diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 19acdb48878e..85f64d357539 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -17630,12 +17630,6 @@
       }
     ];
   };
-  mockersf = {
-    email = "francois.mockers@vleue.com";
-    github = "mockersf";
-    githubId = 8672791;
-    name = "François Mockers";
-  };
   modderme123 = {
     email = "modderme123@gmail.com";
     github = "milomg";
@@ -19317,12 +19311,6 @@
     githubId = 1839979;
     name = "Niklas Thörne";
   };
-  NthTensor = {
-    email = "miles.silberlingcook@gmail.com";
-    github = "NthTensor";
-    githubId = 16138381;
-    name = "Miles Silberling-Cook";
-  };
   nudelsalat = {
     email = "nudelsalat@clouz.de";
     name = "Fabian Dreßler";
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index 988469bd3ee6..827160ad40f4 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -56,16 +56,6 @@ with lib.maintainers;
     enableFeatureFreezePing = true;
   };
 
-  apm = {
-    scope = "Team for packages maintained by employees of Akademie für Pflegeberufe und Management GmbH.";
-    shortName = "apm employees";
-    # Edits to this list should only be done by an already existing member.
-    members = [
-      DutchGerman
-      friedow
-    ];
-  };
-
   apparmor = {
     scope = "AppArmor-related modules, userspace tool packages and profiles";
     shortName = "apparmor";
@@ -96,16 +86,6 @@ with lib.maintainers;
     enableFeatureFreezePing = true;
   };
 
-  bitnomial = {
-    # Verify additions to this team with at least one already existing member of the team.
-    members = [
-      cdepillabout
-      wraithm
-    ];
-    scope = "Group registration for packages maintained by Bitnomial.";
-    shortName = "Bitnomial employees";
-  };
-
   blockchains = {
     members = [
       mmahut
@@ -143,17 +123,6 @@ with lib.maintainers;
     enableFeatureFreezePing = true;
   };
 
-  c3d2 = {
-    members = [
-      astro
-      SuperSandro2000
-      revol-xut
-      oxapentane
-    ];
-    scope = "Maintain packages used in the C3D2 hackspace";
-    shortName = "c3d2";
-  };
-
   categorization = {
     github = "categorization";
   };
@@ -384,17 +353,6 @@ with lib.maintainers;
     github = "freedesktop";
   };
 
-  fslabs = {
-    # Verify additions to this team with at least one already existing member of the team.
-    members = [
-      lpostula
-      mockersf
-      NthTensor
-    ];
-    scope = "Group registration for packages maintained by Foresight Spatial Labs.";
-    shortName = "Foresight Spatial Labs employees";
-  };
-
   gcc = {
     members = [
       synthetica
diff --git a/nixos/lib/test-script-prepend.py b/nixos/lib/test-script-prepend.py
index 067fd20fe7c5..6be20270c6cc 100644
--- a/nixos/lib/test-script-prepend.py
+++ b/nixos/lib/test-script-prepend.py
@@ -13,7 +13,7 @@ from unittest import TestCase
 
 
 class RetryProtocol(Protocol):
-    def __call__(self, fn: Callable, timeout: int = 900) -> None:
+    def __call__(self, fn: Callable, timeout_seconds: int = 900) -> None:
         raise Exception("This is just type information for the Nix test driver")
 
 
diff --git a/nixos/modules/image/images.nix b/nixos/modules/image/images.nix
index b0f86ed5c455..b8729e6e3e6a 100644
--- a/nixos/modules/image/images.nix
+++ b/nixos/modules/image/images.nix
@@ -81,22 +81,30 @@ in
     };
   };
 
-  config.image.modules = lib.mkIf (!config.system.build ? image) imageModules;
-  config.system.build.images = lib.mkIf (!config.system.build ? image) (
-    lib.mapAttrs (
-      name: nixos:
-      let
-        inherit (nixos) config;
-        inherit (config.image) filePath;
-        builder =
-          config.system.build.image
-            or (throw "Module for `system.build.images.${name}` misses required `system.build.image` option.");
-      in
-      lib.recursiveUpdate builder {
-        passthru = {
-          inherit config filePath;
-        };
-      }
-    ) imageConfigs
-  );
+  config.image.modules = imageModules;
+  config.system.build.images =
+    lib.warnIf (config.system.build ? image)
+      ''
+        `system.build.image` is defined, while `system.build.images` is used.
+        The former will conflict with variants in the latter.
+        Maybe you are importing an image-building module into the toplevel?
+        Add it to `image.modules` instead, or adjust priorities manually.
+      ''
+      (
+        lib.mapAttrs (
+          name: nixos:
+          let
+            inherit (nixos) config;
+            inherit (config.image) filePath;
+            builder =
+              config.system.build.image
+                or (throw "Module for `system.build.images.${name}` misses required `system.build.image` option.");
+          in
+          lib.recursiveUpdate builder {
+            passthru = {
+              inherit config filePath;
+            };
+          }
+        ) imageConfigs
+      );
 }
diff --git a/nixos/modules/services/misc/portunus.nix b/nixos/modules/services/misc/portunus.nix
index 700d1a6871bb..5bd5504201c4 100644
--- a/nixos/modules/services/misc/portunus.nix
+++ b/nixos/modules/services/misc/portunus.nix
@@ -313,5 +313,5 @@ in
     ];
   };
 
-  meta.maintainers = [ lib.maintainers.majewsky ] ++ lib.teams.c3d2.members;
+  meta.maintainers = pkgs.portunus.meta.maintainers;
 }
diff --git a/nixos/modules/services/networking/networkmanager.nix b/nixos/modules/services/networking/networkmanager.nix
index f76e649d75e9..069d682e32d4 100644
--- a/nixos/modules/services/networking/networkmanager.nix
+++ b/nixos/modules/services/networking/networkmanager.nix
@@ -238,7 +238,7 @@ in
           types.listOf networkManagerPluginPackage;
         default = [ ];
         example = literalExpression ''
-          [
+          with pkgs; [
             networkmanager-fortisslvpn
             networkmanager-iodine
             networkmanager-l2tp
diff --git a/nixos/modules/services/web-apps/librespeed.nix b/nixos/modules/services/web-apps/librespeed.nix
index 69728e93d6e4..15e7a19047d9 100644
--- a/nixos/modules/services/web-apps/librespeed.nix
+++ b/nixos/modules/services/web-apps/librespeed.nix
@@ -441,5 +441,5 @@ in
     };
   };
 
-  meta.maintainers = lib.teams.c3d2.members;
+  meta.maintainers = pkgs.librespeed-rust.meta.maintainers;
 }
diff --git a/nixos/modules/services/web-apps/pretalx.nix b/nixos/modules/services/web-apps/pretalx.nix
index 00ea66a4c82e..f1f56ffb0d51 100644
--- a/nixos/modules/services/web-apps/pretalx.nix
+++ b/nixos/modules/services/web-apps/pretalx.nix
@@ -30,9 +30,7 @@ let
 in
 
 {
-  meta = {
-    maintainers = with lib.maintainers; [ hexa ] ++ lib.teams.c3d2.members;
-  };
+  meta.maintainers = pkgs.pretalx.meta.maintainers;
 
   options.services.pretalx = {
     enable = lib.mkEnableOption "pretalx";
diff --git a/nixos/tests/lomiri.nix b/nixos/tests/lomiri.nix
index cb24a77618fe..c7cc33d94a94 100644
--- a/nixos/tests/lomiri.nix
+++ b/nixos/tests/lomiri.nix
@@ -137,7 +137,7 @@ let
       with machine.nested("Waiting for the screen to have launcherColor {} on it:".format(launcherColor)):
         retry(check_for_color(launcherColor))
       with machine.nested("Ensuring launcherColor {} stays present on the screen:".format(launcherColor)):
-        retry(fn=check_for_color_continued_presence(launcherColor), timeout=30)
+        retry(fn=check_for_color_continued_presence(launcherColor), timeout_seconds=30)
 
       machine.screenshot("lomiri_launched")
 
diff --git a/nixos/tests/web-apps/pretalx.nix b/nixos/tests/web-apps/pretalx.nix
index c226d607ad00..03fa6684b8b5 100644
--- a/nixos/tests/web-apps/pretalx.nix
+++ b/nixos/tests/web-apps/pretalx.nix
@@ -1,8 +1,8 @@
-{ lib, ... }:
+{ pkgs, ... }:
 
 {
   name = "pretalx";
-  meta.maintainers = lib.teams.c3d2.members;
+  meta.maintainers = pkgs.pretalx.meta.maintainers;
 
   nodes = {
     pretalx =
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 51287d540fa6..019d530e0096 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -17602,6 +17602,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  vim-colors-paramount = buildVimPlugin {
+    pname = "vim-colors-paramount";
+    version = "0-unstable-2018-10-02";
+    src = fetchFromGitHub {
+      owner = "owickstrom";
+      repo = "vim-colors-paramount";
+      rev = "a5601d36fb6932e8d1a6f8b37b179a99b1456798";
+      hash = "sha256-j9nMjKYK7bqrGHprYp0ddLEWs1CNMudxXD13sOROVmY=";
+    };
+    meta.homepage = "https://github.com/owickstrom/vim-colors-paramount/";
+    meta.hydraPlatforms = [ ];
+  };
+
   vim-colors-solarized = buildVimPlugin {
     pname = "vim-colors-solarized";
     version = "0-unstable-2011-05-09";
diff --git a/pkgs/applications/editors/vim/plugins/non-generated/cmp-async-path/default.nix b/pkgs/applications/editors/vim/plugins/non-generated/cmp-async-path/default.nix
index 663717cce39a..be06a8fb9b08 100644
--- a/pkgs/applications/editors/vim/plugins/non-generated/cmp-async-path/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/cmp-async-path/default.nix
@@ -7,14 +7,14 @@
 }:
 vimUtils.buildVimPlugin {
   pname = "cmp-async-path";
-  version = "0-unstable-2026-01-05";
+  version = "0-unstable-2026-01-09";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "FelipeLema";
     repo = "cmp-async-path";
-    rev = "a14d3a9c7f303551a0b8c64a0e4e6527ce39a8a2";
-    hash = "sha256-QOa2Oke3p5wGhTJ4TjcgTUphb0OdDUwmw8MiYp2LkhA=";
+    rev = "9c2374deb32c2bec8b27e928c6f57090e9a875d2";
+    hash = "sha256-obi3c5dRfPhYsNJk33lCwTtXWuwOyzEqKOpUk3z7Bxk=";
   };
 
   checkInputs = [ vimPlugins.nvim-cmp ];
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 417fa51ecd85..d2e8b21a98f3 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -1352,6 +1352,7 @@ https://github.com/tomasiser/vim-code-dark/,,
 https://github.com/google/vim-codefmt/,,
 https://github.com/kchmck/vim-coffee-script/,,
 https://github.com/kalbasit/vim-colemak/,,
+https://github.com/owickstrom/vim-colors-paramount/,HEAD,
 https://github.com/altercation/vim-colors-solarized/,,
 https://github.com/flazz/vim-colorschemes/,,
 https://github.com/jonbri/vim-colorstepper/,,
diff --git a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
index 7b27f9068d69..bfe22093b5b1 100644
--- a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "claude-code";
     publisher = "anthropic";
-    version = "2.1.3";
-    hash = "sha256-UH4f3SZbKQTJS4w0AsZMLpmHg0+kyUYZkHOzy2R5Amo=";
+    version = "2.1.5";
+    hash = "sha256-R7FRTvbadL12uSZjOHK2ggGlie6jDm+tV5Ei1LrVCZQ=";
   };
 
   meta = {
diff --git a/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix b/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
index 00bc6f7e4b6a..cd1a445f47b3 100644
--- a/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "claude-dev";
     publisher = "saoudrizwan";
-    version = "3.46.1";
-    hash = "sha256-jdDdKG6cMn6+FoIzvSWMalrLTzlWvxz9MYRE/tp72Z8=";
+    version = "3.49.0";
+    hash = "sha256-KI4ZRy1DZi2C1UeNDVeoDRn/GsHjHmpyNnno+gO/eDE=";
   };
 
   meta = {
diff --git a/pkgs/applications/misc/ArchiSteamFarm/default.nix b/pkgs/applications/misc/ArchiSteamFarm/default.nix
index fa0bfca404f4..97de6046e270 100644
--- a/pkgs/applications/misc/ArchiSteamFarm/default.nix
+++ b/pkgs/applications/misc/ArchiSteamFarm/default.nix
@@ -21,13 +21,13 @@ in
 buildDotnetModule rec {
   pname = "ArchiSteamFarm";
   # nixpkgs-update: no auto update
-  version = "6.3.1.4";
+  version = "6.3.1.6";
 
   src = fetchFromGitHub {
     owner = "JustArchiNET";
     repo = "ArchiSteamFarm";
     rev = version;
-    hash = "sha256-o95wYtSXLsBSMAPhVQeLBtgPqae/KihOR35QNRMXMjY=";
+    hash = "sha256-WbzPlngp+Vjwc14qgQE5i2WVRCGvcs9N8lVv2SpfqdQ=";
   };
 
   dotnet-runtime = dotnetCorePackages.aspnetcore_10_0;
diff --git a/pkgs/applications/misc/ArchiSteamFarm/deps.json b/pkgs/applications/misc/ArchiSteamFarm/deps.json
index 5ecfcedfb68f..c9816672d21a 100644
--- a/pkgs/applications/misc/ArchiSteamFarm/deps.json
+++ b/pkgs/applications/misc/ArchiSteamFarm/deps.json
@@ -581,8 +581,8 @@
   },
   {
     "pname": "Scalar.AspNetCore",
-    "version": "2.11.6",
-    "hash": "sha256-Zvif7bb67psL8YRMTa04MjeFI8hcWpi/gwtEjp+/xO8="
+    "version": "2.11.10",
+    "hash": "sha256-zSBsHjGTdwgia+v95wAdhNL7X1OuQKUd+CbkKKf/T90="
   },
   {
     "pname": "SteamKit2",
@@ -631,8 +631,8 @@
   },
   {
     "pname": "Tmds.DBus.Protocol",
-    "version": "0.21.2",
-    "hash": "sha256-gaK/5aAummyin6ptnhaJbnA0ih4+2xADrtrLfFbHwYI="
+    "version": "0.22.0",
+    "hash": "sha256-W6ZKFN16KCEM5H8QTVFeQ/UmB55OPdgbSrntuX/X7Rk="
   },
   {
     "pname": "ZstdSharp.Port",
diff --git a/pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix b/pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix
index f4acdd4dc505..0d074397b63c 100644
--- a/pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix
+++ b/pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix
@@ -7,7 +7,7 @@
 
 buildNpmPackage rec {
   pname = "asf-ui";
-  version = "d3b89fc7c3650c00b08beec82a49e9219ed370f2";
+  version = "8891c8b6d1c8caf82d9820a9b3722e36af3d066b";
 
   src = fetchFromGitHub {
     owner = "JustArchiNET";
@@ -15,10 +15,10 @@ buildNpmPackage rec {
     # updated by the update script
     # this is always the commit that should be used with asf-ui from the latest asf version
     rev = version;
-    hash = "sha256-EFPtp+mff4qNkwDTaIxT5x6fDa890GLmI9fWQyPmqZk=";
+    hash = "sha256-WQVHGTuGKJ4BNmq+vIboGcJTiJwt+bfHeO7IOlZhW5I=";
   };
 
-  npmDepsHash = "sha256-AA1NOOWfMUhWEEFuK7I3yMmO+1Oy7bq+7CBXPhm6FHA=";
+  npmDepsHash = "sha256-YTM4/RGPt+VZL7cydGp4h38E4ej+TQeCZFVnk5aCPlw=";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/applications/networking/cluster/rke2/1_32/images-versions.json b/pkgs/applications/networking/cluster/rke2/1_32/images-versions.json
index 89f972132e8d..6b2319859274 100644
--- a/pkgs/applications/networking/cluster/rke2/1_32/images-versions.json
+++ b/pkgs/applications/networking/cluster/rke2/1_32/images-versions.json
@@ -1,138 +1,138 @@
 {
   "images-calico-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.10%2Brke2r1/rke2-images-calico.linux-amd64.tar.gz",
-    "sha256": "5d833bca6808595318f80bf687a5556ed0db7ad55d399a7e1f159f91f58c3399"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.11%2Brke2r1/rke2-images-calico.linux-amd64.tar.gz",
+    "sha256": "3c30438a4eddeb831db2ac5f52f447b8848815c2fd0aa86d05764603689d39c6"
   },
   "images-calico-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.10%2Brke2r1/rke2-images-calico.linux-amd64.tar.zst",
-    "sha256": "68bbc30990d83a8a7280555f9ce633462582de888c03c7d5f6627b0052527d6b"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.11%2Brke2r1/rke2-images-calico.linux-amd64.tar.zst",
+    "sha256": "33c00385b8c3cec3ee5c1eff6f165284b4bf63ee53b1cbbe707fe3317706a7d2"
   },
   "images-calico-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.10%2Brke2r1/rke2-images-calico.linux-arm64.tar.gz",
-    "sha256": "083e270c4370a420499c94924041cf8aa84e730ed29718bb8f91075a421f329c"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.11%2Brke2r1/rke2-images-calico.linux-arm64.tar.gz",
+    "sha256": "0aa89b6a25f0d8ddcd32e7c1931d190d805cb79870a80593d8aa5ec797fc9f79"
   },
   "images-calico-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.10%2Brke2r1/rke2-images-calico.linux-arm64.tar.zst",
-    "sha256": "7ba9e0774559b091a9d6b3587fb39e2c106078f2e412bbdadf6b2b1986060e6f"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.11%2Brke2r1/rke2-images-calico.linux-arm64.tar.zst",
+    "sha256": "e5c760962303fd6296842737be355cde7ee066f464ea550b55f1f6ba7dd95f2c"
   },
   "images-canal-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.10%2Brke2r1/rke2-images-canal.linux-amd64.tar.gz",
-    "sha256": "51ffc6c9b718b0d5d12b034b69dab0c2394f38131d16aaf0c3f16cd68bab071a"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.11%2Brke2r1/rke2-images-canal.linux-amd64.tar.gz",
+    "sha256": "a1a2f2fd90d92bbfdf0a77b77c4295e119e542021204a728cc42f618ab798622"
   },
   "images-canal-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.10%2Brke2r1/rke2-images-canal.linux-amd64.tar.zst",
-    "sha256": "d96d183a2265eaf6d6c9a7787cbb9a191d690130542de45b67389c390fcccada"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.11%2Brke2r1/rke2-images-canal.linux-amd64.tar.zst",
+    "sha256": "a2b72764ab8f5e72169812ce875bbc861e1c2e341b167bef7d5e980b78dd9f6b"
   },
   "images-canal-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.10%2Brke2r1/rke2-images-canal.linux-arm64.tar.gz",
-    "sha256": "2321bf1b453615ba8a50254fb02f260e96bb1a725c1cddee848ef44a0a88a527"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.11%2Brke2r1/rke2-images-canal.linux-arm64.tar.gz",
+    "sha256": "a7163212bea884f76a6a2e3b62be7bf8086460f9149d9f2e5693edeaf0d7ad93"
   },
   "images-canal-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.10%2Brke2r1/rke2-images-canal.linux-arm64.tar.zst",
-    "sha256": "a0285e10bd977b93218231511b3ebbc8913d848c2b77bed73ecaa72a06e7a94a"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.11%2Brke2r1/rke2-images-canal.linux-arm64.tar.zst",
+    "sha256": "3780c1220874f41028ba8f0a49209b090fb2947da23bff53bdc0953ed6e4db9e"
   },
   "images-cilium-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.10%2Brke2r1/rke2-images-cilium.linux-amd64.tar.gz",
-    "sha256": "d89bb5e9b608e4f949375ccecd2685f7317dcea24f39ee2657769e8d65aa02ae"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.11%2Brke2r1/rke2-images-cilium.linux-amd64.tar.gz",
+    "sha256": "38dbc7f386c4fce06aa7a2c6051b4176113e1ff93f2da4beae66853e8ae582b1"
   },
   "images-cilium-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.10%2Brke2r1/rke2-images-cilium.linux-amd64.tar.zst",
-    "sha256": "997ddd67ba6636a139bd635c594e71e16b6c3a06a3e2e6f5260abd9500831fd6"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.11%2Brke2r1/rke2-images-cilium.linux-amd64.tar.zst",
+    "sha256": "75bd972ec8e3266ae01b4968b224a118e374b01c830def92a20dfcbf29cb20e8"
   },
   "images-cilium-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.10%2Brke2r1/rke2-images-cilium.linux-arm64.tar.gz",
-    "sha256": "1777e1e63b9087e157541acfcc03db9ed9ccf96ffd48850eb850c03653629a60"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.11%2Brke2r1/rke2-images-cilium.linux-arm64.tar.gz",
+    "sha256": "48d46a224df1ffe173b432b69f08249e98da31209de613b2ec06eb4476e8f4ff"
   },
   "images-cilium-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.10%2Brke2r1/rke2-images-cilium.linux-arm64.tar.zst",
-    "sha256": "fa3c6e9bc5a36fca572f777e37d43f53d632240a0807206ff88411c6e05e39c8"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.11%2Brke2r1/rke2-images-cilium.linux-arm64.tar.zst",
+    "sha256": "f71fb6f5e2b650958baff8133c61a1ad43c04ab7d222334cf54839de735e2897"
   },
   "images-core-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.10%2Brke2r1/rke2-images-core.linux-amd64.tar.gz",
-    "sha256": "771fbd5957d04cb58038bea2f76f83c34c2040083ab544318f0cfda76f4066f7"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.11%2Brke2r1/rke2-images-core.linux-amd64.tar.gz",
+    "sha256": "375f0bf18da30f2f76aca8bbb065dda9ac75caca76a4704424c800917e351b42"
   },
   "images-core-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.10%2Brke2r1/rke2-images-core.linux-amd64.tar.zst",
-    "sha256": "3b0ef04fa3f5384892b3d9cd4e7f92d1b4de2ee6cd962104e40ddacd9e221fd4"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.11%2Brke2r1/rke2-images-core.linux-amd64.tar.zst",
+    "sha256": "c651e89aabdf77f4c90af42fd337b522691190600272f26059b8f1b48ac2f68c"
   },
   "images-core-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.10%2Brke2r1/rke2-images-core.linux-arm64.tar.gz",
-    "sha256": "30558605dcae858acdb9206e5b60bd1df84053b35d48ee6ef3bb6d4cd416375b"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.11%2Brke2r1/rke2-images-core.linux-arm64.tar.gz",
+    "sha256": "0161796116bab9afcfee91e9116b10516634254ec0771a08178761443eac2147"
   },
   "images-core-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.10%2Brke2r1/rke2-images-core.linux-arm64.tar.zst",
-    "sha256": "ff9bc0790e2dbaf4ff4514cb387b61f0659149e9ff9b345dae2604be39eb1d7f"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.11%2Brke2r1/rke2-images-core.linux-arm64.tar.zst",
+    "sha256": "53648ffc5b03c0aae262734bbe4c684a62a33a89fad4e8183957e57af4b5d65f"
   },
   "images-flannel-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.10%2Brke2r1/rke2-images-flannel.linux-amd64.tar.gz",
-    "sha256": "978b366bffae9e2b9aae3746832123f9063c029b6c0100413ff759a998aec357"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.11%2Brke2r1/rke2-images-flannel.linux-amd64.tar.gz",
+    "sha256": "7683ea5abbf25b1af3a1fc6c1967fb65a05f2d927d1fe8b37fe3f30990c99907"
   },
   "images-flannel-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.10%2Brke2r1/rke2-images-flannel.linux-amd64.tar.zst",
-    "sha256": "1e3d3e7ed0c815233a2d90eff6d828483575fe120070632a03dfdad313e38209"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.11%2Brke2r1/rke2-images-flannel.linux-amd64.tar.zst",
+    "sha256": "99be4dff6a72d45c14ec4c7e2142a52eaac7e79e901d260b7b2a85c9463524f1"
   },
   "images-flannel-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.10%2Brke2r1/rke2-images-flannel.linux-arm64.tar.gz",
-    "sha256": "fe48db6c1e28526c2963a6d104ed6dc51200dfdedad79dd7dae6796808539e86"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.11%2Brke2r1/rke2-images-flannel.linux-arm64.tar.gz",
+    "sha256": "2157b8db3e36a598d266f475f359e78ea8f13ce759e865992fd52728de7f727e"
   },
   "images-flannel-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.10%2Brke2r1/rke2-images-flannel.linux-arm64.tar.zst",
-    "sha256": "3779149f30cdadf1102080e4b4766be922cd31abc58489fe5f69bb54fb98b4dc"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.11%2Brke2r1/rke2-images-flannel.linux-arm64.tar.zst",
+    "sha256": "4413a6ec9305fb811eb99973f0b609ba4412b5a7ae6384146f7be647c8726851"
   },
   "images-harvester-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.10%2Brke2r1/rke2-images-harvester.linux-amd64.tar.gz",
-    "sha256": "8d4d35d196c0661ee52bfa29583042e388613ea13fd52928b3cfae9d7581fc36"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.11%2Brke2r1/rke2-images-harvester.linux-amd64.tar.gz",
+    "sha256": "5edf9c8e8b76e9ffd8accf30ab8d8e4d3edaf0aaf80d325c5cb7c0d319230f35"
   },
   "images-harvester-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.10%2Brke2r1/rke2-images-harvester.linux-amd64.tar.zst",
-    "sha256": "7118609bc2158dfd0552cb581735a57f1ed270752125f6e7a543dbaac77dbbce"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.11%2Brke2r1/rke2-images-harvester.linux-amd64.tar.zst",
+    "sha256": "1ed7217d8e08947f03f96b482e095274d70a491286a8ffc58dfedad43958bcb8"
   },
   "images-harvester-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.10%2Brke2r1/rke2-images-harvester.linux-arm64.tar.gz",
-    "sha256": "58caa6f91d1cd6ae8fcd7b3033599c88a3d37544298a13322aacb10c2c9e1fa6"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.11%2Brke2r1/rke2-images-harvester.linux-arm64.tar.gz",
+    "sha256": "31e926524431667425d7f2120a25aca48ff4ae912e471a117a5d76c178002083"
   },
   "images-harvester-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.10%2Brke2r1/rke2-images-harvester.linux-arm64.tar.zst",
-    "sha256": "8420e153021708aa947adb2a39e751227a9f2aacced5c782f8ba22333c46e553"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.11%2Brke2r1/rke2-images-harvester.linux-arm64.tar.zst",
+    "sha256": "e93b68f4123ae02bb62142468add0be45d98ed2667333421f26102ef01e06048"
   },
   "images-multus-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.10%2Brke2r1/rke2-images-multus.linux-amd64.tar.gz",
-    "sha256": "b41e8cee051759e1626b2998419da06e91a713063fb55c2a26dd7fdc7b34973a"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.11%2Brke2r1/rke2-images-multus.linux-amd64.tar.gz",
+    "sha256": "e642b17c843780f9961864a6a7ef6f5031a05c255cac62f7109a95870ecc46e7"
   },
   "images-multus-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.10%2Brke2r1/rke2-images-multus.linux-amd64.tar.zst",
-    "sha256": "2908a31ef4d1d43940fc49279c5845a9536c1fdc5bb0e7a831f2e0bf4e6e8977"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.11%2Brke2r1/rke2-images-multus.linux-amd64.tar.zst",
+    "sha256": "7997ccf45051611f8c2ba6f0ac4ae59636aeec3e227fe2c31bd678a57396c813"
   },
   "images-multus-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.10%2Brke2r1/rke2-images-multus.linux-arm64.tar.gz",
-    "sha256": "9c7bdca941237c3cb8a18f606f6b62a890cf2b59650d4fb594f0c8b6f665103d"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.11%2Brke2r1/rke2-images-multus.linux-arm64.tar.gz",
+    "sha256": "0483706f7871c1965a0de7c63a011462aadf8f97f5a9fd28c5c16d914a0ca627"
   },
   "images-multus-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.10%2Brke2r1/rke2-images-multus.linux-arm64.tar.zst",
-    "sha256": "b7837f58c46abbdd9a0fdd810ad7fc660593ed38623342287aba6759e21583b5"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.11%2Brke2r1/rke2-images-multus.linux-arm64.tar.zst",
+    "sha256": "0a46e0ce765a01099eba369ff311a12fe2537ebaa32fdbe11248f47e6fe625b4"
   },
   "images-traefik-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.10%2Brke2r1/rke2-images-traefik.linux-amd64.tar.gz",
-    "sha256": "cbcf55b5e40d15557a316178363620d8d7bf8d858f73bed6081de82de127d51d"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.11%2Brke2r1/rke2-images-traefik.linux-amd64.tar.gz",
+    "sha256": "d58271f93c27bad3651b084357025ee5232044ef10c24f9e72c3f70a8fd5112c"
   },
   "images-traefik-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.10%2Brke2r1/rke2-images-traefik.linux-amd64.tar.zst",
-    "sha256": "ec1f4bf39d610276118048b0e8230e3d7079dbdcf2dd00ad7469c317b052d857"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.11%2Brke2r1/rke2-images-traefik.linux-amd64.tar.zst",
+    "sha256": "c5170ab51f07f90da4972e6cda7186a042913a10064792529c3c292cd1c5b723"
   },
   "images-traefik-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.10%2Brke2r1/rke2-images-traefik.linux-arm64.tar.gz",
-    "sha256": "04a242d8aebc07acf39758d5d93163ebf1efbeaf439f1e4f8e70775039a001fd"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.11%2Brke2r1/rke2-images-traefik.linux-arm64.tar.gz",
+    "sha256": "266398b100bd47ca86bb6ccd2edd0163f7606032a36780407dbb553c50705ea3"
   },
   "images-traefik-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.10%2Brke2r1/rke2-images-traefik.linux-arm64.tar.zst",
-    "sha256": "62d3dabf8f62c7a98fed3aecbd88adf7ed8858a059bd1a4d2a31c175f119b6e5"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.11%2Brke2r1/rke2-images-traefik.linux-arm64.tar.zst",
+    "sha256": "1aedcb967b4203a54e247d90e3dfd054cd5de55281c0d9e4a6c7bbea45e0cd7e"
   },
   "images-vsphere-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.10%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.gz",
-    "sha256": "75ecd15d83aea5e9068fae44a8f1a0b272afec8a3155f117e3b0d4da3e0a9277"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.11%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.gz",
+    "sha256": "90e37c8c8cbff0e23dee712821fd6d09302fe1064f8b87d53fae6e26800322c6"
   },
   "images-vsphere-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.32.10%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.zst",
-    "sha256": "d1a5f823829f1045948f5523b6156329610ed74c0f990f42ff8823a4988ffde8"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.32.11%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.zst",
+    "sha256": "341ec63cde711b4aa55f22e59d2238230ae703c70f67e74347755f5909c00b7b"
   }
 }
diff --git a/pkgs/applications/networking/cluster/rke2/1_32/versions.nix b/pkgs/applications/networking/cluster/rke2/1_32/versions.nix
index adec28e0c056..d8a6426ae6b4 100644
--- a/pkgs/applications/networking/cluster/rke2/1_32/versions.nix
+++ b/pkgs/applications/networking/cluster/rke2/1_32/versions.nix
@@ -1,12 +1,13 @@
 {
-  rke2Version = "1.32.10+rke2r1";
-  rke2Commit = "7a87b5095b6e5c8e73bb1524082a5d644dd5e46b";
-  rke2TarballHash = "sha256-GDh7n5xAkeqbE2RDzj905fAf+ip8EU2pcpPPjWKQ3AQ=";
-  rke2VendorHash = "sha256-Hy10UPKyEU3enEitRchbLJILqzFa++7HlFkxth5pBag=";
-  k8sImageTag = "v1.32.10-rke2r1-build20251112";
-  etcdVersion = "v3.5.21-k3s1-build20251017";
+  rke2Version = "1.32.11+rke2r1";
+  rke2Commit = "836ebdc75f3d96bbeed0373e1fee7de24d3798f7";
+  rke2TarballHash = "sha256-AErhQfpUyINPLNaCeXxl67EehB8aKrQUDWZKrFlrG4E=";
+  rke2VendorHash = "sha256-yiyMD4VPM592nwbKGEo380FX/B2NytKcw6ly2JSYx7E=";
+  k8sImageTag = "v1.32.11-rke2r1-build20251216";
+  etcdVersion = "v3.5.25-k3s1-build20251210";
   pauseVersion = "3.6";
-  ccmVersion = "v1.32.10-0.20251010190908-d439f1a03318-build20251017";
-  dockerizedVersion = "v1.32.10-rke2r1";
+  ccmVersion = "v1.32.11-0.20251210094421-ded016535487-build20251210";
+  dockerizedVersion = "v1.32.11-rke2r1";
+  helmJobVersion = "v0.9.12-build20251215";
   imagesVersions = with builtins; fromJSON (readFile ./images-versions.json);
 }
diff --git a/pkgs/applications/networking/cluster/rke2/1_33/images-versions.json b/pkgs/applications/networking/cluster/rke2/1_33/images-versions.json
index 9507eb0bfc55..6441620b80e5 100644
--- a/pkgs/applications/networking/cluster/rke2/1_33/images-versions.json
+++ b/pkgs/applications/networking/cluster/rke2/1_33/images-versions.json
@@ -1,138 +1,138 @@
 {
   "images-calico-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.6%2Brke2r1/rke2-images-calico.linux-amd64.tar.gz",
-    "sha256": "09c368f17a10e74dafc68188a5548011e7605398d36331699554073668c0e1f8"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.7%2Brke2r1/rke2-images-calico.linux-amd64.tar.gz",
+    "sha256": "8ffd0de3ae47590d6891b21c95a4bf718ba26b00acc72c3502e5b7a98cfeaebf"
   },
   "images-calico-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.6%2Brke2r1/rke2-images-calico.linux-amd64.tar.zst",
-    "sha256": "70aa654347b671a3674e9bdf4f027423f441f35bd352a62302cbcae0ac6a9709"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.7%2Brke2r1/rke2-images-calico.linux-amd64.tar.zst",
+    "sha256": "a3edff8cee5b147c736c11c2e074a8501ae82b5aca14d9149a04b14714312570"
   },
   "images-calico-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.6%2Brke2r1/rke2-images-calico.linux-arm64.tar.gz",
-    "sha256": "e1bf14ab9ee37d236d5d81d298ae305f52d4b704326cb34b328c993a05110561"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.7%2Brke2r1/rke2-images-calico.linux-arm64.tar.gz",
+    "sha256": "d3e40d0c99a37419764bbd5be541fa1cc5469f8127aeb3297ab8f203194c916c"
   },
   "images-calico-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.6%2Brke2r1/rke2-images-calico.linux-arm64.tar.zst",
-    "sha256": "bc8b6bb30393380f9b9d115166a7f6c6424a9f75087bc6cce50788d4a85561d2"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.7%2Brke2r1/rke2-images-calico.linux-arm64.tar.zst",
+    "sha256": "d48b4a1d17c8befc174344dab58e5bda6a018d703ffc0cf17bddcfa94c538512"
   },
   "images-canal-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.6%2Brke2r1/rke2-images-canal.linux-amd64.tar.gz",
-    "sha256": "9bdd4622e92b0e77d6d42b17e920697024cd5429a67268af1cb69a2034aed8b3"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.7%2Brke2r1/rke2-images-canal.linux-amd64.tar.gz",
+    "sha256": "b779c59e5d18bd237eaa1664dd469943bbc98231fb471b3dea13c990c5d0c86b"
   },
   "images-canal-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.6%2Brke2r1/rke2-images-canal.linux-amd64.tar.zst",
-    "sha256": "02d7fbfa8cf6e77f5aa98191f7698bd222244f749ec6b79a7d5cf7c62c86f66a"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.7%2Brke2r1/rke2-images-canal.linux-amd64.tar.zst",
+    "sha256": "f113b95fd2835db27570dc5525a5e8b86918b379a67aca12f6d547f5a3aaed23"
   },
   "images-canal-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.6%2Brke2r1/rke2-images-canal.linux-arm64.tar.gz",
-    "sha256": "e28f38bce6f1ce6230f5ed6d7ad69397832d7cd7dc705b6221be2d152aa2ca6b"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.7%2Brke2r1/rke2-images-canal.linux-arm64.tar.gz",
+    "sha256": "507a46b8b160eb85c5d0833342bdc61a769bbcc7e5e0ee9ba4b90563b565e2a5"
   },
   "images-canal-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.6%2Brke2r1/rke2-images-canal.linux-arm64.tar.zst",
-    "sha256": "715c828e08936153f6cad0730474637c64e8c36e686ae2200fc14cc1bd9b040c"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.7%2Brke2r1/rke2-images-canal.linux-arm64.tar.zst",
+    "sha256": "9b542b33488d580223e161ba8d9bb11736eabddd3ed029d7a4a095d42b6e7122"
   },
   "images-cilium-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.6%2Brke2r1/rke2-images-cilium.linux-amd64.tar.gz",
-    "sha256": "8051ec537f5a7cda0a069a4016e5cafcc5edc004543766767ff3fbec5fbbf12b"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.7%2Brke2r1/rke2-images-cilium.linux-amd64.tar.gz",
+    "sha256": "e11afea5475d8c87d078f6847b41167b682d2b59dcd717b50f57912a43544f7c"
   },
   "images-cilium-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.6%2Brke2r1/rke2-images-cilium.linux-amd64.tar.zst",
-    "sha256": "b933b21227faf6a55cb5535d3f010285b13fe54625b7890a083393f9a6b90ed5"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.7%2Brke2r1/rke2-images-cilium.linux-amd64.tar.zst",
+    "sha256": "dd8a2be05ec194783058d3656a07a6b68b0ff7361fd4bc071cb2c61eee9d7803"
   },
   "images-cilium-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.6%2Brke2r1/rke2-images-cilium.linux-arm64.tar.gz",
-    "sha256": "ebfd5842d93451073438a44c6cf56285141005260c201f151aa09bf1b4a27c81"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.7%2Brke2r1/rke2-images-cilium.linux-arm64.tar.gz",
+    "sha256": "7f3c01c545d101ca7b05efbb1d629433f914ad29e99d8d825372027f73b3a628"
   },
   "images-cilium-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.6%2Brke2r1/rke2-images-cilium.linux-arm64.tar.zst",
-    "sha256": "4c4106746308370e57ee239a63308111eac17b2cfd6b31f07c49d8a97055ae53"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.7%2Brke2r1/rke2-images-cilium.linux-arm64.tar.zst",
+    "sha256": "f708c5275cb2a6ac390dcdeba1521da03b10e8812dcd4eef0a72bc7478f50aa7"
   },
   "images-core-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.6%2Brke2r1/rke2-images-core.linux-amd64.tar.gz",
-    "sha256": "b8322b16df2ad433fda09cb78249ad938b495a769bae5e27b914bb2542c13f42"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.7%2Brke2r1/rke2-images-core.linux-amd64.tar.gz",
+    "sha256": "c46fb5f1e71f33d30b3fdfad9bdb9cf45ed56172e99aa197db76e429e9c798b6"
   },
   "images-core-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.6%2Brke2r1/rke2-images-core.linux-amd64.tar.zst",
-    "sha256": "eb01422cbf955d11fe74eb746fff891579d2db62666e788dc82244d7991fbcd1"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.7%2Brke2r1/rke2-images-core.linux-amd64.tar.zst",
+    "sha256": "4d45c42f2a676a69db2cfe61a661d07897dcaf6286e6edd7e0a0a13c4107f1ae"
   },
   "images-core-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.6%2Brke2r1/rke2-images-core.linux-arm64.tar.gz",
-    "sha256": "3f5d7021b071f63fa0ca4084367c36b0886c1e59626b30fbbc434065b047c80a"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.7%2Brke2r1/rke2-images-core.linux-arm64.tar.gz",
+    "sha256": "7312ad66a5ab852abc3365258520ac12ad1682e4d899ebe27c0852524eb7b8e0"
   },
   "images-core-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.6%2Brke2r1/rke2-images-core.linux-arm64.tar.zst",
-    "sha256": "e26daf41fc76f6b5f9e2285a459276a6302af9b72fa85edc73d76d7daff2b114"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.7%2Brke2r1/rke2-images-core.linux-arm64.tar.zst",
+    "sha256": "2e428e080ae979e7a253b1f8a8e0d9d045bbf37e3429a1e0cda7bfd816f9e5f8"
   },
   "images-flannel-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.6%2Brke2r1/rke2-images-flannel.linux-amd64.tar.gz",
-    "sha256": "5e48442961327b025a309e7e9e0beeac3547de034fc267b22d74660b91c363b6"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.7%2Brke2r1/rke2-images-flannel.linux-amd64.tar.gz",
+    "sha256": "c42c70de2a03e024b2a215cf572c2043ad387e647b7f9c79f11f6c8f16169673"
   },
   "images-flannel-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.6%2Brke2r1/rke2-images-flannel.linux-amd64.tar.zst",
-    "sha256": "8d5317988078acc47163e7c5774b767c1b26e7f43ba919fdacde05232d589a8a"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.7%2Brke2r1/rke2-images-flannel.linux-amd64.tar.zst",
+    "sha256": "93136f61caf9b45dea0ab1d76473ebb880c56df404417d7706bab5677ce60ebb"
   },
   "images-flannel-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.6%2Brke2r1/rke2-images-flannel.linux-arm64.tar.gz",
-    "sha256": "67c0713d617f1840c722747d802b5a5a47a58d7d6ed5d32f822965a546589bd8"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.7%2Brke2r1/rke2-images-flannel.linux-arm64.tar.gz",
+    "sha256": "4f32b6f1b4bd502c9622e79143e1f0bb1a5f57277bd496e0534415507094a57b"
   },
   "images-flannel-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.6%2Brke2r1/rke2-images-flannel.linux-arm64.tar.zst",
-    "sha256": "aac6c722f7d07c41eaf80deb1bf8719cb93963fb9d713335fe8c0aef22d65d63"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.7%2Brke2r1/rke2-images-flannel.linux-arm64.tar.zst",
+    "sha256": "46d14c3531e0fd14483fe148ebec5e14b14c28bf1049f258d06511051b167873"
   },
   "images-harvester-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.6%2Brke2r1/rke2-images-harvester.linux-amd64.tar.gz",
-    "sha256": "5eb3e5ab6b0676d7197da756b46f94c7c9eb096d4d79b332eb74016f40136cb5"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.7%2Brke2r1/rke2-images-harvester.linux-amd64.tar.gz",
+    "sha256": "40829aff7709374b9d2d6b5cade000eb3f5dbcc91247364832cae8e1770b9749"
   },
   "images-harvester-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.6%2Brke2r1/rke2-images-harvester.linux-amd64.tar.zst",
-    "sha256": "f52fc26611fa766ad6781d295717199d81f0a21c2108bd333902bb5887689e89"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.7%2Brke2r1/rke2-images-harvester.linux-amd64.tar.zst",
+    "sha256": "fa712c7061cf6cc84c65e2d6aa86e4e98e862c17413d228677eedff2e32b500c"
   },
   "images-harvester-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.6%2Brke2r1/rke2-images-harvester.linux-arm64.tar.gz",
-    "sha256": "612030145cc28528aebf773795deae0c2dfc83eddaf9b90179db978e6fa66330"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.7%2Brke2r1/rke2-images-harvester.linux-arm64.tar.gz",
+    "sha256": "ac5ee84a05b4d9a8082ed58e3691305137f50dcd3de54a503905bd5943f5ada0"
   },
   "images-harvester-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.6%2Brke2r1/rke2-images-harvester.linux-arm64.tar.zst",
-    "sha256": "83501275b07b2632abbde646b07675bdf509dafdff90490f35af4d6cb402cd68"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.7%2Brke2r1/rke2-images-harvester.linux-arm64.tar.zst",
+    "sha256": "94a72b07d0cb69dd2406f52cf6b6d87be2aae2291d76370ded49f7f47197b631"
   },
   "images-multus-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.6%2Brke2r1/rke2-images-multus.linux-amd64.tar.gz",
-    "sha256": "734f2833d156092afd85b0106779ae842745d71e4e226120d2450d9ad894127b"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.7%2Brke2r1/rke2-images-multus.linux-amd64.tar.gz",
+    "sha256": "b2f5875d3d9702b8778d609134a99cdbff720ea41ef7b490a0af2460e2e3ca8f"
   },
   "images-multus-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.6%2Brke2r1/rke2-images-multus.linux-amd64.tar.zst",
-    "sha256": "5da8147e6330b3b60723734afb5a2cc70a67c6282edf730f6bd3c1f2d89958e5"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.7%2Brke2r1/rke2-images-multus.linux-amd64.tar.zst",
+    "sha256": "69ed710c8a64668d9fd59f1fa30601d26051389819753dcb27f46fc12192a884"
   },
   "images-multus-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.6%2Brke2r1/rke2-images-multus.linux-arm64.tar.gz",
-    "sha256": "bd6e3efc21b83431ba3d49a8ecf514320046ce9ba5b35de6241ffb549883d2c7"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.7%2Brke2r1/rke2-images-multus.linux-arm64.tar.gz",
+    "sha256": "8917010380e3c2501af3b6cfc497b0d226aecf9a290b1a84090d62c549716564"
   },
   "images-multus-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.6%2Brke2r1/rke2-images-multus.linux-arm64.tar.zst",
-    "sha256": "74c60dfa064c4ab636a15378d082338fe245875648c4fc2522905f81b9b56154"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.7%2Brke2r1/rke2-images-multus.linux-arm64.tar.zst",
+    "sha256": "8c6164f34bff5253874fa7d5c18da79c5d2849bd874cf75eb6200bce79e4e342"
   },
   "images-traefik-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.6%2Brke2r1/rke2-images-traefik.linux-amd64.tar.gz",
-    "sha256": "9c03f6d933412f3c084e2cccfcae0bd2f2da5833fdc9bab1d5a38224afcb6013"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.7%2Brke2r1/rke2-images-traefik.linux-amd64.tar.gz",
+    "sha256": "3af0e0aae8de0558602b278216f92d85bc976d1d44028900067b4e164b987f19"
   },
   "images-traefik-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.6%2Brke2r1/rke2-images-traefik.linux-amd64.tar.zst",
-    "sha256": "fdff38dee1bdba17f047c1d7575d8ee30ca4da36e54c856829bdc019d74f17fe"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.7%2Brke2r1/rke2-images-traefik.linux-amd64.tar.zst",
+    "sha256": "2bdec4a29e5660aeeb7789a12b48e0c92d1abb3d3533c779e1eb3a1859868895"
   },
   "images-traefik-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.6%2Brke2r1/rke2-images-traefik.linux-arm64.tar.gz",
-    "sha256": "b990c68a76480620275a55f0db199aed84a2415add3575cae4ac116197ad4481"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.7%2Brke2r1/rke2-images-traefik.linux-arm64.tar.gz",
+    "sha256": "d3c0a38066a85ee63d8363ed26ca511a2c94267ef48334e45d1abb756fc3d562"
   },
   "images-traefik-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.6%2Brke2r1/rke2-images-traefik.linux-arm64.tar.zst",
-    "sha256": "a1e35cc62a5c9c16b5d9df99ec3a467bcf7cdb22c778435baa784ffcb13baf8f"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.7%2Brke2r1/rke2-images-traefik.linux-arm64.tar.zst",
+    "sha256": "02187f5f06231bb50c8ac0cd908669e7a7bd5c611f633eb119f8bc8458a5f24c"
   },
   "images-vsphere-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.6%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.gz",
-    "sha256": "b73d6cd9caef5bc6617106def9af18c7bd6a56a68b87eb0bf3c107eb62a7b011"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.7%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.gz",
+    "sha256": "b492c8863e82f6223c8a8ff27d316d51c8931778921a16cab9b6861915ed7c45"
   },
   "images-vsphere-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.33.6%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.zst",
-    "sha256": "c9162d55c1129e83c1af956c6a0b9173857f0b2bccda889955b490df90578223"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.33.7%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.zst",
+    "sha256": "547cb03a489f2762e2d6de5693d91a17780113d88d3b6881fc4b182e864e7adb"
   }
 }
diff --git a/pkgs/applications/networking/cluster/rke2/1_33/versions.nix b/pkgs/applications/networking/cluster/rke2/1_33/versions.nix
index 7bbc0aca001a..1c5ded6d08c2 100644
--- a/pkgs/applications/networking/cluster/rke2/1_33/versions.nix
+++ b/pkgs/applications/networking/cluster/rke2/1_33/versions.nix
@@ -1,12 +1,13 @@
 {
-  rke2Version = "1.33.6+rke2r1";
-  rke2Commit = "2c2298232b55a94bd16b059f893c76a950811489";
-  rke2TarballHash = "sha256-K58K5jqOtabjyG1MIfvnaMo4pePgWaAd9SQ5BCNo3nw=";
-  rke2VendorHash = "sha256-taNWaULzVE3d4MhHvet3JFH3Mb4m/8no+DzIhqAjyVw=";
-  k8sImageTag = "v1.33.6-rke2r1-build20251112";
-  etcdVersion = "v3.5.21-k3s1-build20251017";
+  rke2Version = "1.33.7+rke2r1";
+  rke2Commit = "b0a4ec8463abd1e23e41f213fdb54ad8006c693b";
+  rke2TarballHash = "sha256-Dkr+rDsC3L9LSGuu6hBLuyWqWJLrpEi/p35wzP7P0uw=";
+  rke2VendorHash = "sha256-ybxWnzKjpH3sYeFIqUZyvV1KXB5zxpjMAzN6oC6MOXo=";
+  k8sImageTag = "v1.33.7-rke2r1-build20251210";
+  etcdVersion = "v3.5.25-k3s1-build20251210";
   pauseVersion = "3.6";
-  ccmVersion = "v1.33.6-0.20251010190850-d6b5244412d1-build20251017";
-  dockerizedVersion = "v1.33.6-rke2r1";
+  ccmVersion = "v1.33.7-0.20251210094413-291666bcc1a4-build20251210";
+  dockerizedVersion = "v1.33.7-rke2r1";
+  helmJobVersion = "v0.9.12-build20251215";
   imagesVersions = with builtins; fromJSON (readFile ./images-versions.json);
 }
diff --git a/pkgs/applications/networking/cluster/rke2/1_34/images-versions.json b/pkgs/applications/networking/cluster/rke2/1_34/images-versions.json
index f4e979d1504f..0ef85ea54b4d 100644
--- a/pkgs/applications/networking/cluster/rke2/1_34/images-versions.json
+++ b/pkgs/applications/networking/cluster/rke2/1_34/images-versions.json
@@ -1,138 +1,138 @@
 {
   "images-calico-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.2%2Brke2r1/rke2-images-calico.linux-amd64.tar.gz",
-    "sha256": "46f81e8114ddb829352d83ae3c45fc533659d474dbd19aeaf05971321885b9ad"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.3%2Brke2r1/rke2-images-calico.linux-amd64.tar.gz",
+    "sha256": "b85571d4e77831c90e5ab9169890177b472bb471ca4538335594109659239f32"
   },
   "images-calico-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.2%2Brke2r1/rke2-images-calico.linux-amd64.tar.zst",
-    "sha256": "2da3ed0859fa19b86deb78f39f7d4eea40b5322475d367bf95c2ca7ab3e5876c"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.3%2Brke2r1/rke2-images-calico.linux-amd64.tar.zst",
+    "sha256": "94721c4576ea11ac7a53077f7b3b83e0da06d83bbe4ab7bf696085eee8d79bdf"
   },
   "images-calico-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.2%2Brke2r1/rke2-images-calico.linux-arm64.tar.gz",
-    "sha256": "7166499d6aa70d2e08c2088db2edd7ac6be61dafbfcb7279767faad1608b4b06"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.3%2Brke2r1/rke2-images-calico.linux-arm64.tar.gz",
+    "sha256": "d5ea81e1b784d6631faf6c2dad980c2ab119a9d6bee3766e174c4ddd6afbd7d7"
   },
   "images-calico-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.2%2Brke2r1/rke2-images-calico.linux-arm64.tar.zst",
-    "sha256": "858ab93a661a028d09f389f3b67cfc323dddb488976dd0a7fc6a98be352b09e4"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.3%2Brke2r1/rke2-images-calico.linux-arm64.tar.zst",
+    "sha256": "1e6fac46a83442055666c2ab2aecbbbb8d8491c723fe6f587bd4af53423f5e23"
   },
   "images-canal-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.2%2Brke2r1/rke2-images-canal.linux-amd64.tar.gz",
-    "sha256": "7d336b65888212130ccdd572343ebd806d1332b061ea210204c32d98c5e1c790"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.3%2Brke2r1/rke2-images-canal.linux-amd64.tar.gz",
+    "sha256": "17d5b245b9ed022c4eb806c0a974be672b87dd5d21491dcac17ba2fc6cf7b105"
   },
   "images-canal-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.2%2Brke2r1/rke2-images-canal.linux-amd64.tar.zst",
-    "sha256": "c3e220b89fa78ea6522aaf8155d0c3d3b75521932cb412ffc776572e1731eefd"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.3%2Brke2r1/rke2-images-canal.linux-amd64.tar.zst",
+    "sha256": "20a8491b6a1c5ede6db6b2f8eb9c6dd2bccb1014193f50273b794d466f96b671"
   },
   "images-canal-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.2%2Brke2r1/rke2-images-canal.linux-arm64.tar.gz",
-    "sha256": "231c685f1412a67631aca0dac648e0484a23d219318eb110ee4f2b857dd734c4"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.3%2Brke2r1/rke2-images-canal.linux-arm64.tar.gz",
+    "sha256": "172691f696af33bec02fa560eb490fac5bba90ff206c3fe76f33ac48b3d89235"
   },
   "images-canal-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.2%2Brke2r1/rke2-images-canal.linux-arm64.tar.zst",
-    "sha256": "05449ac08f395ca1df496d37d50cb2531b1dea73074e0eed4d46680d59c723e8"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.3%2Brke2r1/rke2-images-canal.linux-arm64.tar.zst",
+    "sha256": "c6b4f18d5512159a783d8980b266eae0697e2eb9c9b6a87e845d8155ac3d10a7"
   },
   "images-cilium-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.2%2Brke2r1/rke2-images-cilium.linux-amd64.tar.gz",
-    "sha256": "181714ca655d22b4eb2bfe76f87ec94e86dde2e7b1d8770b9497ea4c987d81cd"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.3%2Brke2r1/rke2-images-cilium.linux-amd64.tar.gz",
+    "sha256": "d0b3351896b2475d86b3db55a176300b13e5c29f7ce253895871181de6c554d5"
   },
   "images-cilium-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.2%2Brke2r1/rke2-images-cilium.linux-amd64.tar.zst",
-    "sha256": "bd32f93fe2abe41f404789382daaeedf30e609fe681bb8320e2ea1a3e6ea821a"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.3%2Brke2r1/rke2-images-cilium.linux-amd64.tar.zst",
+    "sha256": "5eb9e750ccb966a5f65b294df586cadaa7988b84585c06538ba7e26a5e04ea31"
   },
   "images-cilium-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.2%2Brke2r1/rke2-images-cilium.linux-arm64.tar.gz",
-    "sha256": "7638a5cef90a4d978b458e6e01604b902e90900dcc56c98e0693555baf7810b3"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.3%2Brke2r1/rke2-images-cilium.linux-arm64.tar.gz",
+    "sha256": "473c179e121fa372118d8acf6d4042dcfbd78aa4180bde8f32a3686f6e67da0c"
   },
   "images-cilium-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.2%2Brke2r1/rke2-images-cilium.linux-arm64.tar.zst",
-    "sha256": "30fd832859920a01768c951dde0e91261a543c3cf59448324b96ec543532a7a6"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.3%2Brke2r1/rke2-images-cilium.linux-arm64.tar.zst",
+    "sha256": "9d60605d51e9adeae650731b1fcb06681140fe7ddff76178c3437f8bfc5876e8"
   },
   "images-core-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.2%2Brke2r1/rke2-images-core.linux-amd64.tar.gz",
-    "sha256": "429f4447439d293cf07ca50cedb64e2611c113ce0019abad82485198b57a2fbb"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.3%2Brke2r1/rke2-images-core.linux-amd64.tar.gz",
+    "sha256": "cd62de26e53ff647b542782a539b2f5b4fadd9e34e8c84071fb1ac744b353af5"
   },
   "images-core-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.2%2Brke2r1/rke2-images-core.linux-amd64.tar.zst",
-    "sha256": "a60e746be8075a67f2ded0e2beff192346fb0779f3e9896a86b20c3bb0a1ec36"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.3%2Brke2r1/rke2-images-core.linux-amd64.tar.zst",
+    "sha256": "c19d06dcafbadd08bc46199a7f22d43ce70848191c242d3642313f17b4fe186f"
   },
   "images-core-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.2%2Brke2r1/rke2-images-core.linux-arm64.tar.gz",
-    "sha256": "e1814a7f7f0f10c029e35fa3b49b9ede1039d60e47dfb1c17d7a730c4f7937c1"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.3%2Brke2r1/rke2-images-core.linux-arm64.tar.gz",
+    "sha256": "ed1650ffed4882821a833aaa86247038d386ab36a753726926de2346f228f240"
   },
   "images-core-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.2%2Brke2r1/rke2-images-core.linux-arm64.tar.zst",
-    "sha256": "83410a65484d691c280ee9fc29928dae53890b4623a2ffc2482b12c646fb56a9"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.3%2Brke2r1/rke2-images-core.linux-arm64.tar.zst",
+    "sha256": "9df49d0786965a359e3ab70208e65632e7962befb46175e217d5b35e5a556f4b"
   },
   "images-flannel-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.2%2Brke2r1/rke2-images-flannel.linux-amd64.tar.gz",
-    "sha256": "45767364848ceaa3824d9767dc269d2c042d4c73861d02100dc68d5e423ebd9f"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.3%2Brke2r1/rke2-images-flannel.linux-amd64.tar.gz",
+    "sha256": "5642c999542e0e09b5b304f363b4612bc7e1d18ea209787c65015728a61d64f7"
   },
   "images-flannel-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.2%2Brke2r1/rke2-images-flannel.linux-amd64.tar.zst",
-    "sha256": "cc77078e84b41ddf77c2eb7cb03e7e3fb6f70e07ada84daf2fdd553093aaa9b3"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.3%2Brke2r1/rke2-images-flannel.linux-amd64.tar.zst",
+    "sha256": "e87d546dcbe16384fe163bf8d52cd41b36a106a6202ac0bf308e91085cc02c00"
   },
   "images-flannel-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.2%2Brke2r1/rke2-images-flannel.linux-arm64.tar.gz",
-    "sha256": "350c22c1980745d86f639376f4567d1da65488288cd1b85d0957c52bec8b2a4f"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.3%2Brke2r1/rke2-images-flannel.linux-arm64.tar.gz",
+    "sha256": "6ff5df889ac61275f876c090476768cb0fde8d675300ac17ffa1bcab19c419a6"
   },
   "images-flannel-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.2%2Brke2r1/rke2-images-flannel.linux-arm64.tar.zst",
-    "sha256": "056ff1ed67c6fa75dd9653cb98d785349dbbcd7c4f47ca0847b9ec890f2e0afd"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.3%2Brke2r1/rke2-images-flannel.linux-arm64.tar.zst",
+    "sha256": "9f33d2b63ae6c59e91e534a9f9908966116b3fec4880c3a13b522d3bbbddf207"
   },
   "images-harvester-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.2%2Brke2r1/rke2-images-harvester.linux-amd64.tar.gz",
-    "sha256": "a876cfe3af3fa2630489e836729948257deb1056c0ad11083cd9ccd516f48ed0"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.3%2Brke2r1/rke2-images-harvester.linux-amd64.tar.gz",
+    "sha256": "a27f7c2ca33466cbf99d79648d30aa6b9cd8813bda40abf78f48315f7b038d2d"
   },
   "images-harvester-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.2%2Brke2r1/rke2-images-harvester.linux-amd64.tar.zst",
-    "sha256": "8447aaa2c45b753fd37b9ea3e49deaa0e90d207c7b53d4cb53dd3ab83f7e25fa"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.3%2Brke2r1/rke2-images-harvester.linux-amd64.tar.zst",
+    "sha256": "8b83f60edc527b368bc412a1f2773387d8691f4e17b3a176cf2f648af9b4989b"
   },
   "images-harvester-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.2%2Brke2r1/rke2-images-harvester.linux-arm64.tar.gz",
-    "sha256": "5f957df8553c5c2678342e8138ef30f81483be94e1399c0f0c8de4e7cc9c0fda"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.3%2Brke2r1/rke2-images-harvester.linux-arm64.tar.gz",
+    "sha256": "abe89abd5e5b09a00469e256cfcb0e4bd1b72f5ac01d8efecfef2c623c705454"
   },
   "images-harvester-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.2%2Brke2r1/rke2-images-harvester.linux-arm64.tar.zst",
-    "sha256": "639db539e8e95ae6ff25f4af54b47144784975a06ec0091c52dc48606b79dad1"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.3%2Brke2r1/rke2-images-harvester.linux-arm64.tar.zst",
+    "sha256": "cf1ff411e9acd0a78994e4d2fa52b63fc03ae30e59ecebf24609a65988fe877c"
   },
   "images-multus-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.2%2Brke2r1/rke2-images-multus.linux-amd64.tar.gz",
-    "sha256": "61f03dbac2a3911d558d0dbdf685966d26982f799e837256cd7f9d353a00dd2b"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.3%2Brke2r1/rke2-images-multus.linux-amd64.tar.gz",
+    "sha256": "4472b330de3725c0135740da2c59e954c1f2cd3904b6bb22b2c764a2333c4a9a"
   },
   "images-multus-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.2%2Brke2r1/rke2-images-multus.linux-amd64.tar.zst",
-    "sha256": "8e2cf0a062b8b704f612ced0751e288278f63632d9444141036da933d847ebcf"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.3%2Brke2r1/rke2-images-multus.linux-amd64.tar.zst",
+    "sha256": "aadd39289a95d0658cf8373aa896608d6ac62c654ed66f4edf1ff7f8e6a75881"
   },
   "images-multus-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.2%2Brke2r1/rke2-images-multus.linux-arm64.tar.gz",
-    "sha256": "a67e9317749743a30313bca5c919aa7300b83513eb330535669b411beb8b6220"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.3%2Brke2r1/rke2-images-multus.linux-arm64.tar.gz",
+    "sha256": "b4447f161a0c86adea6050f298644fa42ef9b6eb0f315cd64d22b62ad20b3780"
   },
   "images-multus-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.2%2Brke2r1/rke2-images-multus.linux-arm64.tar.zst",
-    "sha256": "611231207174f2c90dc767296d39b3da6c81acdb6809add4bb0e9ecf32c3eecf"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.3%2Brke2r1/rke2-images-multus.linux-arm64.tar.zst",
+    "sha256": "f1b91676d2517fa30afc36d077aef5568db8dcedfffce5f2081d35f6468620b2"
   },
   "images-traefik-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.2%2Brke2r1/rke2-images-traefik.linux-amd64.tar.gz",
-    "sha256": "6d0d198443f3102a0160179d57645d98888ad5da4a22e7e3cde78d1661c0e0b3"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.3%2Brke2r1/rke2-images-traefik.linux-amd64.tar.gz",
+    "sha256": "52b6fdc13ba7ada02a1bf4a9e6044e2f1b53a864d53edeb1908f82a41e442c25"
   },
   "images-traefik-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.2%2Brke2r1/rke2-images-traefik.linux-amd64.tar.zst",
-    "sha256": "55e06739983ea113870d5e161797ad7fc9a045adb7424c6112b6fc7ef77f4613"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.3%2Brke2r1/rke2-images-traefik.linux-amd64.tar.zst",
+    "sha256": "8c07f6491263873efbdf40795cf733a3a3da349e4bfc9d5edc59c50504347ebd"
   },
   "images-traefik-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.2%2Brke2r1/rke2-images-traefik.linux-arm64.tar.gz",
-    "sha256": "34b8bd724ed79f471b5cd0f739cbaf6d6e7907fd2ea0f7fd9836fbe4c9d85d1c"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.3%2Brke2r1/rke2-images-traefik.linux-arm64.tar.gz",
+    "sha256": "21d052162e50021c9d0efae0ad1c22e490dec2ac70d8d36dfe2975ab0d0105e3"
   },
   "images-traefik-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.2%2Brke2r1/rke2-images-traefik.linux-arm64.tar.zst",
-    "sha256": "5a58a01484e0f1e1e5752cb303bf1127897a252ac3b38c67f29e087d5178364c"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.3%2Brke2r1/rke2-images-traefik.linux-arm64.tar.zst",
+    "sha256": "25a2c696e2ff8cfa508bf8cf7efdfe897018783dba92ff92c8aebcfcd1f2fb08"
   },
   "images-vsphere-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.2%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.gz",
-    "sha256": "887fc456a3092fa085081432a24600cbffa5118d0a04573e24c8dc040311d49b"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.3%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.gz",
+    "sha256": "9d37cc1e535d65a8f2d53ff35f35f3a0d0a09d5aa1fea474f47dc60900741e42"
   },
   "images-vsphere-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.2%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.zst",
-    "sha256": "1f159abf894d00e9aab001efc6ea7cef34ba8ce9a4c2e9ce4f1162860c57d25d"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.3%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.zst",
+    "sha256": "325587c90dbb2bbaf7aa5c2a42910b6110927031dc031535db779486c36e969d"
   }
 }
diff --git a/pkgs/applications/networking/cluster/rke2/1_34/versions.nix b/pkgs/applications/networking/cluster/rke2/1_34/versions.nix
index fb39c241afdd..dd65cf9cb230 100644
--- a/pkgs/applications/networking/cluster/rke2/1_34/versions.nix
+++ b/pkgs/applications/networking/cluster/rke2/1_34/versions.nix
@@ -1,12 +1,13 @@
 {
-  rke2Version = "1.34.2+rke2r1";
-  rke2Commit = "5e3fff8134a5269977762be64197d0cb9b26b48c";
-  rke2TarballHash = "sha256-qd8oD51x2tiIRLWWA5rWUVp/stBB2ebe8dFIB5XuZME=";
-  rke2VendorHash = "sha256-0qsCo/9kttOaFqOwfNfwxaG9z+EAdk15Dde3Gw5tK98=";
-  k8sImageTag = "v1.34.2-rke2r1-build20251112";
-  etcdVersion = "v3.6.5-k3s1-build20251017";
+  rke2Version = "1.34.3+rke2r1";
+  rke2Commit = "1b103f296ab20fac6b32951c9efe59d28a5ed79f";
+  rke2TarballHash = "sha256-94wB6Dt06/evdQcW1K8blNBHwNR3ZGCZPLJyeyMbYAM=";
+  rke2VendorHash = "sha256-hVEIhaF5gabDKWX2VCTyKQa0cZktO9w+l2JtSNQIkg8=";
+  k8sImageTag = "v1.34.3-rke2r1-build20251210";
+  etcdVersion = "v3.6.6-k3s1-build20251210";
   pauseVersion = "3.6";
-  ccmVersion = "v1.34.2-0.20251010190833-cf0d35a732d1-build20251017";
-  dockerizedVersion = "v1.34.2-rke2r1";
+  ccmVersion = "v1.34.3-0.20251210094406-1ff6ebef7028-build20251210";
+  dockerizedVersion = "v1.34.3-rke2r1";
+  helmJobVersion = "v0.9.12-build20251215";
   imagesVersions = with builtins; fromJSON (readFile ./images-versions.json);
 }
diff --git a/pkgs/applications/networking/cluster/rke2/builder.nix b/pkgs/applications/networking/cluster/rke2/builder.nix
index 63801f9d14f8..52b2baeb8b6f 100644
--- a/pkgs/applications/networking/cluster/rke2/builder.nix
+++ b/pkgs/applications/networking/cluster/rke2/builder.nix
@@ -10,6 +10,7 @@ lib:
   pauseVersion,
   ccmVersion,
   dockerizedVersion,
+  helmJobVersion,
   imagesVersions,
 }:
 
@@ -76,20 +77,27 @@ buildGoModule (finalAttrs: {
   # Passing boringcrypto to GOEXPERIMENT variable to build with goboring library
   GOEXPERIMENT = "boringcrypto";
 
-  # See: https://github.com/rancher/rke2/blob/e7f87c6dd56fdd76a7dab58900aeea8946b2c008/scripts/build-binary#L27-L38
-  ldflags = [
-    "-w"
-    "-X github.com/k3s-io/k3s/pkg/version.GitCommit=${lib.substring 0 6 rke2Commit}"
-    "-X github.com/k3s-io/k3s/pkg/version.Program=${finalAttrs.pname}"
-    "-X github.com/k3s-io/k3s/pkg/version.Version=v${finalAttrs.version}"
-    "-X github.com/k3s-io/k3s/pkg/version.UpstreamGolang=go${go.version}"
-    "-X github.com/rancher/rke2/pkg/images.DefaultRegistry=docker.io"
-    "-X github.com/rancher/rke2/pkg/images.DefaultEtcdImage=rancher/hardened-etcd:${etcdVersion}"
-    "-X github.com/rancher/rke2/pkg/images.DefaultKubernetesImage=rancher/hardened-kubernetes:${k8sImageTag}"
-    "-X github.com/rancher/rke2/pkg/images.DefaultPauseImage=rancher/mirrored-pause:${pauseVersion}"
-    "-X github.com/rancher/rke2/pkg/images.DefaultRuntimeImage=rancher/rke2-runtime:${dockerizedVersion}"
-    "-X github.com/rancher/rke2/pkg/images.DefaultCloudControllerManagerImage=rancher/rke2-cloud-provider:${ccmVersion}"
-  ];
+  # https://github.com/rancher/rke2/blob/104ddbf3de65ab5490aedff36df2332d503d90fe/scripts/build-binary#L27-L39
+  ldflags =
+    let
+      K3S_PKG = "github.com/k3s-io/k3s";
+      HELMCTR_PKG = "github.com/k3s-io/helm-controller";
+      RKE2_PKG = "github.com/rancher/rke2";
+    in
+    [
+      "-w"
+      "-X ${K3S_PKG}/pkg/version.GitCommit=${lib.substring 0 6 rke2Commit}"
+      "-X ${K3S_PKG}/pkg/version.Program=${finalAttrs.pname}"
+      "-X ${K3S_PKG}/pkg/version.Version=v${finalAttrs.version}"
+      "-X ${K3S_PKG}/pkg/version.UpstreamGolang=go${go.version}"
+      "-X ${HELMCTR_PKG}/pkg/controllers/chart.DefaultJobImage=rancher/klipper-helm:${helmJobVersion}"
+      "-X ${RKE2_PKG}/pkg/images.DefaultRegistry=docker.io"
+      "-X ${RKE2_PKG}/pkg/images.DefaultEtcdImage=rancher/hardened-etcd:${etcdVersion}"
+      "-X ${RKE2_PKG}/pkg/images.DefaultKubernetesImage=rancher/hardened-kubernetes:${k8sImageTag}"
+      "-X ${RKE2_PKG}/pkg/images.DefaultPauseImage=rancher/mirrored-pause:${pauseVersion}"
+      "-X ${RKE2_PKG}/pkg/images.DefaultRuntimeImage=rancher/rke2-runtime:${dockerizedVersion}"
+      "-X ${RKE2_PKG}/pkg/images.DefaultCloudControllerManagerImage=rancher/rke2-cloud-provider:${ccmVersion}"
+    ];
 
   tags = [
     "no_cri_dockerd"
diff --git a/pkgs/applications/networking/cluster/rke2/default.nix b/pkgs/applications/networking/cluster/rke2/default.nix
index 24e1550c065d..c2b0169cf691 100644
--- a/pkgs/applications/networking/cluster/rke2/default.nix
+++ b/pkgs/applications/networking/cluster/rke2/default.nix
@@ -36,6 +36,6 @@ rec {
   ) extraArgs;
 
   # Automatically set by update script
-  rke2_stable = rke2_1_33;
+  rke2_stable = rke2_1_34;
   rke2_latest = rke2_1_34;
 }
diff --git a/pkgs/applications/networking/cluster/rke2/update-script.sh b/pkgs/applications/networking/cluster/rke2/update-script.sh
index fa1023bcdb9a..2290890003b3 100755
--- a/pkgs/applications/networking/cluster/rke2/update-script.sh
+++ b/pkgs/applications/networking/cluster/rke2/update-script.sh
@@ -71,6 +71,7 @@ cat << EOF > "${WORKDIR}/1_${MINOR_VERSION}/versions.nix"
   pauseVersion = "${PAUSE_VERSION}";
   ccmVersion = "${CCM_VERSION}";
   dockerizedVersion = "${DOCKERIZED_VERSION}";
+  helmJobVersion = "${KLIPPERHELM_VERSION}";
   imagesVersions = with builtins; fromJSON (readFile ./images-versions.json);
 }
 EOF
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 231b0df827de..3e3479ddf98c 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -73,11 +73,11 @@
     "vendorHash": "sha256-gVzj5x95MNgCbxwqiqakrUnhF/x+vXnAurv4pUt8kV4="
   },
   "auth0_auth0": {
-    "hash": "sha256-NB8MRaj3O7Fb2xBYzYEEQ6+ZcibF4JHUQQz51ynUzlc=",
+    "hash": "sha256-vk4GoCnXJ8Ep5/Y91npXogNcKqnchw+u0qH958+pCBw=",
     "homepage": "https://registry.terraform.io/providers/auth0/auth0",
     "owner": "auth0",
     "repo": "terraform-provider-auth0",
-    "rev": "v1.37.0",
+    "rev": "v1.38.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-6GejDtQg8CJqyDPsB2dS8dtBZha/5TNH3XNECuCgJAw="
   },
@@ -472,13 +472,13 @@
     "vendorHash": "sha256-mzDFyk2oImRXt72kFV5Ln++ScgoecpJEJtzUKjvCaws="
   },
   "grafana_grafana": {
-    "hash": "sha256-+LMaN6dmXSlFuu2jM/Ye1Pyut/TQ1zQ766y98hFQXHs=",
+    "hash": "sha256-gfS+sJREaObaXSgfVK7oUAgm05EqSRhiLauGP6V9Vhw=",
     "homepage": "https://registry.terraform.io/providers/grafana/grafana",
     "owner": "grafana",
     "repo": "terraform-provider-grafana",
-    "rev": "v4.21.0",
+    "rev": "v4.23.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-Nf0aUnV0jLNnXAbWkRYwG/DIqQwZ9fFlwwmE/cDMbGQ="
+    "vendorHash": "sha256-sP86GbNZUmltn5a7AREyw54Fa3eFNwW/lMIFZIEj/Bo="
   },
   "gridscale_gridscale": {
     "hash": "sha256-FAKvQ/MEod5Ck0PG4ffQ+gQp6zZ0JDRXPOrOiDpWMls=",
@@ -508,13 +508,13 @@
     "vendorHash": "sha256-Ce3ay7PGdv97fQQJjb3PHrvecv4g8vJ/HtSUHeUPqtU="
   },
   "hashicorp_awscc": {
-    "hash": "sha256-rqZULnv3FaewbLNe1PT+OmDpBRPxloAcn8Yvzj17hIc=",
+    "hash": "sha256-eJ4GiOkohhbuwsKtvoDlUM933F3Fd3b5HMLG3mjHBvA=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/awscc",
     "owner": "hashicorp",
     "repo": "terraform-provider-awscc",
-    "rev": "v1.67.0",
+    "rev": "v1.68.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-jRDBWDEjD07SerwcScIpWDqv8bEotVwRaqwSuXHKy7w="
+    "vendorHash": "sha256-udGQHfLQ/gc73ZhbO7Wko5MUhkeFpIvSGCDgPkYAG38="
   },
   "hashicorp_azuread": {
     "hash": "sha256-ATYOrBmZP9LximrS5KpfktU/kfW08XWShxE4z+x6Sts=",
@@ -923,13 +923,13 @@
     "vendorHash": "sha256-5cqj1O57snU+NoVqmWc/KIGnowQNMww+rJxYfIPvHWU="
   },
   "mongodb_mongodbatlas": {
-    "hash": "sha256-5OZUz3NxanfUZXaLGf4/IJXj4WnRJX4lXQMsraQxONI=",
+    "hash": "sha256-yVkhW1cYH+1biC1kUI6MdAK00QpiCyG/sGbOOxTEmm8=",
     "homepage": "https://registry.terraform.io/providers/mongodb/mongodbatlas",
     "owner": "mongodb",
     "repo": "terraform-provider-mongodbatlas",
-    "rev": "v2.3.0",
+    "rev": "v2.4.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-wbV68V083UGVoX0Hh3BfA9O9MqUxVLBRz4GXSaJ0vY0="
+    "vendorHash": "sha256-5xHm81ribxzdgSkMPAY7JEnlwf7wN/QGD8UyxUx2FOQ="
   },
   "namecheap_namecheap": {
     "hash": "sha256-fHH9sHI1mqQ9q9nX9DHJ0qfEfmDB4/2uzyVvUuIAF18=",
diff --git a/pkgs/applications/system/coolercontrol/coolercontrol-gui.nix b/pkgs/applications/system/coolercontrol/coolercontrol-gui.nix
index b9a2ae22ff67..5b87ee59497b 100644
--- a/pkgs/applications/system/coolercontrol/coolercontrol-gui.nix
+++ b/pkgs/applications/system/coolercontrol/coolercontrol-gui.nix
@@ -29,7 +29,11 @@ stdenv.mkDerivation {
     install -Dm644 "${src}/packaging/metadata/org.coolercontrol.CoolerControl.desktop" -t "$out/share/applications/"
     install -Dm644 "${src}/packaging/metadata/org.coolercontrol.CoolerControl.metainfo.xml" -t "$out/share/metainfo/"
     install -Dm644 "${src}/packaging/metadata/org.coolercontrol.CoolerControl.png" -t "$out/share/icons/hicolor/256x256/apps/"
+    install -Dm644 "${src}/packaging/metadata/org.coolercontrol.CoolerControl-alert.png" -t "$out/share/icons/hicolor/256x256/apps/"
     install -Dm644 "${src}/packaging/metadata/org.coolercontrol.CoolerControl.svg" -t "$out/share/icons/hicolor/scalable/apps/"
+    install -Dm644 "${src}/packaging/metadata/org.coolercontrol.CoolerControl-alert.svg" -t "$out/share/icons/hicolor/scalable/apps/"
+    install -Dm644 "${src}/packaging/metadata/org.coolercontrol.CoolerControl-symbolic.svg" -t "$out/share/icons/hicolor/symbolic/apps/"
+    install -Dm644 "${src}/packaging/metadata/org.coolercontrol.CoolerControl-symbolic-alert.svg" -t "$out/share/icons/hicolor/symbolic/apps/"
   '';
 
   meta = meta // {
diff --git a/pkgs/applications/system/coolercontrol/coolercontrol-ui-data.nix b/pkgs/applications/system/coolercontrol/coolercontrol-ui-data.nix
index 5a591c01e114..17aa677cb734 100644
--- a/pkgs/applications/system/coolercontrol/coolercontrol-ui-data.nix
+++ b/pkgs/applications/system/coolercontrol/coolercontrol-ui-data.nix
@@ -11,7 +11,7 @@ buildNpmPackage {
   inherit version src;
   sourceRoot = "${src.name}/coolercontrol-ui";
 
-  npmDepsHash = "sha256-pXK2wyRujUqnRZNIf/bDXpYdfEYHeia/E/jwLkfWwfo=";
+  npmDepsHash = "sha256-crkAK9k7wwbjiAQGBK584/29Zi0TZlljuASdvni8RkQ=";
 
   postBuild = ''
     cp -r dist $out
diff --git a/pkgs/applications/system/coolercontrol/coolercontrold.nix b/pkgs/applications/system/coolercontrol/coolercontrold.nix
index 1022560eeb1c..75142ec80f49 100644
--- a/pkgs/applications/system/coolercontrol/coolercontrold.nix
+++ b/pkgs/applications/system/coolercontrol/coolercontrold.nix
@@ -7,6 +7,7 @@
   addDriverRunpath,
   python3Packages,
   liquidctl,
+  protobuf,
 }:
 
 {
@@ -20,11 +21,12 @@ rustPlatform.buildRustPackage {
   inherit version src;
   sourceRoot = "${src.name}/coolercontrold";
 
-  cargoHash = "sha256-teKMz6ruTSwQ76dMXoupS3D7n1ashfHPpxMGo3Qm6FI=";
+  cargoHash = "sha256-5YYodScAAs6ERVbj+irvyNS9IOkVaBHR4DCXTrrtyVI=";
 
   buildInputs = [ libdrm ];
 
   nativeBuildInputs = [
+    protobuf
     addDriverRunpath
     python3Packages.wrapPython
   ];
diff --git a/pkgs/applications/system/coolercontrol/default.nix b/pkgs/applications/system/coolercontrol/default.nix
index 12b176cfdd8b..0aa095f4f763 100644
--- a/pkgs/applications/system/coolercontrol/default.nix
+++ b/pkgs/applications/system/coolercontrol/default.nix
@@ -5,13 +5,13 @@
 }:
 
 let
-  version = "3.0.2";
+  version = "3.1.1";
 
   src = fetchFromGitLab {
     owner = "coolercontrol";
     repo = "coolercontrol";
     rev = version;
-    hash = "sha256-puWnnNc3T/R+vPp3oyxP2aTHo1rZ5RWyW6KF6wywF1I=";
+    hash = "sha256-ocGW55z/cbO7uXWxiHoE798hN56fLlSgmZkO507eruY=";
   };
 
   meta = {
diff --git a/pkgs/by-name/ap/aptly/package.nix b/pkgs/by-name/ap/aptly/package.nix
index 0d355bd8d83b..3028101b0b06 100644
--- a/pkgs/by-name/ap/aptly/package.nix
+++ b/pkgs/by-name/ap/aptly/package.nix
@@ -65,8 +65,11 @@ buildGoModule (finalAttrs: {
     description = "Debian repository management tool";
     license = lib.licenses.mit;
     changelog = "https://github.com/aptly-dev/aptly/releases/tag/v${finalAttrs.version}";
-    maintainers = [ lib.maintainers.montag451 ];
-    teams = [ lib.teams.bitnomial ];
+    maintainers = with lib.maintainers; [
+      cdepillabout
+      montag451
+      wraithm
+    ];
     mainProgram = "aptly";
   };
 })
diff --git a/pkgs/by-name/as/ast-grep/package.nix b/pkgs/by-name/as/ast-grep/package.nix
index f138fc780d42..acf0467f76ce 100644
--- a/pkgs/by-name/as/ast-grep/package.nix
+++ b/pkgs/by-name/as/ast-grep/package.nix
@@ -11,13 +11,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ast-grep";
-  version = "0.40.4";
+  version = "0.40.5";
 
   src = fetchFromGitHub {
     owner = "ast-grep";
     repo = "ast-grep";
     tag = finalAttrs.version;
-    hash = "sha256-RPL7EpI4c0CA40s2MfkpmgQODqHtuCVx0dGnIYbZY5Y=";
+    hash = "sha256-O4f9PjGtwK6poFIbtz26q8q4fiYjfQEtobXmghQZAfw=";
   };
 
   # error: linker `aarch64-linux-gnu-gcc` not found
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rm .cargo/config.toml
   '';
 
-  cargoHash = "sha256-sFRSoJRlJRPv7NYIVivDGhG78oPpXHgBU6TdG8+7X/Y=";
+  cargoHash = "sha256-N5WrItW/yeZ+GDTw5yFy4eB11BzOlcuePGAefhJaG6I=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/cl/claude-code/package-lock.json b/pkgs/by-name/cl/claude-code/package-lock.json
index d2670c5023ad..d186c3ab5c02 100644
--- a/pkgs/by-name/cl/claude-code/package-lock.json
+++ b/pkgs/by-name/cl/claude-code/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@anthropic-ai/claude-code",
-  "version": "2.1.2",
+  "version": "2.1.5",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@anthropic-ai/claude-code",
-      "version": "2.1.2",
+      "version": "2.1.5",
       "license": "SEE LICENSE IN README.md",
       "bin": {
         "claude": "cli.js"
diff --git a/pkgs/by-name/cl/claude-code/package.nix b/pkgs/by-name/cl/claude-code/package.nix
index f932cd7f1816..3b988171acc6 100644
--- a/pkgs/by-name/cl/claude-code/package.nix
+++ b/pkgs/by-name/cl/claude-code/package.nix
@@ -6,19 +6,22 @@
   lib,
   buildNpmPackage,
   fetchzip,
+  procps,
   writableTmpDirAsHomeHook,
   versionCheckHook,
 }:
 buildNpmPackage (finalAttrs: {
   pname = "claude-code";
-  version = "2.1.2";
+  version = "2.1.5";
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${finalAttrs.version}.tgz";
-    hash = "sha256-PpNXyZ3xoZ/4lCvtErltkdsL/1hDRyiicblvhykgROw=";
+    hash = "sha256-hJECxkGC+nkQ6YCZpSZxRbuHaeYQDs2q7L5SYKSFVFc=";
   };
 
-  npmDepsHash = "sha256-KdVaAYXCy+oMN9b1lLeIRiGp/Zb29T4b3pvDp8O1v/M=";
+  npmDepsHash = "sha256-HjHBNa9gcGpo5qFb9CQvBH60qDM58WXJhClWRrzczBc=";
+
+  strictDeps = true;
 
   postPatch = ''
     cp ${./package-lock.json} package-lock.json
@@ -39,7 +42,12 @@ buildNpmPackage (finalAttrs: {
   postInstall = ''
     wrapProgram $out/bin/claude \
       --set DISABLE_AUTOUPDATER 1 \
-      --unset DEV
+      --unset DEV \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          procps # claude-code uses [node-tree-kill](https://github.com/pkrumins/node-tree-kill) which requires procps's pgrep(darwin) or ps(linux)
+        ]
+      }
   '';
 
   doInstallCheck = true;
diff --git a/pkgs/by-name/co/codebook/package.nix b/pkgs/by-name/co/codebook/package.nix
index 07826b559f4e..8604d826bf12 100644
--- a/pkgs/by-name/co/codebook/package.nix
+++ b/pkgs/by-name/co/codebook/package.nix
@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "codebook";
-  version = "0.3.23";
+  version = "0.3.28";
 
   src = fetchFromGitHub {
     owner = "blopker";
     repo = "codebook";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-msd0y6+MXyrcJ7F5X8LP23Q/VcVSeO8VRqCJlidhkqo=";
+    hash = "sha256-iYQy0uupRoNkBwlvykicGcRIpZftrpDOQaKzFoG+JgI=";
   };
 
   buildAndTestSubdir = "crates/codebook-lsp";
-  cargoHash = "sha256-NoqF1qos9/0aNhisrHupQBvR0Vxpng9o5xBgoSOWlr4=";
+  cargoHash = "sha256-jW2HQxoTZ+1x2j+fVHm1K1TU9TB9wGuEm7D9Fn2Xnac=";
 
   CARGO_PROFILE_RELEASE_LTO = "fat";
   CARGO_PROFILE_RELEASE_CODEGEN_UNITS = "1";
diff --git a/pkgs/by-name/do/dokieli/package.nix b/pkgs/by-name/do/dokieli/package.nix
index 33fe4b003c83..0ff533020f93 100644
--- a/pkgs/by-name/do/dokieli/package.nix
+++ b/pkgs/by-name/do/dokieli/package.nix
@@ -16,19 +16,19 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "dokieli";
-  version = "0-unstable-2025-12-16";
+  version = "0-unstable-2026-01-10";
 
   src = fetchFromGitHub {
     owner = "dokieli";
     repo = "dokieli";
-    rev = "5a9fa93eb670f79bb350e44c8fa850f42893a8ee";
-    hash = "sha256-zqr30yjhPqpY8Iv7/Jq77iWjHiDRtEguULwtmQ13xr4=";
+    rev = "c5645be3b80e98363c030da7424a53250742d989";
+    hash = "sha256-trYpk4NHYjboISMFMcQMLvdNFlrHgx4uoGcmmUaG+PI=";
   };
 
   missingHashes = ./missing-hashes.json;
   offlineCache = yarn-berry.fetchYarnBerryDeps {
     inherit (finalAttrs) src missingHashes;
-    hash = "sha256-JJ4AtggWyTjyLtZwTn6oxj1fgRd3Itv9S1/gB3XlSOI=";
+    hash = "sha256-vPC+GVdNfYUOKTmLO+2/eC6mEGJuqebqAbe3X3iIySI=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/ev/everest-bin/package.nix b/pkgs/by-name/ev/everest-bin/package.nix
index 820d35b4c046..7981f9df002d 100644
--- a/pkgs/by-name/ev/everest-bin/package.nix
+++ b/pkgs/by-name/ev/everest-bin/package.nix
@@ -8,15 +8,15 @@
 
 let
   pname = "everest";
-  version = "6088";
+  version = "6129";
   phome = "$out/lib/Celeste";
 in
 stdenvNoCC.mkDerivation {
   inherit pname version;
   src = fetchzip {
-    url = "https://github.com/EverestAPI/Everest/releases/download/stable-1.6088.0/main.zip";
+    url = "https://github.com/EverestAPI/Everest/releases/download/stable-1.6129.0/main.zip";
     extension = "zip";
-    hash = "sha256-npcjx7KOCe8T4MyK1d8Z485+XlvkMgjJ5m0PN5TbpgU=";
+    hash = "sha256-6Pvnvt7ZVQRIKpyBZt18rcqy8DL42WGhR7IF2O9zFLc=";
   };
   buildInputs = [
     icu
diff --git a/pkgs/by-name/ev/everest/package.nix b/pkgs/by-name/ev/everest/package.nix
index da5570875879..d33b7a1d7dd7 100644
--- a/pkgs/by-name/ev/everest/package.nix
+++ b/pkgs/by-name/ev/everest/package.nix
@@ -11,7 +11,7 @@
 
 let
   pname = "everest";
-  version = "6088";
+  version = "6129";
   phome = "$out/lib/Celeste";
 in
 buildDotnetModule {
@@ -20,11 +20,11 @@ buildDotnetModule {
   src = fetchFromGitHub {
     owner = "EverestAPI";
     repo = "Everest";
-    rev = "d7bc4c2716b747d243fa4347b98422766b3d8b5a";
+    rev = "04aa4228786ba8448455f1962f9714c08ad28383";
     fetchSubmodules = true;
     # TODO: use leaveDotGit = true and modify external/MonoMod in postFetch to please SourceLink
     # Microsoft.SourceLink.Common.targets(53,5): warning : Source control information is not available - the generated source link is empty.
-    hash = "sha256-aCeqEqSxpLZjO8xskjcBjrKOFFGun1TxK88P2VO6BEg=";
+    hash = "sha256-p/zcqqKOwqumEY6RRH26FV3j7VQ3q2uFWm6IBEtLrgA=";
   };
 
   nativeBuildInputs = [ autoPatchelfHook ];
diff --git a/pkgs/by-name/fa/fastfetch/package.nix b/pkgs/by-name/fa/fastfetch/package.nix
index 22885b8d5e51..76bbbeeb9305 100644
--- a/pkgs/by-name/fa/fastfetch/package.nix
+++ b/pkgs/by-name/fa/fastfetch/package.nix
@@ -59,13 +59,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "fastfetch";
-  version = "2.56.1";
+  version = "2.57.0";
 
   src = fetchFromGitHub {
     owner = "fastfetch-cli";
     repo = "fastfetch";
     tag = finalAttrs.version;
-    hash = "sha256-loTEadHPhE0b7VYCq2Lh+FKKnqzc4kzWFkHLnTjFsBg=";
+    hash = "sha256-bdzD+od+KyEqkFixqGf/7O//1nHO9i0jzg65NRDIN7I=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/fl/flashrom/package.nix b/pkgs/by-name/fl/flashrom/package.nix
index 936c536ac226..bce0af5e1847 100644
--- a/pkgs/by-name/fl/flashrom/package.nix
+++ b/pkgs/by-name/fl/flashrom/package.nix
@@ -56,6 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   mesonFlags = [
+    (lib.mesonBool "werror" false)
     (lib.mesonOption "programmer" "auto")
     (lib.mesonEnable "man-pages" true)
     (lib.mesonEnable "tests" (!stdenv.buildPlatform.isDarwin))
diff --git a/pkgs/by-name/fo/fonttosfnt/package.nix b/pkgs/by-name/fo/fonttosfnt/package.nix
index f7228391f4f9..10176a54726b 100644
--- a/pkgs/by-name/fo/fonttosfnt/package.nix
+++ b/pkgs/by-name/fo/fonttosfnt/package.nix
@@ -12,7 +12,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "fonttosfnt";
-  version = "1.2.4";
+  version = "1.2.5";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
@@ -20,7 +20,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "app";
     repo = "fonttosfnt";
     tag = "fonttosfnt-${finalAttrs.version}";
-    hash = "sha256-DPPouSLsPurJ7fscxraF9HEYENbuCvZcxZ44bBY7ytU=";
+    hash = "sha256-W516e6ChCyvyjW4AT5DKzg12s+up0fO5UMDedAcO68o=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/go/goat/package.nix b/pkgs/by-name/go/goat/package.nix
index 3c8a041dce8d..5b02883e98ea 100644
--- a/pkgs/by-name/go/goat/package.nix
+++ b/pkgs/by-name/go/goat/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "goat";
-  version = "0.5.0";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = "blampe";
     repo = "goat";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-+x+bOgNa9nOMWUMUVK816DK7f4SuoWEbRr2OZ+iSPig=";
+    hash = "sha256-aWfopBdr5YC/nksp4wi32OUPUR1vPp36FLlMVSMi4/8=";
   };
 
   vendorHash = "sha256-RRjEFZLbfeiFUWjGZI4HSZ8PhVj1IMlU5D4Nb1sexoQ=";
diff --git a/pkgs/by-name/gq/gqlgen/package.nix b/pkgs/by-name/gq/gqlgen/package.nix
index d07cb5e6d95b..6ca341cd8ed4 100644
--- a/pkgs/by-name/gq/gqlgen/package.nix
+++ b/pkgs/by-name/gq/gqlgen/package.nix
@@ -6,7 +6,7 @@
 }:
 
 let
-  version = "0.17.85";
+  version = "0.17.86";
 in
 buildGoModule {
   pname = "gqlgen";
@@ -16,10 +16,10 @@ buildGoModule {
     owner = "99designs";
     repo = "gqlgen";
     tag = "v${version}";
-    hash = "sha256-U2qbOjWUE1MfrMJTVaB59Osax8B6CKMlk6uqGioVgBk=";
+    hash = "sha256-3lN/hW2LpLUmm+w31XWOJb7rP3Wyk054WcKVwwQ8afs=";
   };
 
-  vendorHash = "sha256-9rBdr1fP5LKioz2c6lAZEdcDnG2JL2CO1VXK5+MwGEs=";
+  vendorHash = "sha256-mOLFcbodgEn86ZV3mDeoBjoDVlYLo+7Gz930pi/KqAI=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/gr/grafana-dash-n-grab/package.nix b/pkgs/by-name/gr/grafana-dash-n-grab/package.nix
index 62b268b52d69..6b79a75e607c 100644
--- a/pkgs/by-name/gr/grafana-dash-n-grab/package.nix
+++ b/pkgs/by-name/gr/grafana-dash-n-grab/package.nix
@@ -32,7 +32,10 @@ buildGoModule rec {
     description = "Grafana Dash-n-Grab (gdg) -- backup and restore Grafana dashboards, datasources, and other entities";
     license = lib.licenses.bsd3;
     homepage = "https://github.com/esnet/gdg";
-    teams = [ lib.teams.bitnomial ];
+    maintainers = with lib.maintainers; [
+      cdepillabout
+      wraithm
+    ];
     mainProgram = "gdg";
     changelog = "https://github.com/esnet/gdg/releases/tag/v${version}";
   };
diff --git a/pkgs/by-name/ha/harfbuzz/package.nix b/pkgs/by-name/ha/harfbuzz/package.nix
index 9bc4691a6628..cebf23db0247 100644
--- a/pkgs/by-name/ha/harfbuzz/package.nix
+++ b/pkgs/by-name/ha/harfbuzz/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
   pkg-config,
   glib,
   freetype,
@@ -41,6 +42,15 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-hmDr08J9lAf8hDO10XK6+6XwMXywu0M58o5TcMk9Qrc=";
   };
 
+  patches = [
+    (fetchpatch {
+      # https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-xvjr-f2r9-c7ww
+      name = "CVE-2026-22693.patch";
+      url = "https://github.com/harfbuzz/harfbuzz/commit/1265ff8d990284f04d8768f35b0e20ae5f60daae.patch";
+      hash = "sha256-mdgIhp1ndPSfzplBRB7s+BN2T5Z9dEYZ0bAmSDCUPSE=";
+    })
+  ];
+
   postPatch = ''
     patchShebangs src/*.py test
   ''
diff --git a/pkgs/by-name/ka/kardolus-chatgpt-cli/package.nix b/pkgs/by-name/ka/kardolus-chatgpt-cli/package.nix
index 168855ce1429..e2aff916f127 100644
--- a/pkgs/by-name/ka/kardolus-chatgpt-cli/package.nix
+++ b/pkgs/by-name/ka/kardolus-chatgpt-cli/package.nix
@@ -9,18 +9,18 @@ buildGoModule (finalAttrs: {
   # "chatgpt-cli" is taken by another package with the same upsteam name.
   # To keep "pname" and "package attribute name" identical, the owners name (kardolus) gets prefixed as identifier.
   pname = "kardolus-chatgpt-cli";
-  version = "1.9.0";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "kardolus";
     repo = "chatgpt-cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Ya8Ttud9sJ94jdZK7LctGI5kcHcIonzcmsAteelkLYY=";
+    hash = "sha256-qyKnafCj+THXV8Lbgt6VSLfUbUc5uaeaaakWthnEguU=";
   };
 
   vendorHash = null;
   # The tests of kardolus/chatgpt-cli require an OpenAI API Key to be present in the environment,
-  # (e.g. https://github.com/kardolus/chatgpt-cli/blob/v1.9.0/test/contract/contract_test.go#L35)
+  # (e.g. https://github.com/kardolus/chatgpt-cli/blob/v1.10.0/test/contract/contract_test.go#L35)
   # which will not be the case in the pipeline.
   # Therefore, tests must be skipped.
   doCheck = false;
diff --git a/pkgs/by-name/le/ledfx/package.nix b/pkgs/by-name/le/ledfx/package.nix
index 4d4ac302d230..1443ba9f7a0d 100644
--- a/pkgs/by-name/le/ledfx/package.nix
+++ b/pkgs/by-name/le/ledfx/package.nix
@@ -85,7 +85,7 @@ python3.pkgs.buildPythonApplication rec {
     homepage = "https://github.com/LedFx/LedFx";
     changelog = "https://github.com/LedFx/LedFx/blob/${version}/CHANGELOG.rst";
     license = lib.licenses.gpl3Only;
-    teams = [ lib.teams.c3d2 ];
+    maintainers = with lib.maintainers; [ SuperSandro2000 ];
     mainProgram = "ledfx";
   };
 }
diff --git a/pkgs/by-name/li/libmpeg2/getopt-getenv-signatures.patch b/pkgs/by-name/li/libmpeg2/getopt-getenv-signatures.patch
new file mode 100644
index 000000000000..881f11882371
--- /dev/null
+++ b/pkgs/by-name/li/libmpeg2/getopt-getenv-signatures.patch
@@ -0,0 +1,26 @@
+diff --git a/src/getopt.c b/src/getopt.c
+index 4744e43..19776f3 100644
+--- a/src/getopt.c
++++ b/src/getopt.c
+@@ -208,7 +208,7 @@ static char *posixly_correct;
+    whose names are inconsistent.  */
+ 
+ #ifndef getenv
+-extern char *getenv ();
++extern char *getenv (const char *);
+ #endif
+ 
+ static char *
+diff --git a/src/getopt.h b/src/getopt.h
+index b0147e9..6f1e784 100644
+--- a/src/getopt.h
++++ b/src/getopt.h
+@@ -133,7 +133,7 @@ struct option
+    errors, only prototype getopt for the GNU C library.  */
+ extern int getopt (int __argc, char *const *__argv, const char *__shortopts);
+ # else /* not __GNU_LIBRARY__ */
+-extern int getopt ();
++extern int getopt (int, char *const*, const char *);
+ # endif /* __GNU_LIBRARY__ */
+ 
+ # ifndef __need_getopt
diff --git a/pkgs/by-name/li/libmpeg2/package.nix b/pkgs/by-name/li/libmpeg2/package.nix
index 7860056707ca..4242f5c2edd5 100644
--- a/pkgs/by-name/li/libmpeg2/package.nix
+++ b/pkgs/by-name/li/libmpeg2/package.nix
@@ -13,6 +13,11 @@ stdenv.mkDerivation rec {
     sha256 = "1m3i322n2fwgrvbs1yck7g5md1dbg22bhq5xdqmjpz5m7j4jxqny";
   };
 
+  patches = [
+    # Fixes mismatching definitions with C23 / GCC15 on non-glibc platforms
+    ./getopt-getenv-signatures.patch
+  ];
+
   # Otherwise clang fails with 'duplicate symbol ___sputc'
   buildFlags = lib.optional stdenv.hostPlatform.isDarwin "CFLAGS=-std=gnu89";
 
diff --git a/pkgs/by-name/li/libphonenumber/cmake-include-dir.patch b/pkgs/by-name/li/libphonenumber/cmake-include-dir.patch
new file mode 100644
index 000000000000..59de2beb6480
--- /dev/null
+++ b/pkgs/by-name/li/libphonenumber/cmake-include-dir.patch
@@ -0,0 +1,34 @@
+--- a/cpp/CMakeLists.txt
++++ b/cpp/CMakeLists.txt
+@@ -458,12 +458,12 @@ if (BUILD_STATIC_LIB)
+   # Build a static library (without -fPIC).
+   add_library (phonenumber STATIC ${SOURCES})
+   target_link_libraries (phonenumber ${LIBRARY_DEPS})
+-  target_include_directories(phonenumber PUBLIC $<INSTALL_INTERFACE:include>)
++  target_include_directories(phonenumber PUBLIC $<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>)
+
+   if (BUILD_GEOCODER)
+     add_library (geocoding STATIC ${GEOCODING_SOURCES})
+     target_link_libraries (geocoding ${LIBRARY_DEPS})
+-    target_include_directories(geocoding PUBLIC $<INSTALL_INTERFACE:include>)
++    target_include_directories(geocoding PUBLIC $<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>)
+     add_dependencies (geocoding generate_geocoding_data)
+     add_dependencies (phonenumber generate_geocoding_data)
+   endif ()
+@@ -478,7 +478,7 @@ if (BUILD_SHARED_LIBS)
+   # Build a shared library (with -fPIC).
+   add_library (phonenumber-shared SHARED ${SOURCES})
+   target_link_libraries (phonenumber-shared ${LIBRARY_DEPS})
+-  target_include_directories(phonenumber-shared PUBLIC $<INSTALL_INTERFACE:include>)
++  target_include_directories(phonenumber-shared PUBLIC $<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>)
+
+   set_target_properties (phonenumber-shared
+     PROPERTIES
+@@ -494,7 +494,7 @@ if (BUILD_SHARED_LIBS)
+   if (BUILD_GEOCODER)
+     add_library (geocoding-shared SHARED ${GEOCODING_SOURCES})
+     target_link_libraries (geocoding-shared ${LIBRARY_DEPS})
+-    target_include_directories(geocoding-shared PUBLIC $<INSTALL_INTERFACE:include>)
++    target_include_directories(geocoding-shared PUBLIC $<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>)
+     add_dependencies (geocoding-shared generate_geocoding_data)
+     add_dependencies (phonenumber-shared generate_geocoding_data)
\ No newline at end of file
diff --git a/pkgs/by-name/li/libphonenumber/package.nix b/pkgs/by-name/li/libphonenumber/package.nix
index 47887927a754..e334b09f1232 100644
--- a/pkgs/by-name/li/libphonenumber/package.nix
+++ b/pkgs/by-name/li/libphonenumber/package.nix
@@ -28,6 +28,13 @@ stdenv.mkDerivation (finalAttrs: {
     # An earlier version of this patch was submitted upstream but did not get
     # any interest there - https://github.com/google/libphonenumber/pull/2921
     ./build-reproducibility.patch
+    # Fix include directory in generated cmake files with split outputs
+    ./cmake-include-dir.patch
+  ];
+
+  outputs = [
+    "out"
+    "dev"
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/librespeed-rust/package.nix b/pkgs/by-name/li/librespeed-rust/package.nix
index 345526b093d2..69d0417a1782 100644
--- a/pkgs/by-name/li/librespeed-rust/package.nix
+++ b/pkgs/by-name/li/librespeed-rust/package.nix
@@ -30,7 +30,7 @@ rustPlatform.buildRustPackage rec {
     description = "Very lightweight speed test implementation in Rust";
     homepage = "https://github.com/librespeed/speedtest-rust";
     license = lib.licenses.lgpl3Plus;
-    teams = with lib.teams; [ c3d2 ];
+    maintainers = with lib.maintainers; [ SuperSandro2000 ];
     mainProgram = "librespeed-rs";
   };
 }
diff --git a/pkgs/by-name/ma/macmon/package.nix b/pkgs/by-name/ma/macmon/package.nix
index e4e42878e4a1..87b15ec309e3 100644
--- a/pkgs/by-name/ma/macmon/package.nix
+++ b/pkgs/by-name/ma/macmon/package.nix
@@ -2,26 +2,34 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
+  versionCheckHook,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "macmon";
   version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "vladkens";
     repo = "macmon";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-GiSF5PBRUcKZzd9vWf9MmKKZbtqchnu0DjFgbXmp7bg=";
   };
 
   cargoHash = "sha256-b9CpHSC3/kj7lHs+QhDqnRZfda9rtJJEs3j24NDZSPQ=";
 
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+
   meta = {
-    homepage = "https://github.com/vladkens/macmon";
     description = "Sudoless performance monitoring for Apple Silicon processors";
+    homepage = "https://github.com/vladkens/macmon";
+    changelog = "https://github.com/vladkens/macmon/releases/tag/${finalAttrs.src.tag}";
     platforms = [ "aarch64-darwin" ];
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ schrobingus ];
+    mainProgram = "macmon";
   };
-}
+})
diff --git a/pkgs/by-name/ma/matrix-synapse-unwrapped/plugins/ldap3.nix b/pkgs/by-name/ma/matrix-synapse-unwrapped/plugins/ldap3.nix
index c520f6e30e51..a5ffbdf837f2 100644
--- a/pkgs/by-name/ma/matrix-synapse-unwrapped/plugins/ldap3.nix
+++ b/pkgs/by-name/ma/matrix-synapse-unwrapped/plugins/ldap3.nix
@@ -41,6 +41,6 @@ buildPythonPackage rec {
     description = "LDAP3 auth provider for Synapse";
     homepage = "https://github.com/matrix-org/matrix-synapse-ldap3";
     license = lib.licenses.asl20;
-    teams = [ lib.teams.c3d2 ];
+    maintainers = with lib.maintainers; [ SuperSandro2000 ];
   };
 }
diff --git a/pkgs/by-name/me/mediagoblin/package.nix b/pkgs/by-name/me/mediagoblin/package.nix
index 43cc073f3ded..f9a71182c4ca 100644
--- a/pkgs/by-name/me/mediagoblin/package.nix
+++ b/pkgs/by-name/me/mediagoblin/package.nix
@@ -175,6 +175,6 @@ python.pkgs.buildPythonApplication rec {
     description = "Free software media publishing platform that anyone can run";
     homepage = "https://mediagoblin.org/";
     license = lib.licenses.agpl3Plus;
-    teams = [ lib.teams.c3d2 ];
+    teams = with lib.maintainers; [ SuperSandro2000 ];
   };
 }
diff --git a/pkgs/by-name/me/mediawiki/package.nix b/pkgs/by-name/me/mediawiki/package.nix
index 1d5a58c1ecec..44d2c3a23a54 100644
--- a/pkgs/by-name/me/mediawiki/package.nix
+++ b/pkgs/by-name/me/mediawiki/package.nix
@@ -40,6 +40,6 @@ stdenvNoCC.mkDerivation rec {
     license = lib.licenses.gpl2Plus;
     homepage = "https://www.mediawiki.org/";
     platforms = lib.platforms.all;
-    teams = [ lib.teams.c3d2 ];
+    teams = with lib.maintainers; [ SuperSandro2000 ];
   };
 }
diff --git a/pkgs/by-name/nc/ncpamixer/package.nix b/pkgs/by-name/nc/ncpamixer/package.nix
index 58559d74d03b..63bd4f94fd5c 100644
--- a/pkgs/by-name/nc/ncpamixer/package.nix
+++ b/pkgs/by-name/nc/ncpamixer/package.nix
@@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/fulhax/ncpamixer";
     license = lib.licenses.mit;
     platforms = lib.platforms.linux;
-    teams = [ lib.teams.c3d2 ];
+    maintainers = with lib.maintainers; [ SuperSandro2000 ];
     mainProgram = "ncpamixer";
   };
 }
diff --git a/pkgs/by-name/ne/netgen-vlsi/package.nix b/pkgs/by-name/ne/netgen-vlsi/package.nix
new file mode 100644
index 000000000000..f878476fd6cf
--- /dev/null
+++ b/pkgs/by-name/ne/netgen-vlsi/package.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  tcl,
+  tk,
+  m4,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "netgen";
+  version = "1.5.314";
+
+  src = fetchFromGitHub {
+    owner = "RTimothyEdwards";
+    repo = "netgen";
+    tag = finalAttrs.version;
+    hash = "sha256-g8d/faYjhL6WXSShqWn9n+4cUJ8qKtqyEgyIRsrHo5o=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    m4
+  ];
+
+  buildInputs = [
+    tcl
+    tk
+  ];
+
+  env.NIX_CFLAGS_COMPILE = "-std=gnu89";
+
+  configureFlags = [
+    "--with-tcl=${lib.getLib tcl}/lib"
+    "--with-tk=${lib.getLib tk}/lib"
+  ];
+
+  # Netgen generates a wrapper script with a hardcoded /bin/bash shebang.
+  # We fix it here because patchShebangs sometimes misses it in post-install.
+  postFixup = ''
+    sed -i "1s|#!/bin/bash|#!${stdenv.shell}|" $out/bin/netgen
+  '';
+
+  meta = {
+    description = "LVS tool for VLSI circuit netlists";
+    mainProgram = "netgen";
+    homepage = "https://github.com/RTimothyEdwards/netgen";
+    license = lib.licenses.gpl1Only;
+    maintainers = [ lib.maintainers.gonsolo ];
+  };
+})
diff --git a/pkgs/by-name/nz/nzbhydra2/lombok-compiler-annotation.patch b/pkgs/by-name/nz/nzbhydra2/lombok-compiler-annotation.patch
deleted file mode 100644
index 407f4c8c7908..000000000000
--- a/pkgs/by-name/nz/nzbhydra2/lombok-compiler-annotation.patch
+++ /dev/null
@@ -1,25 +0,0 @@
---- a/pom.xml	1970-01-01 01:00:01.000000000 +0100
-+++ b/pom.xml	2025-12-02 21:04:01.739489000 +0100
-@@ -74,12 +74,13 @@
-                 <version>3.10.1</version>
-                 <configuration>
-                     <compilerArgs>
-                         <arg>-parameters</arg>
-+                      <arg>-proc:full</arg>
-                     </compilerArgs>
-                     <source>17</source>
-                     <target>17</target>
-                 </configuration>
-             </plugin>
-         </plugins>
-     </build>
- 
-@@ -108,7 +109,7 @@
-         <spring-data-commons.version>3.1.5</spring-data-commons.version>
-         <jakarta.persistence-api.version>3.1.0</jakarta.persistence-api.version>
-         <jackson.version>2.15.0</jackson.version>
--        <lombok.version>1.18.30</lombok.version>
-+        <lombok.version>1.18.42</lombok.version>
-         <logback.version>1.5.21</logback.version>
-         <guava.version>23.0</guava.version>
-         <junit.version>4.13.2</junit.version>
diff --git a/pkgs/by-name/nz/nzbhydra2/maven-plugin-scope.patch b/pkgs/by-name/nz/nzbhydra2/maven-plugin-scope.patch
new file mode 100644
index 000000000000..7dcc28b2e516
--- /dev/null
+++ b/pkgs/by-name/nz/nzbhydra2/maven-plugin-scope.patch
@@ -0,0 +1,10 @@
+--- a/other/github-release-plugin/pom.xml	1970-01-01 01:00:01.000000000 +0100
++++ b/other/github-release-plugin/pom.xml	2026-01-11 00:23:47.212158113 +0100
+@@ -126,7 +133,6 @@
+                             <groupId>org.projectlombok</groupId>
+                             <artifactId>lombok</artifactId>
+                             <version>1.18.30</version>
+-                            <scope>provided</scope>
+                         </path>
+                     </annotationProcessorPaths>
+                 </configuration>
diff --git a/pkgs/by-name/nz/nzbhydra2/package.nix b/pkgs/by-name/nz/nzbhydra2/package.nix
index c4d7ec57773e..ab80b6c0b1e1 100644
--- a/pkgs/by-name/nz/nzbhydra2/package.nix
+++ b/pkgs/by-name/nz/nzbhydra2/package.nix
@@ -6,6 +6,8 @@
   maven,
   fetchFromGitHub,
   jdk,
+  nix-update-script,
+  xmlstarlet,
 }:
 
 # Skip some plugins not required for NixOS packaging to reduce required dependencies.
@@ -23,53 +25,41 @@ let
       "tests"
     ]
   },!org.nzbhydra.tests:system";
+
+  timestampParameter = "-Dproject.build.outputTimestamp=1980-01-01T00:00:02Z";
+
+  parameters = lib.concatStringsSep " " [
+    projectFilter
+    timestampParameter
+  ];
 in
 maven.buildMavenPackage rec {
   pname = "nzbhydra2";
-  version = "8.1.2";
+  version = "8.2.2";
 
   src = fetchFromGitHub {
     owner = "theotherp";
     repo = pname;
     tag = "v${version}";
-    hash = "sha256-BD9bvbPaVz3MJam78EHqfFc9jbh1SpkIxTe0UK8Lh0w=";
+    hash = "sha256-aUaPzfP4PPX08DZxbDhy7U/qH37ddR9jWtt+pt7BqCI=";
   };
 
-  patches = [
-    # Older lombok versions are incompatible with newer JDK versions.
-    ./lombok-compiler-annotation.patch
-  ];
+  mvnHash = "sha256-02Fj7Rv0kGmO7ysHWMjE7qlwFY3G+hQzjXvrvRG/2M8=";
 
-  buildOffline = true;
+  mvnFetchExtraArgs.preBuild = ''
+    mvn -nsu "${timestampParameter}" --projects org.nzbhydra:github-release-plugin "-Dmaven.repo.local=$out/.m2" clean install
+  '';
+
+  mvnFetchExtraArgs.postInstall = ''
+    ${lib.getExe xmlstarlet} ed -L -u "/metadata/versioning/lastUpdated" -v "0" $out/.m2/org/nzbhydra/github-release-plugin/maven-metadata-local.xml
+  '';
 
   mvnJdk = jdk;
 
-  mvnHash = "sha256-SXanl43Fpd7IdhuD1H2LpB5BwvzbbjRNyZYzBvV1XXY=";
-
-  manualMvnArtifacts = [
-    "org.springframework.boot:spring-boot-maven-plugin:4.0.0"
-
-    "org.apache.maven.plugins:maven-antrun-plugin:3.1.0"
-    "org.apache.maven.plugins:maven-dependency-plugin:3.7.0"
-    "org.apache.maven.plugins:maven-release-plugin:3.0.1"
-    "org.apache.maven.plugins:maven-plugin-plugin:3.7.1"
-    "org.apache.maven.plugins:maven-install-plugin:3.1.4"
-
-    # Dependencies for building and running tests are included below.
-    # The set of dependencies for successfully building and running the tests is different.
-    # For simplicity all dependencies are included here, independently of whether we're running the tests.
-    "org.apache.maven.plugins:maven-surefire-plugin:2.22.2"
-    "org.apache.maven.surefire:surefire-junit4:3.0.0-M2"
-    "org.apache.maven.surefire:surefire-junit-platform:2.22.2"
-    "org.apache.maven.surefire:surefire-junit-platform:3.0.0-M2"
-    "org.apache.maven.surefire:surefire-junit-platform:3.2.5"
-    "org.junit.platform:junit-platform-surefire-provider:1.3.2"
-  ];
-
   doCheck = true;
 
-  mvnDepsParameters = projectFilter;
-  mvnParameters = projectFilter;
+  mvnDepsParameters = parameters;
+  mvnParameters = parameters;
 
   nativeBuildInputs = [
     makeWrapper
@@ -90,8 +80,11 @@ maven.buildMavenPackage rec {
     runHook postInstall
   '';
 
-  passthru.tests = {
-    inherit (nixosTests) nzbhydra2;
+  passthru = {
+    tests = {
+      inherit (nixosTests) nzbhydra2;
+    };
+    updateScript = nix-update-script { };
   };
 
   meta = {
diff --git a/pkgs/by-name/op/opensp/package.nix b/pkgs/by-name/op/opensp/package.nix
index 45f5c89e702f..d376fbe329dd 100644
--- a/pkgs/by-name/op/opensp/package.nix
+++ b/pkgs/by-name/op/opensp/package.nix
@@ -31,6 +31,11 @@ stdenv.mkDerivation rec {
       url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/app-text/opensp/files/opensp-1.5.2-c11-using.patch?id=688d9675782dfc162d4e6cff04c668f7516118d0";
       sha256 = "04q14s8qsad0bkjmj067dn831i0r6v7742rafdlnbfm5y249m2q6";
     })
+    (fetchpatch {
+      name = "opensp-1.5.2-gcc15-musl.patch";
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/app-text/opensp/files/opensp-1.5.2-gcc15-musl.patch?id=7143f4a01836f8991d6c90b61fa919e88bf9a0fd";
+      hash = "sha256-6pNsVh3BErAN4lyykhFJqCydplh4cVvxgwc5MuWFd+A=";
+    })
     # Clang 16 defaults to C++17, which does not allow `register` as a storage class specifier.
     ./fix-register-storage-class.patch
   ];
diff --git a/pkgs/by-name/op/openwebrx/package.nix b/pkgs/by-name/op/openwebrx/package.nix
index 4707d53e4e27..9f8872f01847 100644
--- a/pkgs/by-name/op/openwebrx/package.nix
+++ b/pkgs/by-name/op/openwebrx/package.nix
@@ -40,7 +40,6 @@ let
       homepage = "https://github.com/jketterl/js8py";
       description = "Library to decode the output of the js8 binary of JS8Call";
       license = lib.licenses.gpl3Only;
-      teams = with lib.teams; [ c3d2 ];
     };
   };
 
@@ -83,7 +82,6 @@ let
       description = "Set of connectors that are used by OpenWebRX to interface with SDR hardware";
       license = lib.licenses.gpl3Only;
       platforms = lib.platforms.unix;
-      teams = with lib.teams; [ c3d2 ];
     };
   };
 
@@ -136,6 +134,5 @@ python3Packages.buildPythonApplication rec {
     description = "Simple DSP library and command-line tool for Software Defined Radio";
     mainProgram = "openwebrx";
     license = lib.licenses.gpl3Only;
-    teams = with lib.teams; [ c3d2 ];
   };
 }
diff --git a/pkgs/by-name/po/portunus/package.nix b/pkgs/by-name/po/portunus/package.nix
index 34a305a3affc..156b033bd2ed 100644
--- a/pkgs/by-name/po/portunus/package.nix
+++ b/pkgs/by-name/po/portunus/package.nix
@@ -28,7 +28,9 @@ buildGoModule rec {
     homepage = "https://github.com/majewsky/portunus";
     license = lib.licenses.gpl3Plus;
     platforms = lib.platforms.linux;
-    maintainers = with lib.maintainers; [ majewsky ];
-    teams = [ lib.teams.c3d2 ];
+    maintainers = with lib.maintainers; [
+      majewsky
+      SuperSandro2000
+    ];
   };
 }
diff --git a/pkgs/by-name/pr/pretalx/package.nix b/pkgs/by-name/pr/pretalx/package.nix
index 16422945d960..c9db67140ba9 100644
--- a/pkgs/by-name/pr/pretalx/package.nix
+++ b/pkgs/by-name/pr/pretalx/package.nix
@@ -42,8 +42,10 @@ let
     homepage = "https://github.com/pretalx/pretalx";
     changelog = "https://docs.pretalx.org/changelog/#${version}";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ hexa ];
-    teams = [ lib.teams.c3d2 ];
+    maintainers = with lib.maintainers; [
+      hexa
+      SuperSandro2000
+    ];
     platforms = lib.platforms.linux;
   };
 
diff --git a/pkgs/by-name/pr/proton-pass-cli/package.nix b/pkgs/by-name/pr/proton-pass-cli/package.nix
index 18d28fe8f27e..d13608ae3ffe 100644
--- a/pkgs/by-name/pr/proton-pass-cli/package.nix
+++ b/pkgs/by-name/pr/proton-pass-cli/package.nix
@@ -14,7 +14,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "proton-pass-cli";
-  version = "1.3.2";
+  version = "1.3.3";
 
   src = finalAttrs.passthru.sources.${stdenv.hostPlatform.system};
 
@@ -47,19 +47,19 @@ stdenv.mkDerivation (finalAttrs: {
     sources = {
       "aarch64-darwin" = fetchurl {
         url = "https://proton.me/download/pass-cli/${finalAttrs.version}/pass-cli-macos-aarch64";
-        hash = "sha256-B+hmxagP5Ls+Jc8DZN8Y9fvdrTq+HkMICUzMVsd8aU4=";
+        hash = "sha256-JPjJsbPvmJ83gOw9xy7QEStY/00X9acHukOx6W/M8YM=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://proton.me/download/pass-cli/${finalAttrs.version}/pass-cli-linux-aarch64";
-        hash = "sha256-w5mwbYQgqAU07T4+vUaYkcVp8XtMFNynGTV3jJQjAFw=";
+        hash = "sha256-kGwL6bvmdogx1xZFH8Z7O55GSQWZSEORD86A2sVKoGU=";
       };
       "x86_64-darwin" = fetchurl {
         url = "https://proton.me/download/pass-cli/${finalAttrs.version}/pass-cli-macos-x86_64";
-        hash = "sha256-VmkTLyHNZ8p8wgvzHOYiQsbDTjzKsjyGDShcQZlAH7A=";
+        hash = "sha256-JYQmHNcPpaJTJHq+qsy2Y06SSr10MOREVvtUDWILR78=";
       };
       "x86_64-linux" = fetchurl {
         url = "https://proton.me/download/pass-cli/${finalAttrs.version}/pass-cli-linux-x86_64";
-        hash = "sha256-X7FK1t0+SuBGgSsBuhYUCkcR8LtCQMjbplo5B1LSuh0=";
+        hash = "sha256-rcu+Ob3N4S2q5MUc3OLS8frMF2QyLn83/88QtI96/cE=";
       };
     };
     updateScript = writeShellScript "update-proton-pass-cli" ''
diff --git a/pkgs/by-name/re/remnote/package.nix b/pkgs/by-name/re/remnote/package.nix
index 9a7c233c308a..634570114df4 100644
--- a/pkgs/by-name/re/remnote/package.nix
+++ b/pkgs/by-name/re/remnote/package.nix
@@ -6,10 +6,10 @@
 }:
 let
   pname = "remnote";
-  version = "1.22.51";
+  version = "1.22.56";
   src = fetchurl {
     url = "https://download2.remnote.io/remnote-desktop2/RemNote-${version}.AppImage";
-    hash = "sha256-ss+gH0FRIDpAkz3dMF0X45p8XJKDnJbqrvMGpmyFldM=";
+    hash = "sha256-MGWwXEzgUD4vjBnxolvtma59abK8qpXQLVKMhk54wr4=";
   };
   appimageContents = appimageTools.extractType2 { inherit pname version src; };
 in
diff --git a/pkgs/by-name/ru/ruff/package.nix b/pkgs/by-name/ru/ruff/package.nix
index 7e2f0084c645..fc50449ca92d 100644
--- a/pkgs/by-name/ru/ruff/package.nix
+++ b/pkgs/by-name/ru/ruff/package.nix
@@ -16,18 +16,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ruff";
-  version = "0.14.10";
+  version = "0.14.11";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "ruff";
     tag = finalAttrs.version;
-    hash = "sha256-YwgW3sjI3l3H9Tq2BO7yDOhiiaIy///xxj4UQYq39gI=";
+    hash = "sha256-W8BYc0m/3WsguchDweUapreLrNp47jzkuldI5yEWgvA=";
   };
 
   cargoBuildFlags = [ "--package=ruff" ];
 
-  cargoHash = "sha256-NyNXR1PGds+GXAha9u4DglUyy7T+yqLjNpGnchYn6oc=";
+  cargoHash = "sha256-0axyrkSHjBPhv40LvdcRDUqC+j0mUL/VzpgL/I0R5/o=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/sc/scalafmt/package.nix b/pkgs/by-name/sc/scalafmt/package.nix
index a39c7f1ba929..be1f1d383003 100644
--- a/pkgs/by-name/sc/scalafmt/package.nix
+++ b/pkgs/by-name/sc/scalafmt/package.nix
@@ -9,7 +9,7 @@
 
 let
   baseName = "scalafmt";
-  version = "3.10.2";
+  version = "3.10.3";
   deps = stdenv.mkDerivation {
     name = "${baseName}-deps-${version}";
     buildCommand = ''
@@ -19,7 +19,7 @@ let
       cp $(< deps) $out/share/java/
     '';
     outputHashMode = "recursive";
-    outputHash = "sha256-98RW+aCgf+gEvupbq5+eVlybdfDWn80otoZU6g5un+c=";
+    outputHash = "sha256-xJqppoHji0cYvd1iAmhqjCbuX0yV15TvqCvYKrf7Y3E=";
   };
 in
 stdenv.mkDerivation {
diff --git a/pkgs/by-name/se/sea-orm-cli/package.nix b/pkgs/by-name/se/sea-orm-cli/package.nix
index 27ba7d4a5d9e..aee39070a119 100644
--- a/pkgs/by-name/se/sea-orm-cli/package.nix
+++ b/pkgs/by-name/se/sea-orm-cli/package.nix
@@ -9,18 +9,18 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "sea-orm-cli";
-  version = "1.1.17";
+  version = "1.1.19";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-qf0SPFOfp180j6IHds6aQ2y0oYcwQWq7VrO8iyi7LXo=";
+    hash = "sha256-dsise5MDhR4pcD3ZWDUzTG0Q4Fg/VdKw2Q59/g6BabA=";
   };
 
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [ openssl ];
 
-  cargoHash = "sha256-AqrS+5y3bKuqAVvbmWDO3V0OBVSkW6212WQeY1hixsk=";
+  cargoHash = "sha256-38KIJYwRvVmChGSJwaRRWbb/HPuuTp/qnvXpo3xjRpE=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
diff --git a/pkgs/by-name/si/sitespeed-io/package.nix b/pkgs/by-name/si/sitespeed-io/package.nix
index a6a5e9e21ac8..835a68bd266b 100644
--- a/pkgs/by-name/si/sitespeed-io/package.nix
+++ b/pkgs/by-name/si/sitespeed-io/package.nix
@@ -9,6 +9,7 @@
   imagemagick_light,
   procps,
   python3,
+  versionCheckHook,
   xorg,
   nix-update-script,
 
@@ -24,21 +25,23 @@
 }:
 assert
   (!withFirefox && !withChromium) -> throw "Either `withFirefox` or `withChromium` must be enabled.";
-buildNpmPackage rec {
+buildNpmPackage (finalAttrs: {
   pname = "sitespeed-io";
-  version = "38.4.1";
+  version = "39.3.1";
 
   src = fetchFromGitHub {
     owner = "sitespeedio";
     repo = "sitespeed.io";
-    tag = "v${version}";
-    hash = "sha256-7aqZ63q+17MmUjHwh5Z9yqvwRq/Av+UOswIlSA2V14E=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Qgw1rqUZ/2znTmvqSCSyTyzQWpHtxsG/tHNXDphT/Ng=";
   };
 
-  # Don't try to download the browser drivers
-  CHROMEDRIVER_SKIP_DOWNLOAD = true;
-  GECKODRIVER_SKIP_DOWNLOAD = true;
-  EDGEDRIVER_SKIP_DOWNLOAD = true;
+  env = {
+    # Don't try to download the browser drivers
+    CHROMEDRIVER_SKIP_DOWNLOAD = true;
+    GECKODRIVER_SKIP_DOWNLOAD = true;
+    EDGEDRIVER_SKIP_DOWNLOAD = true;
+  };
 
   buildInputs = [
     systemdLibs
@@ -46,13 +49,18 @@ buildNpmPackage rec {
 
   dontNpmBuild = true;
   npmInstallFlags = [ "--omit=dev" ];
-  npmDepsHash = "sha256-2v/3Ygy6pAyfoQKcbJphIExcU46xc9c6+yXP2JbX11Y=";
+  npmDepsHash = "sha256-/SzoscPVDhOlAPKSCNkGnAbXjCXVD6KRD1MglM3ExAQ=";
 
   postInstall = ''
     mv $out/bin/sitespeed{.,-}io
     mv $out/bin/sitespeed{.,-}io-wpr
   '';
 
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+
   postFixup =
     let
       chromiumArgs = lib.concatStringsSep " " [
@@ -95,9 +103,11 @@ buildNpmPackage rec {
   meta = {
     description = "Open source tool that helps you monitor, analyze and optimize your website speed and performance";
     homepage = "https://sitespeed.io";
+    downloadPage = "https://github.com/sitespeedio/sitespeed.io";
+    changelog = "https://github.com/sitespeedio/sitespeed.io/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ misterio77 ];
     platforms = lib.unique (geckodriver.meta.platforms ++ chromedriver.meta.platforms);
     mainProgram = "sitespeed-io";
   };
-}
+})
diff --git a/pkgs/by-name/ss/ssh-vault/package.nix b/pkgs/by-name/ss/ssh-vault/package.nix
index 0ef9b33ba08f..360176ba00e6 100644
--- a/pkgs/by-name/ss/ssh-vault/package.nix
+++ b/pkgs/by-name/ss/ssh-vault/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ssh-vault";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "ssh-vault";
     repo = "ssh-vault";
     tag = finalAttrs.version;
-    hash = "sha256-d4XhH9i43AkgZR/6XE6iR8pSC5xSuWiX8VghJsC8Ek4=";
+    hash = "sha256-vrMYQ+0lRui4OhEnSOE4rth/L8J73lCo0TF+u/9MCDg=";
   };
 
-  cargoHash = "sha256-7IOX69MIrSLU6vit0/rg7IRbz9Dn0rSN5RuM4dJ49/A=";
+  cargoHash = "sha256-BQftk6VGqFqiq+Wo92uBrYScSLyW6BcaUk2ivZfA/Us=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/sy/sydbox/package.nix b/pkgs/by-name/sy/sydbox/package.nix
index 29c06fad7742..cc3217c09447 100644
--- a/pkgs/by-name/sy/sydbox/package.nix
+++ b/pkgs/by-name/sy/sydbox/package.nix
@@ -12,7 +12,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "sydbox";
-  version = "3.45.1";
+  version = "3.48.2";
 
   outputs = [
     "out"
@@ -24,10 +24,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "Sydbox";
     repo = "sydbox";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CqtcHwWxEJqFcM0F2959gBEJG1mRMR80mRGj2ENFjFM=";
+    hash = "sha256-yZBH7uVU4dqbUuHZaEw2glcQtHqUhXF3cycUr4J/NZI=";
   };
 
-  cargoHash = "sha256-Xy1cg6i8ulSAyEw6YNz2kBcObYN0PgnaHKwRzTLNrgU=";
+  cargoHash = "sha256-zK2Z9iuJs43Qmiv/ircNF891XyfVwn6pDeYmJzfmNOU=";
 
   nativeBuildInputs = [
     mandoc
diff --git a/pkgs/by-name/ta/tabiew/package.nix b/pkgs/by-name/ta/tabiew/package.nix
index 430da8d4cb3c..e5ee9a4b0540 100644
--- a/pkgs/by-name/ta/tabiew/package.nix
+++ b/pkgs/by-name/ta/tabiew/package.nix
@@ -7,16 +7,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "tabiew";
-  version = "0.11.1";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "shshemi";
     repo = "tabiew";
     tag = "v${version}";
-    hash = "sha256-RvbHXnDaoqMHjA9u9kFs5MB6xeQG/E35PEu+1LIXIBU=";
+    hash = "sha256-OCfxgOXTVizeYJyCk5I/Fb/iDdjtcTeieWx8kWzGb2I=";
   };
 
-  cargoHash = "sha256-F+5Iy8eY5s+EfMqx4z4mh0SVoBwwnbM33c3yE7FUy4g=";
+  cargoHash = "sha256-nw5qu1o34dpG9NMxix4Fj3rV53Wm3KOSwZgEqK584Lw=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/te/termcap/package.nix b/pkgs/by-name/te/termcap/package.nix
index a0cf6eaadeb6..9c2311d6420d 100644
--- a/pkgs/by-name/te/termcap/package.nix
+++ b/pkgs/by-name/te/termcap/package.nix
@@ -8,12 +8,12 @@
   enableShared ? !stdenv.hostPlatform.isStatic,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "termcap";
   version = "1.3.1";
 
   src = fetchurl {
-    url = "mirror://gnu/termcap/termcap-${version}.tar.gz";
+    url = "mirror://gnu/termcap/termcap-${finalAttrs.version}.tar.gz";
     hash = "sha256-kaDiLlOHykRntbyxjt8cUbkwJi/UZtX9o5bdnSZxkQA=";
   };
 
@@ -43,6 +43,7 @@ stdenv.mkDerivation rec {
   env.NIX_CFLAGS_COMPILE = toString (
     [
       "-DSTDC_HEADERS"
+      "-std=gnu89"
     ]
     ++ lib.optionals stdenv.cc.isClang [
       "-Wno-implicit-function-declaration"
@@ -76,4 +77,4 @@ stdenv.mkDerivation rec {
     maintainers = with lib.maintainers; [ wegank ];
     platforms = lib.platforms.all;
   };
-}
+})
diff --git a/pkgs/by-name/tf/tftui/package.nix b/pkgs/by-name/tf/tftui/package.nix
index 9090c0961b45..aeee88fd0210 100644
--- a/pkgs/by-name/tf/tftui/package.nix
+++ b/pkgs/by-name/tf/tftui/package.nix
@@ -51,7 +51,10 @@ python3Packages.buildPythonApplication rec {
     homepage = "https://github.com/idoavrah/terraform-tui";
     changelog = "https://github.com/idoavrah/terraform-tui/releases/tag/v${version}";
     license = lib.licenses.asl20;
-    teams = [ lib.teams.bitnomial ];
+    maintainers = with lib.maintainers; [
+      cdepillabout
+      wraithm
+    ];
     mainProgram = "tftui";
   };
 }
diff --git a/pkgs/by-name/vu/vunnel/package.nix b/pkgs/by-name/vu/vunnel/package.nix
index 826ed315999f..9f45fcc25450 100644
--- a/pkgs/by-name/vu/vunnel/package.nix
+++ b/pkgs/by-name/vu/vunnel/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "vunnel";
-  version = "0.46.2";
+  version = "0.46.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = "vunnel";
     tag = "v${version}";
-    hash = "sha256-wQ+tu6XotTN/QcemTGzeN6/pcuEb4aRJkZROQ3liY9I=";
+    hash = "sha256-2eopYMfg2jjZMT/FP5923aLoXTKAcwAdCkcyXT8weeY=";
     leaveDotGit = true;
   };
 
diff --git a/pkgs/by-name/wh/whisper-cpp/package.nix b/pkgs/by-name/wh/whisper-cpp/package.nix
index 699e1cab4199..d7b745d00558 100644
--- a/pkgs/by-name/wh/whisper-cpp/package.nix
+++ b/pkgs/by-name/wh/whisper-cpp/package.nix
@@ -133,6 +133,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
   ++ optionals (effectiveStdenv.hostPlatform.isx86 && !effectiveStdenv.hostPlatform.isStatic) [
     (cmakeBool "GGML_BACKEND_DL" true)
     (cmakeBool "GGML_CPU_ALL_VARIANTS" true)
+    (cmakeFeature "GGML_BACKEND_DIR" "${placeholder "out"}/lib")
   ]
   ++ optionals cudaSupport [
     (cmakeFeature "CMAKE_CUDA_ARCHITECTURES" cudaPackages.flags.cmakeCudaArchitecturesString)
diff --git a/pkgs/by-name/ze/zenith/package.nix b/pkgs/by-name/ze/zenith/package.nix
index 8318ed40bd4c..1f311bfcffe4 100644
--- a/pkgs/by-name/ze/zenith/package.nix
+++ b/pkgs/by-name/ze/zenith/package.nix
@@ -1,6 +1,5 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitHub,
   nvidiaSupport ? false,
@@ -9,13 +8,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "zenith";
-  version = "0.14.2";
+  version = "0.14.3";
 
   src = fetchFromGitHub {
     owner = "bvaisvil";
     repo = "zenith";
     rev = version;
-    hash = "sha256-kMjDbWhey3SoT4hlEz2mEoSIICfI+X03PdBgTs5yxuI=";
+    hash = "sha256-D/o8JmKLiT8LhmJ6q2h7f5vJQNXAN5aCislxwDw9yqo=";
   };
 
   # remove cargo config so it can find the linker on aarch64-linux
@@ -23,7 +22,7 @@ rustPlatform.buildRustPackage rec {
     rm .cargo/config
   '';
 
-  cargoHash = "sha256-M+I7+mcXn2UM340loy4OS6z+uZMxwiO/JwD0KjHvcFw=";
+  cargoHash = "sha256-/SRZWbsAvV4rgEsVj5WRgc5KJZm+JvIs1QTgaK/+l+g=";
 
   nativeBuildInputs = [ rustPlatform.bindgenHook ] ++ lib.optional nvidiaSupport makeWrapper;
 
diff --git a/pkgs/development/ocaml-modules/cryptokit/default.nix b/pkgs/development/ocaml-modules/cryptokit/default.nix
index 33ec440fb5a2..8d33c7e47534 100644
--- a/pkgs/development/ocaml-modules/cryptokit/default.nix
+++ b/pkgs/development/ocaml-modules/cryptokit/default.nix
@@ -1,23 +1,28 @@
 {
   lib,
   buildDunePackage,
+  ocaml,
   fetchFromGitHub,
   zlib,
   dune-configurator,
   zarith,
+  version ? if lib.versionAtLeast ocaml.version "4.13" then "1.21.1" else "1.20.1",
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "cryptokit";
-  version = "1.20.1";
-
-  minimalOCamlVersion = "4.08";
+  inherit version;
 
   src = fetchFromGitHub {
     owner = "xavierleroy";
     repo = "cryptokit";
-    rev = "release${lib.replaceStrings [ "." ] [ "" ] version}";
-    hash = "sha256-VFY10jGctQfIUVv7dK06KP8zLZHLXTxvLyTCObS+W+E=";
+    tag = "release${lib.replaceStrings [ "." ] [ "" ] finalAttrs.version}";
+    hash =
+      {
+        "1.21.1" = "sha256-9JU9grZpTTrYYO9gai2UPq119HfenI1JAY+EyoR6x7Q=";
+        "1.20.1" = "sha256-VFY10jGctQfIUVv7dK06KP8zLZHLXTxvLyTCObS+W+E=";
+      }
+      ."${finalAttrs.version}";
   };
 
   # dont do autotools configuration, but do trigger findlib's preConfigure hook
@@ -39,4 +44,4 @@ buildDunePackage rec {
     description = "Library of cryptographic primitives for OCaml";
     license = lib.licenses.lgpl2Only;
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/gapi-ocaml/default.nix b/pkgs/development/ocaml-modules/gapi-ocaml/default.nix
index 84ffc37a30cd..a6bec8a069cb 100644
--- a/pkgs/development/ocaml-modules/gapi-ocaml/default.nix
+++ b/pkgs/development/ocaml-modules/gapi-ocaml/default.nix
@@ -10,17 +10,20 @@
   ounit2,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "gapi-ocaml";
-  version = "0.4.7";
-
-  minimalOCamlVersion = "4.08";
+  version = if lib.versionAtLeast cryptokit.version "1.21" then "0.4.8" else "0.4.7";
 
   src = fetchFromGitHub {
     owner = "astrada";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-uQJfrgF0oafURlamHslt9hX9MP4vFeVqDhuX7T/kjiY=";
+    repo = "gapi-ocaml";
+    tag = "v${finalAttrs.version}";
+    hash =
+      {
+        "0.4.7" = "sha256-uQJfrgF0oafURlamHslt9hX9MP4vFeVqDhuX7T/kjiY=";
+        "0.4.8" = "sha256-RvHcse3ech8BwnR0Kd1oE5ycAdSBpeQ0IGAp9egFbBY=";
+      }
+      ."${finalAttrs.version}";
   };
 
   nativeBuildInputs = [ cppo ];
@@ -41,4 +44,4 @@ buildDunePackage rec {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ bennofs ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/aiohttp-utils/default.nix b/pkgs/development/python-modules/aiohttp-utils/default.nix
index 5b4976bd8718..bfa03709b7a4 100644
--- a/pkgs/development/python-modules/aiohttp-utils/default.nix
+++ b/pkgs/development/python-modules/aiohttp-utils/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  pythonAtLeast,
   setuptools,
   aiohttp,
   python-mimeparse,
@@ -11,7 +12,7 @@
   webtest-aiohttp,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "aiohttp-utils";
   version = "3.2.1";
   pyproject = true;
@@ -19,7 +20,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "sloria";
     repo = "aiohttp-utils";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-CGKka6nGQ9o4wn6o3YJ3hm8jGbg16NKkCdBA1mKz4bo=";
   };
 
@@ -48,11 +49,18 @@ buildPythonPackage rec {
     "test_renders_to_json_by_default"
   ];
 
+  disabledTestPaths = lib.optionals (pythonAtLeast "3.14") [
+    # RuntimeError: There is no current event loop in thread 'MainThread'.
+    "tests/test_examples.py"
+    "tests/test_negotiation.py"
+    "tests/test_routing.py"
+  ];
+
   meta = {
     description = "Handy utilities for building aiohttp.web applications";
     homepage = "https://github.com/sloria/aiohttp-utils";
-    changelog = "https://github.com/sloria/aiohttp-utils/blob/${src.rev}/CHANGELOG.rst";
+    changelog = "https://github.com/sloria/aiohttp-utils/tags/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/aiopulsegrow/default.nix b/pkgs/development/python-modules/aiopulsegrow/default.nix
new file mode 100644
index 000000000000..3357b6dbd858
--- /dev/null
+++ b/pkgs/development/python-modules/aiopulsegrow/default.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  aiohttp,
+  aioresponses,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytest-aiohttp,
+  pytest-asyncio,
+  pytest-cov-stub,
+  pytestCheckHook,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "aiopulsegrow";
+  version = "25.12.6";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "pvizeli";
+    repo = "aiopulsegrow";
+    tag = finalAttrs.version;
+    hash = "sha256-Srtk8EmvTQvx2//TuB2JR74lw58EdLORKWDnvTPStww=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ aiohttp ];
+
+  nativeCheckInputs = [
+    aioresponses
+    pytestCheckHook
+    pytest-aiohttp
+    pytest-asyncio
+    pytest-cov-stub
+  ];
+
+  pythonImportsCheck = [ "aiopulsegrow" ];
+
+  meta = {
+    description = "Python async api client for Pulse Grow";
+    homepage = "https://github.com/pvizeli/aiopulsegrow";
+    changelog = "https://github.com/pvizeli/aiopulsegrow/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/beaupy/default.nix b/pkgs/development/python-modules/beaupy/default.nix
index 0f7c2db62dfa..a256721c82e4 100644
--- a/pkgs/development/python-modules/beaupy/default.nix
+++ b/pkgs/development/python-modules/beaupy/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "beaupy";
-  version = "3.10.2";
+  version = "3.11.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "petereon";
     repo = "beaupy";
     rev = "v${version}";
-    hash = "sha256-0m0qc/ei8BuU7vHK/4mY7YQvHVTfwsaPH4Kko9wCKvM=";
+    hash = "sha256-EQekSvjhL2qVQTjbdv4OqYMRUXrS9VzAIWiDjGdy3Rc=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/bidsschematools/default.nix b/pkgs/development/python-modules/bidsschematools/default.nix
index 3da037a03138..da89e5e3fa09 100644
--- a/pkgs/development/python-modules/bidsschematools/default.nix
+++ b/pkgs/development/python-modules/bidsschematools/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "bidsschematools";
-  version = "1.1.3";
+  version = "1.1.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bids-standard";
     repo = "bids-specification";
     tag = "schema-${version}";
-    hash = "sha256-77ctT1Btin9gJSfgu1euFep0lg6SauCZn60VRrJ0IRk=";
+    hash = "sha256-4aRM0c1onwASuhkKA7DLPjhLGeo6WAE3T2mKePFiRvw=";
   };
 
   sourceRoot = "${src.name}/tools/schemacode";
diff --git a/pkgs/development/python-modules/checkdmarc/default.nix b/pkgs/development/python-modules/checkdmarc/default.nix
index 4a9516747755..7aa4c13c52b4 100644
--- a/pkgs/development/python-modules/checkdmarc/default.nix
+++ b/pkgs/development/python-modules/checkdmarc/default.nix
@@ -18,16 +18,16 @@
   xmltodict,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "checkdmarc";
-  version = "5.13.1";
+  version = "5.13.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "domainaware";
     repo = "checkdmarc";
-    tag = version;
-    hash = "sha256-/y5fFRqnlxrPrg5WAUfTQnuyShiqnqXrAZfShQnGvgc=";
+    tag = finalAttrs.version;
+    hash = "sha256-Ub/B3IO7f5Ah2XNTJ90Y6whP+PIDCL7ucHGd5sWwJRk=";
   };
 
   pythonRelaxDeps = [
@@ -71,9 +71,9 @@ buildPythonPackage rec {
   meta = {
     description = "Parser for SPF and DMARC DNS records";
     homepage = "https://github.com/domainaware/checkdmarc";
-    changelog = "https://github.com/domainaware/checkdmarc/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/domainaware/checkdmarc/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "checkdmarc";
   };
-}
+})
diff --git a/pkgs/development/python-modules/gto/default.nix b/pkgs/development/python-modules/gto/default.nix
index 3ffc70164d23..880a1e5c7ef6 100644
--- a/pkgs/development/python-modules/gto/default.nix
+++ b/pkgs/development/python-modules/gto/default.nix
@@ -6,7 +6,7 @@
   fetchFromGitHub,
   freezegun,
   funcy,
-  gitMinimal,
+  gitSetupHook,
   pydantic,
   pydantic-settings,
   pytest-cov-stub,
@@ -21,9 +21,10 @@
   setuptools,
   tabulate,
   typer,
+  writableTmpDirAsHomeHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "gto";
   version = "1.9.0";
   pyproject = true;
@@ -31,7 +32,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "iterative";
     repo = "gto";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-LXYpOnk9W/ellG70qZLihmvk4kvVcwZfE5buPNU2qzQ=";
   };
 
@@ -55,28 +56,25 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     freezegun
-    gitMinimal
+    gitSetupHook
     pytest-cov-stub
     pytest-mock
     pytest-test-utils
     pytestCheckHook
+    writableTmpDirAsHomeHook
   ];
 
   preCheck = ''
-    export HOME=$(mktemp -d)
-
-    git config --global user.email "nobody@example.com"
-    git config --global user.name "Nobody"
-
     # _pygit2.GitError: OpenSSL error: failed to load certificates: error:00000000:lib(0)::reason(0)
     export SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt
   '';
 
   disabledTests = [
-    # Tests want to with a remote repo
+    # Tests want to do it with a remote repo
     "remote_repo"
     "remote_git_repo"
     "test_action_doesnt_push_even_if_repo_has_remotes_set"
+    "test_api"
     # ValueError: stderr not separately captured
     "test_register"
     "test_assign"
@@ -89,9 +87,9 @@ buildPythonPackage rec {
   meta = {
     description = "Module for Git Tag Operations";
     homepage = "https://github.com/iterative/gto";
-    changelog = "https://github.com/iterative/gto/releases/tag/${src.tag}";
+    changelog = "https://github.com/iterative/gto/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "gto";
   };
-}
+})
diff --git a/pkgs/development/python-modules/jsonschema-rs/default.nix b/pkgs/development/python-modules/jsonschema-rs/default.nix
index 472cde02ab49..892dcfa5819c 100644
--- a/pkgs/development/python-modules/jsonschema-rs/default.nix
+++ b/pkgs/development/python-modules/jsonschema-rs/default.nix
@@ -45,6 +45,9 @@ buildPythonPackage rec {
     homepage = "https://github.com/Stranger6667/jsonschema/tree/master/crates/jsonschema-py";
     changelog = "https://github.com/Stranger6667/jsonschema/blob/python-v${version}/crates/jsonschema-py/CHANGELOG.md";
     license = lib.licenses.mit;
-    teams = [ lib.teams.apm ];
+    maintainers = with lib.maintainers; [
+      DutchGerman
+      friedow
+    ];
   };
 }
diff --git a/pkgs/development/python-modules/minify-html/default.nix b/pkgs/development/python-modules/minify-html/default.nix
index 61f81813dc83..0cd4728defed 100644
--- a/pkgs/development/python-modules/minify-html/default.nix
+++ b/pkgs/development/python-modules/minify-html/default.nix
@@ -35,6 +35,9 @@ buildPythonPackage rec {
     homepage = "https://github.com/wilsonzlin/minify-html/tree/master/minify-html-python";
     changelog = "https://github.com/wilsonzlin/minify-html/blob/v${version}/CHANGELOG.md";
     license = lib.licenses.mit;
-    teams = [ lib.teams.apm ];
+    maintainers = with lib.maintainers; [
+      DutchGerman
+      friedow
+    ];
   };
 }
diff --git a/pkgs/development/python-modules/nestedtext/default.nix b/pkgs/development/python-modules/nestedtext/default.nix
index 923754fe84c2..bb03fce84796 100644
--- a/pkgs/development/python-modules/nestedtext/default.nix
+++ b/pkgs/development/python-modules/nestedtext/default.nix
@@ -12,21 +12,21 @@
   voluptuous,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "nestedtext";
   version = "3.8";
-  format = "pyproject";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "KenKundert";
     repo = "nestedtext";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-eg5Q11dl9ikGpNYx2Sd47MBPC9S4W2M6PpehFpowzdk=";
   };
 
-  nativeBuildInputs = [ flit-core ];
+  build-system = [ flit-core ];
 
-  propagatedBuildInputs = [ inform ];
+  dependencies = [ inform ];
 
   nativeCheckInputs = [
     docopt
@@ -69,8 +69,8 @@ buildPythonPackage rec {
       non-programmers.
     '';
     homepage = "https://nestedtext.org";
-    changelog = "https://github.com/KenKundert/nestedtext/blob/v${version}/doc/releases.rst";
+    changelog = "https://github.com/KenKundert/nestedtext/blob/${finalAttrs.src.tag}/doc/releases.rst";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ jeremyschlatter ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/pyotb/default.nix b/pkgs/development/python-modules/pyotb/default.nix
index 9276da826826..0728317d4338 100644
--- a/pkgs/development/python-modules/pyotb/default.nix
+++ b/pkgs/development/python-modules/pyotb/default.nix
@@ -95,6 +95,7 @@ buildPythonPackage rec {
     homepage = "https://github.com/orfeotoolbox/pyotb";
     changelog = "https://github.com/orfeotoolbox/pyotb/releases/tag/${version}";
     license = lib.licenses.asl20;
+    teams = [ lib.teams.geospatial ];
     maintainers = with lib.maintainers; [ daspk04 ];
   };
 }
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index 570e2137d191..70a78b461dc2 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "tencentcloud-sdk-python";
-  version = "3.1.29";
+  version = "3.1.30";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = finalAttrs.version;
-    hash = "sha256-uXn5UyJ6cwLclo5QnnKTEf5b29OdGrxE1CdGp2u4SqI=";
+    hash = "sha256-W5/rrDxlLJHYGZxq5pPSPlxuUXV7JqCzJRjxec/piAU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/tiptapy/default.nix b/pkgs/development/python-modules/tiptapy/default.nix
index 52c625b32c23..fadb4b44b03a 100644
--- a/pkgs/development/python-modules/tiptapy/default.nix
+++ b/pkgs/development/python-modules/tiptapy/default.nix
@@ -37,6 +37,9 @@ buildPythonPackage {
     homepage = "https://github.com/stckme/tiptapy";
     changelog = "https://github.com/stckme/tiptapy/blob/master/CHANGELOG.rst";
     license = lib.licenses.mit;
-    teams = [ lib.teams.apm ];
+    maintainers = with lib.maintainers; [
+      DutchGerman
+      friedow
+    ];
   };
 }
diff --git a/pkgs/development/python-modules/virtualenv/default.nix b/pkgs/development/python-modules/virtualenv/default.nix
index ca1667b4ca65..7be7089fa303 100644
--- a/pkgs/development/python-modules/virtualenv/default.nix
+++ b/pkgs/development/python-modules/virtualenv/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "virtualenv";
-  version = "20.35.4";
+  version = "20.36.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pypa";
     repo = "virtualenv";
     tag = version;
-    hash = "sha256-0PWIYU1/zXiOBUV/45rJsJwVlcqHeac68nRM2tvEPHo=";
+    hash = "sha256-8fiC7+9FzQnmoI+N4cA5kKBLH9tpU7LXZ7pVj8Bz8Wc=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/weasyprint/default.nix b/pkgs/development/python-modules/weasyprint/default.nix
index 5db33be5ab0b..68656efea693 100644
--- a/pkgs/development/python-modules/weasyprint/default.nix
+++ b/pkgs/development/python-modules/weasyprint/default.nix
@@ -114,6 +114,9 @@ buildPythonPackage (finalAttrs: {
     homepage = "https://weasyprint.org/";
     license = lib.licenses.bsd3;
     mainProgram = "weasyprint";
-    teams = [ lib.teams.apm ];
+    maintainers = with lib.maintainers; [
+      DutchGerman
+      friedow
+    ];
   };
 })
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 3ea3be0917cf..9d8494c2be6d 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,12 +1,12 @@
 {
     "testing": {
-        "version": "6.19-rc4",
-        "hash": "sha256:1ivkpgmmpy7my1vcly82pnnz3ynmdjz62n4q251j970zk8m42r9s",
+        "version": "6.19-rc5",
+        "hash": "sha256:1kwyxmykzy7z7kp80c85b17wrgqn7jjjvbpic9jgk5ps27zbzvdk",
         "lts": false
     },
     "6.1": {
-        "version": "6.1.159",
-        "hash": "sha256:17ib6ila2s8rclqpfxlkk1g72azj2r46k2x1q3n2j24qjfz7w80z",
+        "version": "6.1.160",
+        "hash": "sha256:15l4s87vyv4rnf5yagl6x7kz4yrlalh191ssxwbvwn3m8fl4d18f",
         "lts": true
     },
     "5.15": {
@@ -20,18 +20,18 @@
         "lts": true
     },
     "6.6": {
-        "version": "6.6.119",
-        "hash": "sha256:1s75ad95g4y80idadzqmj9kj4rb3dhnvny9lg4lcq15l1fc9p81x",
+        "version": "6.6.120",
+        "hash": "sha256:08fwwi9wjnhaj4ig0n0ycppzw384djh0gzv3i3blzp7fb4nk6p20",
         "lts": true
     },
     "6.12": {
-        "version": "6.12.64",
-        "hash": "sha256:18j9ivimvlm1afzfiw03n3r35qv91nbjhh2gi3z8w5416sir9bfi",
+        "version": "6.12.65",
+        "hash": "sha256:1h9rl62lffwxan5ggz1vi9wmyzzsclg330gwdk80wp7kg9k55s2l",
         "lts": true
     },
     "6.18": {
-        "version": "6.18.4",
-        "hash": "sha256:1asza9m4vb7lghxaiy5fpnbwmb9a44pgjclbpgv1p77plnf16l7q",
+        "version": "6.18.5",
+        "hash": "sha256:0h6r5w7755gd8ys18zi9rgw95wrd2yalbq0h88ihv3ggki01z78q",
         "lts": false
     }
 }
diff --git a/pkgs/servers/http/nginx/modules.nix b/pkgs/servers/http/nginx/modules.nix
index 33622bd1bd99..9e12806bd7ce 100644
--- a/pkgs/servers/http/nginx/modules.nix
+++ b/pkgs/servers/http/nginx/modules.nix
@@ -1065,7 +1065,10 @@ let
         homepage = "https://github.com/evanmiller/mod_zip";
         license = with lib.licenses; [ bsd3 ];
         broken = stdenv.hostPlatform.isDarwin;
-        teams = [ lib.teams.apm ];
+        maintainers = with lib.maintainers; [
+          DutchGerman
+          friedow
+        ];
       };
     };
 
diff --git a/pkgs/servers/monitoring/grafana/plugins/grafana-exploretraces-app/default.nix b/pkgs/servers/monitoring/grafana/plugins/grafana-exploretraces-app/default.nix
index a5c62f35b612..b443e16cc6fa 100644
--- a/pkgs/servers/monitoring/grafana/plugins/grafana-exploretraces-app/default.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/grafana-exploretraces-app/default.nix
@@ -7,7 +7,7 @@ grafanaPlugin {
   meta = {
     description = "Opinionated traces app";
     license = lib.licenses.agpl3Only;
-    teams = [ lib.teams.fslabs ];
+    maintainers = with lib.maintainers; [ lpostula ];
     platforms = lib.platforms.unix;
   };
 }
diff --git a/pkgs/servers/monitoring/grafana/plugins/grafana-lokiexplore-app/default.nix b/pkgs/servers/monitoring/grafana/plugins/grafana-lokiexplore-app/default.nix
index 5c81315bd639..92b882907fc4 100644
--- a/pkgs/servers/monitoring/grafana/plugins/grafana-lokiexplore-app/default.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/grafana-lokiexplore-app/default.nix
@@ -7,7 +7,7 @@ grafanaPlugin {
   meta = {
     description = "Browse Loki logs without the need for writing complex queries";
     license = lib.licenses.agpl3Only;
-    teams = [ lib.teams.fslabs ];
+    maintainers = with lib.maintainers; [ lpostula ];
     platforms = lib.platforms.unix;
   };
 }
diff --git a/pkgs/servers/monitoring/grafana/plugins/grafana-oncall-app/default.nix b/pkgs/servers/monitoring/grafana/plugins/grafana-oncall-app/default.nix
index fc8617ecd582..2039160a6437 100644
--- a/pkgs/servers/monitoring/grafana/plugins/grafana-oncall-app/default.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/grafana-oncall-app/default.nix
@@ -7,7 +7,7 @@ grafanaPlugin {
   meta = {
     description = "Developer-friendly incident response for Grafana";
     license = lib.licenses.agpl3Only;
-    teams = [ lib.teams.fslabs ];
+    maintainers = with lib.maintainers; [ lpostula ];
     platforms = lib.platforms.unix;
   };
 }
diff --git a/pkgs/servers/monitoring/grafana/plugins/grafana-pyroscope-app/default.nix b/pkgs/servers/monitoring/grafana/plugins/grafana-pyroscope-app/default.nix
index 04486f08f241..4b42fbb8c125 100644
--- a/pkgs/servers/monitoring/grafana/plugins/grafana-pyroscope-app/default.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/grafana-pyroscope-app/default.nix
@@ -7,7 +7,7 @@ grafanaPlugin {
   meta = {
     description = "Integrate seamlessly with Pyroscope, the open-source continuous profiling platform, providing a smooth, query-less experience for browsing and analyzing profiling data";
     license = lib.licenses.agpl3Only;
-    teams = [ lib.teams.fslabs ];
+    maintainers = with lib.maintainers; [ lpostula ];
     platforms = lib.platforms.unix;
   };
 }
diff --git a/pkgs/servers/sql/postgresql/ext/pg_byteamagic.nix b/pkgs/servers/sql/postgresql/ext/pg_byteamagic.nix
index 94f35244ff55..4de8f09e06b1 100644
--- a/pkgs/servers/sql/postgresql/ext/pg_byteamagic.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_byteamagic.nix
@@ -44,7 +44,10 @@ postgresqlBuildExtension (finalAttrs: {
     homepage = "https://github.com/nmandery/pg_byteamagic";
     changelog = "https://raw.githubusercontent.com/nmandery/pg_byteamagic/refs/tags/v${finalAttrs.version}/Changes";
     license = lib.licenses.bsd2WithViews;
-    teams = [ lib.teams.apm ];
+    maintainers = with lib.maintainers; [
+      DutchGerman
+      friedow
+    ];
     platforms = postgresql.meta.platforms;
   };
 })
diff --git a/pkgs/servers/xmpp/prosody/default.nix b/pkgs/servers/xmpp/prosody/default.nix
index 3641e8884f4d..6132bb9f901e 100644
--- a/pkgs/servers/xmpp/prosody/default.nix
+++ b/pkgs/servers/xmpp/prosody/default.nix
@@ -121,7 +121,7 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [
       toastal
       mirror230469
+      SuperSandro2000
     ];
-    teams = with lib.teams; [ c3d2 ];
   };
 })
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 6759b41c7f95..7ee5e6e9ddc9 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -438,6 +438,8 @@ self: super: with self; {
 
   aiopulse = callPackage ../development/python-modules/aiopulse { };
 
+  aiopulsegrow = callPackage ../development/python-modules/aiopulsegrow { };
+
   aiopurpleair = callPackage ../development/python-modules/aiopurpleair { };
 
   aiopvapi = callPackage ../development/python-modules/aiopvapi { };