@ from typing import Final, assert_never
 
 from . import nix, services
 from .constants import EXECUTABLE, WITH_SHELL_FILES
+from .elevate import NO_ELEVATOR, ElevatorKind
 from .models import Action, BuildAttr, Flake, GroupedNixArgs, Profile
 from .process import Remote
 from .utils import LogFormatter
@@ -163,18 +164,32 @@ def get_parser() -> tuple[argparse.ArgumentParser, dict[str, argparse.ArgumentPa
         help="JSON output, only implemented for 'list-generations' right now",
     )
     main_parser.add_argument(
-        "--ask-sudo-password",
-        "-S",
-        action="store_true",
-        help="Asks for sudo password for remote activation, implies --sudo",
+        "--elevate",
+        choices=ElevatorKind.choices(),
+        default=None,
+        help="Privilege-elevation method for activation commands",
     )
     main_parser.add_argument(
-        "--sudo", action="store_true", help="Prefixes activation commands with sudo"
+        "--ask-elevate-password",
+        "-S",
+        action="store_true",
+        help="Prompt locally for the password to feed to the elevation "
+        "method, implies --elevate=sudo if --elevate is not given",
+    )
+    main_parser.add_argument(
+        "--sudo",
+        action="store_true",
+        help="Alias for '--elevate=sudo'",
+    )
+    main_parser.add_argument(
+        "--ask-sudo-password",
+        action="store_true",
+        help="Alias for '--elevate=sudo --ask-elevate-password'",
     )
     main_parser.add_argument(
         "--use-remote-sudo",
         action="store_true",
-        help="Deprecated, use '--sudo' instead",
+        help="Deprecated, use '--elevate=sudo' instead",
     )
     main_parser.add_argument("--no-ssh-tty", action="store_true", help="Deprecated")
     main_parser.add_argument(
@@ -245,16 +260,32 @@ def parse_args(
         args.action = Action.DRY_BUILD.value
 
     if args.ask_sudo_password:
-        args.sudo = True
+        args.ask_elevate_password = True
+
+    if args.use_remote_sudo:
+        parser_warn("--use-remote-sudo is deprecated, use --elevate=sudo instead")
+
+    # Map the elevate flags onto an Elevator. The password itself is
+    # attached later via Elevator.with_prompted_password() once the
+    # target host (used in the prompt) is known.
+    if args.elevate is not None:
+        args.elevator = ElevatorKind.from_name(args.elevate)
+    elif args.sudo or args.use_remote_sudo or args.ask_sudo_password:
+        args.elevator = ElevatorKind.SUDO.make()
+    elif args.ask_elevate_password:
+        # -S historically implied --sudo. Keep that for muscle memory
+        # but be explicit now that there is more than one backend.
+        parser_warn(
+            "--ask-elevate-password without --elevate, falling back to --elevate=sudo"
+        )
+        args.elevator = ElevatorKind.SUDO.make()
+    else:
+        args.elevator = NO_ELEVATOR
 
     if args.install_grub:
         parser_warn("--install-grub is deprecated, use --install-bootloader instead")
         args.install_bootloader = True
 
-    if args.use_remote_sudo:
-        parser_warn("--use-remote-sudo is deprecated, use --sudo instead")
-        args.sudo = True
-
     if args.fast:
         parser_warn("--fast is deprecated, use --no-reexec instead")
         args.no_reexec = True
@@ -321,7 +352,7 @@ def execute(argv: list[str]) -> None:
     args, grouped_nix_args = parse_args(argv)
 
     if args.upgrade or args.upgrade_all:
-        nix.upgrade_channels(args.upgrade_all, args.sudo)
+        nix.upgrade_channels(args.upgrade_all, args.elevator)
 
     action = Action(args.action)
     # Only run shell scripts from the Nixpkgs tree if the action is
@@ -337,8 +368,12 @@ def execute(argv: list[str]) -> None:
         services.reexec(argv, args, grouped_nix_args)
 
     profile = Profile.from_arg(args.profile_name)
-    target_host = Remote.from_arg(args.target_host, args.ask_sudo_password)
-    build_host = Remote.from_arg(args.build_host, False, validate_opts=False)
+    target_host = Remote.from_arg(args.target_host)
+    build_host = Remote.from_arg(args.build_host, validate_opts=False)
+    args.elevator = args.elevator.with_prompted_password(
+        ask=args.ask_elevate_password,
+        host_label=target_host.host if target_host else "localhost",
+    )
     build_attr = BuildAttr.from_arg(args.attr, args.file)
     flake = Flake.from_arg(args.flake, target_host)
 
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/elevate.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/elevate.py
new file mode 100644
index 000000000000..c69eb097445d
--- /dev/null
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/elevate.py
@@ -0,0 +1,418 @@
+"""Privilege-elevation backends for activation commands.
+
+An :class:`Elevator` describes how to wrap a command so it runs as root,
+both on the local machine and on a remote target host over SSH (where no
+controlling terminal is available), and how to feed it a pre-supplied
+password when the backend supports that. ``run_wrapper`` and its callers
+carry a single ``elevate: Elevator`` value and let it produce the command
+prefix and stdin.
+
+The remote case has no controlling terminal and the elevated command's
+environment depends on the backend (``sudo`` inherits the SSH login env,
+while the run0 backend starts a transient unit with only systemd's
+default ``PATH``), so each backend builds the full remote argv itself
+via :meth:`Elevator.wrap_remote`.
+"""
+
+from __future__ import annotations
+
+import getpass
+import os
+import shlex
+from abc import ABC, abstractmethod
+from collections.abc import Mapping, Sequence
+from dataclasses import dataclass, field, replace
+from enum import Enum
+from pathlib import Path, PurePosixPath
+from typing import ClassVar, Final, Literal, Self, override
+
+# Kept here (rather than in process.py) so that elevators can build remote
+# argvs without a circular import.
+type Arg = str | bytes | os.PathLike[str] | os.PathLike[bytes]
+type Args = Sequence[Arg]
+
+
+class _Env(Enum):
+    PRESERVE_ENV = "PRESERVE"
+
+    @override
+    def __repr__(self) -> str:
+        return self.value
+
+
+#: Sentinel meaning "copy this variable from the environment the wrapped
+#: command would naturally see" (``os.environ`` locally, the SSH login
+#: shell's environment remotely).
+PRESERVE_ENV: Final = _Env.PRESERVE_ENV
+
+type EnvValue = str | Literal[_Env.PRESERVE_ENV]
+
+
+def _remote_env_shell_argv(
+    prefix: Sequence[str],
+    env: Mapping[str, EnvValue],
+    args: Args,
+) -> list[Arg]:
+    """Build ``<prefix> /bin/sh -c 'exec /usr/bin/env -i K=V… "$@"' sh <args>``.
+
+    The wrapper runs in the SSH login session, resolves ``PRESERVE_ENV``
+    variables against that session's environment, and re-execs the command
+    with exactly that set. ``/usr/bin/env`` is referenced by absolute path so
+    the wrapper does not depend on ``PATH`` itself (provided on NixOS via
+    ``environment.usrbinenv``).
+    """
+    assigns: list[str] = []
+    for k, v in env.items():
+        if v is PRESERVE_ENV:
+            assigns.append(f'{k}="${{{k}-}}"')
+        else:
+            assigns.append(f"{k}={shlex.quote(v)}")
+    script = f'exec /usr/bin/env -i {" ".join(assigns)} "$@"'
+    return [*prefix, "/bin/sh", "-c", script, "sh", *args]
+
+
+@dataclass(frozen=True)
+class Wrapped:
+    """Result of wrapping a command for local elevation."""
+
+    #: Arguments to prepend to the command.
+    prefix: list[str]
+    #: Text to send on the wrapped command's stdin (typically a password
+    #: followed by a newline), or ``None`` to leave stdin alone.
+    stdin: str | None = None
+
+
+@dataclass(frozen=True)
+class RemoteWrapped:
+    """Result of wrapping a command for remote elevation over SSH.
+
+    Unlike :class:`Wrapped` this carries the *full* remote argv: backends
+    differ in where the env-resolution shell wrapper must sit relative to
+    the elevator (inside ``sudo``, but *around* ``systemd-run``), so a
+    plain prefix is not expressive enough.
+    """
+
+    argv: list[Arg]
+    stdin: str | None = None
+
+
+class Elevator(ABC):
+    """How to gain root for activation commands."""
+
+    #: CLI name, e.g. ``sudo`` or ``run0``.
+    name: str
+
+    @property
+    def elevates(self) -> bool:
+        """Whether this elevator actually changes privileges.
+
+        ``run_wrapper`` uses this to decide between passing ``env`` to
+        :func:`subprocess.run` directly (unprivileged local case) and
+        injecting it via ``env -i`` inside the wrapped command (where the
+        elevator may otherwise scrub the environment).
+        """
+        return True
+
+    @abstractmethod
+    def wrap_local(self) -> Wrapped:
+        """Wrap a command run on the local machine."""
+
+    @abstractmethod
+    def wrap_remote(self, env: Mapping[str, EnvValue], args: Args) -> RemoteWrapped:
+        """Wrap a command run on a target host over SSH.
+
+        The remote side has no controlling terminal, so backends that need
+        interactive prompts must either accept a pre-supplied password
+        (see :meth:`with_password`) or rely on a passwordless policy on
+        the target.
+
+        *env* is the environment to establish for the elevated command.
+        :data:`PRESERVE_ENV` values are resolved against the SSH login
+        shell's environment, and the backend must do so before any step
+        that replaces it with a service-style one.
+        """
+
+    @abstractmethod
+    def with_password(self, password: str) -> Self:
+        """Return a copy that will feed *password* to the backend.
+
+        Backends that have no stdin path for credentials must raise
+        :class:`ElevateError` with a hint pointing at the alternative
+        (e.g. a polkit rule).
+        """
+
+    def with_prompted_password(self, *, ask: bool, host_label: str) -> Self:
+        """Prompt locally for a password and return a copy carrying it.
+
+        No-op when *ask* is false. May raise :class:`ElevateError` (e.g.
+        on :class:`NoElevator`).
+        """
+        if not ask:
+            return self
+        password = getpass.getpass(f"[{self.name}] password for {host_label}: ")
+        return self.with_password(password)
+
+    def for_target_config(self, toplevel: PurePosixPath | Path) -> Self:
+        """Return a copy bound to the toplevel being activated on the target.
+
+        Backends that need a helper binary on the remote
+        (:class:`Run0Elevator`'s ``polkit-stdin-agent``) use this to find
+        a target-architecture copy inside the just-copied closure. No-op
+        by default.
+        """
+        del toplevel  # unused in the base implementation
+        return self
+
+    def on_remote_failure(self) -> str | None:
+        """Optional hint to print when a remote elevated command fails."""
+        return None
+
+
+class ElevateError(Exception):
+    """Raised for invalid elevator/flag combinations."""
+
+
+@dataclass(frozen=True)
+class NoElevator(Elevator):
+    name: str = "none"
+
+    @property
+    @override
+    def elevates(self) -> bool:
+        return False
+
+    @override
+    def wrap_local(self) -> Wrapped:
+        return Wrapped(prefix=[])
+
+    @override
+    def wrap_remote(self, env: Mapping[str, EnvValue], args: Args) -> RemoteWrapped:
+        return RemoteWrapped(argv=_remote_env_shell_argv([], env, args))
+
+    @override
+    def with_password(self, password: str) -> Self:
+        raise ElevateError(
+            "--ask-elevate-password requires --elevate to select an elevation method"
+        )
+
+
+@dataclass(frozen=True)
+class SudoElevator(Elevator):
+    """Wrap with ``sudo``, optionally feeding the password on stdin.
+
+    Extra arguments come from ``NIX_SUDOOPTS`` for backwards
+    compatibility with the previous implementation in ``run_wrapper``.
+    """
+
+    name: str = "sudo"
+    password: str | None = None
+    extra_opts: list[str] = field(
+        default_factory=lambda: shlex.split(os.getenv("NIX_SUDOOPTS", ""))
+    )
+
+    @override
+    def wrap_local(self) -> Wrapped:
+        # Local sudo can prompt on /dev/tty itself, so the password is
+        # only piped when one was supplied explicitly.
+        if self.password is not None:
+            return Wrapped(
+                prefix=["sudo", "--prompt=", "--stdin", *self.extra_opts],
+                stdin=self.password + "\n",
+            )
+        return Wrapped(prefix=["sudo", *self.extra_opts])
+
+    @override
+    def wrap_remote(self, env: Mapping[str, EnvValue], args: Args) -> RemoteWrapped:
+        # sudo runs inside the SSH login session, so the env wrapper can
+        # sit *inside* it and ${VAR-} resolves against the login env.
+        if self.password is not None:
+            prefix = ["sudo", "--prompt=", "--stdin", *self.extra_opts]
+            stdin = self.password + "\n"
+        else:
+            prefix = ["sudo", *self.extra_opts]
+            stdin = None
+        return RemoteWrapped(
+            argv=_remote_env_shell_argv(prefix, env, args),
+            stdin=stdin,
+        )
+
+    @override
+    def with_password(self, password: str) -> Self:
+        return replace(self, password=password)
+
+    @override
+    def on_remote_failure(self) -> str | None:
+        if self.password is None:
+            return (
+                "while running command with remote sudo, did you forget to "
+                "use --ask-elevate-password?"
+            )
+        return None
+
+
+@dataclass(frozen=True)
+class Run0Elevator(Elevator):
+    """Wrap with systemd's polkit-based ``run0``.
+
+    Locally, ``run0`` is used directly and the user's polkit agent
+    (graphical or ``pkttyagent``) handles any prompts.
+
+    Remotely we spell out the explicit ``systemd-run --uid=0 --pipe``
+    form instead. ``run0`` would internally do the same thing when stdio
+    is not a TTY (see systemd ``src/run/run.c``), but going through
+    ``systemd-run`` directly gives us ``--setenv K=V``, which we need to
+    forward the SSH login environment into the transient unit (whose own
+    ``PATH`` on NixOS is just the systemd store path), and keeps the
+    argv independent of whether the SSH session happens to have a TTY.
+
+    Authorisation comes from either a polkit rule on the target granting
+    ``org.freedesktop.systemd1.manage-units`` to the deploying user, or
+    from ``polkit-stdin-agent`` for ``--ask-elevate-password``.
+    """
+
+    name: str = "run0"
+    password: str | None = None
+    #: ``${toplevel}/sw/bin/polkit-stdin-agent`` on the target, set via
+    #: :meth:`for_target_config`. ``None`` falls back to the target's ``PATH``.
+    remote_agent: str | None = None
+
+    #: Non-interactive equivalent of ``run0`` (see the class docstring).
+    REMOTE_BASE: ClassVar[tuple[str, ...]] = (
+        "systemd-run",
+        "--uid=0",
+        "--pipe",
+        "--quiet",
+        "--wait",
+        "--collect",
+        "--service-type=exec",
+        "--send-sighup",
+    )
+
+    @override
+    def wrap_local(self) -> Wrapped:
+        if self.password is not None:
+            # Resolved from PATH, same requirement as the remote case: the
+            # machine doing the elevation needs
+            # system.tools.nixos-rebuild.enableRun0Elevation.
+            return Wrapped(
+                prefix=["polkit-stdin-agent", "--password-fd=0", "--", "run0", "--"],
+                stdin=self.password + "\n",
+            )
+        return Wrapped(prefix=["run0", "--"])
+
+    @override
+    def wrap_remote(self, env: Mapping[str, EnvValue], args: Args) -> RemoteWrapped:
+        # /bin/sh wrapper resolves PRESERVE_ENV in the SSH login session
+        # and forwards the result into the unit via --setenv.
+        setenvs: list[str] = []
+        for k, v in env.items():
+            if v is PRESERVE_ENV:
+                setenvs.append(f'--setenv={k}="${{{k}-}}"')
+            else:
+                setenvs.append(f"--setenv={shlex.quote(f'{k}={v}')}")
+        script = f'exec {shlex.join(self.REMOTE_BASE)} {" ".join(setenvs)} -- "$@"'
+        argv: list[Arg] = ["/bin/sh", "-c", script, "sh", *args]
+        if self.password is not None:
+            # polkit has no `sudo --stdin` equivalent. polkit-stdin-agent
+            # registers a per-process agent for the wrapped command and
+            # answers the PAM conversation from its stdin.
+            argv = self._remote_agent_argv(argv)
+            return RemoteWrapped(argv=argv, stdin=self.password + "\n")
+        return RemoteWrapped(argv=argv)
+
+    #: POSIX sh fragment that picks the first runnable agent from the
+    #: positional parameters up to ``--`` and execs it with the remainder.
+    #: ``command -v`` covers both absolute paths and ``PATH`` lookups.
+    _AGENT_PICKER: ClassVar[str] = (
+        "agent=; "
+        "for a; do "
+        "shift; "
+        '[ "$a" = -- ] && break; '
+        '[ -z "$agent" ] && command -v "$a" >/dev/null 2>&1 && agent="$a"; '
+        "done; "
+        '[ -n "$agent" ] && exec "$agent" --password-fd=0 -- "$@"; '
+        'echo "nixos-rebuild: polkit-stdin-agent not found on target host '
+        '(set system.tools.nixos-rebuild.enableRun0Elevation = true)" >&2; '
+        "exit 127"
+    )
+
+    def _remote_agent_argv(self, inner: list[Arg]) -> list[Arg]:
+        """Wrap *inner* in a target-side agent lookup.
+
+        The deployer's own agent may be the wrong arch/nixpkgs (cross-arch
+        deploys, Darwin deployers, ``--no-reexec``), so resolve on the
+        target instead: first ``${toplevel}/sw/bin/polkit-stdin-agent``
+        (present when ``system.tools.nixos-rebuild.enableRun0Elevation``
+        is set), then bare ``polkit-stdin-agent`` on the SSH login PATH.
+        :data:`_AGENT_PICKER` exits 127 with a hint if neither is found.
+        """
+        candidates: list[str] = []
+        if self.remote_agent is not None:
+            candidates.append(self.remote_agent)
+        candidates.append("polkit-stdin-agent")
+        return ["/bin/sh", "-c", self._AGENT_PICKER, "sh", *candidates, "--", *inner]
+
+    @override
+    def with_password(self, password: str) -> Self:
+        return replace(self, password=password)
+
+    @override
+    def for_target_config(self, toplevel: PurePosixPath | Path) -> Self:
+        return replace(
+            self, remote_agent=str(toplevel / "sw" / "bin" / "polkit-stdin-agent")
+        )
+
+    @override
+    def on_remote_failure(self) -> str | None:
+        if self.password is None:
+            return (
+                "while running command with remote run0. Either pass "
+                "--ask-elevate-password, or grant the deploying user the "
+                "polkit action 'org.freedesktop.systemd1.manage-units' on "
+                "the target host (security.polkit.extraConfig)."
+            )
+        return (
+            "while running command with remote run0. If the error above "
+            "mentions polkit-stdin-agent or PolicyKit1, the target host "
+            "needs system.tools.nixos-rebuild.enableRun0Elevation = true."
+        )
+
+
+class ElevatorKind(Enum):
+    """CLI-selectable elevation backends.
+
+    The enum *value* is the :class:`Elevator` subclass to instantiate,
+    ``str(member)`` is what ``--elevate`` accepts on the command line.
+    """
+
+    NONE = NoElevator
+    SUDO = SudoElevator
+    RUN0 = Run0Elevator
+
+    @override
+    def __str__(self) -> str:
+        return self.name.lower()
+
+    def make(self) -> Elevator:
+        """Instantiate a fresh, unparameterised elevator of this kind."""
+        cls: type[Elevator] = self.value
+        return cls()
+
+    @classmethod
+    def choices(cls) -> list[str]:
+        """All ``--elevate`` values, for argparse ``choices=``."""
+        return [str(m) for m in cls]
+
+    @classmethod
+    def from_name(cls, name: str) -> Elevator:
+        try:
+            return cls[name.upper()].make()
+        except KeyError:
+            raise ElevateError(
+                f"unknown elevation method {name!r}, choose from: "
+                + ", ".join(cls.choices())
+            ) from None
+
+
+#: Singleton used as the default ``elevate=`` argument throughout.
+NO_ELEVATOR: Final[Elevator] = NoElevator()
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
index c6b5b4d63c45..c9d79868f8f4 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
@@ -14,6 +14,7 @@ from textwrap import dedent
 from typing import Final, Literal
 
 from . import tmpdir
+from .elevate import NO_ELEVATOR, PRESERVE_ENV, Elevator
 from .models import (
     Action,
     BuildAttr,
@@ -25,7 +26,7 @@ from .models import (
     Profile,
     Remote,
 )
-from .process import PRESERVE_ENV, SSH_DEFAULT_OPTS, run_wrapper
+from .process import SSH_DEFAULT_OPTS, run_wrapper
 from .utils import Args, dict_to_flags
 
 FLAKE_FLAGS: Final = ["--extra-experimental-features", "nix-command flakes"]
@@ -453,7 +454,7 @@ def get_generations(profile: Profile) -> list[Generation]:
 def get_generations_from_nix_env(
     profile: Profile,
     target_host: Remote | None = None,
-    sudo: bool = False,
+    elevate: Elevator = NO_ELEVATOR,
 ) -> list[Generation]:
     """Get all NixOS generations from profile with nix-env. Needs root.
 
@@ -468,7 +469,7 @@ def get_generations_from_nix_env(
         ["nix-env", "-p", profile.path, "--list-generations"],
         stdout=PIPE,
         remote=target_host,
-        sudo=sudo,
+        elevate=elevate,
     )
 
     def parse_line(line: str) -> Generation:
@@ -600,12 +601,12 @@ def repl_flake(flake: Flake, flake_flags: Args | None = None) -> None:
     )
 
 
-def rollback(profile: Profile, target_host: Remote | None, sudo: bool) -> Path:
+def rollback(profile: Profile, target_host: Remote | None, elevate: Elevator) -> Path:
     "Rollback Nix profile, like one created by `nixos-rebuild switch`."
     run_wrapper(
         ["nix-env", "--rollback", "-p", profile.path],
         remote=target_host,
-        sudo=sudo,
+        elevate=elevate,
     )
     # Rollback config PATH is the own profile
     return profile.path
@@ -614,11 +615,11 @@ def rollback(profile: Profile, target_host: Remote | None, sudo: bool) -> Path:
 def rollback_temporary_profile(
     profile: Profile,
     target_host: Remote | None,
-    sudo: bool,
+    elevate: Elevator,
 ) -> Path | None:
     "Rollback a temporary Nix profile, like one created by `nixos-rebuild test`."
     generations = get_generations_from_nix_env(
-        profile, target_host=target_host, sudo=sudo
+        profile, target_host=target_host, elevate=elevate
     )
     previous_gen_id = None
     for generation in generations:
@@ -635,7 +636,7 @@ def set_profile(
     profile: Profile,
     path_to_config: Path,
     target_host: Remote | None,
-    sudo: bool,
+    elevate: Elevator,
 ) -> None:
     "Set a path as the current active Nix profile."
     if not os.environ.get(
@@ -668,7 +669,7 @@ def set_profile(
     run_wrapper(
         ["nix-env", "-p", profile.path, "--set", path_to_config],
         remote=target_host,
-        sudo=sudo,
+        elevate=elevate,
     )
 
 
@@ -676,7 +677,7 @@ def switch_to_configuration(
     path_to_config: Path,
     action: Literal[Action.SWITCH, Action.BOOT, Action.TEST, Action.DRY_ACTIVATE],
     target_host: Remote | None,
-    sudo: bool,
+    elevate: Elevator,
     install_bootloader: bool = False,
     specialisation: str | None = None,
 ) -> None:
@@ -716,7 +717,7 @@ def switch_to_configuration(
             "NIXOS_INSTALL_BOOTLOADER": "1" if install_bootloader else "0",
         },
         remote=target_host,
-        sudo=sudo,
+        elevate=elevate,
         # switch-to-configuration is not expected to produce meaningful
         # stdout, but if it (or any of its children) does, it would leak
         # into our stdout and break the "only the store path on stdout"
@@ -728,7 +729,7 @@ def switch_to_configuration(
 
 def upgrade_channels(
     all_channels: bool = False,
-    sudo: bool = False,
+    elevate: Elevator = NO_ELEVATOR,
     channels_dir: Path = Path("/nix/var/nix/profiles/per-user/root/channels/"),
 ) -> None:
     """Upgrade channels for classic Nix.
@@ -736,10 +737,10 @@ def upgrade_channels(
     It will either upgrade just the `nixos` channel (including any channel
     that has a `.update-on-nixos-rebuild` file) or all.
     """
-    if not sudo and os.geteuid() != 0:
+    if not elevate.elevates and os.geteuid() != 0:
         raise NixOSRebuildError(
             "if you pass the '--upgrade' or '--upgrade-all' flag, you must "
-            "also pass '--sudo' or run the command as root (e.g., with sudo)"
+            "also pass '--elevate' or run the command as root"
         )
 
     channel_updated = False
@@ -752,7 +753,7 @@ def upgrade_channels(
             run_wrapper(
                 ["nix-channel", "--update", channel_path.name],
                 check=False,
-                sudo=sudo,
+                elevate=elevate,
             )
             channel_updated = True
 
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py
index 9f6baaa178a9..d848709ef8f1 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py
@@ -1,17 +1,23 @@
 import atexit
-import getpass
 import logging
 import os
 import re
 import shlex
 import subprocess
-from collections.abc import Mapping, Sequence
+from collections.abc import Mapping
 from dataclasses import dataclass
-from enum import Enum
 from ipaddress import AddressValueError, IPv6Address
-from typing import Final, Literal, Self, TextIO, TypedDict, Unpack, override
+from typing import Final, Self, TextIO, TypedDict, Unpack
 
 from . import tmpdir
+from .elevate import (
+    NO_ELEVATOR,
+    PRESERVE_ENV,
+    Arg,
+    Args,
+    Elevator,
+    EnvValue,
+)
 
 logger: Final = logging.getLogger(__name__)
 
@@ -19,40 +25,22 @@ SSH_DEFAULT_OPTS: Final = [
     "-o",
     "ControlMaster=auto",
     "-o",
-    f"ControlPath={tmpdir.TMPDIR_PATH / 'ssh-%n'}",
+    f"ControlPath={tmpdir.TMPDIR_PATH / 'ssh-%C'}",
     "-o",
     "ControlPersist=60",
 ]
 
 
-class _Env(Enum):
-    PRESERVE_ENV = "PRESERVE"
-
-    @override
-    def __repr__(self) -> str:
-        return self.value
-
-
-PRESERVE_ENV: Final = _Env.PRESERVE_ENV
-
-
-type Arg = str | bytes | os.PathLike[str] | os.PathLike[bytes]
-type Args = Sequence[Arg]
-type EnvValue = str | Literal[_Env.PRESERVE_ENV]
-
-
 @dataclass(frozen=True)
 class Remote:
     host: str
     opts: list[str]
-    sudo_password: str | None
     store_type: str
 
     @classmethod
     def from_arg(
         cls,
         host: str | None,
-        ask_sudo_password: bool | None,
         validate_opts: bool = True,
     ) -> Self | None:
         if not host:
@@ -65,25 +53,21 @@ class Remote:
 
         opts = shlex.split(os.getenv("NIX_SSHOPTS", ""))
         if validate_opts:
-            cls._validate_opts(opts, ask_sudo_password)
-        sudo_password = None
-        if ask_sudo_password:
-            sudo_password = getpass.getpass(f"[sudo] password for {host}: ")
-        return cls(host, opts, sudo_password, store_type)
+            cls._validate_opts(opts)
+        return cls(host, opts, store_type)
 
     @staticmethod
-    def _validate_opts(opts: list[str], ask_sudo_password: bool | None) -> None:
+    def _validate_opts(opts: list[str]) -> None:
         for o in opts:
             if o in ["-t", "-tt", "RequestTTY=yes", "RequestTTY=force"]:
                 logger.warning(
                     f"detected option '{o}' in NIX_SSHOPTS. SSH's TTY may "
                     "cause issues, it is recommended to remove this option"
                 )
-                if not ask_sudo_password:
-                    logger.warning(
-                        "if you want to prompt for sudo password use "
-                        "'--ask-sudo-password' option instead"
-                    )
+                logger.warning(
+                    "if you want to prompt for a password for remote "
+                    "elevation use '--ask-elevate-password' instead"
+                )
 
     def ssh_host(self) -> str:
         """Fix up host string for SSH.
@@ -130,7 +114,7 @@ def run_wrapper(
     env: Mapping[str, EnvValue] | None = None,
     append_local_env: Mapping[str, str] | None = None,
     remote: Remote | None = None,
-    sudo: bool = False,
+    elevate: Elevator = NO_ELEVATOR,
     **kwargs: Unpack[RunKwargs],
 ) -> subprocess.CompletedProcess[str]:
     "Wrapper around `subprocess.run` that supports extra functionality."
@@ -142,27 +126,9 @@ def run_wrapper(
     resolved_env = _resolve_env_local(normalized_env)
 
     if remote:
-        remote_run_args: list[Arg] = [
-            "/bin/sh",
-            "-c",
-            _remote_shell_script(normalized_env),
-            "sh",
-            *run_args,
-        ]
-
-        if sudo:
-            sudo_args = shlex.split(os.getenv("NIX_SUDOOPTS", ""))
-            if remote.sudo_password:
-                remote_run_args = [
-                    "sudo",
-                    "--prompt=",
-                    "--stdin",
-                    *sudo_args,
-                    *remote_run_args,
-                ]
-                process_input = remote.sudo_password + "\n"
-            else:
-                remote_run_args = ["sudo", *sudo_args, *remote_run_args]
+        rwrapped = elevate.wrap_remote(normalized_env, run_args)
+        process_input = rwrapped.stdin
+        remote_run_args: list[Arg] = rwrapped.argv
 
         ssh_args: list[Arg] = [
             "ssh",
@@ -176,22 +142,19 @@ def run_wrapper(
         popen_env = None  # keep ssh's environment normal
 
     else:
-        if sudo:
-            # subprocess.run(env=...) would affect sudo, but sudo may drop env
-            # for the target command.
-            # So we inject env via `sudo env ... cmd`.
+        wrapped = elevate.wrap_local()
+        process_input = wrapped.stdin
+        if elevate.elevates:
+            # subprocess.run(env=...) would affect the elevator process,
+            # which may then drop env for the target command. Inject env
+            # via `env -i ... cmd` instead so it survives.
             if env is not None and resolved_env:
                 run_args = _prefix_env_cmd(run_args, resolved_env)
-
-            sudo_args = shlex.split(os.getenv("NIX_SUDOOPTS", ""))
-            final_args = ["sudo", *sudo_args, *run_args]
-
-            # No need to pass env to subprocess.run; keep sudo's own env
-            # default.
+            final_args = [*wrapped.prefix, *run_args]
             popen_env = None
         else:
-            # Non-sudo local: we can fully control the environment with
-            # subprocess.run(env=...)
+            # Unprivileged local: we can fully control the environment
+            # with subprocess.run(env=...)
             final_args = run_args
             popen_env = None if env is None else resolved_env
 
@@ -225,16 +188,14 @@ def run_wrapper(
 
         return r
     except KeyboardInterrupt:
-        # sudo commands are activation only and unlikely to be long running
-        if remote and not sudo:
+        # elevated commands are activation only and unlikely to be long
+        # running
+        if remote and not elevate.elevates:
             _kill_long_running_ssh_process(args, remote)
         raise
     except subprocess.CalledProcessError:
-        if sudo and remote and remote.sudo_password is None:
-            logger.error(
-                "while running command with remote sudo, did you forget to use "
-                "--ask-sudo-password?"
-            )
+        if remote and (hint := elevate.on_remote_failure()):
+            logger.error(hint)
         raise
 
 
@@ -268,7 +229,7 @@ def _resolve_env_local(env: dict[str, EnvValue]) -> dict[str, str]:
     return result
 
 
-def _prefix_env_cmd(cmd: Sequence[Arg], resolved_env: dict[str, str]) -> list[Arg]:
+def _prefix_env_cmd(cmd: Args, resolved_env: dict[str, str]) -> list[Arg]:
     """
     Prefix a command with `env -i K=V ... -- <cmd...>` to set vars for the
     command.
@@ -280,24 +241,6 @@ def _prefix_env_cmd(cmd: Sequence[Arg], resolved_env: dict[str, str]) -> list[Ar
     return ["env", "-i", *assigns, *cmd]
 
 
-def _remote_shell_script(env: Mapping[str, EnvValue]) -> str:
-    """
-    Build the POSIX shell wrapper used for remote execution over SSH.
-
-    SSH sends the remote command as a shell-interpreted command line, so we
-    need a wrapper to establish a clean environment before `exec`-ing the real
-    command. This wrapper is always run under `/bin/sh -c` so preserved
-    variables like `${PATH-}` do not depend on the remote user's login shell.
-    """
-    shell_assigns: list[str] = []
-    for k, v in env.items():
-        if v is PRESERVE_ENV:
-            shell_assigns.append(f'{k}="${{{k}-}}"')
-        else:
-            shell_assigns.append(f"{k}={shlex.quote(v)}")
-    return f'exec env -i {" ".join(shell_assigns)} "$@"'
-
-
 def _quote_remote_arg(arg: Arg) -> str:
     return shlex.quote(str(arg))
 
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py
index 4de74aa9c4d4..9994941ebb4d 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py
@@ -35,11 +35,7 @@ def reexec(
         return
 
     drv = None
-    # Parsing the args here but ignore ask_sudo_password since it is not
-    # needed and we would end up asking sudo password twice
-    if flake := Flake.from_arg(
-        args.flake, Remote.from_arg(args.target_host, ask_sudo_password=None)
-    ):
+    if flake := Flake.from_arg(args.flake, Remote.from_arg(args.target_host)):
         drv = nix.build_flake(
             NIXOS_REBUILD_ATTR,
             flake,
@@ -132,12 +128,12 @@ def _rollback_system(
 ) -> Path:
     match action:
         case Action.SWITCH | Action.BOOT:
-            path_to_config = nix.rollback(profile, target_host, sudo=args.sudo)
+            path_to_config = nix.rollback(profile, target_host, elevate=args.elevator)
         case Action.TEST | Action.BUILD:
             maybe_path_to_config = nix.rollback_temporary_profile(
                 profile,
                 target_host,
-                sudo=args.sudo,
+                elevate=args.elevator,
             )
             if maybe_path_to_config:
                 path_to_config = maybe_path_to_config
@@ -231,13 +227,13 @@ def _activate_system(
                 profile,
                 path_to_config,
                 target_host=target_host,
-                sudo=args.sudo,
+                elevate=args.elevator,
             )
             nix.switch_to_configuration(
                 path_to_config,
                 action,
                 target_host=target_host,
-                sudo=args.sudo,
+                elevate=args.elevator,
                 specialisation=args.specialisation,
                 install_bootloader=args.install_bootloader,
             )
@@ -247,7 +243,7 @@ def _activate_system(
                 path_to_config,
                 action,
                 target_host=target_host,
-                sudo=args.sudo,
+                elevate=args.elevator,
                 specialisation=args.specialisation,
                 install_bootloader=args.install_bootloader,
             )
@@ -302,6 +298,11 @@ def build_and_activate_system(
             copy_flags=grouped_nix_args.copy_flags,
         )
     elif args.rollback:
+        if target_host is not None:
+            # The elevated `nix-env --rollback` runs before path_to_config
+            # is known, so point the elevator at the profile to find a
+            # target-arch helper in the *current* generation's sw/bin.
+            args.elevator = args.elevator.for_target_config(profile.path)
         path_to_config = _rollback_system(
             action=action,
             args=args,
@@ -319,6 +320,11 @@ def build_and_activate_system(
             grouped_nix_args=grouped_nix_args,
         )
 
+    if target_host is not None and not args.rollback:
+        # Prefer the helper from the toplevel we just copied to the
+        # target (correct arch, independent of re-exec / nixpkgs pin).
+        args.elevator = args.elevator.for_target_config(path_to_config)
+
     current_config = Path("/run/current-system")
     if args.diff:
         if current_config.exists():
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_elevate.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_elevate.py
new file mode 100644
index 000000000000..25a1c3260cda
--- /dev/null
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_elevate.py
@@ -0,0 +1,155 @@
+from pathlib import PurePosixPath
+
+import pytest
+from pytest import MonkeyPatch
+
+import nixos_rebuild.elevate as e
+
+
+def test_no_elevator() -> None:
+    n = e.NoElevator()
+    assert not n.elevates
+    assert n.wrap_local() == e.Wrapped(prefix=[])
+    rw = n.wrap_remote({"PATH": e.PRESERVE_ENV}, ["cmd"])
+    assert rw.stdin is None
+    assert rw.argv[:2] == ["/bin/sh", "-c"]
+    assert rw.argv[-1] == "cmd"
+    with pytest.raises(e.ElevateError):
+        n.with_password("x")
+
+
+def test_sudo_elevator(monkeypatch: MonkeyPatch) -> None:
+    monkeypatch.delenv("NIX_SUDOOPTS", raising=False)
+
+    s = e.SudoElevator()
+    assert s.elevates
+    assert s.wrap_local() == e.Wrapped(prefix=["sudo"])
+    rw = s.wrap_remote({"PATH": e.PRESERVE_ENV}, ["cmd"])
+    assert rw.argv[0] == "sudo"
+    assert rw.argv[1:3] == ["/bin/sh", "-c"]
+    assert rw.stdin is None
+    assert s.on_remote_failure() is not None
+
+    sp = s.with_password("hunter2")
+    rw = sp.wrap_remote({"PATH": e.PRESERVE_ENV}, ["cmd"])
+    assert rw.argv[:3] == ["sudo", "--prompt=", "--stdin"]
+    assert rw.stdin == "hunter2\n"
+    assert sp.on_remote_failure() is None
+    # original unchanged
+    assert s.password is None
+
+
+def test_sudo_elevator_extra_opts(monkeypatch: MonkeyPatch) -> None:
+    monkeypatch.setenv("NIX_SUDOOPTS", "--preserve-env=FOO -H")
+    s = e.SudoElevator()
+    assert s.wrap_local() == e.Wrapped(prefix=["sudo", "--preserve-env=FOO", "-H"])
+    rw = s.with_password("p").wrap_remote({"PATH": e.PRESERVE_ENV}, ["cmd"])
+    assert rw.argv[:5] == ["sudo", "--prompt=", "--stdin", "--preserve-env=FOO", "-H"]
+    assert rw.stdin == "p\n"
+
+
+def test_run0_elevator() -> None:
+    r = e.Run0Elevator()
+    assert r.elevates
+    assert r.wrap_local() == e.Wrapped(prefix=["run0", "--"])
+    assert r.on_remote_failure() is not None
+
+    rp = r.with_password("hunter2")
+    w = rp.wrap_local()
+    assert w.prefix[0] == "polkit-stdin-agent"
+    assert "run0" in w.prefix
+    assert w.stdin == "hunter2\n"
+    # With a password the failure hint points at the agent, not at -S.
+    hint = rp.on_remote_failure()
+    assert hint is not None and "polkit-stdin-agent" in hint
+
+
+def test_run0_elevator_remote() -> None:
+    r = e.Run0Elevator()
+
+    # No password: /bin/sh wrapper around systemd-run, env passed via
+    # --setenv so it is resolved in the SSH login shell rather than
+    # inside the transient unit (which has a useless PATH on NixOS).
+    rw = r.wrap_remote(
+        {"PATH": e.PRESERVE_ENV, "NIXOS_INSTALL_BOOTLOADER": "1"},
+        ["nix-env", "-p", "/profile"],
+    )
+    assert rw.stdin is None
+    assert rw.argv[:2] == ["/bin/sh", "-c"]
+    script = rw.argv[2]
+    assert isinstance(script, str)
+    assert script.startswith("exec systemd-run --uid=0 --pipe ")
+    assert '--setenv=PATH="${PATH-}"' in script
+    assert "--setenv=NIXOS_INSTALL_BOOTLOADER=1" in script
+    assert script.endswith(' -- "$@"')
+    assert rw.argv[3:] == ["sh", "nix-env", "-p", "/profile"]
+
+    # With password: an agent-picker /bin/sh wraps the inner /bin/sh, so
+    # the agent is registered for the inner shell (and the systemd-run it
+    # execs into). With no toplevel bound the only candidate is bare-name
+    # PATH lookup.
+    rw = r.with_password("pw").wrap_remote({"PATH": e.PRESERVE_ENV}, ["cmd"])
+    assert rw.stdin == "pw\n"
+    assert rw.argv[:3] == ["/bin/sh", "-c", e.Run0Elevator._AGENT_PICKER]
+    sep = rw.argv.index("--")
+    assert rw.argv[3:sep] == ["sh", "polkit-stdin-agent"]
+    assert rw.argv[sep + 1 : sep + 3] == ["/bin/sh", "-c"]
+
+    # Explicit values containing spaces are shell-quoted inside the
+    # script (the whole thing is later shlex.quoted again for SSH).
+    rw = r.wrap_remote({"FOO": "a b"}, ["cmd"])
+    script = rw.argv[2]
+    assert isinstance(script, str)
+    assert "--setenv='FOO=a b'" in script
+
+
+def test_run0_for_target_config() -> None:
+    toplevel = PurePosixPath("/nix/store/aaaa-nixos-system")
+    r = e.Run0Elevator().with_password("pw").for_target_config(toplevel)
+    assert r.remote_agent == f"{toplevel}/sw/bin/polkit-stdin-agent"
+
+    rw = r.wrap_remote({"PATH": e.PRESERVE_ENV}, ["cmd"])
+    sep = rw.argv.index("--")
+    # Order matters: target-arch toplevel first, then PATH.
+    assert rw.argv[4:sep] == [
+        f"{toplevel}/sw/bin/polkit-stdin-agent",
+        "polkit-stdin-agent",
+    ]
+    # Inner argv is preserved verbatim after the separator.
+    assert rw.argv[sep + 1 : sep + 3] == ["/bin/sh", "-c"]
+    assert rw.argv[-1] == "cmd"
+
+    # Non-run0 elevators ignore the toplevel.
+    s = e.SudoElevator()
+    assert s.for_target_config(toplevel) is s
+
+
+def test_elevator_kind() -> None:
+    assert isinstance(e.ElevatorKind.from_name("sudo"), e.SudoElevator)
+    assert isinstance(e.ElevatorKind.from_name("run0"), e.Run0Elevator)
+    assert isinstance(e.ElevatorKind.from_name("none"), e.NoElevator)
+    with pytest.raises(e.ElevateError):
+        e.ElevatorKind.from_name("doas")
+    assert set(e.ElevatorKind.choices()) == {"none", "sudo", "run0"}
+
+
+def test_with_prompted_password(monkeypatch: MonkeyPatch) -> None:
+    prompts: list[str] = []
+
+    def fake_getpass(prompt: str) -> str:
+        prompts.append(prompt)
+        return "hunter2"
+
+    monkeypatch.setattr(e.getpass, "getpass", fake_getpass)
+
+    s = e.SudoElevator()
+    assert s.with_prompted_password(ask=False, host_label="x") is s
+    assert prompts == []
+
+    sp = s.with_prompted_password(ask=True, host_label="user@host")
+    assert isinstance(sp, e.SudoElevator)
+    assert sp.password == "hunter2"
+    assert prompts == ["[sudo] password for user@host: "]
+
+    with pytest.raises(e.ElevateError):
+        e.NoElevator().with_prompted_password(ask=True, host_label="localhost")
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
index 3ebba4edc5b6..1e0e5779ac90 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
@@ -21,6 +21,37 @@ DEFAULT_RUN_KWARGS = {
 }
 
 
+def test_parse_args_elevate() -> None:
+    r, _ = nr.parse_args(["nixos-rebuild", "switch"])
+    assert r.elevator is nr.elevate.NO_ELEVATOR
+
+    r, _ = nr.parse_args(["nixos-rebuild", "switch", "--elevate=sudo"])
+    assert isinstance(r.elevator, nr.elevate.SudoElevator)
+
+    r, _ = nr.parse_args(["nixos-rebuild", "switch", "--elevate=run0"])
+    assert isinstance(r.elevator, nr.elevate.Run0Elevator)
+
+    # back-compat aliases
+    for flag in ("--sudo", "--use-remote-sudo"):
+        r, _ = nr.parse_args(["nixos-rebuild", "switch", flag])
+        assert isinstance(r.elevator, nr.elevate.SudoElevator)
+
+    r, _ = nr.parse_args(["nixos-rebuild", "switch", "--ask-sudo-password"])
+    assert isinstance(r.elevator, nr.elevate.SudoElevator)
+    assert r.ask_elevate_password
+
+    # -S without --elevate implies sudo
+    r, _ = nr.parse_args(["nixos-rebuild", "switch", "-S"])
+    assert isinstance(r.elevator, nr.elevate.SudoElevator)
+
+    # explicit --elevate wins over the --sudo alias
+    r, _ = nr.parse_args(["nixos-rebuild", "switch", "--elevate=none", "--sudo"])
+    assert isinstance(r.elevator, nr.elevate.NoElevator)
+
+    with pytest.raises(SystemExit):
+        nr.parse_args(["nixos-rebuild", "switch", "--elevate=doas"])
+
+
 def test_parse_args() -> None:
     with pytest.raises(SystemExit) as e:
         nr.parse_args(["nixos-rebuild", "unknown-action"])
@@ -663,7 +694,7 @@ def test_execute_nix_switch_build_target_host(
                     "--",
                     "/bin/sh",
                     "-c",
-                    """'exec env -i PATH="${PATH-}" "$@"'""",
+                    """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
                     "sh",
                     "mktemp",
                     "-d",
@@ -682,7 +713,7 @@ def test_execute_nix_switch_build_target_host(
                     "--",
                     "/bin/sh",
                     "-c",
-                    """'exec env -i PATH="${PATH-}" "$@"'""",
+                    """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
                     "sh",
                     "nix-store",
                     "--realise",
@@ -702,7 +733,7 @@ def test_execute_nix_switch_build_target_host(
                     "--",
                     "/bin/sh",
                     "-c",
-                    """'exec env -i PATH="${PATH-}" "$@"'""",
+                    """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
                     "sh",
                     "readlink",
                     "-f",
@@ -720,7 +751,7 @@ def test_execute_nix_switch_build_target_host(
                     "--",
                     "/bin/sh",
                     "-c",
-                    """'exec env -i PATH="${PATH-}" "$@"'""",
+                    """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
                     "sh",
                     "rm",
                     "-rf",
@@ -753,7 +784,7 @@ def test_execute_nix_switch_build_target_host(
                     "sudo",
                     "/bin/sh",
                     "-c",
-                    """'exec env -i PATH="${PATH-}" "$@"'""",
+                    """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
                     "sh",
                     "nix-env",
                     "-p",
@@ -772,7 +803,7 @@ def test_execute_nix_switch_build_target_host(
                     "--",
                     "/bin/sh",
                     "-c",
-                    """'exec env -i PATH="${PATH-}" "$@"'""",
+                    """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
                     "sh",
                     "test",
                     "-d",
@@ -790,7 +821,7 @@ def test_execute_nix_switch_build_target_host(
                     "sudo",
                     "/bin/sh",
                     "-c",
-                    """'exec env -i PATH="${PATH-}" LOCALE_ARCHIVE="${LOCALE_ARCHIVE-}" NIXOS_NO_CHECK="${NIXOS_NO_CHECK-}" NIXOS_INSTALL_BOOTLOADER=0 "$@"'""",
+                    """'exec /usr/bin/env -i PATH="${PATH-}" LOCALE_ARCHIVE="${LOCALE_ARCHIVE-}" NIXOS_NO_CHECK="${NIXOS_NO_CHECK-}" NIXOS_INSTALL_BOOTLOADER=0 "$@"'""",
                     "sh",
                     *nr.nix.SWITCH_TO_CONFIGURATION_CMD_PREFIX,
                     str(config_path / "bin/switch-to-configuration"),
@@ -879,7 +910,7 @@ def test_execute_nix_switch_flake_target_host(
                     "sudo",
                     "/bin/sh",
                     "-c",
-                    """'exec env -i PATH="${PATH-}" "$@"'""",
+                    """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
                     "sh",
                     "nix-env",
                     "-p",
@@ -898,7 +929,7 @@ def test_execute_nix_switch_flake_target_host(
                     "--",
                     "/bin/sh",
                     "-c",
-                    """'exec env -i PATH="${PATH-}" "$@"'""",
+                    """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
                     "sh",
                     "test",
                     "-d",
@@ -916,7 +947,7 @@ def test_execute_nix_switch_flake_target_host(
                     "sudo",
                     "/bin/sh",
                     "-c",
-                    """'exec env -i PATH="${PATH-}" LOCALE_ARCHIVE="${LOCALE_ARCHIVE-}" NIXOS_NO_CHECK="${NIXOS_NO_CHECK-}" NIXOS_INSTALL_BOOTLOADER=0 "$@"'""",
+                    """'exec /usr/bin/env -i PATH="${PATH-}" LOCALE_ARCHIVE="${LOCALE_ARCHIVE-}" NIXOS_NO_CHECK="${NIXOS_NO_CHECK-}" NIXOS_INSTALL_BOOTLOADER=0 "$@"'""",
                     "sh",
                     *nr.nix.SWITCH_TO_CONFIGURATION_CMD_PREFIX,
                     str(config_path / "bin/switch-to-configuration"),
@@ -1004,7 +1035,7 @@ def test_execute_nix_switch_flake_build_host(
                     "--",
                     "/bin/sh",
                     "-c",
-                    """'exec env -i PATH="${PATH-}" "$@"'""",
+                    """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
                     "sh",
                     "nix",
                     "--extra-experimental-features",
@@ -1243,7 +1274,7 @@ def test_execute_build_dry_run_build_and_target_remote(
                     "--",
                     "/bin/sh",
                     "-c",
-                    """'exec env -i PATH="${PATH-}" "$@"'""",
+                    """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
                     "sh",
                     "nix",
                     "--extra-experimental-features",
@@ -1498,7 +1529,7 @@ def test_execute_switch_store_path_target_host(
                     "--",
                     "/bin/sh",
                     "-c",
-                    """'exec env -i PATH="${PATH-}" "$@"'""",
+                    """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
                     "sh",
                     "test",
                     "-f",
@@ -1516,7 +1547,7 @@ def test_execute_switch_store_path_target_host(
                     "sudo",
                     "/bin/sh",
                     "-c",
-                    """'exec env -i PATH="${PATH-}" "$@"'""",
+                    """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
                     "sh",
                     "nix-env",
                     "-p",
@@ -1535,7 +1566,7 @@ def test_execute_switch_store_path_target_host(
                     "--",
                     "/bin/sh",
                     "-c",
-                    """'exec env -i PATH="${PATH-}" "$@"'""",
+                    """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
                     "sh",
                     "test",
                     "-d",
@@ -1553,7 +1584,7 @@ def test_execute_switch_store_path_target_host(
                     "sudo",
                     "/bin/sh",
                     "-c",
-                    """'exec env -i PATH="${PATH-}" LOCALE_ARCHIVE="${LOCALE_ARCHIVE-}" NIXOS_NO_CHECK="${NIXOS_NO_CHECK-}" NIXOS_INSTALL_BOOTLOADER=0 "$@"'""",
+                    """'exec /usr/bin/env -i PATH="${PATH-}" LOCALE_ARCHIVE="${LOCALE_ARCHIVE-}" NIXOS_NO_CHECK="${NIXOS_NO_CHECK-}" NIXOS_INSTALL_BOOTLOADER=0 "$@"'""",
                     "sh",
                     *nr.nix.SWITCH_TO_CONFIGURATION_CMD_PREFIX,
                     str(config_path / "bin/switch-to-configuration"),
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_models.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_models.py
index 64ffce686976..fa9a41f93a42 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_models.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_models.py
@@ -81,7 +81,7 @@ def test_flake_parse(mock_node: Mock, tmpdir: Path, monkeypatch: MonkeyPatch) ->
         autospec=True,
         return_value=subprocess.CompletedProcess([], 0, stdout="remote\n"),
     ):
-        target_host = m.Remote("target@remote", [], None, "ssh")
+        target_host = m.Remote("target@remote", [], "ssh")
         assert m.Flake.parse("/path/to/flake", target_host) == m.Flake(
             "/path/to/flake", 'nixosConfigurations."remote"'
         )
@@ -201,7 +201,7 @@ def test_flake_from_arg(
         ),
     ):
         assert m.Flake.from_arg(
-            "/path/to", m.Remote("user@host", [], None, "ssh")
+            "/path/to", m.Remote("user@host", [], "ssh")
         ) == m.Flake("/path/to", 'nixosConfigurations."remote-hostname"')
 
 
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
index 9b225eca4e84..8100f396cdb7 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
@@ -9,12 +9,15 @@ from unittest.mock import ANY, Mock, call, patch
 import pytest
 from pytest import MonkeyPatch
 
+import nixos_rebuild.elevate as e
 import nixos_rebuild.models as m
 import nixos_rebuild.nix as n
 import nixos_rebuild.process as p
 
 from .helpers import get_qualified_name
 
+SUDO = e.SudoElevator()
+
 
 @patch(
     get_qualified_name(n.run_wrapper, n),
@@ -83,7 +86,7 @@ def test_build_flake(mock_run: Mock, monkeypatch: MonkeyPatch, tmpdir: Path) ->
 def test_build_remote(
     mock_uuid4: Mock, mock_run: Mock, monkeypatch: MonkeyPatch
 ) -> None:
-    build_host = m.Remote("user@host", [], None, "ssh")
+    build_host = m.Remote("user@host", [], "ssh")
     monkeypatch.setenv("NIX_SSHOPTS", "--ssh opts")
 
     def run_wrapper_side_effect(
@@ -177,7 +180,7 @@ def test_build_remote_flake(
 ) -> None:
     monkeypatch.chdir(tmpdir)
     flake = m.Flake.parse("/flake.nix#hostname")
-    build_host = m.Remote("user@host", [], None, "ssh")
+    build_host = m.Remote("user@host", [], "ssh")
     monkeypatch.setenv("NIX_SSHOPTS", "--ssh opts")
 
     assert n.build_remote_flake(
@@ -237,9 +240,9 @@ def test_copy_closure(monkeypatch: MonkeyPatch) -> None:
         n.copy_closure(closure, None)
         mock_run.assert_not_called()
 
-    target_host = m.Remote("user@target.host", [], None, "ssh")
-    build_host = m.Remote("user@build.host", [], None, "ssh")
-    target_host_ng = m.Remote("user@target.host", [], None, "ssh-ng")
+    target_host = m.Remote("user@target.host", [], "ssh")
+    build_host = m.Remote("user@build.host", [], "ssh")
+    target_host_ng = m.Remote("user@target.host", [], "ssh-ng")
     with patch(get_qualified_name(n.run_wrapper, n), autospec=True) as mock_run:
         n.copy_closure(closure, target_host)
         mock_run.assert_called_with(
@@ -531,15 +534,15 @@ def test_get_generations_from_nix_env(tmp_path: Path) -> None:
             ["nix-env", "-p", path, "--list-generations"],
             stdout=PIPE,
             remote=None,
-            sudo=False,
+            elevate=e.NO_ELEVATOR,
         )
 
-    remote = m.Remote("user@host", [], "password", "ssh")
+    remote = m.Remote("user@host", [], "ssh")
     with patch(
         get_qualified_name(n.run_wrapper, n), autospec=True, return_value=return_value
     ) as mock_run:
         assert n.get_generations_from_nix_env(
-            m.Profile("system", path), remote, True
+            m.Profile("system", path), remote, SUDO
         ) == [
             m.Generation(id=2082, current=False, timestamp="2024-11-07 22:58:56"),
             m.Generation(id=2083, current=False, timestamp="2024-11-07 22:59:41"),
@@ -549,7 +552,7 @@ def test_get_generations_from_nix_env(tmp_path: Path) -> None:
             ["nix-env", "-p", path, "--list-generations"],
             stdout=PIPE,
             remote=remote,
-            sudo=True,
+            elevate=SUDO,
         )
 
 
@@ -640,19 +643,19 @@ def test_rollback(mock_run: Mock, tmp_path: Path) -> None:
 
     profile = m.Profile("system", path)
 
-    assert n.rollback(profile, None, False) == profile.path
+    assert n.rollback(profile, None, e.NO_ELEVATOR) == profile.path
     mock_run.assert_called_with(
         ["nix-env", "--rollback", "-p", path],
         remote=None,
-        sudo=False,
+        elevate=e.NO_ELEVATOR,
     )
 
-    target_host = m.Remote("user@localhost", [], None, "ssh")
-    assert n.rollback(profile, target_host, True) == profile.path
+    target_host = m.Remote("user@localhost", [], "ssh")
+    assert n.rollback(profile, target_host, SUDO) == profile.path
     mock_run.assert_called_with(
         ["nix-env", "--rollback", "-p", path],
         remote=target_host,
-        sudo=True,
+        elevate=SUDO,
     )
 
 
@@ -672,7 +675,7 @@ def test_rollback_temporary_profile(tmp_path: Path) -> None:
                 """),
         )
         assert (
-            n.rollback_temporary_profile(m.Profile("system", path), None, False)
+            n.rollback_temporary_profile(m.Profile("system", path), None, e.NO_ELEVATOR)
             == path.parent / "system-2083-link"
         )
         mock_run.assert_called_with(
@@ -684,12 +687,12 @@ def test_rollback_temporary_profile(tmp_path: Path) -> None:
             ],
             stdout=PIPE,
             remote=None,
-            sudo=False,
+            elevate=e.NO_ELEVATOR,
         )
 
-        target_host = m.Remote("user@localhost", [], None, "ssh")
+        target_host = m.Remote("user@localhost", [], "ssh")
         assert (
-            n.rollback_temporary_profile(m.Profile("foo", path), target_host, True)
+            n.rollback_temporary_profile(m.Profile("foo", path), target_host, SUDO)
             == path.parent / "foo-2083-link"
         )
         mock_run.assert_called_with(
@@ -701,12 +704,12 @@ def test_rollback_temporary_profile(tmp_path: Path) -> None:
             ],
             stdout=PIPE,
             remote=target_host,
-            sudo=True,
+            elevate=SUDO,
         )
 
     with patch(get_qualified_name(n.run_wrapper, n), autospec=True) as mock_run:
         mock_run.return_value = CompletedProcess([], 0, stdout="")
-        assert n.rollback_temporary_profile(profile, None, False) is None
+        assert n.rollback_temporary_profile(profile, None, e.NO_ELEVATOR) is None
 
 
 @patch(get_qualified_name(n.run_wrapper, n), autospec=True)
@@ -719,25 +722,25 @@ def test_set_profile(mock_run: Mock) -> None:
         m.Profile("system", profile_path),
         config_path,
         target_host=None,
-        sudo=False,
+        elevate=e.NO_ELEVATOR,
     )
 
     mock_run.assert_called_with(
         ["nix-env", "-p", profile_path, "--set", config_path],
         remote=None,
-        sudo=False,
+        elevate=e.NO_ELEVATOR,
     )
 
     mock_run.return_value = CompletedProcess([], 1)
 
-    with pytest.raises(m.NixOSRebuildError) as e:
+    with pytest.raises(m.NixOSRebuildError) as exc:
         n.set_profile(
             m.Profile("system", profile_path),
             config_path,
             target_host=None,
-            sudo=False,
+            elevate=e.NO_ELEVATOR,
         )
-    assert str(e.value).startswith(
+    assert str(exc.value).startswith(
         "error: your NixOS configuration path seems to be missing essential files."
     )
 
@@ -756,7 +759,7 @@ def test_switch_to_configuration_without_systemd_run(
         n.switch_to_configuration(
             profile_path,
             m.Action.SWITCH,
-            sudo=False,
+            elevate=e.NO_ELEVATOR,
             target_host=None,
             specialisation=None,
             install_bootloader=False,
@@ -764,29 +767,29 @@ def test_switch_to_configuration_without_systemd_run(
     mock_run.assert_called_with(
         [profile_path / "bin/switch-to-configuration", "switch"],
         env={
-            "LOCALE_ARCHIVE": p.PRESERVE_ENV,
-            "NIXOS_NO_CHECK": p.PRESERVE_ENV,
+            "LOCALE_ARCHIVE": e.PRESERVE_ENV,
+            "NIXOS_NO_CHECK": e.PRESERVE_ENV,
             "NIXOS_INSTALL_BOOTLOADER": "0",
         },
-        sudo=False,
+        elevate=e.NO_ELEVATOR,
         remote=None,
         stdout=sys.stderr,
     )
 
-    with pytest.raises(m.NixOSRebuildError) as e:
+    with pytest.raises(m.NixOSRebuildError) as exc:
         n.switch_to_configuration(
             config_path,
             m.Action.BOOT,
-            sudo=False,
+            elevate=e.NO_ELEVATOR,
             target_host=None,
             specialisation="special",
         )
     assert (
-        str(e.value)
+        str(exc.value)
         == "error: '--specialisation' can only be used with 'switch' and 'test'"
     )
 
-    target_host = m.Remote("user@localhost", [], None, "ssh")
+    target_host = m.Remote("user@localhost", [], "ssh")
     with monkeypatch.context() as mp:
         mp.setenv("LOCALE_ARCHIVE", "/path/to/locale")
         mp.setenv("PATH", "/path/to/bin")
@@ -795,7 +798,7 @@ def test_switch_to_configuration_without_systemd_run(
         n.switch_to_configuration(
             Path("/path/to/config"),
             m.Action.TEST,
-            sudo=True,
+            elevate=SUDO,
             target_host=target_host,
             install_bootloader=True,
             specialisation="special",
@@ -806,11 +809,11 @@ def test_switch_to_configuration_without_systemd_run(
             "test",
         ],
         env={
-            "LOCALE_ARCHIVE": p.PRESERVE_ENV,
-            "NIXOS_NO_CHECK": p.PRESERVE_ENV,
+            "LOCALE_ARCHIVE": e.PRESERVE_ENV,
+            "NIXOS_NO_CHECK": e.PRESERVE_ENV,
             "NIXOS_INSTALL_BOOTLOADER": "1",
         },
-        sudo=True,
+        elevate=SUDO,
         remote=target_host,
         stdout=sys.stderr,
     )
@@ -830,7 +833,7 @@ def test_switch_to_configuration_with_systemd_run(
         n.switch_to_configuration(
             profile_path,
             m.Action.SWITCH,
-            sudo=False,
+            elevate=e.NO_ELEVATOR,
             target_host=None,
             specialisation=None,
             install_bootloader=False,
@@ -842,16 +845,16 @@ def test_switch_to_configuration_with_systemd_run(
             "switch",
         ],
         env={
-            "LOCALE_ARCHIVE": p.PRESERVE_ENV,
-            "NIXOS_NO_CHECK": p.PRESERVE_ENV,
+            "LOCALE_ARCHIVE": e.PRESERVE_ENV,
+            "NIXOS_NO_CHECK": e.PRESERVE_ENV,
             "NIXOS_INSTALL_BOOTLOADER": "0",
         },
-        sudo=False,
+        elevate=e.NO_ELEVATOR,
         remote=None,
         stdout=sys.stderr,
     )
 
-    target_host = m.Remote("user@localhost", [], None, "ssh")
+    target_host = m.Remote("user@localhost", [], "ssh")
     with monkeypatch.context() as mp:
         mp.setenv("LOCALE_ARCHIVE", "/path/to/locale")
         mp.setenv("PATH", "/path/to/bin")
@@ -860,7 +863,7 @@ def test_switch_to_configuration_with_systemd_run(
         n.switch_to_configuration(
             Path("/path/to/config"),
             m.Action.TEST,
-            sudo=True,
+            elevate=SUDO,
             target_host=target_host,
             install_bootloader=True,
             specialisation="special",
@@ -872,11 +875,11 @@ def test_switch_to_configuration_with_systemd_run(
             "test",
         ],
         env={
-            "LOCALE_ARCHIVE": p.PRESERVE_ENV,
-            "NIXOS_NO_CHECK": p.PRESERVE_ENV,
+            "LOCALE_ARCHIVE": e.PRESERVE_ENV,
+            "NIXOS_NO_CHECK": e.PRESERVE_ENV,
             "NIXOS_INSTALL_BOOTLOADER": "1",
         },
-        sudo=True,
+        elevate=SUDO,
         remote=target_host,
         stdout=sys.stderr,
     )
@@ -887,11 +890,13 @@ def test_switch_to_configuration_with_systemd_run(
 def test_upgrade_channels(mock_run: Mock, mock_geteuid: Mock, tmpdir: Path) -> None:
     tmp_path = Path(tmpdir)
 
-    with pytest.raises(m.NixOSRebuildError) as e:
-        n.upgrade_channels(all_channels=False, sudo=False, channels_dir=tmp_path)
-    assert str(e.value) == (
+    with pytest.raises(m.NixOSRebuildError) as exc:
+        n.upgrade_channels(
+            all_channels=False, elevate=e.NO_ELEVATOR, channels_dir=tmp_path
+        )
+    assert str(exc.value) == (
         "error: if you pass the '--upgrade' or '--upgrade-all' flag, you must "
-        "also pass '--sudo' or run the command as root (e.g., with sudo)"
+        "also pass '--elevate' or run the command as root"
     )
 
     (tmp_path / "nixos").mkdir()
@@ -899,19 +904,20 @@ def test_upgrade_channels(mock_run: Mock, mock_geteuid: Mock, tmpdir: Path) -> N
     (tmp_path / "nixos-hardware" / ".update-on-nixos-rebuild").touch()
     (tmp_path / "home-manager").mkdir()
 
-    # should work because we are passing sudo=True even with os.geteuid == 1000
-    n.upgrade_channels(all_channels=False, sudo=True, channels_dir=tmp_path)
+    # should work because we are passing an elevator even with os.geteuid == 1000
+    n.upgrade_channels(all_channels=False, elevate=SUDO, channels_dir=tmp_path)
+    # Path.glob order is filesystem-dependent, so don't assert call order.
     mock_run.assert_has_calls(
         [
             call(
                 ["nix-channel", "--update", "nixos-hardware"],
                 check=False,
-                sudo=True,
+                elevate=SUDO,
             ),
             call(
                 ["nix-channel", "--update", "nixos"],
                 check=False,
-                sudo=True,
+                elevate=SUDO,
             ),
         ],
         any_order=True,
@@ -921,23 +927,23 @@ def test_upgrade_channels(mock_run: Mock, mock_geteuid: Mock, tmpdir: Path) -> N
     # root check
     mock_geteuid.return_value = 0
 
-    n.upgrade_channels(all_channels=True, sudo=False, channels_dir=tmp_path)
+    n.upgrade_channels(all_channels=True, elevate=e.NO_ELEVATOR, channels_dir=tmp_path)
     mock_run.assert_has_calls(
         [
             call(
                 ["nix-channel", "--update", "home-manager"],
                 check=False,
-                sudo=False,
+                elevate=e.NO_ELEVATOR,
             ),
             call(
                 ["nix-channel", "--update", "nixos-hardware"],
                 check=False,
-                sudo=False,
+                elevate=e.NO_ELEVATOR,
             ),
             call(
                 ["nix-channel", "--update", "nixos"],
                 check=False,
-                sudo=False,
+                elevate=e.NO_ELEVATOR,
             ),
         ],
         any_order=True,
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_process.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_process.py
index 3780b21f26d5..2abdd26ebe07 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_process.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_process.py
@@ -3,28 +3,46 @@ from unittest.mock import patch
 
 from pytest import MonkeyPatch
 
+import nixos_rebuild.elevate as e
 import nixos_rebuild.models as m
 import nixos_rebuild.process as p
 
 
-def test_remote_shell_script() -> None:
-    assert p._remote_shell_script({"PATH": p.PRESERVE_ENV}) == (
-        '''exec env -i PATH="${PATH-}" "$@"'''
-    )
-    assert p._remote_shell_script(
+def test_remote_env_shell_argv() -> None:
+    assert e._remote_env_shell_argv([], {"PATH": e.PRESERVE_ENV}, ["cmd"]) == [
+        "/bin/sh",
+        "-c",
+        '''exec /usr/bin/env -i PATH="${PATH-}" "$@"''',
+        "sh",
+        "cmd",
+    ]
+    assert e._remote_env_shell_argv(
+        ["sudo"],
         {
-            "PATH": p.PRESERVE_ENV,
-            "LOCALE_ARCHIVE": p.PRESERVE_ENV,
-            "NIXOS_NO_CHECK": p.PRESERVE_ENV,
+            "PATH": e.PRESERVE_ENV,
+            "LOCALE_ARCHIVE": e.PRESERVE_ENV,
+            "NIXOS_NO_CHECK": e.PRESERVE_ENV,
             "NIXOS_INSTALL_BOOTLOADER": "0",
-        }
-    ) == (
-        """exec env -i PATH="${PATH-}" LOCALE_ARCHIVE="${LOCALE_ARCHIVE-}" """
-        '''NIXOS_NO_CHECK="${NIXOS_NO_CHECK-}" NIXOS_INSTALL_BOOTLOADER=0 "$@"'''
-    )
-    assert p._remote_shell_script({"PATH": p.PRESERVE_ENV, "FOO": "some value"}) == (
-        '''exec env -i PATH="${PATH-}" FOO='some value' "$@"'''
-    )
+        },
+        ["cmd", "arg"],
+    ) == [
+        "sudo",
+        "/bin/sh",
+        "-c",
+        """exec /usr/bin/env -i PATH="${PATH-}" LOCALE_ARCHIVE="${LOCALE_ARCHIVE-}" """
+        '''NIXOS_NO_CHECK="${NIXOS_NO_CHECK-}" NIXOS_INSTALL_BOOTLOADER=0 "$@"''',
+        "sh",
+        "cmd",
+        "arg",
+    ]
+    assert e._remote_env_shell_argv(
+        [], {"PATH": e.PRESERVE_ENV, "FOO": "some value"}, []
+    ) == [
+        "/bin/sh",
+        "-c",
+        '''exec /usr/bin/env -i PATH="${PATH-}" FOO='some value' "$@"''',
+        "sh",
+    ]
 
 
 @patch.dict(p.os.environ, {"PATH": "/path/to/bin"}, clear=True)
@@ -43,7 +61,7 @@ def test_run_wrapper(mock_run: Any) -> None:
     p.run_wrapper(
         ["test", "--with", "flags"],
         check=False,
-        sudo=True,
+        elevate=e.SudoElevator(),
         env={"FOO": "bar"},
     )
     mock_run.assert_called_with(
@@ -67,7 +85,6 @@ def test_run_wrapper(mock_run: Any) -> None:
     p.run_wrapper(
         ["test", "--with", "flags"],
         check=False,
-        sudo=False,
         append_local_env={"FOO": "bar"},
     )
     mock_run.assert_called_with(
@@ -89,7 +106,6 @@ def test_run_wrapper(mock_run: Any) -> None:
     p.run_wrapper(
         ["test", "--with", "flags"],
         check=False,
-        sudo=False,
         env={"PATH": "/"},
         append_local_env={"FOO": "bar"},
     )
@@ -112,7 +128,7 @@ def test_run_wrapper(mock_run: Any) -> None:
     p.run_wrapper(
         ["test", "--with", "some flags"],
         check=True,
-        remote=m.Remote("user@localhost", ["--ssh", "opt"], "password", "ssh"),
+        remote=m.Remote("user@localhost", ["--ssh", "opt"], "ssh"),
     )
     mock_run.assert_called_with(
         [
@@ -124,7 +140,7 @@ def test_run_wrapper(mock_run: Any) -> None:
             "--",
             "/bin/sh",
             "-c",
-            """'exec env -i PATH="${PATH-}" "$@"'""",
+            """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
             "sh",
             "test",
             "--with",
@@ -140,9 +156,9 @@ def test_run_wrapper(mock_run: Any) -> None:
     p.run_wrapper(
         ["test", "--with", "flags"],
         check=True,
-        sudo=True,
+        elevate=e.SudoElevator(password="password"),
         env={"FOO": "bar"},
-        remote=m.Remote("user@localhost", ["--ssh", "opt"], "password", "ssh"),
+        remote=m.Remote("user@localhost", ["--ssh", "opt"], "ssh"),
     )
     mock_run.assert_called_with(
         [
@@ -157,7 +173,7 @@ def test_run_wrapper(mock_run: Any) -> None:
             "--stdin",
             "/bin/sh",
             "-c",
-            """'exec env -i PATH="${PATH-}" FOO=bar "$@"'""",
+            """'exec /usr/bin/env -i PATH="${PATH-}" FOO=bar "$@"'""",
             "sh",
             "test",
             "--with",
@@ -181,7 +197,7 @@ def test__kill_long_running_ssh_process(mock_run: Any) -> None:
             "build",
             "/nix/store/la0c8nmpr9xfclla0n4f3qq9iwgdrq4g-nixos-system-sankyuu-nixos-25.05.20250424.f771eb4.drv^*",
         ],
-        m.Remote("user@localhost", opts=[], sudo_password=None, store_type="ssh"),
+        m.Remote("user@localhost", opts=[], store_type="ssh"),
     )
     mock_run.assert_called_with(
         [
@@ -204,21 +220,18 @@ def test__kill_long_running_ssh_process(mock_run: Any) -> None:
 
 def test_remote_from_name(monkeypatch: MonkeyPatch) -> None:
     monkeypatch.setenv("NIX_SSHOPTS", "")
-    assert m.Remote.from_arg("user@localhost", None, False) == m.Remote(
+    assert m.Remote.from_arg("user@localhost", validate_opts=False) == m.Remote(
         "user@localhost",
         opts=[],
-        sudo_password=None,
         store_type="ssh",
     )
 
-    with patch("getpass.getpass", autospec=True, return_value="password"):
-        monkeypatch.setenv("NIX_SSHOPTS", "-f foo -b bar -t")
-        assert m.Remote.from_arg("user@localhost", True, True) == m.Remote(
-            "user@localhost",
-            opts=["-f", "foo", "-b", "bar", "-t"],
-            sudo_password="password",
-            store_type="ssh",
-        )
+    monkeypatch.setenv("NIX_SSHOPTS", "-f foo -b bar -t")
+    assert m.Remote.from_arg("user@localhost") == m.Remote(
+        "user@localhost",
+        opts=["-f", "foo", "-b", "bar", "-t"],
+        store_type="ssh",
+    )
 
 
 def test_ssh_host() -> None:
@@ -240,18 +253,94 @@ def test_ssh_host() -> None:
     }
 
     for host_input, expected in ssh_remotes.items():
-        remote = m.Remote.from_arg(host_input, None, False)
+        remote = m.Remote.from_arg(host_input, validate_opts=False)
         assert remote is not None
         assert remote.ssh_host() == expected
         assert remote.store_type == "ssh"
 
     for host_input, expected in ssh_ng_remotes.items():
-        remote = m.Remote.from_arg(host_input, None, False)
+        remote = m.Remote.from_arg(host_input, validate_opts=False)
         assert remote is not None
         assert remote.ssh_host() == expected
         assert remote.store_type == "ssh-ng"
 
 
+@patch.dict(p.os.environ, {"PATH": "/path/to/bin"}, clear=True)
+@patch("subprocess.run", autospec=True)
+def test_run_wrapper_run0(mock_run: Any) -> None:
+    p.run_wrapper(["cmd", "arg"], elevate=e.Run0Elevator())
+    mock_run.assert_called_with(
+        ["run0", "--", "cmd", "arg"],
+        check=True,
+        text=True,
+        errors="surrogateescape",
+        env=None,
+        input=None,
+    )
+
+    run0_script = (
+        "exec systemd-run --uid=0 --pipe --quiet --wait --collect "
+        "--service-type=exec --send-sighup "
+        '--setenv=PATH="${PATH-}" -- "$@"'
+    )
+
+    p.run_wrapper(
+        ["cmd", "arg"],
+        elevate=e.Run0Elevator(),
+        remote=m.Remote("user@host", [], "ssh"),
+    )
+    mock_run.assert_called_with(
+        [
+            "ssh",
+            *p.SSH_DEFAULT_OPTS,
+            "user@host",
+            "--",
+            "/bin/sh",
+            "-c",
+            p._quote_remote_arg(run0_script),
+            "sh",
+            "cmd",
+            "arg",
+        ],
+        check=True,
+        text=True,
+        errors="surrogateescape",
+        env=None,
+        input=None,
+    )
+
+    p.run_wrapper(
+        ["cmd"],
+        elevate=e.Run0Elevator().with_password("pw"),
+        remote=m.Remote("user@host", [], "ssh"),
+    )
+    mock_run.assert_called_with(
+        [
+            "ssh",
+            *p.SSH_DEFAULT_OPTS,
+            "user@host",
+            "--",
+            "/bin/sh",
+            "-c",
+            p._quote_remote_arg(e.Run0Elevator._AGENT_PICKER),
+            "sh",
+            # No toplevel bound, so the only candidate is PATH lookup.
+            "polkit-stdin-agent",
+            "--",
+            "/bin/sh",
+            "-c",
+            p._quote_remote_arg(run0_script),
+            "sh",
+            "cmd",
+        ],
+        check=True,
+        text=True,
+        errors="surrogateescape",
+        env=None,
+        input="pw\n",
+    )
+
+
 @patch("subprocess.run", autospec=True)
 def test_custom_sudo_args(mock_run: Any) -> None:
     with patch.dict(
@@ -262,7 +351,7 @@ def test_custom_sudo_args(mock_run: Any) -> None:
         p.run_wrapper(
             ["test"],
             check=False,
-            sudo=True,
+            elevate=e.SudoElevator(),
         )
     mock_run.assert_called_with(
         [
@@ -287,8 +376,8 @@ def test_custom_sudo_args(mock_run: Any) -> None:
         p.run_wrapper(
             ["test"],
             check=False,
-            sudo=True,
-            remote=m.Remote("user@localhost", [], None, "ssh"),
+            elevate=e.SudoElevator(),
+            remote=m.Remote("user@localhost", [], "ssh"),
         )
     mock_run.assert_called_with(
         [
@@ -302,7 +391,7 @@ def test_custom_sudo_args(mock_run: Any) -> None:
             "--args",
             "/bin/sh",
             "-c",
-            """'exec env -i PATH="${PATH-}" "$@"'""",
+            """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
             "sh",
             "test",
         ],
diff --git a/pkgs/by-name/ns/nsplist/package.nix b/pkgs/by-name/ns/nsplist/package.nix
index aa649c2d0cc3..98dd27fe5519 100644
--- a/pkgs/by-name/ns/nsplist/package.nix
+++ b/pkgs/by-name/ns/nsplist/package.nix
@@ -35,6 +35,7 @@ stdenv.mkDerivation {
   meta = {
     maintainers = [ ];
     description = "Parses .plist files";
+    homepage = "https://github.com/matthewbauer/NSPlist";
     license = lib.licenses.mit;
     platforms = lib.platforms.unix;
   };
diff --git a/pkgs/by-name/nu/numlockx/package.nix b/pkgs/by-name/nu/numlockx/package.nix
index c02817dae95f..9b561c60c7d9 100644
--- a/pkgs/by-name/nu/numlockx/package.nix
+++ b/pkgs/by-name/nu/numlockx/package.nix
@@ -26,6 +26,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Allows to start X with NumLock turned on";
+    homepage = "https://github.com/rg3/numlockx";
     license = lib.licenses.mit;
     platforms = lib.platforms.all;
     mainProgram = "numlockx";
diff --git a/pkgs/by-name/nu/nushell-plugin-desktop_notifications/package.nix b/pkgs/by-name/nu/nushell-plugin-desktop_notifications/package.nix
index f21d01f6b55c..e4bb6cbe4175 100644
--- a/pkgs/by-name/nu/nushell-plugin-desktop_notifications/package.nix
+++ b/pkgs/by-name/nu/nushell-plugin-desktop_notifications/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "nu_plugin_desktop_notifications";
-  version = "0.112.2";
+  version = "0.113.1";
 
   src = fetchFromGitHub {
     owner = "FMotalleb";
     repo = "nu_plugin_desktop_notifications";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-u/7KUcVoNAAxY+FQe7kB8Yuj2mygdNvS242I+HTA6Ac=";
+    hash = "sha256-aA47T3Fxo2eH0JclZRC7zY4RK8eRnAqj712LhgXEMpU=";
   };
 
-  cargoHash = "sha256-xgCXB06QXl97udmgmnHodNSV/aK2UXaBmdo6dIhG4lo=";
+  cargoHash = "sha256-e/q/X0Temmkoj6DcPLUC+QfN9lVDrE4esVEx9LF4bHc=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/od/odroid-xu3-bootloader/package.nix b/pkgs/by-name/od/odroid-xu3-bootloader/package.nix
index 7868f85c0ed7..b559cc3a6c73 100644
--- a/pkgs/by-name/od/odroid-xu3-bootloader/package.nix
+++ b/pkgs/by-name/od/odroid-xu3-bootloader/package.nix
@@ -37,6 +37,7 @@ stdenv.mkDerivation {
     platforms = lib.platforms.linux;
     license = lib.licenses.unfreeRedistributableFirmware;
     description = "Secure boot enabled boot loader for ODROID-XU{3,4}";
+    homepage = "https://github.com/hardkernel/u-boot";
     maintainers = [ ];
   };
 }
diff --git a/pkgs/by-name/oi/ois/package.nix b/pkgs/by-name/oi/ois/package.nix
index e619fa6f72ad..2565c1a9a193 100644
--- a/pkgs/by-name/oi/ois/package.nix
+++ b/pkgs/by-name/oi/ois/package.nix
@@ -33,6 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Object-oriented C++ input system";
+    homepage = "https://github.com/wgois/OIS";
     maintainers = [ lib.maintainers.raskin ];
     platforms = lib.platforms.unix;
     license = lib.licenses.zlib;
diff --git a/pkgs/by-name/on/onioncircuits/package.nix b/pkgs/by-name/on/onioncircuits/package.nix
index 40607c3f08a1..10b5fa1689f3 100644
--- a/pkgs/by-name/on/onioncircuits/package.nix
+++ b/pkgs/by-name/on/onioncircuits/package.nix
@@ -35,6 +35,7 @@ python3.pkgs.buildPythonApplication rec {
   dependencies = with python3.pkgs; [
     pygobject3
     stem
+    pycountry
   ];
 
   postInstall = ''
diff --git a/pkgs/by-name/op/open-vm-tools/package.nix b/pkgs/by-name/op/open-vm-tools/package.nix
index 8d0823306974..6736e664eccc 100644
--- a/pkgs/by-name/op/open-vm-tools/package.nix
+++ b/pkgs/by-name/op/open-vm-tools/package.nix
@@ -15,6 +15,7 @@
   pciutils,
   procps,
   libtirpc,
+  libtool,
   rpcsvc-proto,
   libx11,
   libxext,
@@ -71,8 +72,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     autoreconfHook
+    glib # provides glib-genmarshal at build time
     makeWrapper
     pkg-config
+    rpcsvc-proto # provides rpcgen at build time
     udevCheckHook
   ];
 
@@ -84,12 +87,12 @@ stdenv.mkDerivation (finalAttrs: {
     libdrm
     libmspack
     libtirpc
+    libtool # provides libltdl (libxmlsec dynamic loading)
     libxcrypt
     libxml2
     openssl
     pam
     procps
-    rpcsvc-proto
     udev
     xercesc
     xmlsec
@@ -186,6 +189,8 @@ stdenv.mkDerivation (finalAttrs: {
       }"
   '';
 
+  strictDeps = true;
+
   meta = {
     homepage = "https://github.com/vmware/open-vm-tools";
     changelog = "https://github.com/vmware/open-vm-tools/releases/tag/stable-${finalAttrs.version}";
diff --git a/pkgs/by-name/or/orthorobot/package.nix b/pkgs/by-name/or/orthorobot/package.nix
index 416ea142b70c..e2516d336447 100644
--- a/pkgs/by-name/or/orthorobot/package.nix
+++ b/pkgs/by-name/or/orthorobot/package.nix
@@ -79,6 +79,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Recharge the robot";
+    homepage = "https://github.com/Stabyourself/orthorobot";
     mainProgram = "orthorobot";
     platforms = love.meta.platforms;
     license = lib.licenses.wtfpl;
diff --git a/pkgs/by-name/os/ostui/package.nix b/pkgs/by-name/os/ostui/package.nix
index 51a739a57f6f..7b21f97e0515 100644
--- a/pkgs/by-name/os/ostui/package.nix
+++ b/pkgs/by-name/os/ostui/package.nix
@@ -8,13 +8,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "ostui";
-  version = "1.0.5";
+  version = "1.1.1";
 
   src = fetchFromSourcehut {
     owner = "~ser";
     repo = "ostui";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-85vCyKcQIGjO6raYgKUt4D3N9UjbBJmEKkWxUB4Av48=";
+    hash = "sha256-5QwI4E6OqxnFPSgWsowNRolK6yi4tQR8ZyADzYw7tNY=";
   };
 
   vendorHash = "sha256-3FP+qZChS9A8R6il282pkyFweeOolrAu0L0WFcnrdKI=";
diff --git a/pkgs/by-name/ox/oxygenfonts/package.nix b/pkgs/by-name/ox/oxygenfonts/package.nix
index 584d1b8e1c86..78a3613c3fd3 100644
--- a/pkgs/by-name/ox/oxygenfonts/package.nix
+++ b/pkgs/by-name/ox/oxygenfonts/package.nix
@@ -51,6 +51,7 @@ stdenvNoCC.mkDerivation {
       See: http://sansoxygen.com/
     '';
 
+    homepage = "https://github.com/vernnobile/oxygenFont";
     license = lib.licenses.ofl;
     platforms = lib.platforms.all;
   };
diff --git a/pkgs/by-name/pa/pa_applet/package.nix b/pkgs/by-name/pa/pa_applet/package.nix
index c32aabca6e67..607d50e27c64 100644
--- a/pkgs/by-name/pa/pa_applet/package.nix
+++ b/pkgs/by-name/pa/pa_applet/package.nix
@@ -49,6 +49,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "";
+    homepage = "https://github.com/fernandotcl/pa-applet";
     mainProgram = "pa-applet";
     license = lib.licenses.bsd2;
     maintainers = [ ];
diff --git a/pkgs/by-name/pb/pbzx/package.nix b/pkgs/by-name/pb/pbzx/package.nix
index a895863821ab..8aee634e3b83 100644
--- a/pkgs/by-name/pb/pbzx/package.nix
+++ b/pkgs/by-name/pb/pbzx/package.nix
@@ -29,6 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
   meta = {
     description = "Stream parser of Apple's pbzx compression format";
+    homepage = "https://github.com/NiklasRosenstein/pbzx";
     platforms = lib.platforms.unix;
     license = lib.licenses.gpl3;
     maintainers = [ ];
diff --git a/pkgs/by-name/pd/pdftag/package.nix b/pkgs/by-name/pd/pdftag/package.nix
index bae1464c9eb9..738ab6684c41 100644
--- a/pkgs/by-name/pd/pdftag/package.nix
+++ b/pkgs/by-name/pd/pdftag/package.nix
@@ -36,6 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Edit metadata found in PDFs";
+    homepage = "https://github.com/arrufat/pdftag";
     license = lib.licenses.gpl3;
     platforms = lib.platforms.unix;
     mainProgram = "pdftag";
diff --git a/pkgs/by-name/ph/physlock/package.nix b/pkgs/by-name/ph/physlock/package.nix
index 9df8771e3fdf..7d484d4d4c5a 100644
--- a/pkgs/by-name/ph/physlock/package.nix
+++ b/pkgs/by-name/ph/physlock/package.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation (finalAttrs: {
   version = "13";
   pname = "physlock";
   src = fetchFromGitHub {
-    owner = "muennich";
+    owner = "xyb3rt";
     repo = "physlock";
     rev = "v${finalAttrs.version}";
     sha256 = "1mz4xxjip5ldiw9jgfq9zvqb6w10bcjfx6939w1appqg8f521a7s";
@@ -33,6 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Secure suspend/hibernate-friendly alternative to `vlock -an`";
+    homepage = "https://github.com/xyb3rt/physlock";
     mainProgram = "physlock";
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/pi/pi-coding-agent/package.nix b/pkgs/by-name/pi/pi-coding-agent/package.nix
index e37c769445f7..05a9ce5246de 100644
--- a/pkgs/by-name/pi/pi-coding-agent/package.nix
+++ b/pkgs/by-name/pi/pi-coding-agent/package.nix
@@ -12,16 +12,16 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "pi-coding-agent";
-  version = "0.75.4";
+  version = "0.78.0";
 
   src = fetchFromGitHub {
     owner = "earendil-works";
     repo = "pi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zyIgs2N7uVz+7E+NqxH78baRw0OwXvlrjZiDIP/v0M4=";
+    hash = "sha256-Cw+W5w6yuL+cH+JfgCbEwiyeXloMb7yFd46TXJPZGTg=";
   };
 
-  npmDepsHash = "sha256-5Vl+0BBUS7Rtb6XqpGKbbNMyh+9UX2aAsgtn60QLX7A=";
+  npmDepsHash = "sha256-TxMiT7nJqLZRXKFoxb4FpsETGe3I99qU7olTgNsoQd4=";
 
   npmWorkspace = "packages/coding-agent";
 
diff --git a/pkgs/by-name/pi/pipenv/package.nix b/pkgs/by-name/pi/pipenv/package.nix
index f634948ad3fc..f625406ec75d 100644
--- a/pkgs/by-name/pi/pipenv/package.nix
+++ b/pkgs/by-name/pi/pipenv/package.nix
@@ -108,6 +108,7 @@ buildPythonApplication rec {
 
   meta = {
     description = "Python Development Workflow for Humans";
+    homepage = "https://github.com/pypa/pipenv";
     license = lib.licenses.mit;
     platforms = lib.platforms.all;
     mainProgram = "pipenv";
diff --git a/pkgs/by-name/pi/pixz/package.nix b/pkgs/by-name/pi/pixz/package.nix
index 5dcdcd49afb2..dc3b398874be 100644
--- a/pkgs/by-name/pi/pixz/package.nix
+++ b/pkgs/by-name/pi/pixz/package.nix
@@ -49,6 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Parallel compressor/decompressor for xz format";
+    homepage = "https://github.com/vasi/pixz";
     license = lib.licenses.bsd2;
     maintainers = [ lib.maintainers.raskin ];
     platforms = lib.platforms.unix;
diff --git a/pkgs/by-name/pl/plistcpp/package.nix b/pkgs/by-name/pl/plistcpp/package.nix
index 015e443d7f37..f57dc1953aab 100644
--- a/pkgs/by-name/pl/plistcpp/package.nix
+++ b/pkgs/by-name/pl/plistcpp/package.nix
@@ -39,6 +39,7 @@ stdenv.mkDerivation {
   meta = {
     maintainers = [ ];
     description = "CPP bindings for Plist";
+    homepage = "https://github.com/matthewbauer/PlistCpp";
     license = lib.licenses.mit;
     platforms = lib.platforms.unix;
   };
diff --git a/pkgs/by-name/po/polkit-stdin-agent/package.nix b/pkgs/by-name/po/polkit-stdin-agent/package.nix
new file mode 100644
index 000000000000..7377d1727ca6
--- /dev/null
+++ b/pkgs/by-name/po/polkit-stdin-agent/package.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitea,
+  nix-update-script,
+  nixosTests,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "polkit-stdin-agent";
+  version = "0.3.0";
+
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "r-vdp";
+    repo = "polkit-stdin-agent";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Nl/+IBbUEsxSKSWLXwUB3mV4iAG0z9mv+Bl6CSeFzR4=";
+  };
+
+  cargoHash = "sha256-Eb/7ejVmtG5FNSh66gZO3337KCPNi+xtYVC5qyFKJzg=";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  passthru = {
+    updateScript = nix-update-script { };
+    tests = { inherit (nixosTests) nixos-rebuild-target-host; };
+  };
+
+  meta = {
+    description = "Non-interactive polkit authentication agent that answers PAM prompts from a file descriptor";
+    longDescription = ''
+      Registers a per-process polkit authentication agent for a wrapped
+      command and answers the PAM conversation from a file descriptor
+      instead of /dev/tty, giving run0 / systemd-run the same
+      "password on stdin" ergonomics as `sudo --stdin`.
+
+      Used by `nixos-rebuild --elevate=run0 --ask-elevate-password` to
+      authenticate on a target host over SSH without allocating a TTY.
+    '';
+    homepage = "https://codeberg.org/r-vdp/polkit-stdin-agent";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ rvdp ];
+    platforms = lib.platforms.linux;
+    mainProgram = "polkit-stdin-agent";
+  };
+})
diff --git a/pkgs/by-name/po/powercap/package.nix b/pkgs/by-name/po/powercap/package.nix
index 38692932a202..7e28880391cb 100644
--- a/pkgs/by-name/po/powercap/package.nix
+++ b/pkgs/by-name/po/powercap/package.nix
@@ -34,6 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Tools and library to read/write to the Linux power capping framework (sysfs interface)";
+    homepage = "https://github.com/powercap/powercap";
     license = lib.licenses.bsd3;
     platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [ rowanG077 ];
diff --git a/pkgs/by-name/po/powersploit/package.nix b/pkgs/by-name/po/powersploit/package.nix
index 1f2600a7493d..9c452d954b28 100644
--- a/pkgs/by-name/po/powersploit/package.nix
+++ b/pkgs/by-name/po/powersploit/package.nix
@@ -26,6 +26,7 @@ stdenvNoCC.mkDerivation {
   meta = {
     changelog = "https://github.com/PowerShellMafia/PowerSploit/releases/";
     description = "PowerShell Post-Exploitation Framework";
+    homepage = "https://github.com/PowerShellMafia/PowerSploit";
     license = with lib.licenses; [ bsd3 ];
     maintainers = with lib.maintainers; [ shard7 ];
     platforms = lib.platforms.all;
diff --git a/pkgs/by-name/pr/priocpp/package.nix b/pkgs/by-name/pr/priocpp/package.nix
index d2518f9bee89..6e65a8a71a4d 100644
--- a/pkgs/by-name/pr/priocpp/package.nix
+++ b/pkgs/by-name/pr/priocpp/package.nix
@@ -47,6 +47,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Property I/O for C++";
+    homepage = "https://github.com/Grumbel/priocpp";
     maintainers = [ lib.maintainers.SchweGELBin ];
     platforms = lib.platforms.linux;
     license = lib.licenses.free;
diff --git a/pkgs/by-name/pu/pulumi-esc/package.nix b/pkgs/by-name/pu/pulumi-esc/package.nix
index 63d69f85626b..cf898654a883 100644
--- a/pkgs/by-name/pu/pulumi-esc/package.nix
+++ b/pkgs/by-name/pu/pulumi-esc/package.nix
@@ -6,18 +6,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "pulumi-esc";
-  version = "0.24.0";
+  version = "0.25.0";
 
   src = fetchFromGitHub {
     owner = "pulumi";
     repo = "esc";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-umZEP3c7y/3DgcWj1iUH8wUUKFRw43jCrF+nZk62jXU=";
+    hash = "sha256-mtsbd66vjvy30khJxrCLd9RzUZGO9VPi9hfa7HIiq8s=";
   };
 
   subPackages = "cmd/esc";
 
-  vendorHash = "sha256-DNT1qwgtjSwLnSTru9jumwTIISCIhe5SGHz4CzE/fSo=";
+  vendorHash = "sha256-Va8vcIbNqAcrbJECa+utSg6EZNOTSZalP/W3GC0I2lM=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/pw/pwalarmctl/package.nix b/pkgs/by-name/pw/pwalarmctl/package.nix
index 6e6a09f14a75..ebc6392463b7 100644
--- a/pkgs/by-name/pw/pwalarmctl/package.nix
+++ b/pkgs/by-name/pw/pwalarmctl/package.nix
@@ -35,6 +35,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       for live configuration changes and access to the active state
       of pwalarmd.
     '';
+    homepage = "https://github.com/amyipdev/pwalarmd";
     mainProgram = "pwalarmctl";
     license = lib.licenses.gpl2Only;
     platforms = lib.platforms.all;
diff --git a/pkgs/by-name/pw/pwalarmd/package.nix b/pkgs/by-name/pw/pwalarmd/package.nix
index 37eda91a9eb2..dfce084957c0 100644
--- a/pkgs/by-name/pw/pwalarmd/package.nix
+++ b/pkgs/by-name/pw/pwalarmd/package.nix
@@ -29,6 +29,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       It has extensive configuration and personalization, PulseAudio
       and PipeWire support, and supports live configuration changes.
     '';
+    homepage = "https://github.com/amyipdev/pwalarmd";
     mainProgram = "pwalarmd";
     license = lib.licenses.gpl2Only;
     platforms = lib.platforms.all;
diff --git a/pkgs/by-name/qe/qemu/package.nix b/pkgs/by-name/qe/qemu/package.nix
index 31515f58d636..dea71a96bd84 100644
--- a/pkgs/by-name/qe/qemu/package.nix
+++ b/pkgs/by-name/qe/qemu/package.nix
@@ -140,11 +140,11 @@ stdenv.mkDerivation (finalAttrs: {
     + lib.optionalString nixosTestRunner "-for-vm-tests"
     + lib.optionalString toolsOnly "-utils"
     + lib.optionalString userOnly "-user";
-  version = "10.2.2";
+  version = "11.0.0";
 
   src = fetchurl {
     url = "https://download.qemu.org/qemu-${finalAttrs.version}.tar.xz";
-    hash = "sha256-eEspb/KcFBeqcjI6vLLS6pq5dxck9Xfc14XDsE8h4XY=";
+    hash = "sha256-wEyjYBJlPzLRHGdNNwz1KnEOfT8Ywti2PkkyBSpIVNY=";
   };
 
   depsBuildBuild = [
@@ -165,6 +165,8 @@ stdenv.mkDerivation (finalAttrs: {
     # For python changes other than simple package additions, ping @dramforever for review.
     # Don't change `python3Packages` to `python3.pkgs.*`, breaks cross-compilation.
     python3Packages.distlib
+    python3Packages.setuptools
+    python3Packages.wheel
     # Hooks from the python package are needed to add `$pythonPath` so
     # `python/scripts/mkvenv.py` can detect `meson` otherwise the vendored meson without patches will be used.
     python3Packages.python
@@ -374,7 +376,11 @@ stdenv.mkDerivation (finalAttrs: {
 
   # tests can still timeout on slower systems
   doCheck = false;
-  nativeCheckInputs = [ socat ];
+  nativeCheckInputs = [
+    python3Packages.pygdbmi
+    python3Packages.qemu-qmp
+    socat
+  ];
   preCheck = ''
     # time limits are a little meagre for a build machine that's
     # potentially under load.
@@ -444,7 +450,7 @@ stdenv.mkDerivation (finalAttrs: {
       license = lib.licenses.gpl2Plus;
       maintainers = with lib.maintainers; [ qyliss ];
       teams = lib.optionals xenSupport xen.meta.teams;
-      platforms = lib.platforms.unix;
+      platforms = with lib.systems.inspect; patternLogicalAnd patterns.is64bit patterns.isUnix;
     }
     # toolsOnly: Does not have qemu-kvm and there's no main support tool
     # userOnly: There's one qemu-<arch> for every architecture
@@ -453,7 +459,14 @@ stdenv.mkDerivation (finalAttrs: {
     }
     # userOnly: https://qemu.readthedocs.io/en/master/user/main.html#supported-operating-systems
     // lib.optionalAttrs userOnly {
-      platforms = with lib.platforms; (linux ++ freebsd ++ openbsd ++ netbsd);
+      platforms =
+        with lib.systems.inspect;
+        patternLogicalAnd patterns.is64bit [
+          patterns.isLinux
+          patterns.isFreeBSD
+          patterns.isOpenBSD
+          patterns.isNetBSD
+        ];
       description = "QEMU User space emulator - launch executables compiled for one CPU on another CPU";
     };
 })
diff --git a/pkgs/by-name/qo/qoi/package.nix b/pkgs/by-name/qo/qoi/package.nix
index feceac3d0311..da1d82e3e286 100644
--- a/pkgs/by-name/qo/qoi/package.nix
+++ b/pkgs/by-name/qo/qoi/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "qoi";
-  version = "0-unstable-2026-04-21"; # no upstream version yet.
+  version = "0-unstable-2026-05-29"; # no upstream version yet.
 
   src = fetchFromGitHub {
     owner = "phoboslab";
     repo = "qoi";
-    rev = "e084ec009b38c755acc40fe31d3f83ee17935b9d";
-    hash = "sha256-sPwmpkMo++Eo33fsiLHY6QYScXQNCucQyNPJdDysgFw=";
+    rev = "97bacc86a9c4abf5a2d452102dc26546c4c670b9";
+    hash = "sha256-9R43rWfpB2J6TXHoTt0u0LLiTY9XYmmph+pb7Y6aU84=";
   };
 
   patches = [
diff --git a/pkgs/by-name/qu/quartz-wm/package.nix b/pkgs/by-name/qu/quartz-wm/package.nix
index 68d373ba102a..d9bc9b1fd90c 100644
--- a/pkgs/by-name/qu/quartz-wm/package.nix
+++ b/pkgs/by-name/qu/quartz-wm/package.nix
@@ -41,6 +41,7 @@ clangStdenv.mkDerivation (finalAttrs: {
   ];
 
   meta = {
+    homepage = "https://gitlab.freedesktop.org/xorg/app/quartz-wm";
     license = lib.licenses.apple-psl20;
     platforms = lib.platforms.darwin;
     maintainers = [ lib.maintainers.booxter ];
diff --git a/pkgs/by-name/qu/quirc/package.nix b/pkgs/by-name/qu/quirc/package.nix
index e5fb332a2289..de49ff5fe24f 100644
--- a/pkgs/by-name/qu/quirc/package.nix
+++ b/pkgs/by-name/qu/quirc/package.nix
@@ -74,6 +74,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Small QR code decoding library";
+    homepage = "https://github.com/dlbeer/quirc";
     license = lib.licenses.isc;
     maintainers = [ lib.maintainers.raskin ];
     platforms = lib.platforms.unix;
diff --git a/pkgs/by-name/re/reattach-to-user-namespace/package.nix b/pkgs/by-name/re/reattach-to-user-namespace/package.nix
index a77f696f55ea..9e5d6419fd9b 100644
--- a/pkgs/by-name/re/reattach-to-user-namespace/package.nix
+++ b/pkgs/by-name/re/reattach-to-user-namespace/package.nix
@@ -30,6 +30,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Wrapper that provides access to the Mac OS X pasteboard service";
+    homepage = "https://github.com/ChrisJohnsen/tmux-MacOSX-pasteboard";
     license = lib.licenses.bsd2;
     maintainers = [ ];
     platforms = lib.platforms.darwin;
diff --git a/pkgs/by-name/re/regname/package.nix b/pkgs/by-name/re/regname/package.nix
index 77c74957a9a9..d40ca5c64495 100644
--- a/pkgs/by-name/re/regname/package.nix
+++ b/pkgs/by-name/re/regname/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "regname";
-  version = "0.1.0";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "linkdd";
     repo = "regname";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zKsWEjFMTFibzfZ2dEc+RN74Ih1jr9vJhOUU0gY1rYE=";
+    hash = "sha256-oa02AyZxbT2M4MxOCgWvy+4pTyy6WGONHS5U/l3haTA=";
   };
 
-  cargoHash = "sha256-6iRDUOXPDzlD11JEL4at+z3aWkhn/dECtl7y2/vGMwo=";
+  cargoHash = "sha256-waayV+1Tg3CmPM7mdMc4D0G2BOSk1Mw3ga0O+R3IrwU=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/rt/rt/package.nix b/pkgs/by-name/rt/rt/package.nix
index 5582bc15bee5..9ea0019a6532 100644
--- a/pkgs/by-name/rt/rt/package.nix
+++ b/pkgs/by-name/rt/rt/package.nix
@@ -183,6 +183,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = {
+    homepage = "https://github.com/bestpractical/rt";
     platforms = lib.platforms.unix;
     license = lib.licenses.gpl2Only;
   };
diff --git a/pkgs/by-name/rt/rt5677-firmware/package.nix b/pkgs/by-name/rt/rt5677-firmware/package.nix
index 7ec294d8780b..e7c03db10ded 100644
--- a/pkgs/by-name/rt/rt5677-firmware/package.nix
+++ b/pkgs/by-name/rt/rt5677-firmware/package.nix
@@ -22,6 +22,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Firmware for Realtek rt5677 device";
+    homepage = "https://github.com/raphael/linux-samus";
     license = lib.licenses.unfreeRedistributableFirmware;
     maintainers = with lib.maintainers; [ zohl ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/rt/rtl8761b-firmware/package.nix b/pkgs/by-name/rt/rtl8761b-firmware/package.nix
index eb32aa353440..0fe71e03ca15 100644
--- a/pkgs/by-name/rt/rtl8761b-firmware/package.nix
+++ b/pkgs/by-name/rt/rtl8761b-firmware/package.nix
@@ -27,6 +27,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Firmware for Realtek RTL8761b";
+    homepage = "https://github.com/Realtek-OpenSource/android_hardware_realtek";
     license = lib.licenses.unfreeRedistributableFirmware;
     maintainers = with lib.maintainers; [ milibopp ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/ru/ruff/package.nix b/pkgs/by-name/ru/ruff/package.nix
index 08d40e4e30ff..75992b42240e 100644
--- a/pkgs/by-name/ru/ruff/package.nix
+++ b/pkgs/by-name/ru/ruff/package.nix
@@ -16,7 +16,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ruff";
-  version = "0.15.14";
+  version = "0.15.15";
 
   __structuredAttrs = true;
 
@@ -24,12 +24,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "astral-sh";
     repo = "ruff";
     tag = finalAttrs.version;
-    hash = "sha256-Z8UhVS+YbYAxVWodU/I+p3Ns5/EpmzBTChcbkvJwe6Y=";
+    hash = "sha256-WpjOOCYLZ1d8XPUx3qNHD+fuK6t65u/1/ZezABWpBD0=";
   };
 
   cargoBuildFlags = [ "--package=ruff" ];
 
-  cargoHash = "sha256-GnRC5jXySAna7uAKPDtpPQUJe8AKqVSU+ynmGKZtfTs=";
+  cargoHash = "sha256-SfkoLl43Y1DNqIRW+HljVcEHWhedTS99SGhMvkQ4dmo=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/ru/runzip/package.nix b/pkgs/by-name/ru/runzip/package.nix
index 5ad60868bcf0..ce558eba78ab 100644
--- a/pkgs/by-name/ru/runzip/package.nix
+++ b/pkgs/by-name/ru/runzip/package.nix
@@ -39,6 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Tool to convert filename encoding inside a ZIP archive";
+    homepage = "https://github.com/vlm/zip-fix-filename-encoding";
     license = lib.licenses.bsd2;
     maintainers = [ lib.maintainers.raskin ];
     # runzip vendors libzip 0.7.1.
diff --git a/pkgs/by-name/rw/rwc/package.nix b/pkgs/by-name/rw/rwc/package.nix
index 597885ca7d53..f14cedf10a02 100644
--- a/pkgs/by-name/rw/rwc/package.nix
+++ b/pkgs/by-name/rw/rwc/package.nix
@@ -19,6 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Report when files are changed";
+    homepage = "https://github.com/leahneukirchen/rwc";
     license = lib.licenses.publicDomain;
     platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [ somasis ];
diff --git a/pkgs/by-name/sb/sbom-utility/package.nix b/pkgs/by-name/sb/sbom-utility/package.nix
index f94a2f1a39ae..6fff931f6a49 100644
--- a/pkgs/by-name/sb/sbom-utility/package.nix
+++ b/pkgs/by-name/sb/sbom-utility/package.nix
@@ -9,7 +9,7 @@
 }:
 
 let
-  version = "0.19.0";
+  version = "0.19.1";
 in
 buildGoModule {
   pname = "sbom-utility";
@@ -19,7 +19,7 @@ buildGoModule {
     owner = "CycloneDX";
     repo = "sbom-utility";
     tag = "v${version}";
-    hash = "sha256-G+0gQrQIWAgYsojFuvXU1IhMS2p3fHCejJLjZNaAU1I=";
+    hash = "sha256-AEy29ZL2KfWuHzVohUF5xWI34QgvtIDQfH6AlVfFkAY=";
   };
 
   vendorHash = "sha256-vyYSir5u6d5nv+2ScrHpasQGER4VFSoLb1FDUDIrtDM=";
diff --git a/pkgs/by-name/sc/scip-go/package.nix b/pkgs/by-name/sc/scip-go/package.nix
index 979d4ab95983..92cf58587847 100644
--- a/pkgs/by-name/sc/scip-go/package.nix
+++ b/pkgs/by-name/sc/scip-go/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "scip-go";
-  version = "0.2.6";
+  version = "0.2.7";
 
   src = fetchFromGitHub {
     owner = "sourcegraph";
     repo = "scip-go";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-QtfGiMRrGHgL1VHLMX9icXkY/jv567On3xe/dYmoaQI=";
+    hash = "sha256-Him9V4+cXxQxG6a3L960rXEhxJYKl7n8mRlRK2PeMIg=";
   };
 
   vendorHash = "sha256-aKOjU6LhixVpMW2JUkI++jjd4eQbv3w4apBjLbfqpvw=";
diff --git a/pkgs/by-name/se/seehecht/package.nix b/pkgs/by-name/se/seehecht/package.nix
index 17ef07029f27..5feb2f9068b4 100644
--- a/pkgs/by-name/se/seehecht/package.nix
+++ b/pkgs/by-name/se/seehecht/package.nix
@@ -23,6 +23,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   meta = {
     description = "Tool to quickly open a markdown document with already filled out frontmatter";
+    homepage = "https://codeberg.org/annaaurora/seehecht";
     license = lib.licenses.lgpl3Only;
     platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [ annaaurora ];
diff --git a/pkgs/by-name/se/sexp-cpp/package.nix b/pkgs/by-name/se/sexp-cpp/package.nix
index 52b915243d36..a5ce0cb66786 100644
--- a/pkgs/by-name/se/sexp-cpp/package.nix
+++ b/pkgs/by-name/se/sexp-cpp/package.nix
@@ -38,6 +38,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "S-Expression parser for C++";
+    homepage = "https://github.com/lispparser/sexp-cpp";
     maintainers = [ lib.maintainers.SchweGELBin ];
     platforms = lib.platforms.linux;
     license = lib.licenses.gpl3;
diff --git a/pkgs/by-name/sh/sha1collisiondetection/package.nix b/pkgs/by-name/sh/sha1collisiondetection/package.nix
index 907f662b3666..32289cba10cc 100644
--- a/pkgs/by-name/sh/sha1collisiondetection/package.nix
+++ b/pkgs/by-name/sh/sha1collisiondetection/package.nix
@@ -36,6 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
       each file. It is very fast and takes less than twice the amount
       of time as regular SHA-1.
     '';
+    homepage = "https://github.com/cr-marcstevens/sha1collisiondetection";
     platforms = lib.platforms.all;
     license = lib.licenses.mit;
     mainProgram = "sha1dcsum";
diff --git a/pkgs/by-name/si/sigtop/package.nix b/pkgs/by-name/si/sigtop/package.nix
index dad47b1a982b..7f3305b1bf0b 100644
--- a/pkgs/by-name/si/sigtop/package.nix
+++ b/pkgs/by-name/si/sigtop/package.nix
@@ -28,6 +28,7 @@ buildGoModule (finalAttrs: {
 
   meta = {
     description = "Utility to export messages, attachments and other data from Signal Desktop";
+    homepage = "https://github.com/tbvdm/sigtop";
     mainProgram = "sigtop";
     license = lib.licenses.isc;
     platforms = lib.platforms.all;
diff --git a/pkgs/by-name/sl/slack-cli/package.nix b/pkgs/by-name/sl/slack-cli/package.nix
index 36bbe1bdd64c..bd49d240c99e 100644
--- a/pkgs/by-name/sl/slack-cli/package.nix
+++ b/pkgs/by-name/sl/slack-cli/package.nix
@@ -59,6 +59,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = {
+    homepage = "https://github.com/rockymadden/slack-cli";
     license = lib.licenses.mit;
     maintainers = [ ];
     mainProgram = "slack";
diff --git a/pkgs/by-name/sn/snooze/package.nix b/pkgs/by-name/sn/snooze/package.nix
index f49604c270c9..1c3432259a8b 100644
--- a/pkgs/by-name/sn/snooze/package.nix
+++ b/pkgs/by-name/sn/snooze/package.nix
@@ -19,6 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Tool for waiting until a particular time and then running a command";
+    homepage = "https://github.com/leahneukirchen/snooze";
     maintainers = with lib.maintainers; [ kaction ];
     license = lib.licenses.cc0;
     platforms = lib.platforms.unix;
diff --git a/pkgs/by-name/sp/spade/package.nix b/pkgs/by-name/sp/spade/package.nix
index 448e439e3038..ba08513aa2c9 100644
--- a/pkgs/by-name/sp/spade/package.nix
+++ b/pkgs/by-name/sp/spade/package.nix
@@ -16,18 +16,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "spade";
-  version = "0.18.0";
+  version = "0.19.0";
 
   src = fetchFromGitLab {
     owner = "spade-lang";
     repo = "spade";
     rev = "v${version}";
-    hash = "sha256-BSbE0hJvCIaxxqCo+QltZuoS2yst6TgUnHXAE4kZD2A=";
+    hash = "sha256-HSRttrf4Dsl9iatqVr9YH4MoKPwe9XJWJYqNRchFLY0=";
     # only needed for vatch, which contains test data
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-+lQiXOof6MnjnVf8CXNYgeyzFMf0myLErbSfnjLVZWU=";
+  cargoHash = "sha256-koMnkwgQtVMvxlslvC5dZAhr3K/66XWyp5UPW7yZtio=";
 
   # TODO: somehow respect https://nixos.org/manual/nixpkgs/stable/#var-passthru-updateScript-commit
   passthru.updateScript = _experimental-update-script-combinators.sequence [
diff --git a/pkgs/by-name/st/standardnotes/package.nix b/pkgs/by-name/st/standardnotes/package.nix
index 7d066391940c..f04bb2dbbbd5 100644
--- a/pkgs/by-name/st/standardnotes/package.nix
+++ b/pkgs/by-name/st/standardnotes/package.nix
@@ -84,7 +84,7 @@ stdenv.mkDerivation {
       Standard Notes is a private notes app that features unmatched simplicity,
       end-to-end encryption, powerful extensions, and open-source applications.
     '';
-    homepage = "https://standardnotes.org";
+    homepage = "https://standardnotes.com";
     license = lib.licenses.agpl3Only;
     maintainers = with lib.maintainers; [
       mgregoire
diff --git a/pkgs/by-name/st/starkiller/package.nix b/pkgs/by-name/st/starkiller/package.nix
index b116900433a0..ad1a2ea538c1 100644
--- a/pkgs/by-name/st/starkiller/package.nix
+++ b/pkgs/by-name/st/starkiller/package.nix
@@ -10,18 +10,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "starkiller";
-  version = "3.4.0";
+  version = "3.5.0";
 
   src = fetchFromGitHub {
     owner = "bc-security";
     repo = "starkiller";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-odjS3OJFaLSHimK+Wn5GrfBs2jNTTMsN8SCDkexWPcQ=";
+    hash = "sha256-uFSv/SfXATi01e4VH6iImvRnlFTUB3OarhfSTLQDg/M=";
   };
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-BKhflhrJdDsZK9r7GnVDoiX21dUayewPYgm5XOpMdxc=";
+    hash = "sha256-NAnROD2Bt2sYydLbZVzudwDajbc4zonTjSLcdD32KNE=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/st/stlink/package.nix b/pkgs/by-name/st/stlink/package.nix
index da9ea1b4786f..7ebde6a72328 100644
--- a/pkgs/by-name/st/stlink/package.nix
+++ b/pkgs/by-name/st/stlink/package.nix
@@ -63,6 +63,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "In-circuit debug and programming for ST-Link devices";
+    homepage = "https://github.com/stlink-org/stlink";
     license = lib.licenses.bsd3;
     platforms = lib.platforms.unix;
     badPlatforms = lib.platforms.darwin;
diff --git a/pkgs/by-name/st/stress/package.nix b/pkgs/by-name/st/stress/package.nix
index a61ba45c7b12..bce58a7dec9c 100644
--- a/pkgs/by-name/st/stress/package.nix
+++ b/pkgs/by-name/st/stress/package.nix
@@ -20,6 +20,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Simple workload generator for POSIX systems. It imposes a configurable amount of CPU, memory, I/O, and disk stress on the system";
+    homepage = "https://github.com/resurrecting-open-source-projects/stress";
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.unix;
     mainProgram = "stress";
diff --git a/pkgs/by-name/st/strutcpp/package.nix b/pkgs/by-name/st/strutcpp/package.nix
index f15f2bfaa1be..6b87b838dcf7 100644
--- a/pkgs/by-name/st/strutcpp/package.nix
+++ b/pkgs/by-name/st/strutcpp/package.nix
@@ -32,6 +32,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Collection of string utilities";
+    homepage = "https://github.com/Grumbel/strutcpp";
     maintainers = [ lib.maintainers.SchweGELBin ];
     platforms = lib.platforms.linux;
     license = lib.licenses.free;
diff --git a/pkgs/by-name/st/stw/package.nix b/pkgs/by-name/st/stw/package.nix
index ace62888fa4e..8a02a0659269 100644
--- a/pkgs/by-name/st/stw/package.nix
+++ b/pkgs/by-name/st/stw/package.nix
@@ -33,6 +33,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Simple text widget for X resembling the watch(1) command";
+    homepage = "https://github.com/sineemore/stw";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ somasis ];
     platforms = lib.platforms.unix;
diff --git a/pkgs/by-name/sw/sway-assign-cgroups/package.nix b/pkgs/by-name/sw/sway-assign-cgroups/package.nix
index 432d5d86b91d..234a5d9aeb11 100644
--- a/pkgs/by-name/sw/sway-assign-cgroups/package.nix
+++ b/pkgs/by-name/sw/sway-assign-cgroups/package.nix
@@ -44,6 +44,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
       Therefore it's recommended to supplement the script with use of systemd user
       services for such background apps.
     '';
+    homepage = "https://github.com/alebastr/sway-systemd";
     license = lib.licenses.mit;
     platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [ nickhu ];
diff --git a/pkgs/by-name/sw/swim/package.nix b/pkgs/by-name/sw/swim/package.nix
index 5c5528bc7759..26cfc74f1cee 100644
--- a/pkgs/by-name/sw/swim/package.nix
+++ b/pkgs/by-name/sw/swim/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "swim";
-  version = "0.18.0";
+  version = "0.19.0";
 
   src = fetchFromGitLab {
     owner = "spade-lang";
     repo = "swim";
     rev = "v${version}";
-    hash = "sha256-l0iEzctt3WHW7m3wnr5WdthqBlGSh0SxHCQlM6it0Ds=";
+    hash = "sha256-5/yIucyErZpY5iN/6r8JNAfsrYPxh+lBHDBD6cnjbHQ=";
   };
 
-  cargoHash = "sha256-k3sWg/oG5+ckxa10Jt/AncbyoB8kaOcG3xKPg1fl/ME=";
+  cargoHash = "sha256-+znzedDuB7hMzaRtAvLNUC9gG0Q2R8Fn61D64udAyAM=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/sw/switch-to-configuration-ng/src/main.rs b/pkgs/by-name/sw/switch-to-configuration-ng/src/main.rs
index d9568c7b5464..20c80a50baa5 100644
--- a/pkgs/by-name/sw/switch-to-configuration-ng/src/main.rs
+++ b/pkgs/by-name/sw/switch-to-configuration-ng/src/main.rs
@@ -688,12 +688,7 @@ fn handle_modified_unit(
     let reload_list = scope.reload_list_file();
     let use_restart_as_stop_and_start = new_unit_info.is_none();
 
-    if matches!(
-        unit,
-        "sysinit.target" | "basic.target" | "multi-user.target" | "graphical.target"
-    ) || unit.ends_with(".unit")
-        || unit.ends_with(".slice")
-    {
+    if cannot_be_restarted_directly(unit) {
         // Do nothing.  These cannot be restarted directly.
 
         // Slices and Paths don't have to be restarted since properties (resource limits and
@@ -940,6 +935,17 @@ fn parse_fstab(fstab: impl BufRead) -> (HashMap<String, Filesystem>, HashMap<Str
     (filesystems, swaps)
 }
 
+/// Whether a unit cannot be (re)started directly. Special targets are pulled
+/// in by their dependents; slices and paths get their properties applied on
+/// daemon-reload.
+fn cannot_be_restarted_directly(unit: &str) -> bool {
+    matches!(
+        unit,
+        "sysinit.target" | "basic.target" | "multi-user.target" | "graphical.target"
+    ) || unit.ends_with(".path")
+        || unit.ends_with(".slice")
+}
+
 // Returns a HashMap containing the same contents as the passed in `units`, minus the units in
 // `units_to_filter`.
 fn filter_units(
@@ -957,6 +963,50 @@ fn filter_units(
     res
 }
 
+/// Action to take on a unit that migrated to NixOS ownership during the
+/// post-activation pass. Honours the same X-* directives as
+/// `handle_modified_unit`.
+#[derive(Debug, PartialEq)]
+enum MigrationAction {
+    Skip,
+    Reload,
+    Restart,
+    Start,
+}
+
+impl MigrationAction {
+    /// Action to take on a migrated unit that is still active.
+    fn for_active_unit(unit: &str, new_unit_info: &UnitInfo) -> Self {
+        if cannot_be_restarted_directly(unit) {
+            return Self::Skip;
+        }
+
+        if parse_systemd_bool(Some(new_unit_info), "Service", "X-ReloadIfChanged", false) {
+            return Self::Reload;
+        }
+
+        if !parse_systemd_bool(Some(new_unit_info), "Service", "X-RestartIfChanged", true)
+            || parse_systemd_bool(Some(new_unit_info), "Unit", "RefuseManualStop", false)
+            || parse_systemd_bool(Some(new_unit_info), "Unit", "X-OnlyManualStart", false)
+        {
+            return Self::Skip;
+        }
+
+        Self::Restart
+    }
+
+    /// Action to take on a migrated unit that the previous owner stopped.
+    fn for_stopped_unit(new_unit_info: &UnitInfo) -> Self {
+        if parse_systemd_bool(Some(new_unit_info), "Unit", "RefuseManualStart", false)
+            || parse_systemd_bool(Some(new_unit_info), "Unit", "X-OnlyManualStart", false)
+        {
+            return Self::Skip;
+        }
+
+        Self::Start
+    }
+}
+
 fn unit_is_active(conn: &LocalConnection, unit: &str) -> Result<bool> {
     let unit_object_path = conn
         .with_proxy(
@@ -1345,26 +1395,79 @@ fn do_user_switch(parent_exe: String) -> anyhow::Result<()> {
 
     let current_active_units = get_active_units(&systemd)?;
 
+    let old_unit_dir = old_toplevel.join(scope.etc_dir());
     let new_unit_dir = toplevel.join(scope.etc_dir());
-    let fragment_prefix = scope
-        .current_dir()
-        .to_str()
-        .expect("scope dir is valid UTF-8");
+    let fragment_dir = scope.current_dir();
 
-    // Units that are currently running from a non-/etc location (typically
-    // ~/.config/systemd/user, i.e. home-manager) but that the new NixOS
-    // configuration also defines. Pass 1 will skip these because of the
-    // FragmentPath filter; if the per-user activation (sd-switch) later drops
-    // its copy, we need a second pass to bring the NixOS-owned definition up.
+    // Determine $XDG_CONFIG_HOME/systemd/user from the user manager's own
+    // environment (we are spawned with env_clear()).
+    let user_config_unit_dir: Option<PathBuf> = match systemd.environment() {
+        Err(err) => {
+            log::debug!("Failed to read user manager environment: {err}");
+            None
+        }
+        Ok(env) => {
+            let lookup = |key: &str| {
+                env.iter().find_map(|kv| {
+                    kv.strip_prefix(key)
+                        .and_then(|rest| rest.strip_prefix('='))
+                        .filter(|v| Path::new(v).is_absolute())
+                        .map(PathBuf::from)
+                })
+            };
+            let config_home =
+                lookup("XDG_CONFIG_HOME").or_else(|| lookup("HOME").map(|h| h.join(".config")));
+            if config_home.is_none() {
+                log::debug!(
+                    "Neither $XDG_CONFIG_HOME nor $HOME is set in the user manager's environment"
+                );
+            }
+            config_home.map(|config_home| config_home.join("systemd/user"))
+        }
+    };
+
+    if user_config_unit_dir.is_none() {
+        log::debug!(
+            "Could not determine $XDG_CONFIG_HOME/systemd/user; \
+             units shadowed by ~/.config will not be considered for migration"
+        );
+    }
+
+    // Units active from a non-/etc location that the new generation defines
+    // in /etc/systemd/user. Pass 1 skips these (FragmentPath filter); pass 2
+    // brings the /etc definition into effect once /etc has won. Two cases:
+    //   * ~/.config/systemd/user (home-manager): shadows /etc, so wait for
+    //     the per-user activation (sd-switch) to remove its copy.
+    //   * anywhere else outside /etc ($XDG_DATA_HOME, $XDG_DATA_DIRS, ...):
+    //     /etc outranks these, so only act when /etc is gaining the unit;
+    //     if the previous generation already had it, leave it alone.
+    // Pass 2's `now_etc` check verifies /etc actually won before acting.
     let migration_candidates: Vec<String> = current_active_units
         .iter()
         .filter(|(unit, _)| new_unit_dir.join(unit).exists())
-        .filter(|(_, unit_state)| {
-            !unit_state
+        .filter(|(unit, unit_state)| {
+            let Ok(fragment_path) = unit_state
                 .proxy
-                .get("org.freedesktop.systemd1.Unit", "FragmentPath")
-                .map(|p: String| p.starts_with(fragment_prefix))
-                .unwrap_or(false)
+                .get::<String>("org.freedesktop.systemd1.Unit", "FragmentPath")
+            else {
+                return false;
+            };
+            let fragment_parent = Path::new(&fragment_path).parent();
+
+            // Already in /etc: handled by pass 1.
+            if fragment_parent == Some(fragment_dir) {
+                return false;
+            }
+
+            // Loaded from ~/.config/systemd/user, which shadows /etc.
+            if let Some(dir) = &user_config_unit_dir {
+                if fragment_parent == Some(dir.as_path()) {
+                    return true;
+                }
+            }
+
+            // Elsewhere: only act if /etc is gaining the unit this switch.
+            !old_unit_dir.join(unit).exists()
         })
         .map(|(unit, _)| unit.clone())
         .collect();
@@ -1372,7 +1475,7 @@ fn do_user_switch(parent_exe: String) -> anyhow::Result<()> {
     collect_unit_changes(
         &toplevel,
         scope,
-        &old_toplevel.join(scope.etc_dir()),
+        &old_unit_dir,
         &new_unit_dir,
         &current_active_units,
         &mut units_to_stop,
@@ -1383,6 +1486,9 @@ fn do_user_switch(parent_exe: String) -> anyhow::Result<()> {
         &mut units_to_filter,
     )?;
 
+    // Restarted unconditionally below; don't list it as skipped.
+    units_to_skip.remove("nixos-activation.service");
+
     let print_units = |verb: &str, units: &HashMap<String, ()>| {
         if units.is_empty() {
             return;
@@ -1483,6 +1589,7 @@ fn do_user_switch(parent_exe: String) -> anyhow::Result<()> {
     // Toplevels with system.activatable = false do not ship this unit; mirror
     // the system scope's tolerance for a missing activate script.
     if new_unit_dir.join("nixos-activation.service").exists() {
+        eprintln!("restarting the following user units: nixos-activation.service");
         match systemd.restart_unit("nixos-activation.service", "replace") {
             Ok(_) => {
                 log::debug!("waiting for nixos activation to finish");
@@ -1510,29 +1617,40 @@ fn do_user_switch(parent_exe: String) -> anyhow::Result<()> {
 
         let active_after = get_active_units(&systemd)?;
 
+        let mut to_reload = HashMap::new();
         let mut to_restart = HashMap::new();
         let mut to_start = HashMap::new();
+        let mut to_skip = HashMap::new();
 
         for unit in &migration_candidates {
-            match active_after.get(unit) {
+            // Honour X-* directives so reloadIfChanged/restartIfChanged hold.
+            let new_unit_file = new_unit_dir.join(unit);
+            let new_unit_info = parse_unit(&new_unit_file, &new_unit_file)?;
+
+            let action = match active_after.get(unit) {
                 Some(unit_state) => {
+                    // Only act if /etc now wins (i.e. the higher-priority
+                    // copy is gone). Read errors are treated as "leave alone".
                     let now_etc = unit_state
                         .proxy
                         .get("org.freedesktop.systemd1.Unit", "FragmentPath")
-                        .map(|p: String| p.starts_with(fragment_prefix))
+                        .map(|p: String| Path::new(&p).parent() == Some(fragment_dir))
                         .unwrap_or(false);
-                    if now_etc {
-                        // Still running with the previous manager's binary;
-                        // restart so the /etc definition takes effect.
-                        to_restart.insert(unit.clone(), ());
+                    if !now_etc {
+                        // Still shadowed (or read error); leave it alone.
+                        continue;
                     }
-                    // else: still shadowed by ~/.config, leave it alone.
+                    MigrationAction::for_active_unit(unit, &new_unit_info)
                 }
-                None => {
-                    // Stopped by the previous manager; start the /etc copy.
-                    to_start.insert(unit.clone(), ());
-                }
-            }
+                // Stopped by the previous manager; start the /etc copy.
+                None => MigrationAction::for_stopped_unit(&new_unit_info),
+            };
+            match action {
+                MigrationAction::Skip => to_skip.insert(unit.clone(), ()),
+                MigrationAction::Reload => to_reload.insert(unit.clone(), ()),
+                MigrationAction::Restart => to_restart.insert(unit.clone(), ()),
+                MigrationAction::Start => to_start.insert(unit.clone(), ()),
+            };
         }
 
         // Re-start active targets so any other newly-unmasked dependencies are
@@ -1543,6 +1661,24 @@ fn do_user_switch(parent_exe: String) -> anyhow::Result<()> {
             }
         }
 
+        if !to_skip.is_empty() {
+            print_units("NOT restarting (post-activation)", &to_skip);
+        }
+
+        print_units("reloading (post-activation)", &to_reload);
+        for unit in to_reload.keys() {
+            match systemd.reload_unit(unit, "replace") {
+                Ok(job_path) => {
+                    submitted_jobs.borrow_mut().insert(job_path, Job::Reload);
+                }
+                Err(err) => {
+                    eprintln!("Failed to reload user unit {unit}: {err}");
+                    exit_code = 4;
+                }
+            }
+        }
+        block_on_jobs(&dbus_conn, &submitted_jobs);
+
         print_units("restarting (post-activation)", &to_restart);
         for unit in to_restart.keys() {
             match systemd.restart_unit(unit, "replace") {
@@ -2863,4 +2999,107 @@ After=dev-disk-by\x2dlabel-root.device
             );
         }
     }
+
+    fn unit_info(
+        sections: &[(&str, &[(&str, &str)])],
+    ) -> HashMap<String, HashMap<String, Vec<String>>> {
+        sections
+            .iter()
+            .map(|(section, kvs)| {
+                (
+                    section.to_string(),
+                    kvs.iter()
+                        .map(|(k, v)| (k.to_string(), vec![v.to_string()]))
+                        .collect(),
+                )
+            })
+            .collect()
+    }
+
+    #[test]
+    fn migration_action_for_active_unit() {
+        use super::MigrationAction;
+
+        // Plain service: restart.
+        assert_eq!(
+            MigrationAction::for_active_unit("foo.service", &unit_info(&[])),
+            MigrationAction::Restart
+        );
+
+        // reloadIfChanged must reload, not restart.
+        assert_eq!(
+            MigrationAction::for_active_unit(
+                "foo.service",
+                &unit_info(&[("Service", &[("X-ReloadIfChanged", "true")])])
+            ),
+            MigrationAction::Reload
+        );
+
+        // X-RestartIfChanged=false (restartIfChanged = false) must skip.
+        assert_eq!(
+            MigrationAction::for_active_unit(
+                "foo.service",
+                &unit_info(&[("Service", &[("X-RestartIfChanged", "false")])])
+            ),
+            MigrationAction::Skip
+        );
+
+        // RefuseManualStop must skip.
+        assert_eq!(
+            MigrationAction::for_active_unit(
+                "foo.service",
+                &unit_info(&[("Unit", &[("RefuseManualStop", "yes")])])
+            ),
+            MigrationAction::Skip
+        );
+
+        // X-OnlyManualStart must skip.
+        assert_eq!(
+            MigrationAction::for_active_unit(
+                "foo.service",
+                &unit_info(&[("Unit", &[("X-OnlyManualStart", "yes")])])
+            ),
+            MigrationAction::Skip
+        );
+
+        // Units that cannot be restarted directly must skip.
+        for unit in [
+            "sysinit.target",
+            "basic.target",
+            "multi-user.target",
+            "graphical.target",
+            "foo.path",
+            "bar.slice",
+        ] {
+            assert_eq!(
+                MigrationAction::for_active_unit(unit, &unit_info(&[])),
+                MigrationAction::Skip,
+                "{unit}"
+            );
+        }
+    }
+
+    #[test]
+    fn migration_action_for_stopped_unit() {
+        use super::MigrationAction;
+
+        assert_eq!(
+            MigrationAction::for_stopped_unit(&unit_info(&[])),
+            MigrationAction::Start
+        );
+        assert_eq!(
+            MigrationAction::for_stopped_unit(&unit_info(&[(
+                "Unit",
+                &[("RefuseManualStart", "true")]
+            )])),
+            MigrationAction::Skip
+        );
+        assert_eq!(
+            MigrationAction::for_stopped_unit(&unit_info(&[(
+                "Unit",
+                &[("X-OnlyManualStart", "true")]
+            )])),
+            MigrationAction::Skip
+        );
+    }
 }
diff --git a/pkgs/by-name/sy/sympow/package.nix b/pkgs/by-name/sy/sympow/package.nix
index 06bf91fadc5f..862bdfd5a74a 100644
--- a/pkgs/by-name/sy/sympow/package.nix
+++ b/pkgs/by-name/sy/sympow/package.nix
@@ -72,6 +72,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Compute special values of symmetric power elliptic curve L-functions";
+    homepage = "https://gitlab.com/rezozer/forks/sympow";
     mainProgram = "sympow";
     license = {
       shortName = "sympow";
diff --git a/pkgs/by-name/sy/syntex/package.nix b/pkgs/by-name/sy/syntex/package.nix
index faf7257de051..535717fea4ea 100644
--- a/pkgs/by-name/sy/syntex/package.nix
+++ b/pkgs/by-name/sy/syntex/package.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
   version = "0.0pre20160915";
   src = fetchFromGitHub {
     owner = "mxgmn";
-    repo = "SynTex";
+    repo = "TextureSynthesis";
     rev = "f499a7c8112be4a63eb44843ba72957c2c9a04db";
     sha256 = "13fz6frlxsdz8qq94fsvim27cd5klmdsax5109yxm9175vgvpa0a";
   };
@@ -31,6 +31,7 @@ stdenv.mkDerivation {
   buildInputs = [ mono ];
   meta = {
     description = "Texture synthesis from examples";
+    homepage = "https://github.com/mxgmn/TextureSynthesis";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.raskin ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/ta/tar2ext4/package.nix b/pkgs/by-name/ta/tar2ext4/package.nix
index eebeb10e9f6f..9300227c8dfd 100644
--- a/pkgs/by-name/ta/tar2ext4/package.nix
+++ b/pkgs/by-name/ta/tar2ext4/package.nix
@@ -20,6 +20,7 @@ buildGoModule (finalAttrs: {
 
   meta = {
     description = "Convert a tar archive to an ext4 image";
+    homepage = "https://github.com/microsoft/hcsshim";
     maintainers = with lib.maintainers; [ qyliss ];
     license = lib.licenses.mit;
     mainProgram = "tar2ext4";
diff --git a/pkgs/by-name/te/termbench-pro/package.nix b/pkgs/by-name/te/termbench-pro/package.nix
index 6ac6f19f1848..99f4bb29a714 100644
--- a/pkgs/by-name/te/termbench-pro/package.nix
+++ b/pkgs/by-name/te/termbench-pro/package.nix
@@ -40,6 +40,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Terminal Benchmarking as CLI and library";
+    homepage = "https://github.com/contour-terminal/termbench-pro";
     mainProgram = "tb";
     license = lib.licenses.asl20;
     platforms = lib.platforms.unix;
diff --git a/pkgs/by-name/te/termtekst/package.nix b/pkgs/by-name/te/termtekst/package.nix
index 9589b1ccd50a..0ae2be7536be 100644
--- a/pkgs/by-name/te/termtekst/package.nix
+++ b/pkgs/by-name/te/termtekst/package.nix
@@ -39,6 +39,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
       as a workaround the braille set is abused to approximate the
       graphics.
     '';
+    homepage = "https://github.com/zevv/termtekst";
     license = lib.licenses.mit;
     platforms = lib.platforms.all;
   };
diff --git a/pkgs/by-name/te/tesh/package.nix b/pkgs/by-name/te/tesh/package.nix
index 9a6eae86f6ec..4ed4a53ed376 100644
--- a/pkgs/by-name/te/tesh/package.nix
+++ b/pkgs/by-name/te/tesh/package.nix
@@ -29,6 +29,7 @@ python3Packages.buildPythonPackage rec {
   ];
 
   meta = {
+    homepage = "https://github.com/OceanSprint/tesh";
     license = lib.licenses.mit;
   };
 }
diff --git a/pkgs/by-name/ti/tinycmmc/package.nix b/pkgs/by-name/ti/tinycmmc/package.nix
index 796639ee45b3..ccc467c45338 100644
--- a/pkgs/by-name/ti/tinycmmc/package.nix
+++ b/pkgs/by-name/ti/tinycmmc/package.nix
@@ -20,6 +20,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Tiny CMake Module Collections";
+    homepage = "https://github.com/Grumbel/tinycmmc";
     maintainers = [ lib.maintainers.SchweGELBin ];
     platforms = lib.platforms.linux;
     license = lib.licenses.zlib;
diff --git a/pkgs/by-name/ti/tinygettext/package.nix b/pkgs/by-name/ti/tinygettext/package.nix
index 7ea1ea0fc1b9..7208f4898094 100644
--- a/pkgs/by-name/ti/tinygettext/package.nix
+++ b/pkgs/by-name/ti/tinygettext/package.nix
@@ -24,6 +24,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "A simple gettext replacement that works directly on .po files";
+    homepage = "https://github.com/tinygettext/tinygettext";
     maintainers = [ lib.maintainers.SchweGELBin ];
     platforms = lib.platforms.linux;
     license = lib.licenses.zlib;
diff --git a/pkgs/by-name/tp/tpacpi-bat/package.nix b/pkgs/by-name/tp/tpacpi-bat/package.nix
index 48111ede5e44..de5f86b1ba8c 100644
--- a/pkgs/by-name/tp/tpacpi-bat/package.nix
+++ b/pkgs/by-name/tp/tpacpi-bat/package.nix
@@ -36,6 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = [ lib.maintainers.orbekk ];
     platforms = lib.platforms.linux;
     description = "Tool to set battery charging thresholds on Lenovo Thinkpad";
+    homepage = "https://github.com/teleshoes/tpacpi-bat";
     mainProgram = "tpacpi-bat";
     license = lib.licenses.gpl3Plus;
   };
diff --git a/pkgs/by-name/tr/tranquil-pds-frontend/package.nix b/pkgs/by-name/tr/tranquil-pds-frontend/package.nix
index ced153fb08dd..0375eac4cdaf 100644
--- a/pkgs/by-name/tr/tranquil-pds-frontend/package.nix
+++ b/pkgs/by-name/tr/tranquil-pds-frontend/package.nix
@@ -10,12 +10,12 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tranquil-frontend";
-  version = "0.6.3";
+  version = "0.6.4";
 
   src = fetchgit {
     url = "https://tangled.org/tranquil.farm/tranquil-pds";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TORNOFPlbCt4QWNd+bmxkShTUvT/5ynOj+UBYITAhg8=";
+    hash = "sha256-kGB5jFwghMsjlAoS4mj94s9peo7PL54UKTH/3TS567w=";
   };
   sourceRoot = "${finalAttrs.src.name}/frontend";
 
@@ -28,7 +28,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       ;
     inherit pnpm;
     fetcherVersion = 4;
-    hash = "sha256-qbmIAvE/3u/NB5x9bERCGQqwiDLkzjff3QchgR+ZDFs=";
+    hash = "sha256-9G74AVRXPgR+aj00ksCc1+dDqgE2GQR4cpjJsY6yjro=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/tr/tranquil-pds/package.nix b/pkgs/by-name/tr/tranquil-pds/package.nix
index 9d274810bc64..272af9d3fd81 100644
--- a/pkgs/by-name/tr/tranquil-pds/package.nix
+++ b/pkgs/by-name/tr/tranquil-pds/package.nix
@@ -10,15 +10,15 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tranquil-pds";
-  version = "0.6.3";
+  version = "0.6.4";
 
   src = fetchgit {
     url = "https://tangled.org/tranquil.farm/tranquil-pds";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TORNOFPlbCt4QWNd+bmxkShTUvT/5ynOj+UBYITAhg8=";
+    hash = "sha256-kGB5jFwghMsjlAoS4mj94s9peo7PL54UKTH/3TS567w=";
   };
 
-  cargoHash = "sha256-tQk9WQZmaG2XEx5gocPhYd8fZ2cikvduhln5h/w+WZA=";
+  cargoHash = "sha256-X2zoQSBQaq+W0rT/Y08EA1b81pbePUvH7q+Ccmtbf+Y=";
 
   __structuredAttrs = true;
 
diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index b6c72d4b9bd4..7d56da69a556 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -2583,9 +2583,9 @@
   };
 
   swift = rec {
-    version = "0.7.2";
+    version = "0.7.3";
     url = "github:alex-pinkus/tree-sitter-swift/${version}-with-generated-files";
-    hash = "sha256-tG+tM7B6901QP4QyJdf55V38b4XduSU1eb+gaP7BikE=";
+    hash = "sha256-SnWwqk6IRpaNldsraSKwHGtS64LiCndxDksrvLMs1P8=";
     meta = {
       license = lib.licenses.mit;
       maintainers = with lib.maintainers; [
diff --git a/pkgs/by-name/ty/ty/package.nix b/pkgs/by-name/ty/ty/package.nix
index 0dde0db10465..8b1c65bf1be6 100644
--- a/pkgs/by-name/ty/ty/package.nix
+++ b/pkgs/by-name/ty/ty/package.nix
@@ -17,7 +17,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ty";
-  version = "0.0.38";
+  version = "0.0.40";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     repo = "ty";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-70Y5i9m2h2+Jc44jLOf+gXX/PeDbURRJ80y+6h5SlRk=";
+    hash = "sha256-kdfPnyQXYtf3BDrYCFGfX0bMoPGjRpyH3aUeRZBiUKY=";
   };
 
   # For Darwin platforms, remove the integration test for file notifications,
@@ -39,7 +39,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoBuildFlags = [ "--package=ty" ];
 
-  cargoHash = "sha256-+c2JfB55w9otmmgTFIDMwkpASJV7bIMEf0uqRXjk/QM=";
+  cargoHash = "sha256-yUbHTzUGNdpm3b1s/SkcpFGdp7WjN+xO+CVrPPwrh6A=";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = [ rust-jemalloc-sys ];
@@ -101,6 +101,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     mainProgram = "ty";
     maintainers = with lib.maintainers; [
       bengsparks
+      ddogfoodd
       figsoda
       GaetanLepage
     ];
diff --git a/pkgs/by-name/ui/uitest/package.nix b/pkgs/by-name/ui/uitest/package.nix
index 9eff2ef5b47f..3bbfaddb6484 100644
--- a/pkgs/by-name/ui/uitest/package.nix
+++ b/pkgs/by-name/ui/uitest/package.nix
@@ -27,6 +27,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Simple testing framework for interactive tests";
+    homepage = "https://github.com/Grumbel/uitest";
     maintainers = [ lib.maintainers.SchweGELBin ];
     platforms = lib.platforms.linux;
     license = lib.licenses.gpl3;
diff --git a/pkgs/by-name/un/unnamed-sdvx-clone/package.nix b/pkgs/by-name/un/unnamed-sdvx-clone/package.nix
index 20684058b43f..1a92f78a9cf0 100644
--- a/pkgs/by-name/un/unnamed-sdvx-clone/package.nix
+++ b/pkgs/by-name/un/unnamed-sdvx-clone/package.nix
@@ -103,6 +103,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Game based on K-Shoot MANIA and Sound Voltex";
+    homepage = "https://github.com/Drewol/unnamed-sdvx-clone";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ sako ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/up/updatecli/package.nix b/pkgs/by-name/up/updatecli/package.nix
index 45243ebb97de..8ab0db0c484b 100644
--- a/pkgs/by-name/up/updatecli/package.nix
+++ b/pkgs/by-name/up/updatecli/package.nix
@@ -12,17 +12,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "updatecli";
-  version = "0.117.0";
+  version = "0.117.1";
 
   src = fetchFromGitHub {
     owner = "updatecli";
     repo = "updatecli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-9nA+sOlcIm5Try0oag1Oz/ALPDaMag0jZKzHrS0Brf8=";
+    hash = "sha256-24ZL2o5TauhPFDG6evOSHJUX3ZMDlekpUu5zvh2ZEQE=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-8WPwZjoDbRDi1IbjdZ40796JA5PRh8T75wRlWgTF7dI=";
+  vendorHash = "sha256-q53DDtSBYaXJElJZU4KV4Y3o0OIuOTPF0pskqpmQWXk=";
 
   # tests require network access
   doCheck = false;
diff --git a/pkgs/by-name/uu/uutils-acl/package.nix b/pkgs/by-name/uu/uutils-acl/package.nix
index 124394efd5ef..c459a54536f1 100644
--- a/pkgs/by-name/uu/uutils-acl/package.nix
+++ b/pkgs/by-name/uu/uutils-acl/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "uutils-acl";
-  version = "0.0.1-unstable-2026-05-17";
+  version = "0.0.1-unstable-2026-05-29";
 
   src = fetchFromGitHub {
     owner = "uutils";
     repo = "acl";
-    rev = "8c23acae9473c2a6a425a95eda474cdec33fb9a4";
-    hash = "sha256-q1dMJMMhL7/vA1ffy4KBhoPx7BoZnnr7yxLc9XDOCak=";
+    rev = "41b2a98f52d4a4d3e87f3debec506b259c296453";
+    hash = "sha256-42Eos2bIhA2DTvt9ZYlijtSk075iz/WJAhy5eBf4XAY=";
   };
 
-  cargoHash = "sha256-06gamu+PZK68QSA4vLYyjRS6ecO/ugjkmaHH2tipTl4=";
+  cargoHash = "sha256-7kzG0x5UQvF7MRu9tnrnJdhm4zYqrSfUa8mTrnfcIqs=";
 
   cargoBuildFlags = [ "--workspace" ];
 
diff --git a/pkgs/by-name/uu/uutils-procps/package.nix b/pkgs/by-name/uu/uutils-procps/package.nix
index c04b5e21d987..47823f26226d 100644
--- a/pkgs/by-name/uu/uutils-procps/package.nix
+++ b/pkgs/by-name/uu/uutils-procps/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "uutils-procps";
-  version = "0.0.1-unstable-2026-05-13";
+  version = "0.0.1-unstable-2026-05-30";
 
   src = fetchFromGitHub {
     owner = "uutils";
     repo = "procps";
-    rev = "c0b901770156504d1a2021794d5375b7f35a2112";
-    hash = "sha256-1aB/xFZaB9mvjYsHud0wajpdXKVKFLIFfeb9vpJebFQ=";
+    rev = "67cdcd74b855dfa324c3270fa2f05dae2681a64c";
+    hash = "sha256-gURJ37fugUnv+EXRAlhJIZ0xwzWeY/2X9ScxJALPOGU=";
   };
 
-  cargoHash = "sha256-fv7bgnbuhE2XKxb7ZKL2Vjt+mmrdqK6bSVKRBdTgoRE=";
+  cargoHash = "sha256-mtaOME1eRpQy2IaSh+ari4CwmsKbuPy2v2s5CdauQpo=";
 
   cargoBuildFlags = [ "--workspace" ];
 
diff --git a/pkgs/by-name/v2/v2ray-domain-list-community/package.nix b/pkgs/by-name/v2/v2ray-domain-list-community/package.nix
index 25f8a62a0eb7..0358e2142496 100644
--- a/pkgs/by-name/v2/v2ray-domain-list-community/package.nix
+++ b/pkgs/by-name/v2/v2ray-domain-list-community/package.nix
@@ -9,12 +9,12 @@
 let
   generator = pkgsBuildBuild.buildGoModule rec {
     pname = "v2ray-domain-list-community";
-    version = "20260522120028";
+    version = "20260531040030";
     src = fetchFromGitHub {
       owner = "v2fly";
       repo = "domain-list-community";
       rev = version;
-      hash = "sha256-+w+waGLxlkrp42Cy0WJoawcUpBuXbssD5/lokJhUJyw=";
+      hash = "sha256-+3lr7x+Ye2FcNjPNlxzI51yaNjQZl0CKeJ497HQZkm0=";
     };
     vendorHash = "sha256-9tXv+rDBowxDN9gH4zHCr4TRbic4kijco3Y6bojJKRk=";
     meta = {
diff --git a/pkgs/by-name/ve/vendir/package.nix b/pkgs/by-name/ve/vendir/package.nix
index 1e9771badd48..a3b1714c004b 100644
--- a/pkgs/by-name/ve/vendir/package.nix
+++ b/pkgs/by-name/ve/vendir/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "vendir";
-  version = "0.45.3";
+  version = "0.45.4";
 
   src = fetchFromGitHub {
     owner = "vmware-tanzu";
     repo = "carvel-vendir";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-pGChtADYje6tGM0qYTwSrGQkUu6P1N8AZiXLJDWoYjA=";
+    sha256 = "sha256-6Emc25RGd3diHc8wQCiH+tEuiD/SmYiA1L1KU9Z5cEk=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/ve/veryl/package.nix b/pkgs/by-name/ve/veryl/package.nix
index f787ded6d86a..10846811396c 100644
--- a/pkgs/by-name/ve/veryl/package.nix
+++ b/pkgs/by-name/ve/veryl/package.nix
@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "veryl";
-  version = "0.20.0";
+  version = "0.20.1";
 
   src = fetchFromGitHub {
     owner = "veryl-lang";
     repo = "veryl";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ZHt62r/mxPRNG0nv9IqTtmR4V++K8e6ttJ1zDeVjv+Q=";
+    hash = "sha256-jY8CeuRjtRtyQl07ezl/PUILvMABFJn9Q6AH11C4M/0=";
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-aouhM9rbMmlm78k6LTT5UGpFFpYRJXCo/2pnuiIxQag=";
+  cargoHash = "sha256-j6lJlGqtQf/mRYKDUi3nttbPWfI7CyE1tlksGhrnrEM=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/ve/vespa-cli/package.nix b/pkgs/by-name/ve/vespa-cli/package.nix
index 9d9bd34ebcc7..de5385e95237 100644
--- a/pkgs/by-name/ve/vespa-cli/package.nix
+++ b/pkgs/by-name/ve/vespa-cli/package.nix
@@ -9,14 +9,14 @@
 
 buildGoModule (finalAttrs: {
   pname = "vespa-cli";
-  version = "8.692.16";
+  version = "8.697.20";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "vespa-engine";
     repo = "vespa";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xpulYJ9qA7loxr2USE0/7ITOA5Sc55Y4k/1SDCAt2AA=";
+    hash = "sha256-h2dwCScX0LVd5hV1fnhKjXQue/ywmqyk5t/vzEDAwQE=";
   };
 
   # case-insensitive conflicts which produce platform `vendorHash` checksumm
@@ -24,7 +24,7 @@ buildGoModule (finalAttrs: {
 
   sourceRoot = "${finalAttrs.src.name}/client/go";
 
-  vendorHash = "sha256-OFZsGtarujDxiFgdY7bLnnJZzmnez9uqfEAWuap2+8I=";
+  vendorHash = "sha256-lrMGxMzUdr2ZlTn13AGwzHZBHUDonmoSxmUIo7cWx3g=";
 
   env.CGO_ENABLED = 0;
 
diff --git a/pkgs/by-name/wa/warmup-s3-archives/package.nix b/pkgs/by-name/wa/warmup-s3-archives/package.nix
index b37345dfbced..cde22e2238e2 100644
--- a/pkgs/by-name/wa/warmup-s3-archives/package.nix
+++ b/pkgs/by-name/wa/warmup-s3-archives/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "warmup-s3-archives";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchFromGitLab {
     owner = "philipmw";
     repo = "warmup-s3-archives";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-SIbynXs81EJz+r5vwl7BIj8UW6sXRWefU1h5D1g4V+4=";
+    hash = "sha256-AI/PD7Kkzzg5IqBy0uRM1QG7+pzhjECo+ad2I0pUkKo=";
   };
 
-  cargoHash = "sha256-Ck+xhPz2e+FtaaG3DI/7OJXHxjaNajPJg45xGWAjh+w=";
+  cargoHash = "sha256-2LOJ+f6SIkzPM+ucWU+7COUwo2Pvti7hL8k0+ry29SM=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/wa/wavefunctioncollapse/package.nix b/pkgs/by-name/wa/wavefunctioncollapse/package.nix
index 6d9b6ce6aa8a..a720ebeb9f47 100644
--- a/pkgs/by-name/wa/wavefunctioncollapse/package.nix
+++ b/pkgs/by-name/wa/wavefunctioncollapse/package.nix
@@ -31,6 +31,7 @@ stdenv.mkDerivation {
   buildInputs = [ mono ];
   meta = {
     description = "Generator of bitmaps that are locally similar to the input bitmap";
+    homepage = "https://github.com/mxgmn/WaveFunctionCollapse";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.raskin ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/we/webcord-vencord/package.nix b/pkgs/by-name/we/webcord-vencord/package.nix
index 7053f4bb5a7c..24f36c08118b 100644
--- a/pkgs/by-name/we/webcord-vencord/package.nix
+++ b/pkgs/by-name/we/webcord-vencord/package.nix
@@ -21,6 +21,7 @@
     inherit (old.meta) license mainProgram platforms;
 
     description = "Webcord with Vencord web extension";
+    homepage = "https://github.com/SpacingBat3/WebCord";
     maintainers = with lib.maintainers; [
       FlafyDev
       NotAShelf
diff --git a/pkgs/by-name/wi/wireworld/package.nix b/pkgs/by-name/wi/wireworld/package.nix
index cbcececa93a0..41f9d9ddd6f9 100644
--- a/pkgs/by-name/wi/wireworld/package.nix
+++ b/pkgs/by-name/wi/wireworld/package.nix
@@ -51,6 +51,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Fascinating electronics logic puzzles, game where you'll learn how to build clocks, diodes, and logic gates";
+    homepage = "https://gitlab.com/blinry/wireworld";
     mainProgram = "Wireworld";
     license = with lib.licenses; [
       mit
diff --git a/pkgs/by-name/wm/wmfs/package.nix b/pkgs/by-name/wm/wmfs/package.nix
index 273c2c920d85..355d0fd4de2c 100644
--- a/pkgs/by-name/wm/wmfs/package.nix
+++ b/pkgs/by-name/wm/wmfs/package.nix
@@ -52,6 +52,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Window manager from scratch";
+    homepage = "https://github.com/xorg62/wmfs";
     license = lib.licenses.bsd2;
     maintainers = [ lib.maintainers.balsoft ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/ws/wstsound/package.nix b/pkgs/by-name/ws/wstsound/package.nix
index 2464faaf69ed..b836fb9a2294 100644
--- a/pkgs/by-name/ws/wstsound/package.nix
+++ b/pkgs/by-name/ws/wstsound/package.nix
@@ -57,6 +57,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Windstille Sound Library";
+    homepage = "https://github.com/WindstilleTeam/wstsound";
     maintainers = [ lib.maintainers.SchweGELBin ];
     platforms = lib.platforms.linux;
     license = lib.licenses.free;
diff --git a/pkgs/by-name/xb/xbanish/package.nix b/pkgs/by-name/xb/xbanish/package.nix
index 572c7bb0778c..1ce78f8e111b 100644
--- a/pkgs/by-name/xb/xbanish/package.nix
+++ b/pkgs/by-name/xb/xbanish/package.nix
@@ -48,6 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
       The name comes from ratpoison's "banish" command that sends the cursor to the
       corner of the screen.
     '';
+    homepage = "https://github.com/jcs/xbanish";
     license = lib.licenses.bsd3;
     maintainers = [ lib.maintainers.choochootrain ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/xd/xdg-desktop-portal-gtk/package.nix b/pkgs/by-name/xd/xdg-desktop-portal-gtk/package.nix
index e9c77c3c0348..c8dab9ff8426 100644
--- a/pkgs/by-name/xd/xdg-desktop-portal-gtk/package.nix
+++ b/pkgs/by-name/xd/xdg-desktop-portal-gtk/package.nix
@@ -48,6 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Desktop integration portals for sandboxed apps";
+    homepage = "https://github.com/flatpak/xdg-desktop-portal-gtk";
     maintainers = with lib.maintainers; [ jtojnar ];
     platforms = lib.platforms.linux;
     license = lib.licenses.lgpl21Plus;
diff --git a/pkgs/by-name/xd/xdgcpp/package.nix b/pkgs/by-name/xd/xdgcpp/package.nix
index ef8162e9fa15..3853360be99a 100644
--- a/pkgs/by-name/xd/xdgcpp/package.nix
+++ b/pkgs/by-name/xd/xdgcpp/package.nix
@@ -20,6 +20,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Implementation of the XDG Base Directory Specification in C++";
+    homepage = "https://github.com/Grumbel/xdgcpp";
     maintainers = [ lib.maintainers.SchweGELBin ];
     platforms = lib.platforms.linux;
     license = lib.licenses.lgpl3;
diff --git a/pkgs/by-name/xi/xib2nib/package.nix b/pkgs/by-name/xi/xib2nib/package.nix
index 35d87f62867e..df1184698951 100644
--- a/pkgs/by-name/xi/xib2nib/package.nix
+++ b/pkgs/by-name/xi/xib2nib/package.nix
@@ -31,6 +31,7 @@ stdenv.mkDerivation {
   meta = {
     maintainers = [ ];
     description = "Compiles CocoaTouch .xib files into .nib";
+    homepage = "https://github.com/matthewbauer/xib2nib";
     license = lib.licenses.mit;
     platforms = lib.platforms.unix;
   };
diff --git a/pkgs/by-name/xr/xremap/package.nix b/pkgs/by-name/xr/xremap/package.nix
index e3f937dfb586..032ccfee3578 100644
--- a/pkgs/by-name/xr/xremap/package.nix
+++ b/pkgs/by-name/xr/xremap/package.nix
@@ -58,13 +58,13 @@ assert (
 );
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "xremap${variant.suffix or ""}";
-  version = "0.15.7";
+  version = "0.15.8";
 
   src = fetchFromGitHub {
     owner = "xremap";
     repo = "xremap";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vsXojdGdAhtFdOlyBEnnBHvZfcgDhNqMN9axxu6wfb0=";
+    hash = "sha256-Ia5jG+wsdhFmX2ZreIHpRQDscOF6FB0zZlOWWboMqDk=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -72,7 +72,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   buildNoDefaultFeatures = true;
   buildFeatures = variant.features;
 
-  cargoHash = "sha256-Fd+SnT3lUoB2tU/lZtI9AoRMV2Dcl4XLknCVgAbTL60=";
+  cargoHash = "sha256-xwAO6OekuyxRGXIYek0918ZHod21Ae/mbGn8ZP6LjSc=";
 
   passthru = lib.mapAttrs (name: lib.const (xremap.override { withVariant = name; })) variants;
 
diff --git a/pkgs/by-name/xs/xsensors/package.nix b/pkgs/by-name/xs/xsensors/package.nix
index 36745f3453dc..e97d756d0cb1 100644
--- a/pkgs/by-name/xs/xsensors/package.nix
+++ b/pkgs/by-name/xs/xsensors/package.nix
@@ -26,6 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   meta = {
+    homepage = "https://github.com/Mystro256/xsensors";
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.linux;
     maintainers = [ ];
diff --git a/pkgs/by-name/xs/xss-lock/package.nix b/pkgs/by-name/xs/xss-lock/package.nix
index 86a7cfeaa8ce..d01902021757 100644
--- a/pkgs/by-name/xs/xss-lock/package.nix
+++ b/pkgs/by-name/xs/xss-lock/package.nix
@@ -47,6 +47,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Use external locker (such as i3lock) as X screen saver";
+    homepage = "https://github.com/xdbob/xss-lock";
     license = lib.licenses.mit;
     mainProgram = "xss-lock";
     maintainers = with lib.maintainers; [
diff --git a/pkgs/by-name/xs/xssstate/package.nix b/pkgs/by-name/xs/xssstate/package.nix
index 8572a6ecccf0..d53b0e502604 100644
--- a/pkgs/by-name/xs/xssstate/package.nix
+++ b/pkgs/by-name/xs/xssstate/package.nix
@@ -26,6 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   meta = {
+    homepage = "https://git.suckless.org/xssstate/file/README.html";
     description = "Simple tool to retrieve the X screensaver state";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ onemoresuza ];
diff --git a/pkgs/by-name/xv/xva-img/package.nix b/pkgs/by-name/xv/xva-img/package.nix
index 718c31ef0aa0..dcc57afe23f6 100644
--- a/pkgs/by-name/xv/xva-img/package.nix
+++ b/pkgs/by-name/xv/xva-img/package.nix
@@ -33,6 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     maintainers = [ ];
     description = "Tool for converting Xen images to raw and back";
+    homepage = "https://github.com/eriklax/xva-img";
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.unix;
     mainProgram = "xva-img";
diff --git a/pkgs/by-name/xw/xwinmosaic/package.nix b/pkgs/by-name/xw/xwinmosaic/package.nix
index 0a45662bb9df..8436101ff10c 100644
--- a/pkgs/by-name/xw/xwinmosaic/package.nix
+++ b/pkgs/by-name/xw/xwinmosaic/package.nix
@@ -46,6 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "X window switcher drawing a colourful grid";
+    homepage = "https://github.com/soulthreads/xwinmosaic";
     license = lib.licenses.bsd2;
     maintainers = [ lib.maintainers.raskin ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/zi/zigbee2mqtt/package.nix b/pkgs/by-name/zi/zigbee2mqtt/package.nix
index b4cbb34b0e4c..7991d5a7c972 100644
--- a/pkgs/by-name/zi/zigbee2mqtt/package.nix
+++ b/pkgs/by-name/zi/zigbee2mqtt/package.nix
@@ -14,20 +14,20 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "zigbee2mqtt";
-  version = "2.10.1";
+  version = "2.11.0";
 
   src = fetchFromGitHub {
     owner = "Koenkk";
     repo = "zigbee2mqtt";
     tag = finalAttrs.version;
-    hash = "sha256-UAU7yxpaCIUrjXp8uMUEPnwSRGTHNQMD9PqSIoH686Q=";
+    hash = "sha256-4/P7ZPVdafWQqfi7sg+9Uy1MZYeHaNDESAaUq0nrBQ8=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_9;
     fetcherVersion = 3;
-    hash = "sha256-QxUoTQxBscovpYWo3WdBYInHkPbvLxDSZmjNLkDllVw=";
+    hash = "sha256-KSPdu9v34WYxyZtcL0NtP58LWmhK0KU0be6Z/VkZjH0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/zs/zs-apc-spdu-ctl/package.nix b/pkgs/by-name/zs/zs-apc-spdu-ctl/package.nix
index fcfd1ae18781..8e3d17ef417a 100644
--- a/pkgs/by-name/zs/zs-apc-spdu-ctl/package.nix
+++ b/pkgs/by-name/zs/zs-apc-spdu-ctl/package.nix
@@ -33,6 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "APC SPDU control utility";
+    homepage = "https://github.com/fogti/zs-apc-spdu-ctl";
     license = lib.licenses.mit;
     maintainers = [ ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/zu/zuban/package.nix b/pkgs/by-name/zu/zuban/package.nix
index df8422c0453a..9b6fbda85dfd 100644
--- a/pkgs/by-name/zu/zuban/package.nix
+++ b/pkgs/by-name/zu/zuban/package.nix
@@ -9,13 +9,13 @@
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zuban";
 
-  version = "0.7.2";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "zubanls";
     repo = "zuban";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KCQOJ2NyWohbfW6fdG7F+borxUEXOy1IRB/jlc1wrc0=";
+    hash = "sha256-/m66vCXutOBMXMJfulJ9nFeqRWVJCIrHVJiICOvs/+A=";
     fetchSubmodules = true;
   };
 
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   buildAndTestSubdir = "crates/zuban";
 
-  cargoHash = "sha256-r8ezvIkd4R3rFdoKr+KKHKnLWl1/Vl3Ch9GdKhVflMo=";
+  cargoHash = "sha256-mT8QG4pI96gTgFFZN49Yi7Ax90ulPM8pA0tdB/fdSuM=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/development/compilers/llvm/common/clang/default.nix b/pkgs/development/compilers/llvm/common/clang/default.nix
index f3b8f52bcfa3..e353d9203b2a 100644
--- a/pkgs/development/compilers/llvm/common/clang/default.nix
+++ b/pkgs/development/compilers/llvm/common/clang/default.nix
@@ -249,6 +249,7 @@ stdenv.mkDerivation (
 
     meta = llvm_meta // {
       description = "man page for Clang ${version}";
+      homepage = "https://github.com/llvm/llvm-project";
     };
   }
 )
diff --git a/pkgs/development/compilers/llvm/common/lldb/default.nix b/pkgs/development/compilers/llvm/common/lldb/default.nix
index e146f1d896b8..75bdebc71906 100644
--- a/pkgs/development/compilers/llvm/common/lldb/default.nix
+++ b/pkgs/development/compilers/llvm/common/lldb/default.nix
@@ -213,6 +213,7 @@ stdenv.mkDerivation (
 
     meta = llvm_meta // {
       description = "man pages for LLDB ${version}";
+      homepage = "https://github.com/llvm/llvm-project";
     };
   }
 )
diff --git a/pkgs/development/compilers/llvm/common/llvm/default.nix b/pkgs/development/compilers/llvm/common/llvm/default.nix
index d5dcd4d58cce..a886dac9c709 100644
--- a/pkgs/development/compilers/llvm/common/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/common/llvm/default.nix
@@ -626,6 +626,7 @@ stdenv.mkDerivation (
 
     meta = llvm_meta // {
       description = "man pages for LLVM ${version}";
+      homepage = "https://github.com/llvm/llvm-project";
     };
   }
 )
diff --git a/pkgs/development/compilers/yosys/plugins/bluespec.nix b/pkgs/development/compilers/yosys/plugins/bluespec.nix
index 29f2da23e49d..4379a5a16394 100644
--- a/pkgs/development/compilers/yosys/plugins/bluespec.nix
+++ b/pkgs/development/compilers/yosys/plugins/bluespec.nix
@@ -38,6 +38,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Bluespec plugin for Yosys";
+    homepage = "https://github.com/thoughtpolice/yosys-bluespec";
     license = lib.licenses.isc;
     platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [ thoughtpolice ];
diff --git a/pkgs/development/libraries/qoauth/default.nix b/pkgs/development/libraries/qoauth/default.nix
index 6ec0a7bc0517..d8f840078aa0 100644
--- a/pkgs/development/libraries/qoauth/default.nix
+++ b/pkgs/development/libraries/qoauth/default.nix
@@ -40,6 +40,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Qt library for OAuth authentication";
+    homepage = "https://github.com/ayoy/qoauth";
     inherit (qtbase.meta) platforms;
     license = lib.licenses.lgpl21;
   };
diff --git a/pkgs/development/lisp-modules/packages.nix b/pkgs/development/lisp-modules/packages.nix
index 83399f8ec787..560e80f954dc 100644
--- a/pkgs/development/lisp-modules/packages.nix
+++ b/pkgs/development/lisp-modules/packages.nix
@@ -221,6 +221,9 @@ let
           "slynk/indentation"
           "slynk/retro"
         ];
+        meta = {
+          homepage = "https://github.com/joaotavora/sly";
+        };
       };
 
       cephes = build-with-compile-into-pwd {
@@ -331,6 +334,9 @@ let
         nativeLibs = [
           pkgs.gtk4
         ];
+        meta = {
+          homepage = "https://github.com/bohonghuang/cl-gtk4";
+        };
       };
 
       cl-gtk4_dot_adw = build-asdf-system {
@@ -347,6 +353,9 @@ let
         nativeLibs = [
           pkgs.libadwaita
         ];
+        meta = {
+          homepage = "https://github.com/bohonghuang/cl-gtk4";
+        };
       };
 
       cl-gtk4_dot_webkit = build-asdf-system {
@@ -363,6 +372,9 @@ let
         nativeLibs = [
           pkgs.webkitgtk_6_0
         ];
+        meta = {
+          homepage = "https://github.com/bohonghuang/cl-gtk4";
+        };
       };
 
       cl-avro = build-asdf-system {
@@ -389,6 +401,9 @@ let
           time-interval
           trivial-extensible-sequences
         ];
+        meta = {
+          homepage = "https://github.com/SahilKang/cl-avro";
+        };
       };
 
       frugal-uuid = super.frugal-uuid.overrideLispAttrs (o: {
@@ -433,6 +448,9 @@ let
           mcclim
           mcclim-layouts
         ];
+        meta = {
+          homepage = "https://github.com/kaveh808/kons-9";
+        };
       };
 
       kons-9 = build-asdf-system {
@@ -465,6 +483,9 @@ let
           shasht
           org_dot_melusina_dot_confidence
         ];
+        meta = {
+          homepage = "https://github.com/kaveh808/kons-9";
+        };
       };
 
       nsb-cga = super.nsb-cga.overrideLispAttrs (old: {
@@ -528,7 +549,10 @@ let
           runHook postInstall
         '';
 
-        meta.mainProgram = "qlot";
+        meta = {
+          mainProgram = "qlot";
+          homepage = "https://github.com/fukamachi/qlot";
+        };
       };
 
       fset = super.fset.overrideLispAttrs (old: {
diff --git a/pkgs/development/misc/or1k/newlib.nix b/pkgs/development/misc/or1k/newlib.nix
index b45cf4fe96ee..4ea6471eeacf 100644
--- a/pkgs/development/misc/or1k/newlib.nix
+++ b/pkgs/development/misc/or1k/newlib.nix
@@ -43,4 +43,8 @@ stdenvNoLibc.mkDerivation {
     incdir = "/${stdenv.targetPlatform.config}/include";
     libdir = "/${stdenv.targetPlatform.config}/lib";
   };
+
+  meta = {
+    homepage = "https://github.com/openrisc/newlib";
+  };
 }
diff --git a/pkgs/development/misc/resholve/resholve.nix b/pkgs/development/misc/resholve/resholve.nix
index 67200729d4ef..ffb6c2cf6ac9 100644
--- a/pkgs/development/misc/resholve/resholve.nix
+++ b/pkgs/development/misc/resholve/resholve.nix
@@ -59,7 +59,6 @@ python27.pkgs.buildPythonApplication {
       inherit
         rSrc
         binlore
-        python27
         resholve
         ;
     };
diff --git a/pkgs/development/misc/vc4/newlib.nix b/pkgs/development/misc/vc4/newlib.nix
index 4575a4149f31..20bcd3276498 100644
--- a/pkgs/development/misc/vc4/newlib.nix
+++ b/pkgs/development/misc/vc4/newlib.nix
@@ -39,4 +39,8 @@ stdenvNoLibc.mkDerivation {
     incdir = "/${stdenv.targetPlatform.config}/include";
     libdir = "/${stdenv.targetPlatform.config}/lib";
   };
+
+  meta = {
+    homepage = "https://github.com/itszor/newlib-vc4";
+  };
 }
diff --git a/pkgs/development/mobile/webos/cmake-modules.nix b/pkgs/development/mobile/webos/cmake-modules.nix
index 22953516a172..5c8802e5e261 100644
--- a/pkgs/development/mobile/webos/cmake-modules.nix
+++ b/pkgs/development/mobile/webos/cmake-modules.nix
@@ -38,6 +38,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "CMake modules needed to build Open WebOS components";
+    homepage = "https://github.com/openwebos/cmake-modules-webos";
     license = lib.licenses.asl20;
     maintainers = [ ];
   };
diff --git a/pkgs/development/mobile/webos/novacom.nix b/pkgs/development/mobile/webos/novacom.nix
index 6cde96f7895f..975320fbf16a 100644
--- a/pkgs/development/mobile/webos/novacom.nix
+++ b/pkgs/development/mobile/webos/novacom.nix
@@ -36,6 +36,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Utility for communicating with WebOS devices";
+    homepage = "https://github.com/openwebos/novacom";
     license = lib.licenses.asl20;
     maintainers = [ ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/development/mobile/webos/novacomd.nix b/pkgs/development/mobile/webos/novacomd.nix
index 781efe73c6b1..505920b3a249 100644
--- a/pkgs/development/mobile/webos/novacomd.nix
+++ b/pkgs/development/mobile/webos/novacomd.nix
@@ -61,6 +61,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Daemon for communicating with WebOS devices";
+    homepage = "https://github.com/openwebos/novacomd";
     mainProgram = "novacomd";
     license = lib.licenses.asl20;
     maintainers = [ ];
diff --git a/pkgs/development/ocaml-modules/aches/default.nix b/pkgs/development/ocaml-modules/aches/default.nix
index 63f814baf6c2..a166056100cf 100644
--- a/pkgs/development/ocaml-modules/aches/default.nix
+++ b/pkgs/development/ocaml-modules/aches/default.nix
@@ -14,6 +14,7 @@ buildDunePackage {
 
   meta = {
     description = "Caches (bounded-size stores) for in-memory values and for resources";
+    homepage = "https://gitlab.com/nomadic-labs/ringo";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.ulrikstrid ];
   };
diff --git a/pkgs/development/ocaml-modules/aches/lwt.nix b/pkgs/development/ocaml-modules/aches/lwt.nix
index e0bc45820ba6..2d52b6410d76 100644
--- a/pkgs/development/ocaml-modules/aches/lwt.nix
+++ b/pkgs/development/ocaml-modules/aches/lwt.nix
@@ -17,6 +17,7 @@ buildDunePackage {
 
   meta = {
     description = "Caches (bounded-size stores) for Lwt promises";
+    homepage = "https://gitlab.com/nomadic-labs/ringo";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.ulrikstrid ];
   };
diff --git a/pkgs/development/ocaml-modules/bz2/default.nix b/pkgs/development/ocaml-modules/bz2/default.nix
index 67689cac1a2e..36d0efa13bb0 100644
--- a/pkgs/development/ocaml-modules/bz2/default.nix
+++ b/pkgs/development/ocaml-modules/bz2/default.nix
@@ -40,6 +40,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "OCaml bindings for the libbz2 (AKA, bzip2) (de)compression library";
+    homepage = "https://gitlab.com/irill/camlbz2";
     downloadPage = "https://gitlab.com/irill/camlbz2";
     license = lib.licenses.lgpl21;
     broken = lib.versionOlder ocaml.version "4.02" || lib.versionAtLeast ocaml.version "5.0";
diff --git a/pkgs/development/ocaml-modules/camlp-streams/default.nix b/pkgs/development/ocaml-modules/camlp-streams/default.nix
index 9457682b189e..9095eb0518e2 100644
--- a/pkgs/development/ocaml-modules/camlp-streams/default.nix
+++ b/pkgs/development/ocaml-modules/camlp-streams/default.nix
@@ -17,6 +17,7 @@ buildDunePackage (finalAttrs: {
 
   meta = {
     description = "Stream and Genlex libraries for use with Camlp4 and Camlp5";
+    homepage = "https://github.com/ocaml/camlp-streams";
     license = lib.licenses.lgpl21Only;
     maintainers = [ lib.maintainers.vbgl ];
   };
diff --git a/pkgs/development/ocaml-modules/clap/default.nix b/pkgs/development/ocaml-modules/clap/default.nix
index 7735cf2d6249..12c919263ded 100644
--- a/pkgs/development/ocaml-modules/clap/default.nix
+++ b/pkgs/development/ocaml-modules/clap/default.nix
@@ -19,6 +19,7 @@ buildDunePackage (finalAttrs: {
 
   meta = {
     description = "Command-Line Argument Parsing, imperative style with a consumption mechanism";
+    homepage = "https://github.com/rbardou/clap";
     license = lib.licenses.mit;
   };
 })
diff --git a/pkgs/development/ocaml-modules/fontconfig/default.nix b/pkgs/development/ocaml-modules/fontconfig/default.nix
index 4668d6e316e4..361e80ee4524 100644
--- a/pkgs/development/ocaml-modules/fontconfig/default.nix
+++ b/pkgs/development/ocaml-modules/fontconfig/default.nix
@@ -39,6 +39,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Fontconfig bindings for OCaml";
+    homepage = "https://github.com/flh/ocaml-fontconfig";
     license = lib.licenses.gpl2Plus;
     platforms = ocaml.meta.platforms;
     maintainers = with lib.maintainers; [ vbgl ];
diff --git a/pkgs/development/ocaml-modules/hashcons/default.nix b/pkgs/development/ocaml-modules/hashcons/default.nix
index a8649341c964..011af37382bd 100644
--- a/pkgs/development/ocaml-modules/hashcons/default.nix
+++ b/pkgs/development/ocaml-modules/hashcons/default.nix
@@ -19,6 +19,7 @@ buildDunePackage (finalAttrs: {
 
   meta = {
     description = "OCaml hash-consing library";
+    homepage = "https://github.com/backtracking/ocaml-hashcons";
     license = lib.licenses.lgpl21;
     maintainers = [ lib.maintainers.ulrikstrid ];
   };
diff --git a/pkgs/development/ocaml-modules/lwt-exit/default.nix b/pkgs/development/ocaml-modules/lwt-exit/default.nix
index bc9288d9d152..83f4f8e967e2 100644
--- a/pkgs/development/ocaml-modules/lwt-exit/default.nix
+++ b/pkgs/development/ocaml-modules/lwt-exit/default.nix
@@ -26,6 +26,7 @@ buildDunePackage (finalAttrs: {
 
   meta = {
     description = "Opinionated clean-exit and signal-handling library for Lwt programs";
+    homepage = "https://gitlab.com/nomadic-labs/lwt-exit";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.ulrikstrid ];
   };
diff --git a/pkgs/development/ocaml-modules/lwt-watcher/default.nix b/pkgs/development/ocaml-modules/lwt-watcher/default.nix
index 27a64c186efd..2c336b085185 100644
--- a/pkgs/development/ocaml-modules/lwt-watcher/default.nix
+++ b/pkgs/development/ocaml-modules/lwt-watcher/default.nix
@@ -23,6 +23,7 @@ buildDunePackage (finalAttrs: {
 
   meta = {
     description = "One-to-many broadcast in Lwt";
+    homepage = "https://gitlab.com/nomadic-labs/lwt-watcher";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.ulrikstrid ];
   };
diff --git a/pkgs/development/ocaml-modules/reason-native/dir.nix b/pkgs/development/ocaml-modules/reason-native/dir.nix
index 3f0cb5c4d141..353ace38bc48 100644
--- a/pkgs/development/ocaml-modules/reason-native/dir.nix
+++ b/pkgs/development/ocaml-modules/reason-native/dir.nix
@@ -22,6 +22,7 @@ buildDunePackage {
 
   meta = {
     description = "Library that provides a consistent API for common system, user and application directories consistently on all platforms";
+    homepage = "https://github.com/reasonml/reason-native";
     downloadPage = "https://github.com/reasonml/reason-native/tree/master/src/dir";
     license = lib.licenses.mit;
     maintainers = [ ];
diff --git a/pkgs/development/ocaml-modules/reason-native/fp.nix b/pkgs/development/ocaml-modules/reason-native/fp.nix
index dc630aa12aba..9db0cc29903e 100644
--- a/pkgs/development/ocaml-modules/reason-native/fp.nix
+++ b/pkgs/development/ocaml-modules/reason-native/fp.nix
@@ -17,6 +17,7 @@ buildDunePackage {
 
   meta = {
     description = "Library for creating and operating on file paths consistently on multiple platforms";
+    homepage = "https://github.com/reasonml/reason-native";
     downloadPage = "https://github.com/reasonml/reason-native/tree/master/src/fp";
     license = lib.licenses.mit;
     maintainers = [ ];
diff --git a/pkgs/development/ocaml-modules/reason-native/frame.nix b/pkgs/development/ocaml-modules/reason-native/frame.nix
index 998ab567a14d..fd9ae6668d9d 100644
--- a/pkgs/development/ocaml-modules/reason-native/frame.nix
+++ b/pkgs/development/ocaml-modules/reason-native/frame.nix
@@ -24,6 +24,7 @@ buildDunePackage {
 
   meta = {
     description = "Reason Native text layout library";
+    homepage = "https://github.com/reasonml/reason-native";
     downloadPage = "https://github.com/reasonml/reason-native/tree/master/src/frame";
     license = lib.licenses.mit;
     maintainers = [ ];
diff --git a/pkgs/development/ocaml-modules/reason-native/fs.nix b/pkgs/development/ocaml-modules/reason-native/fs.nix
index 331607990544..939bc1699229 100644
--- a/pkgs/development/ocaml-modules/reason-native/fs.nix
+++ b/pkgs/development/ocaml-modules/reason-native/fs.nix
@@ -22,6 +22,7 @@ buildDunePackage {
 
   meta = {
     description = "Reason Native file system API";
+    homepage = "https://github.com/reasonml/reason-native";
     downloadPage = "https://github.com/reasonml/reason-native/tree/master/src/fs";
     license = lib.licenses.mit;
     maintainers = [ ];
diff --git a/pkgs/development/ocaml-modules/reason-native/qcheck-rely.nix b/pkgs/development/ocaml-modules/reason-native/qcheck-rely.nix
index df376cf7b3ce..d8cbe8fbd9f7 100644
--- a/pkgs/development/ocaml-modules/reason-native/qcheck-rely.nix
+++ b/pkgs/development/ocaml-modules/reason-native/qcheck-rely.nix
@@ -26,6 +26,7 @@ buildDunePackage {
 
   meta = {
     description = "Library containing custom Rely matchers allowing for easily using QCheck with Rely. QCheck is a 'QuickCheck inspired property-based testing for OCaml, and combinators to generate random values to run tests on'";
+    homepage = "https://github.com/reasonml/reason-native";
     downloadPage = "https://github.com/reasonml/reason-native/tree/master/src/qcheck-rely";
     license = lib.licenses.mit;
     maintainers = [ ];
diff --git a/pkgs/development/ocaml-modules/reason-native/unicode-config.nix b/pkgs/development/ocaml-modules/reason-native/unicode-config.nix
index b0393918b188..6b9a8c6f32b5 100644
--- a/pkgs/development/ocaml-modules/reason-native/unicode-config.nix
+++ b/pkgs/development/ocaml-modules/reason-native/unicode-config.nix
@@ -17,6 +17,7 @@ buildDunePackage {
 
   meta = {
     description = "Configuration used to generate the @reason-native/unicode library";
+    homepage = "https://github.com/reasonml/reason-native";
     downloadPage = "https://github.com/reasonml/reason-native/tree/master/src/unicode-config";
     license = lib.licenses.mit;
     maintainers = [ ];
diff --git a/pkgs/development/ocaml-modules/reason-native/unicode.nix b/pkgs/development/ocaml-modules/reason-native/unicode.nix
index f8376ec67561..663c02e49306 100644
--- a/pkgs/development/ocaml-modules/reason-native/unicode.nix
+++ b/pkgs/development/ocaml-modules/reason-native/unicode.nix
@@ -17,6 +17,7 @@ buildDunePackage {
 
   meta = {
     description = "Easy to use and well documented Unicode symbols";
+    homepage = "https://github.com/reasonml/reason-native";
     downloadPage = "https://github.com/reasonml/reason-native/tree/master/src/unicode";
     license = lib.licenses.mit;
     maintainers = [ ];
diff --git a/pkgs/development/ocaml-modules/reason-native/utf8.nix b/pkgs/development/ocaml-modules/reason-native/utf8.nix
index 5e2c6eef79ea..f272c4fd2632 100644
--- a/pkgs/development/ocaml-modules/reason-native/utf8.nix
+++ b/pkgs/development/ocaml-modules/reason-native/utf8.nix
@@ -17,6 +17,7 @@ buildDunePackage {
 
   meta = {
     description = "Utf8 logic with minimal dependencies";
+    homepage = "https://github.com/reasonml/reason-native";
     downloadPage = "https://github.com/reasonml/reason-native/tree/master/src/utf8";
     license = lib.licenses.mit;
     maintainers = [ ];
diff --git a/pkgs/development/ocaml-modules/ringo/default.nix b/pkgs/development/ocaml-modules/ringo/default.nix
index 06ef0791de53..47ddef1cdb4b 100644
--- a/pkgs/development/ocaml-modules/ringo/default.nix
+++ b/pkgs/development/ocaml-modules/ringo/default.nix
@@ -20,6 +20,7 @@ buildDunePackage (finalAttrs: {
 
   meta = {
     description = "Caches (bounded-size key-value stores) and other bounded-size stores";
+    homepage = "https://gitlab.com/nomadic-labs/ringo";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.ulrikstrid ];
   };
diff --git a/pkgs/development/ocaml-modules/secp256k1-internal/default.nix b/pkgs/development/ocaml-modules/secp256k1-internal/default.nix
index 077cd46b44b3..734120c012e4 100644
--- a/pkgs/development/ocaml-modules/secp256k1-internal/default.nix
+++ b/pkgs/development/ocaml-modules/secp256k1-internal/default.nix
@@ -42,6 +42,7 @@ buildDunePackage (finalAttrs: {
 
   meta = {
     description = "Bindings to secp256k1 internal functions (generic operations on the curve)";
+    homepage = "https://gitlab.com/nomadic-labs/ocaml-secp256k1-internal";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.ulrikstrid ];
   };
diff --git a/pkgs/development/ocaml-modules/systemd/default.nix b/pkgs/development/ocaml-modules/systemd/default.nix
index ce6410a282bd..b7f2c3666bfe 100644
--- a/pkgs/development/ocaml-modules/systemd/default.nix
+++ b/pkgs/development/ocaml-modules/systemd/default.nix
@@ -18,6 +18,7 @@ buildDunePackage {
   meta = {
     platforms = lib.platforms.linux;
     description = "OCaml module for native access to the systemd facilities";
+    homepage = "https://github.com/juergenhoetzel/ocaml-systemd";
     license = lib.licenses.lgpl3Only;
     maintainers = [ lib.maintainers.atagen ];
   };
diff --git a/pkgs/development/ocaml-modules/tezt/default.nix b/pkgs/development/ocaml-modules/tezt/default.nix
index c77951e6f250..7e5e36aa09ff 100644
--- a/pkgs/development/ocaml-modules/tezt/default.nix
+++ b/pkgs/development/ocaml-modules/tezt/default.nix
@@ -30,6 +30,7 @@ buildDunePackage rec {
 
   meta = {
     description = "Test framework for unit tests, integration tests, and regression tests";
+    homepage = "https://gitlab.com/nomadic-labs/tezt";
     license = lib.licenses.mit;
     broken = lib.versionAtLeast lwt.version "6.0.0";
   };
diff --git a/pkgs/development/python-modules/ale-py/default.nix b/pkgs/development/python-modules/ale-py/default.nix
index 3282fd421f5d..ec10c5decc26 100644
--- a/pkgs/development/python-modules/ale-py/default.nix
+++ b/pkgs/development/python-modules/ale-py/default.nix
@@ -48,6 +48,15 @@ buildPythonPackage (finalAttrs: {
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     jax
   ];
+
+  # disable lto on darwin, cmake cannot find llvm-ar
+  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    substituteInPlace src/ale/CMakeLists.txt \
+      --replace-fail \
+        'set(CMAKE_INTERPROCEDURAL_OPTIMIZATION TRUE)' \
+        'set(CMAKE_INTERPROCEDURAL_OPTIMIZATION FALSE)'
+  '';
+
   dontUseCmakeConfigure = true;
 
   buildInputs = [
@@ -104,10 +113,5 @@ buildPythonPackage (finalAttrs: {
     changelog = "https://github.com/Farama-Foundation/Arcade-Learning-Environment/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.gpl2;
     maintainers = with lib.maintainers; [ billhuang ];
-    badPlatforms = [
-      # FAILED: src/ale/libale.a
-      # /bin/sh: CMAKE_CXX_COMPILER_AR-NOTFOUND: command not found
-      lib.systems.inspect.patterns.isDarwin
-    ];
   };
 })
diff --git a/pkgs/development/python-modules/asn1ate/default.nix b/pkgs/development/python-modules/asn1ate/default.nix
index 31fa4a7b2743..0a54896521f0 100644
--- a/pkgs/development/python-modules/asn1ate/default.nix
+++ b/pkgs/development/python-modules/asn1ate/default.nix
@@ -13,7 +13,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     sha256 = "1p8hv4gsyqsdr0gafcq497n52pybiqmc22di8ai4nsj60fv0km45";
     rev = "v${version}";
-    owner = "kimgr";
+    owner = "schneider-electric";
     repo = "asn1ate";
   };
 
@@ -21,6 +21,7 @@ buildPythonPackage rec {
 
   meta = {
     description = "Python library for translating ASN.1 into other forms";
+    homepage = "https://github.com/schneider-electric/asn1ate";
     mainProgram = "asn1ate";
     license = lib.licenses.bsd3;
     platforms = lib.platforms.unix;
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index 80cc6bf0720c..01c4c7131c26 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -358,13 +358,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "boto3-stubs";
-  version = "1.43.17";
+  version = "1.43.18";
   pyproject = true;
 
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit (finalAttrs) version;
-    hash = "sha256-noNa6wsJD4OKnDr3vJ8TGHWv5kOUyJW6Ht4V9OZcNb8=";
+    hash = "sha256-Cb9IDGK8VM9ZvQrROz2w7ZoAWSZ1/QEki8uk+T6qdmA=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/cx-logging/default.nix b/pkgs/development/python-modules/cx-logging/default.nix
index fd984216f9e5..cda1235ed4d3 100644
--- a/pkgs/development/python-modules/cx-logging/default.nix
+++ b/pkgs/development/python-modules/cx-logging/default.nix
@@ -37,6 +37,7 @@ buildPythonPackage (finalAttrs: {
 
   meta = {
     description = "Python and C interfaces for logging";
+    homepage = "https://github.com/anthony-tuininga/cx_Logging";
     changelog = "https://github.com/anthony-tuininga/cx_Logging/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ sigmanificient ];
diff --git a/pkgs/development/python-modules/django-auditlog/default.nix b/pkgs/development/python-modules/django-auditlog/default.nix
index c589b1ecb1c2..4266d96ba71c 100644
--- a/pkgs/development/python-modules/django-auditlog/default.nix
+++ b/pkgs/development/python-modules/django-auditlog/default.nix
@@ -66,6 +66,7 @@ buildPythonPackage rec {
   meta = {
     changelog = "https://github.com/jazzband/django-auditlog/blob/${src.tag}/CHANGELOG.md";
     description = "Django app that keeps a log of changes made to an object";
+    homepage = "https://github.com/jazzband/django-auditlog";
     downloadPage = "https://github.com/jazzband/django-auditlog";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ leona ];
diff --git a/pkgs/development/python-modules/enocean-async/default.nix b/pkgs/development/python-modules/enocean-async/default.nix
index a92f9dd4d86f..fa23095331c0 100644
--- a/pkgs/development/python-modules/enocean-async/default.nix
+++ b/pkgs/development/python-modules/enocean-async/default.nix
@@ -45,6 +45,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     changelog = "https://github.com/henningkerstan/enocean-async/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     description = "Async implementation of the EnOcean Serial Protocol Version 3";
+    homepage = "https://github.com/henningkerstan/enocean-async";
     license = lib.licenses.asl20;
     maintainers = [ lib.maintainers.dotlambda ];
   };
diff --git a/pkgs/development/python-modules/flask-admin/default.nix b/pkgs/development/python-modules/flask-admin/default.nix
index 1cc2e1fbc908..5c75fca02d7e 100644
--- a/pkgs/development/python-modules/flask-admin/default.nix
+++ b/pkgs/development/python-modules/flask-admin/default.nix
@@ -52,14 +52,14 @@
 
 buildPythonPackage rec {
   pname = "flask-admin";
-  version = "2.1.0";
+  version = "2.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "flask-admin";
     repo = "flask-admin";
     tag = "v${version}";
-    hash = "sha256-xEVsYYwpcHMyvlmUYDviM5MLVz8bWLShUW6GOpfAmro=";
+    hash = "sha256-lRLyGvCat6nBixFKkrn4NxeVF52Hl32admAL37mf9wc=";
   };
 
   build-system = [ flit-core ];
diff --git a/pkgs/development/python-modules/freeze-core/default.nix b/pkgs/development/python-modules/freeze-core/default.nix
index 6095a22b7524..194efee77ea5 100644
--- a/pkgs/development/python-modules/freeze-core/default.nix
+++ b/pkgs/development/python-modules/freeze-core/default.nix
@@ -55,6 +55,7 @@ buildPythonPackage (finalAttrs: {
 
   meta = {
     description = "Core dependency for cx_Freeze";
+    homepage = "https://github.com/marcelotduarte/freeze-core";
     changelog = "https://github.com/marcelotduarte/freeze-core/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ sigmanificient ];
diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index 134cb0d00495..9f157e4a36a3 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202605311";
+  version = "0.1.202606011";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YTAnViAo+G2Yxwi1lnt1oBteV8GDHlWDcQBITy/wgoQ=";
+    hash = "sha256-O2TrzMml1mCbWN4yFotixnXVMSINeAY/iK4jWJWCtAA=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/imgsize/default.nix b/pkgs/development/python-modules/imgsize/default.nix
index a9b3a1b4432b..7668497f2110 100644
--- a/pkgs/development/python-modules/imgsize/default.nix
+++ b/pkgs/development/python-modules/imgsize/default.nix
@@ -8,19 +8,19 @@
 
 buildPythonPackage rec {
   pname = "imgsize";
-  version = "4.0.1";
+  version = "4.0.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ojii";
     repo = "imgsize";
     tag = version;
-    sha256 = "sha256-Cm6dywl9QOtF8qZ3L/XHCeNf3mU1ki5l8RUpWQilBPw=";
+    sha256 = "sha256-pHLYDC3UjrCKOdfgo2OreE5hGyIyWVSIsQR6piJZe6k=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-8vSBsnNqvHlbSj7m09U9fqBMRHnC2qtpMtWp2KYGA08=";
+    hash = "sha256-AXBd6cCpBVEYnU/uqynnO8wsVypV34r023kwzwSsbe4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/iocx/default.nix b/pkgs/development/python-modules/iocx/default.nix
index a802796f2ed2..15f6d1537c75 100644
--- a/pkgs/development/python-modules/iocx/default.nix
+++ b/pkgs/development/python-modules/iocx/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iocx";
-  version = "0.7.4";
+  version = "0.7.4.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "iocx-dev";
     repo = "iocx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-z/l6i+RKYfEC02OxFHEXvo38VYty2FVt48pP+HBLJco=";
+    hash = "sha256-bSfmAAsVgtyCapcc9k4ky+nAFZV6GUf/EX1Ht8TOEg4=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/kmock/default.nix b/pkgs/development/python-modules/kmock/default.nix
index 153c92cf1f39..99cd9ac584b1 100644
--- a/pkgs/development/python-modules/kmock/default.nix
+++ b/pkgs/development/python-modules/kmock/default.nix
@@ -71,6 +71,7 @@ buildPythonPackage (finalAttrs: {
 
   meta = {
     description = "HTTP/API/Kubernetes Mock Server in Python";
+    homepage = "https://github.com/nolar/kmock";
     changelog = "https://github.com/nolar/kmock/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ sigmanificient ];
diff --git a/pkgs/development/python-modules/langchain-protocol/default.nix b/pkgs/development/python-modules/langchain-protocol/default.nix
index 85a85d42d11e..5fa39b168f07 100644
--- a/pkgs/development/python-modules/langchain-protocol/default.nix
+++ b/pkgs/development/python-modules/langchain-protocol/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langchain-protocol";
-  version = "0.0.15";
+  version = "0.0.16";
   pyproject = true;
 
   # Not available vis Github yet; required by langchain-core
   src = fetchPypi {
     pname = "langchain_protocol";
     inherit (finalAttrs) version;
-    hash = "sha256-mrLRHuc5RHVPEOA35xcJjTpnlvDlivqcrdphVOdlWt4=";
+    hash = "sha256-gGx83ZUbHE9pL6QPzmCCH/DyIdQ2DidnPd8sK5nCt/8=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/libipld/default.nix b/pkgs/development/python-modules/libipld/default.nix
index 0de4688cd0ea..c4a0c6545a0d 100644
--- a/pkgs/development/python-modules/libipld/default.nix
+++ b/pkgs/development/python-modules/libipld/default.nix
@@ -17,18 +17,18 @@
 
 buildPythonPackage rec {
   pname = "libipld";
-  version = "3.3.2";
+  version = "3.4.1";
   pyproject = true;
 
   # use pypi, GitHub does not include Cargo.lock
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-foXM2RNhEOY5Q9lSMrGTyJPjacQGJz0jUWDlzEs5yc4=";
+    hash = "sha256-XTT8j5DJVDIPyn/vEg5f6a9Y+2dP9yNfJ4cDZN5sEG8=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit src;
-    hash = "sha256-BtFIX6xCJWBkIOzYEr8XohA1jsXC9rhiaMd87pe101w=";
+    hash = "sha256-8DYIiX/lFGYz/4+vWgoYTsV5L3O7rulof6UomrulbeM=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/llama-stack-client/default.nix b/pkgs/development/python-modules/llama-stack-client/default.nix
index 176d1f26cd39..267d487befe4 100644
--- a/pkgs/development/python-modules/llama-stack-client/default.nix
+++ b/pkgs/development/python-modules/llama-stack-client/default.nix
@@ -32,13 +32,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "llama-stack-client";
-  version = "0.7.2";
+  version = "0.7.4";
   pyproject = true;
 
   src = fetchPypi {
     pname = "llama_stack_client";
     inherit (finalAttrs) version;
-    hash = "sha256-DjRYgAr2oY/Y/F4HYO1iaTGkFvbB/fJK66QAHm/Kmuw=";
+    hash = "sha256-SxPWXuH1ob5eYoZyWWs2YWsyElJufS28QXnby2hgwWc=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/mdx-truly-sane-lists/default.nix b/pkgs/development/python-modules/mdx-truly-sane-lists/default.nix
index bf22ebeae71f..2427efdb54b6 100644
--- a/pkgs/development/python-modules/mdx-truly-sane-lists/default.nix
+++ b/pkgs/development/python-modules/mdx-truly-sane-lists/default.nix
@@ -35,6 +35,7 @@ buildPythonPackage rec {
       Features custom indents for nested lists and fix for messy linebreaks and
       paragraphs between lists.
     '';
+    homepage = "https://github.com/radude/mdx_truly_sane_lists";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ kaction ];
   };
diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 7ab9a4ff90f2..082ac7d64e74 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -586,8 +586,8 @@ in
       "sha256-kw8ncmITgoIGnWIOk9X3S8klQ4B56LtH1CVLFKwA2ic=";
 
   mypy-boto3-groundstation =
-    buildMypyBoto3Package "groundstation" "1.43.0"
-      "sha256-nTKK7qqa2apyNM4/U2AphLGvoSqemVKfpAciilJ0pRE=";
+    buildMypyBoto3Package "groundstation" "1.43.18"
+      "sha256-+DDeD9YWo98meLZU2Mzu5AE0S7HFg6kfxeUWUh9XcQA=";
 
   mypy-boto3-guardduty =
     buildMypyBoto3Package "guardduty" "1.43.15"
@@ -962,8 +962,8 @@ in
       "sha256-BUl/wnJKR3TB1YsTCLrJdEoH9Lz8DZ6H94STOOX8gkQ=";
 
   mypy-boto3-omics =
-    buildMypyBoto3Package "omics" "1.43.0"
-      "sha256-by5t5x+vu84vjqe176tFcz1zhDUIsmUo6dH5f3OyWOw=";
+    buildMypyBoto3Package "omics" "1.43.18"
+      "sha256-aMV1kli90lXUsGmOwP1lPW9yTH+0/520hBonZC3AIjY=";
 
   mypy-boto3-opensearch =
     buildMypyBoto3Package "opensearch" "1.43.16"
@@ -1070,8 +1070,8 @@ in
       "sha256-YrrEKl3aGz//5Z5JGapHhWtk6hBXQ4cuRQmLqGYztzg=";
 
   mypy-boto3-quicksight =
-    buildMypyBoto3Package "quicksight" "1.43.10"
-      "sha256-I+J24XB8hRjuklH5dlYAyTfOI6f7cN+EhKMI2UYFHQw=";
+    buildMypyBoto3Package "quicksight" "1.43.18"
+      "sha256-+cfQUyFlqWRQtkX28raVgZjdwnqhyK5vNyZjpWW3aEI=";
 
   mypy-boto3-ram =
     buildMypyBoto3Package "ram" "1.43.0"
@@ -1086,8 +1086,8 @@ in
       "sha256-ZKRhSBcrpdi3T2Qdw5v8WFg7dDbGCUlZBgIrmgHSUFs=";
 
   mypy-boto3-rds-data =
-    buildMypyBoto3Package "rds-data" "1.43.0"
-      "sha256-sgjEU7RqruiFWqUxxiDt/mx0uTJFhJQxkJsXvo5lYbk=";
+    buildMypyBoto3Package "rds-data" "1.43.18"
+      "sha256-dpTlWnEq5++iAsccn0Jj4C2yyvs8Cs5tMph5yzpbjcc=";
 
   mypy-boto3-redshift =
     buildMypyBoto3Package "redshift" "1.43.7"
@@ -1150,8 +1150,8 @@ in
       "sha256-F1xhitFa4Eac9VlCpfqjCObUH+YvLz7TYDYfI/bPYbc=";
 
   mypy-boto3-route53resolver =
-    buildMypyBoto3Package "route53resolver" "1.43.6"
-      "sha256-/KAlBKNGLO+PLapddz4kSW3ymsGc7Bf/tlhiIV/K9Bs=";
+    buildMypyBoto3Package "route53resolver" "1.43.18"
+      "sha256-IoIpgRY94hxtu0keb2KrqrL/mUmY4Cun0JPNpdEVwF0=";
 
   mypy-boto3-rum =
     buildMypyBoto3Package "rum" "1.43.0"
@@ -1250,8 +1250,8 @@ in
       "sha256-JO9Mm6dTJuFnbyRzuSaPpT2lvDNaSUMlspWgeH+bt5M=";
 
   mypy-boto3-sesv2 =
-    buildMypyBoto3Package "sesv2" "1.43.0"
-      "sha256-rHuTd77z8sOL25W1F+LaRabZpqOkv/J+oiclvHvnGuc=";
+    buildMypyBoto3Package "sesv2" "1.43.18"
+      "sha256-2wRWO4EF6lH/69o8UvavMG5tlsqOSP4hdvF5bwOcS1M=";
 
   mypy-boto3-shield =
     buildMypyBoto3Package "shield" "1.43.0"
diff --git a/pkgs/development/python-modules/outspin/default.nix b/pkgs/development/python-modules/outspin/default.nix
index 5908863e5456..fc92fbc1bc9f 100644
--- a/pkgs/development/python-modules/outspin/default.nix
+++ b/pkgs/development/python-modules/outspin/default.nix
@@ -26,6 +26,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     changelog = "https://github.com/trag1c/outspin/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     description = "Conveniently read single char inputs in the console";
+    homepage = "https://github.com/trag1c/outspin";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ sigmanificient ];
   };
diff --git a/pkgs/development/python-modules/paperbush/default.nix b/pkgs/development/python-modules/paperbush/default.nix
index b7e7331c3495..2287b0d0940e 100644
--- a/pkgs/development/python-modules/paperbush/default.nix
+++ b/pkgs/development/python-modules/paperbush/default.nix
@@ -23,6 +23,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     changelog = "https://github.com/trag1c/paperbush/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     description = "Super concise argument parsing tool for Python";
+    homepage = "https://github.com/trag1c/paperbush";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ sigmanificient ];
   };
diff --git a/pkgs/development/python-modules/protoletariat/default.nix b/pkgs/development/python-modules/protoletariat/default.nix
index 92f5a09ed77c..bf899be7906b 100644
--- a/pkgs/development/python-modules/protoletariat/default.nix
+++ b/pkgs/development/python-modules/protoletariat/default.nix
@@ -52,6 +52,7 @@ buildPythonPackage (finalAttrs: {
 
   meta = {
     description = "Python protocol buffers for the rest of us";
+    homepage = "https://github.com/cpcloud/protoletariat";
     changelog = "https://github.com/cpcloud/protoletariat/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = with lib.licenses; [ asl20 ];
     maintainers = with lib.maintainers; [ sigmanificient ];
diff --git a/pkgs/development/python-modules/pyftgl/default.nix b/pkgs/development/python-modules/pyftgl/default.nix
index 8cb6330d5e92..701194acfe1a 100644
--- a/pkgs/development/python-modules/pyftgl/default.nix
+++ b/pkgs/development/python-modules/pyftgl/default.nix
@@ -47,6 +47,7 @@ buildPythonPackage rec {
 
   meta = {
     description = "Python bindings for FTGL (FreeType for OpenGL)";
+    homepage = "https://github.com/umlaeute/pyftgl";
     license = lib.licenses.gpl2Plus;
   };
 }
diff --git a/pkgs/development/python-modules/scikit-posthocs/default.nix b/pkgs/development/python-modules/scikit-posthocs/default.nix
index 87ee46b01ec9..fd5db75eb8ed 100644
--- a/pkgs/development/python-modules/scikit-posthocs/default.nix
+++ b/pkgs/development/python-modules/scikit-posthocs/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "scikit-posthocs";
-  version = "0.13.0";
+  version = "0.14.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "maximtrp";
     repo = "scikit-posthocs";
     tag = "v${version}";
-    hash = "sha256-jdppRvzkW+Y+bHh8yhCjU5VJgjFc9OsEmAzNNFMtr9E=";
+    hash = "sha256-hFqZVMsbFvqbfr0gHYsy0H6eCHJOxtz0vZm5Onk7Vzo=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/slothy/default.nix b/pkgs/development/python-modules/slothy/default.nix
index f3e9b53ede81..fa35bc5d3ec0 100644
--- a/pkgs/development/python-modules/slothy/default.nix
+++ b/pkgs/development/python-modules/slothy/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "slothy";
-  version = "0.2.0";
+  version = "0.2.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "slothy-optimizer";
     repo = "slothy";
     tag = version;
-    hash = "sha256-1seD/wqAyEcv5HJFO8j53ARd64fddGropA6xk0dq2yk=";
+    hash = "sha256-/xjOhf/Z4IQjrI05IfLWurZ0x0zTH97pr9F8dtEEsbA=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index ccd1f49355bd..caeee15b8b85 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "tencentcloud-sdk-python";
-  version = "3.1.105";
+  version = "3.1.107";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = finalAttrs.version;
-    hash = "sha256-Ru3aykWrA1kOtsYv8gp/m7rTWBzEU+hVi2jOCYhjduQ=";
+    hash = "sha256-6hXJx3VSXQlUs6h4gYP+Yqy6uoMKplKX1CfiwFIbZ70=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/tstr/default.nix b/pkgs/development/python-modules/tstr/default.nix
index cf1a3e78221e..cc1eb41c788b 100644
--- a/pkgs/development/python-modules/tstr/default.nix
+++ b/pkgs/development/python-modules/tstr/default.nix
@@ -30,6 +30,7 @@ buildPythonPackage (finalAttrs: {
 
   meta = {
     description = "Backports of various template string utilities";
+    homepage = "https://github.com/ilotoki0804/tstr";
     license = [ lib.licenses.asl20 ];
     maintainers = with lib.maintainers; [ sigmanificient ];
   };
diff --git a/pkgs/development/python-modules/zenoh/default.nix b/pkgs/development/python-modules/zenoh/default.nix
index 8946bcc4b3ea..c74b906ce3a5 100644
--- a/pkgs/development/python-modules/zenoh/default.nix
+++ b/pkgs/development/python-modules/zenoh/default.nix
@@ -9,19 +9,19 @@
 
 buildPythonPackage rec {
   pname = "zenoh";
-  version = "1.6.2"; # nixpkgs-update: no auto update
+  version = "1.9.0"; # nixpkgs-update: no auto update
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "eclipse-zenoh";
     repo = "zenoh-python";
     rev = version;
-    hash = "sha256-GGqZGtHSCaPeO6wFFBxPjdjhsIdcgI1RJ4mZbGq4uzc=";
+    hash = "sha256-rKWbJti5bgwAfc8LpQFsU6KhhcWyWAwOX+SF1UAGRbk=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit src pname version;
-    hash = "sha256-2Hieow0+GzcNQmvqsJd+5bpE9RWUDbaBR9jah+O4GtI=";
+    hash = "sha256-g7Om2QvlbwVmB0wGcbuafUELh53IJ2uM+miHyzBKQQI=";
   };
 
   build-system = [
diff --git a/pkgs/development/rocm-modules/mscclpp/default.nix b/pkgs/development/rocm-modules/mscclpp/default.nix
index b7fa373e80a7..58a0066a48ab 100644
--- a/pkgs/development/rocm-modules/mscclpp/default.nix
+++ b/pkgs/development/rocm-modules/mscclpp/default.nix
@@ -39,4 +39,7 @@ stdenv.mkDerivation {
     "-DFETCHCONTENT_SOURCE_DIR_JSON=${nlohmann_json.src}"
   ];
   env.ROCM_PATH = clr;
+  meta = {
+    homepage = "https://github.com/microsoft/mscclpp";
+  };
 }
diff --git a/pkgs/development/tools/misc/luarocks/default.nix b/pkgs/development/tools/misc/luarocks/default.nix
index 10a1ff3b4699..75327f83f184 100644
--- a/pkgs/development/tools/misc/luarocks/default.nix
+++ b/pkgs/development/tools/misc/luarocks/default.nix
@@ -136,6 +136,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Package manager for Lua";
+    homepage = "https://github.com/luarocks/luarocks";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       raskin
diff --git a/pkgs/development/tools/misc/luarocks/luarocks-nix.nix b/pkgs/development/tools/misc/luarocks/luarocks-nix.nix
index 9acca73d82e0..684c102401f6 100644
--- a/pkgs/development/tools/misc/luarocks/luarocks-nix.nix
+++ b/pkgs/development/tools/misc/luarocks/luarocks-nix.nix
@@ -41,6 +41,7 @@ luarocks_bootstrap.overrideAttrs (old: {
       maintainers
       platforms
       ;
+    homepage = "https://github.com/nix-community/luarocks-nix";
     mainProgram = "luarocks";
   };
 })
diff --git a/pkgs/misc/tmux-plugins/default.nix b/pkgs/misc/tmux-plugins/default.nix
index 28c809ed996d..6b61a16d94ab 100644
--- a/pkgs/misc/tmux-plugins/default.nix
+++ b/pkgs/misc/tmux-plugins/default.nix
@@ -85,6 +85,9 @@ in
       tag = "v${version}";
       hash = "sha256-kyUrJdraDDye8WEBP2RgHN7kHmafToYtLmrMJ9u0f+0=";
     };
+    meta = {
+      homepage = "https://github.com/tmux-plugins/tmux-battery";
+    };
   };
 
   better-mouse-mode = mkTmuxPlugin {
@@ -197,6 +200,9 @@ in
       rev = "77ca3aab2aed8ede3e2b941079b1c92dd221cf5f";
       hash = "sha256-ugVk1zpKeUjOlDWi3LEkJPFsCqyZEivGzGWiqODnkK0=";
     };
+    meta = {
+      homepage = "https://github.com/tmux-plugins/tmux-copycat";
+    };
   };
 
   cpu = mkTmuxPlugin {
@@ -208,6 +214,9 @@ in
       rev = "98d787191bc3e8f19c3de54b96ba1caf61385861";
       hash = "sha256-ymmCI6VYvf94Ot7h2GAboTRBXPIREP+EB33+px5aaJk=";
     };
+    meta = {
+      homepage = "https://github.com/tmux-plugins/tmux-cpu";
+    };
   };
 
   ctrlw = mkTmuxPlugin rec {
@@ -219,6 +228,9 @@ in
       rev = "v${version}";
       hash = "sha256-YYbPkGQmukIDD1fcYleioETFai/SOJni+aZ9Jh2+Zc8=";
     };
+    meta = {
+      homepage = "https://github.com/eraserhd/tmux-ctrlw";
+    };
   };
 
   dracula = mkTmuxPlugin rec {
@@ -316,6 +328,9 @@ in
     postInstall = ''
       sed -i -e 's|fpp |${pkgs.fpp}/bin/fpp |g' $target/fpp.tmux
     '';
+    meta = {
+      homepage = "https://github.com/tmux-plugins/tmux-fpp";
+    };
   };
 
   fuzzback = mkTmuxPlugin {
@@ -496,6 +511,9 @@ in
       rev = "b085ad423b5d59a2c8b8d71772352e7028b8e1d0";
       hash = "sha256-Wp4xY2nxv4jl/G7bjNokYk3TcbS9waLERBFSpT1XGlw=";
     };
+    meta = {
+      homepage = "https://github.com/tmux-plugins/tmux-logging";
+    };
   };
 
   minimal-tmux-status = mkTmuxPlugin {
@@ -552,6 +570,9 @@ in
       rev = "58abb615971cb617821e2e7e41c660334f55a92d";
       hash = "sha256-LFPcPDBiSvsOhOhlAScajr/Y/Uw2CPdl87qzD9szQKo=";
     };
+    meta = {
+      homepage = "https://github.com/tmux-plugins/tmux-net-speed";
+    };
   };
 
   nord = mkTmuxPlugin {
@@ -587,6 +608,9 @@ in
       rev = "9415f0207e71e37cbd870c9443426dbea6da78b9";
       hash = "sha256-RFdnF/ScOPoeVgGXWhQs28tS7CmsRA0DyFyutCPEmzc=";
     };
+    meta = {
+      homepage = "https://github.com/tmux-plugins/tmux-maildir-counter";
+    };
   };
 
   online-status = mkTmuxPlugin {
@@ -598,6 +622,9 @@ in
       rev = "ea86704ced8a20f4a431116aa43f57edcf5a6312";
       hash = "sha256-OQW2WcNDVBMgX5IIlykn7f1wI8miXuqLQTlqsdHbw8M=";
     };
+    meta = {
+      homepage = "https://github.com/tmux-plugins/tmux-online-status";
+    };
   };
 
   open = mkTmuxPlugin {
@@ -609,6 +636,9 @@ in
       rev = "cedb4584908bd8458fadc8d3e64101d3cbb48d46";
       hash = "sha256-sFl+wkvQ498irwKWXXAT6/XBrziYLT+CvLCBV2HrQIM=";
     };
+    meta = {
+      homepage = "https://github.com/tmux-plugins/tmux-open";
+    };
   };
 
   onedark-theme = mkTmuxPlugin {
@@ -621,6 +651,9 @@ in
       rev = "3607ef889a47dd3b4b31f66cda7f36da6f81b85c";
       hash = "sha256-pQooiDEeB8NvBOQ1IKUgPSSQDK+hMTLMGuiKy6GWVKY=";
     };
+    meta = {
+      homepage = "https://github.com/odedlaz/tmux-onedark-theme";
+    };
   };
 
   pain-control = mkTmuxPlugin {
@@ -632,6 +665,9 @@ in
       rev = "2db63de3b08fc64831d833240749133cecb67d92";
       hash = "sha256-84NJtxoz4KTVv+i3cde235WcHhRSBIkZjtobZIk16nA=";
     };
+    meta = {
+      homepage = "https://github.com/tmux-plugins/tmux-pain-control";
+    };
   };
 
   pass = mkTmuxPlugin {
@@ -685,6 +721,9 @@ in
     postInstall = ''
       sed -i -e 's,9 plumb,${pkgs.plan9port}/bin/9 plumb,' $target/scripts/plumb
     '';
+    meta = {
+      homepage = "https://github.com/eraserhd/tmux-plumb";
+    };
   };
 
   power-theme = mkTmuxPlugin {
@@ -714,6 +753,9 @@ in
       rev = "15acc6172300bc2eb13c81718dc53da6ae69de4f";
       hash = "sha256-9LWRV0Hw8MmDwn5hWl3DrBuYUqBjLCO02K9bbx11MyM=";
     };
+    meta = {
+      homepage = "https://github.com/tmux-plugins/tmux-prefix-highlight";
+    };
   };
 
   resurrect = mkTmuxPlugin {
@@ -818,6 +860,9 @@ in
     postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
       sed -e 's:reattach-to-user-namespace:${pkgs.reattach-to-user-namespace}/bin/reattach-to-user-namespace:g' -i $target/sensible.tmux
     '';
+    meta = {
+      homepage = "https://github.com/tmux-plugins/tmux-sensible";
+    };
   };
 
   session-wizard = mkTmuxPlugin rec {
@@ -873,6 +918,9 @@ in
       rev = "09ec86be38eae98ffc27bd0dde605ed10ae0dc89";
       hash = "sha256-hFNrdbhmBUAyJ73RCG4RILzJ3LHIYiuNYGsqJGsVGAw=";
     };
+    meta = {
+      homepage = "https://github.com/tmux-plugins/tmux-sessionist";
+    };
   };
 
   sidebar = mkTmuxPlugin {
@@ -884,6 +932,9 @@ in
       rev = "aacbdb45bc5ab69db448a72de4155d0b8dbac677";
       hash = "sha256-7MCouewjpTCMGmWMaTWWQevlR0LrLTBjXGumsNcH6a4=";
     };
+    meta = {
+      homepage = "https://github.com/tmux-plugins/tmux-sidebar";
+    };
   };
 
   sysstat = mkTmuxPlugin {
@@ -895,6 +946,9 @@ in
       rev = "29e150f403151f2341f3abcb2b2487a5f011dd23";
       hash = "sha256-2EMSV6z9FZHq20dkPna0qELSVIOIAnOHpiCLbG7adQQ=";
     };
+    meta = {
+      homepage = "https://github.com/samoshkin/tmux-plugin-sysstat";
+    };
   };
 
   tilish = mkTmuxPlugin {
@@ -944,6 +998,9 @@ in
       rev = "e5e7b4f1af37f8f3fc81ca17eadee5ae5d82cd09";
       hash = "sha256-nVA4fkmxf8he3lxG6P0sASvH6HlSt8dKGovEv5RAcdA=";
     };
+    meta = {
+      homepage = "https://github.com/seebi/tmux-colors-solarized";
+    };
   };
 
   tmux-floax = mkTmuxPlugin {
@@ -1171,6 +1228,9 @@ in
       find $target -type f -print0 | xargs -0 sed -i -e 's|fzf |${pkgs.fzf}/bin/fzf |g'
       find $target -type f -print0 | xargs -0 sed -i -e 's|zoxide |${pkgs.zoxide}/bin/zoxide |g'
     '';
+    meta = {
+      homepage = "https://github.com/joshmedeski/t-smart-tmux-session-manager";
+    };
   };
 
   urlview = mkTmuxPlugin {
@@ -1185,6 +1245,9 @@ in
     postInstall = ''
       sed -i -e '14,20{s|extract_url|${pkgs.extract_url}/bin/extract_url|g}' $target/urlview.tmux
     '';
+    meta = {
+      homepage = "https://github.com/tmux-plugins/tmux-urlview";
+    };
   };
 
   vim-tmux-focus-events = mkTmuxPlugin {
@@ -1216,6 +1279,9 @@ in
       rev = "c45243dc1f32ac6bcf6068e5300f3b2b237e576a";
       hash = "sha256-IEPnr/GdsAnHzdTjFnXCuMyoNLm3/Jz4cBAM0AJBrj8=";
     };
+    meta = {
+      homepage = "https://github.com/christoomey/vim-tmux-navigator";
+    };
   };
 
   weather = mkTmuxPlugin {
@@ -1251,6 +1317,9 @@ in
       rev = "acfd36e4fcba99f8310a7dfb432111c242fe7392";
       hash = "sha256-/5HPaoOx2U2d8lZZJo5dKmemu6hKgHJYq23hxkddXpA=";
     };
+    meta = {
+      homepage = "https://github.com/tmux-plugins/tmux-yank";
+    };
   };
 
   tmux-nova = mkTmuxPlugin rec {
diff --git a/pkgs/misc/tmux-plugins/tmux-fingers/default.nix b/pkgs/misc/tmux-plugins/tmux-fingers/default.nix
index 72fae95c6772..f4fa5c87aa6a 100644
--- a/pkgs/misc/tmux-plugins/tmux-fingers/default.nix
+++ b/pkgs/misc/tmux-plugins/tmux-fingers/default.nix
@@ -29,6 +29,10 @@ let
     # Unhandled exception: Missing ENV key: "TMUX" (KeyError)
     doCheck = false;
     doInstallCheck = false;
+
+    meta = {
+      homepage = "https://github.com/Morantron/tmux-fingers";
+    };
   };
 in
 mkTmuxPlugin {
diff --git a/pkgs/os-specific/darwin/by-name/lo/locale/package.nix b/pkgs/os-specific/darwin/by-name/lo/locale/package.nix
index 85376eafe625..78be8eec1f29 100644
--- a/pkgs/os-specific/darwin/by-name/lo/locale/package.nix
+++ b/pkgs/os-specific/darwin/by-name/lo/locale/package.nix
@@ -54,6 +54,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Locale data for Darwin";
+    homepage = "https://github.com/apple-oss-distributions/adv_cmds";
     license = [
       lib.licenses.apsl10
       lib.licenses.apsl20
diff --git a/pkgs/os-specific/linux/kernel/build.nix b/pkgs/os-specific/linux/kernel/build.nix
index ac191a3ba149..23a08f5beaa4 100644
--- a/pkgs/os-specific/linux/kernel/build.nix
+++ b/pkgs/os-specific/linux/kernel/build.nix
@@ -19,7 +19,6 @@
   zlib,
   pahole,
   kmod,
-  ubootTools,
   fetchpatch,
   rustc-unwrapped,
   rust-bindgen-unwrapped,
@@ -116,31 +115,6 @@ lib.makeOverridable (
         ;
     };
 
-    # Folding in `ubootTools` in the default nativeBuildInputs is problematic, as
-    # it makes updating U-Boot cumbersome, since it will go above the current
-    # threshold of rebuilds
-    #
-    # To prevent these needless rounds of staging for U-Boot builds, we can
-    # limit the inclusion of ubootTools to target platforms where uImage *may*
-    # be produced.
-    #
-    # This command lists those (kernel-named) platforms:
-    #     .../linux $ grep -l uImage ./arch/*/Makefile | cut -d'/' -f3 | sort
-    #
-    # This is still a guesstimation, but since none of our cached platforms
-    # coincide in that list, this gives us "perfect" decoupling here.
-    linuxPlatformsUsingUImage = [
-      "arc"
-      "arm"
-      "csky"
-      "mips"
-      "powerpc"
-      "sh"
-      "sparc"
-      "xtensa"
-    ];
-    needsUbootTools = lib.elem stdenv.hostPlatform.linuxArch linuxPlatformsUsingUImage;
-
     config =
       let
         attrName = attr: "CONFIG_" + attr;
@@ -267,7 +241,6 @@ lib.makeOverridable (
       kmod
       hexdump
     ]
-    ++ optional needsUbootTools ubootTools
     ++ optionals (lib.versionAtLeast version "5.2") [
       cpio
       pahole
@@ -510,7 +483,7 @@ lib.makeOverridable (
 
     preFixup = ''
       if [ -z "''${dontStrip-}" -a -e $out/vmlinux ]; then
-        strip -v -S -p $out/vmlinux
+        $STRIP -v -S -p $out/vmlinux
       fi
     '';
 
@@ -536,12 +509,10 @@ lib.makeOverridable (
       kernelAtLeast = lib.versionAtLeast baseVersion;
     };
 
-    # Some image types need special install targets (e.g. uImage is installed with make uinstall on arm)
+    # Some image types need special install targets
     installTargets = [
       (stdenv.hostPlatform.linux-kernel.installTarget or (
-        if target == "uImage" && stdenv.hostPlatform.linuxArch == "arm" then
-          "uinstall"
-        else if
+        if
           (target == "zImage" || target == "Image.gz" || target == "vmlinuz.efi")
           && builtins.elem stdenv.hostPlatform.linuxArch [
             "arm"
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index d1734a2b32c5..e0083addb03f 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -773,6 +773,9 @@ let
       SQUASHFS_LZ4 = yes;
       SQUASHFS_ZSTD = yes;
 
+      EROFS_FS_ZIP_DEFLATE = whenAtLeast "6.6" yes;
+      EROFS_FS_ZIP_ZSTD = whenAtLeast "6.10" yes;
+
       # Native Language Support modules, needed by some filesystems
       NLS = yes;
       NLS_DEFAULT = freeform "utf8";
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index fd9cf5dac790..f2e87f79b99c 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,42 +1,42 @@
 {
     "testing": {
-        "version": "7.1-rc4",
-        "hash": "sha256:06z73f1vprl4adbdj01h3407p3f8bl8jsz91zx454c62k2jg3w40",
+        "version": "7.1-rc6",
+        "hash": "sha256:1fmbsjhdrkzim6vzqc40raikv1szfw28q0lbvap8a1g77an0qi58",
         "lts": false
     },
     "6.1": {
-        "version": "6.1.174",
-        "hash": "sha256:0vp07x4v82qnmc1pifv3ynp2ab5mvlbfnpqvs5893bi3yrnk927d",
+        "version": "6.1.175",
+        "hash": "sha256:11fapr04y96p9ja6mfzm7bcd3zb4dzyw6qrh7c11bss9wjlq9s9p",
         "lts": true
     },
     "5.15": {
-        "version": "5.15.208",
-        "hash": "sha256:0wmi50q8vgblhbh77d1a4sw4snymr6srqd22bxcjg9i7wcv70gdm",
+        "version": "5.15.209",
+        "hash": "sha256:1d0yhbpqlkr1znahky15dfavr6dzb3wb8c15k9qqvkf2xb3pfv9l",
         "lts": true
     },
     "5.10": {
-        "version": "5.10.257",
-        "hash": "sha256:1lghcrxc1fqarvym03jrcda2a3labc887ci9yjqgbmv3nphzvc88",
+        "version": "5.10.258",
+        "hash": "sha256:1rdldzb3g33v6zvcmxafqpkjgqpp4n5qlxwb77wfd5jpzhgcnz4y",
         "lts": true
     },
     "6.6": {
-        "version": "6.6.141",
-        "hash": "sha256:1qbzxgqs7q9gyqfrf0j7p0pgjxnjj5mibamhm280mf9anqp6bhiv",
+        "version": "6.6.142",
+        "hash": "sha256:0w1bdzp9x1sqcr9xlk7dvylhs7kycghjabfgd3iv49ydfmx61xmj",
         "lts": true
     },
     "6.12": {
-        "version": "6.12.91",
-        "hash": "sha256:0sbrb612b653w64g5jkpbf68y0fka2sgnwblam41k7wz2sgapwhg",
+        "version": "6.12.92",
+        "hash": "sha256:0gly5wld3x8l0f3zk9pspsw1q2d7zbjbx4c2ndb49b1wvfvpdqqg",
         "lts": true
     },
     "6.18": {
-        "version": "6.18.33",
-        "hash": "sha256:10mp1ypsdz42jr26g1xxbw806mvpy0n35418fhsgxxlr4lqgy5kg",
+        "version": "6.18.34",
+        "hash": "sha256:0q6palsvwx0gnisjr658hlngfpvyzv0k5q4pvdk23122zcr4f334",
         "lts": true
     },
     "7.0": {
-        "version": "7.0.10",
-        "hash": "sha256:1p1j9s0b4qv9m0pm6vj477rqgyd1b0lsk0gy74cks3n2cbmpfj89",
+        "version": "7.0.11",
+        "hash": "sha256:012307ni1v555a1rgzsxsg99pj8fplrghvhw0jk3c4d0vmb86v75",
         "lts": false
     }
 }
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index 040b194c56d8..de3605e7cee4 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -100,11 +100,11 @@ rec {
   # Vulkan developer beta driver
   # See here for more information: https://developer.nvidia.com/vulkan-driver
   vulkan_beta = generic rec {
-    version = "595.44.08";
+    version = "595.44.09";
     persistencedVersion = "595.45.04";
     settingsVersion = "595.45.04";
-    sha256_64bit = "sha256-slPOKXeI3Y2ebiytS20c8bbwWbUdn2dFkwJih9Mbmyc=";
-    openSha256 = "sha256-PpfrDfBkrzszROLDfgeBUISIZm3BimmXTRhkL/X4+p8=";
+    sha256_64bit = "sha256-LOcwE47hUG1aZX7JvLmTb/yC5qQgXYZ0TAavSn38Xug=";
+    openSha256 = "sha256-QboSiRWRZWseFg7GN/a4vZVQGGBF1UJlC9MyAxUxyF4=";
     settingsSha256 = "sha256-Y45pryyM+6ZTJyRaRF3LMKaiIWxB5gF5gGEEcQVr9nA=";
     persistencedSha256 = "sha256-5FoeUaRRMBIPEWGy4Uo0Aho39KXmjzQsuAD9m/XkNpA=";
     url = "https://developer.nvidia.com/downloads/vulkan-beta-${lib.concatStrings (lib.splitVersion version)}-linux";
@@ -155,12 +155,12 @@ rec {
 
   # LTSB supported until Aug 2028
   legacy_580 = generic {
-    version = "580.142";
-    sha256_64bit = "sha256-IJFfzz/+icNVDPk7YKBKKFRTFQ2S4kaOGRGkNiBEdWM=";
-    sha256_aarch64 = "sha256-jntr88SpTYR648P1rizQjB/8KleBoa14Ay12vx8XETM=";
-    openSha256 = "sha256-v968LbRqy8jB9+yHy9ceP2TDdgyqfDQ6P41NsCoM2AY=";
-    settingsSha256 = "sha256-BnrIlj5AvXTfqg/qcBt2OS9bTDDZd3uhf5jqOtTMTQM=";
-    persistencedSha256 = "sha256-il403KPFAnDbB+dITnBGljhpsUPjZwmLjGt8iPKuBqw=";
+    version = "580.159.04";
+    sha256_64bit = "sha256-weZnYbCI0Xs632y2l53przi+JoTRArABoXbc+vq9yh4=";
+    sha256_aarch64 = "sha256-iRLyYjvHyDl2Xzb87j20o1MYNKLK/zql1JwSWbI3Kus=";
+    openSha256 = "sha256-zsNmjZW0cyZWPp3vDT3mNeqAo0hS0M7e9Tbvwvij+F4=";
+    settingsSha256 = "sha256-U0hics4gQeZWsD+ch9PBz42zfTOEVcKRVIqYZb3VOY8=";
+    persistencedSha256 = "sha256-vDawiy52GB8JABUKZDiQUc8uda8p/7jCFW7rTu6QMa4=";
   };
 
   # Last one without the bug reported here:
diff --git a/pkgs/os-specific/linux/r8168/default.nix b/pkgs/os-specific/linux/r8168/default.nix
index 3ff8e2ad9f24..3cf1687d86d8 100644
--- a/pkgs/os-specific/linux/r8168/default.nix
+++ b/pkgs/os-specific/linux/r8168/default.nix
@@ -60,6 +60,7 @@ stdenv.mkDerivation rec {
       If you want to use this driver, you might need to blacklist the r8169 driver
       by adding "r8169" to boot.blacklistedKernelModules.
     '';
+    homepage = "https://github.com/mtorromeo/r8168";
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.linux;
     maintainers = [ ];
diff --git a/pkgs/os-specific/linux/sheep-net/default.nix b/pkgs/os-specific/linux/sheep-net/default.nix
index 61083960b102..c7c2b113def2 100644
--- a/pkgs/os-specific/linux/sheep-net/default.nix
+++ b/pkgs/os-specific/linux/sheep-net/default.nix
@@ -25,6 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = {
+    homepage = "https://github.com/kanjitalk755/macemu";
     license = lib.licenses.gpl2Only;
     maintainers = with lib.maintainers; [ matthewcroughan ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/servers/home-assistant/custom-components/entity-notes/package.nix b/pkgs/servers/home-assistant/custom-components/entity-notes/package.nix
index bc71285acac1..a1f51a666a74 100644
--- a/pkgs/servers/home-assistant/custom-components/entity-notes/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/entity-notes/package.nix
@@ -8,13 +8,13 @@
 buildHomeAssistantComponent rec {
   owner = "martindell";
   domain = "entity_notes";
-  version = "3.3.10";
+  version = "3.3.11";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "ha-entity-notes";
     tag = "v${version}";
-    hash = "sha256-2ZwIqqF3OQ6wjfi5c3cV8NyJNcucd95Nkrs/OimHrb0=";
+    hash = "sha256-J+HIa8VgfObhuOY8jn39hQH3I4DEgVn65U9w9a/vNd4=";
   };
 
   dependencies = [
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/sankey-chart/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/sankey-chart/package.nix
index 614e0dafd54e..f499ae3ca86e 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/sankey-chart/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/sankey-chart/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "sankey-chart";
-  version = "6.0.0";
+  version = "6.3.0";
 
   src = fetchFromGitHub {
     owner = "MindFreeze";
     repo = "ha-sankey-chart";
     rev = "v${version}";
-    hash = "sha256-LNJvUy0vj6j5FKaEN2l9AD92pY6qKie1tRiuiA61Q58=";
+    hash = "sha256-W14fU3qM98QtNDPzfILAoHJiwGhGK39i/LTJyriKLcE=";
   };
 
-  npmDepsHash = "sha256-VLByimuvXO+PMTzuK4M07An7nnMXHe8dHS4ptdIt/sc=";
+  npmDepsHash = "sha256-are6FGTk5woHbtqAyZQ34FWN9+uB6n66k71ZM+w6t70=";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/servers/monitoring/nagios-plugins/check_openvpn/default.nix b/pkgs/servers/monitoring/nagios-plugins/check_openvpn/default.nix
index 51763b874ff9..319a63220249 100644
--- a/pkgs/servers/monitoring/nagios-plugins/check_openvpn/default.nix
+++ b/pkgs/servers/monitoring/nagios-plugins/check_openvpn/default.nix
@@ -21,6 +21,7 @@ python3Packages.buildPythonApplication rec {
 
   meta = {
     description = "Nagios/icinga/sensu check plugin for OpenVPN";
+    homepage = "https://github.com/liquidat/nagios-icinga-openvpn";
     license = lib.licenses.mit;
     mainProgram = "check_openvpn";
     maintainers = with lib.maintainers; [ peterhoeg ];
diff --git a/pkgs/servers/sql/postgresql/ext/pg_similarity.nix b/pkgs/servers/sql/postgresql/ext/pg_similarity.nix
index 6caa133c36b1..b4dc86bfd034 100644
--- a/pkgs/servers/sql/postgresql/ext/pg_similarity.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_similarity.nix
@@ -36,6 +36,7 @@ postgresqlBuildExtension {
       is tightly integrated in the RDBMS in the sense that it defines operators so instead of the traditional
       operators (= and <>) you can use ~~~ and ~!~ (any of these operators represents a similarity function).
     '';
+    homepage = "https://github.com/eulerto/pg_similarity";
     platforms = postgresql.meta.platforms;
     license = lib.licenses.bsd3;
     maintainers = [ ];
diff --git a/pkgs/servers/sql/postgresql/ext/pgjwt.nix b/pkgs/servers/sql/postgresql/ext/pgjwt.nix
index 575bfd3bafc8..2c8572efd84c 100644
--- a/pkgs/servers/sql/postgresql/ext/pgjwt.nix
+++ b/pkgs/servers/sql/postgresql/ext/pgjwt.nix
@@ -38,6 +38,7 @@ postgresqlBuildExtension (finalAttrs: {
     longDescription = ''
       sign() and verify() functions to create and verify JSON Web Tokens.
     '';
+    homepage = "https://github.com/michelp/pgjwt";
     license = lib.licenses.mit;
     platforms = postgresql.meta.platforms;
     maintainers = with lib.maintainers; [ spinus ];
diff --git a/pkgs/shells/fish/plugins/foreign-env/default.nix b/pkgs/shells/fish/plugins/foreign-env/default.nix
index 287009acce4d..e19dd23c8d99 100644
--- a/pkgs/shells/fish/plugins/foreign-env/default.nix
+++ b/pkgs/shells/fish/plugins/foreign-env/default.nix
@@ -22,6 +22,7 @@ buildFishPlugin {
 
   meta = {
     description = "Foreign environment interface for Fish shell";
+    homepage = "https://github.com/oh-my-fish/plugin-foreign-env";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       jgillich
diff --git a/pkgs/shells/fish/plugins/grc.nix b/pkgs/shells/fish/plugins/grc.nix
index 15a8b09135be..da653483f91b 100644
--- a/pkgs/shells/fish/plugins/grc.nix
+++ b/pkgs/shells/fish/plugins/grc.nix
@@ -21,6 +21,7 @@ buildFishPlugin {
 
   meta = {
     description = "Grc Colourizer for some commands on Fish shell";
+    homepage = "https://github.com/oh-my-fish/plugin-grc";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ onny ];
     platforms = with lib.platforms; unix;
diff --git a/pkgs/stdenv/linux/make-bootstrap-tools-cross.nix b/pkgs/stdenv/linux/make-bootstrap-tools-cross.nix
index d69cc836a19e..5b670400ef43 100644
--- a/pkgs/stdenv/linux/make-bootstrap-tools-cross.nix
+++ b/pkgs/stdenv/linux/make-bootstrap-tools-cross.nix
@@ -25,7 +25,7 @@ lib.mapAttrs (n: make) (
     # on how to request an upload.
     # Sort following the sorting in `./default.nix` `bootstrapFiles` argument.
 
-    armv5tel-unknown-linux-gnueabi = sheevaplug;
+    armv5tel-unknown-linux-gnueabi = armv5tel-multiplatform;
     armv6l-unknown-linux-gnueabihf = raspberryPi;
     armv7l-unknown-linux-gnueabihf = armv7l-hf-multiplatform;
     aarch64-unknown-linux-gnu = aarch64-multiplatform;
diff --git a/pkgs/test/cross/default.nix b/pkgs/test/cross/default.nix
index c5320f72a4bc..b4a007fa17e2 100644
--- a/pkgs/test/cross/default.nix
+++ b/pkgs/test/cross/default.nix
@@ -189,7 +189,7 @@ let
     pkgs.pkgsLLVM.stdenv
     pkgs.pkgsStatic.bash
     pkgs.pkgsCross.arm-embedded.stdenv
-    pkgs.pkgsCross.sheevaplug.stdenv # for armv5tel
+    pkgs.pkgsCross.armv5tel-multiplatform.stdenv
     pkgs.pkgsCross.raspberryPi.stdenv # for armv6l
     pkgs.pkgsCross.armv7l-hf-multiplatform.stdenv
     pkgs.pkgsCross.m68k.stdenv
diff --git a/pkgs/tools/compression/bzip2/1_1.nix b/pkgs/tools/compression/bzip2/1_1.nix
index d62ad11e3ec4..d6ff290fd1a4 100644
--- a/pkgs/tools/compression/bzip2/1_1.nix
+++ b/pkgs/tools/compression/bzip2/1_1.nix
@@ -46,6 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "High-quality data compression program";
+    homepage = "https://gitlab.com/federicomenaquintero/bzip2";
     license = lib.licenses.bzip2;
     pkgConfigModules = [ "bz2" ];
     platforms = lib.platforms.all;
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-libpinyin/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-libpinyin/default.nix
index f189c05222f3..6412d8731901 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-libpinyin/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-libpinyin/default.nix
@@ -68,6 +68,7 @@ stdenv.mkDerivation rec {
   meta = {
     isIbusEngine = true;
     description = "IBus interface to the libpinyin input method";
+    homepage = "https://github.com/libpinyin/ibus-libpinyin";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [
       linsui
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-pinyin/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-pinyin/default.nix
index 3cfbb0bd1091..1905555c6bd8 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-pinyin/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-pinyin/default.nix
@@ -49,6 +49,7 @@ stdenv.mkDerivation rec {
   meta = {
     isIbusEngine = true;
     description = "PinYin engine for IBus";
+    homepage = "https://github.com/ibus/ibus-pinyin";
     license = lib.licenses.gpl2Only;
     maintainers = with lib.maintainers; [ azuwis ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/tools/misc/xvfb-run/default.nix b/pkgs/tools/misc/xvfb-run/default.nix
index ff77c0a7447d..e99fdb3e5dc2 100644
--- a/pkgs/tools/misc/xvfb-run/default.nix
+++ b/pkgs/tools/misc/xvfb-run/default.nix
@@ -78,6 +78,7 @@ stdenvNoCC.mkDerivation {
 
   meta = {
     description = "Convenience script to run a virtualized X-Server";
+    homepage = "https://github.com/archlinux/svntogit-packages";
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
     license = lib.licenses.gpl2Only;
     maintainers = [ lib.maintainers.artturin ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f9a3fb9acfe1..90876760dc05 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10358,9 +10358,6 @@ with pkgs;
     )
       haskellPackages.bench;
 
-  cri-o = callPackage ../applications/virtualization/cri-o/wrapper.nix { };
-  cri-o-unwrapped = callPackage ../applications/virtualization/cri-o { };
-
   ### GAMES
 
   inherit (callPackages ../games/fteqw { })
diff --git a/pkgs/top-level/emscripten-packages.nix b/pkgs/top-level/emscripten-packages.nix
index e588a4287d09..50053381acef 100644
--- a/pkgs/top-level/emscripten-packages.nix
+++ b/pkgs/top-level/emscripten-packages.nix
@@ -155,6 +155,10 @@ rec {
       cp README.md $doc/share/${pname}
     '';
     checkPhase = "";
+
+    meta = {
+      homepage = "https://gitlab.com/odfplugfest/xmlmirror";
+    };
   };
 
   zlib =
diff --git a/pkgs/top-level/release-cross.nix b/pkgs/top-level/release-cross.nix
index e264d1cf8590..cc0ab49a8c40 100644
--- a/pkgs/top-level/release-cross.nix
+++ b/pkgs/top-level/release-cross.nix
@@ -197,8 +197,8 @@ in
 
   crossIphone32 = mapTestOnCross systems.examples.iphone32 darwinCommon;
 
-  # Test some cross builds to the Sheevaplug
-  crossSheevaplugLinux = mapTestOnCross systems.examples.sheevaplug (
+  # Test some cross builds to ARMv5
+  armv5tel = mapTestOnCross systems.examples.armv5tel-multiplatform (
     linuxCommon
     // {
       ubootSheevaplug = nativePlatforms;
@@ -235,8 +235,6 @@ in
   # Linux on armv7l-hf
   armv7l-hf = mapTestOnCross systems.examples.armv7l-hf-multiplatform linuxCommon;
 
-  pogoplug4 = mapTestOnCross systems.examples.pogoplug4 linuxCommon;
-
   # Linux on aarch64
   aarch64 = mapTestOnCross systems.examples.aarch64-multiplatform linuxCommon;
   aarch64-musl = mapTestOnCross systems.examples.aarch64-multiplatform-musl linuxCommon;