diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
index 2396dcef6fa3..83e38523f57c 100644
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -4,7 +4,7 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- Create the first release note entry in this section!
+- The default kernel package has been updated from 6.12 to 6.18. All supported kernels remain available.
 
 ## New Modules {#sec-release-26.05-new-modules}
 
diff --git a/nixos/modules/tasks/filesystems/bcachefs.nix b/nixos/modules/tasks/filesystems/bcachefs.nix
index d6d08f232738..481773991206 100644
--- a/nixos/modules/tasks/filesystems/bcachefs.nix
+++ b/nixos/modules/tasks/filesystems/bcachefs.nix
@@ -242,9 +242,6 @@ in
           }
         ];
 
-        # Use LTS that bcachefs is compatible with.
-        boot.kernelPackages = lib.mkDefault pkgs.linuxPackages_6_18;
-
         # needed for systemd-remount-fs
         system.fsPackages = [ cfg.package ];
         services.udev.packages = [ cfg.package ];
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
index aeae7b435523..ad0f45b3971b 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py
@@ -376,20 +376,20 @@ def main() -> None:
 
     try:
         execute(sys.argv)
+    except KeyboardInterrupt:
+        sys.exit(130)
     except CalledProcessError as ex:
-        _handle_called_process_error(ex)
-    except (Exception, KeyboardInterrupt) as ex:
+        sys.exit(_handle_called_process_error(ex))
+    except Exception as ex:
         if logger.isEnabledFor(logging.DEBUG):
             raise
         else:
             sys.exit(str(ex))
 
 
-def _handle_called_process_error(ex: CalledProcessError) -> None:
+def _handle_called_process_error(ex: CalledProcessError) -> int:
     if logger.isEnabledFor(logging.DEBUG):
-        import traceback
-
-        traceback.print_exception(ex)
+        sys.excepthook(*sys.exc_info())
     else:
         import shlex
 
@@ -410,4 +410,4 @@ def _handle_called_process_error(ex: CalledProcessError) -> None:
         print(str(ex), file=sys.stderr)
 
     # Exit with the error code of the process that failed
-    sys.exit(ex.returncode)
+    return ex.returncode
diff --git a/pkgs/by-name/su/sudo/package.nix b/pkgs/by-name/su/sudo/package.nix
index f916f8d53377..781761698db3 100644
--- a/pkgs/by-name/su/sudo/package.nix
+++ b/pkgs/by-name/su/sudo/package.nix
@@ -54,6 +54,18 @@ stdenv.mkDerivation (finalAttrs: {
     "--with-sssd-lib=${sssd}/lib"
   ];
 
+  outputs = [
+    "out"
+    "man"
+    "doc"
+    "dev"
+  ];
+  # The default stdenv ./configure flags for some reason cause the upstream's
+  # Makefile to `mkdir /var/db`, which fails in the sandbox. Since we split
+  # only trivial outputs - a single header and documentation, we can safely set
+  # the following:
+  setOutputFlags = false;
+
   postConfigure = ''
     cat >> pathnames.h <<'EOF'
       #undef _PATH_MV
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index d909526a5aef..5d45d4526774 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -591,6 +591,8 @@ let
         DRM_VC4_HDMI_CEC = yes;
         # Enable HDMI out on platforms using the RK3588 lineup of SoCs.
         ROCKCHIP_DW_HDMI_QP = whenAtLeast "6.13" yes;
+        # Enable DSI out on platforms using the RK3588 lineup of SoCs.
+        ROCKCHIP_DW_MIPI_DSI2 = whenAtLeast "6.16" yes;
       };
 
     # Enable Rust and features that depend on it
diff --git a/pkgs/tools/security/mkpasswd/default.nix b/pkgs/tools/security/mkpasswd/default.nix
index 59c9c411af81..9f2e36ed7bd0 100644
--- a/pkgs/tools/security/mkpasswd/default.nix
+++ b/pkgs/tools/security/mkpasswd/default.nix
@@ -21,6 +21,11 @@ stdenv.mkDerivation {
   buildPhase = "make mkpasswd";
   installPhase = "make install-mkpasswd";
 
+  outputs = [
+    "out"
+    "man"
+  ];
+
   meta = {
     homepage = "https://packages.qa.debian.org/w/whois.html";
     description = "Overfeatured front-end to crypt, from the Debian whois package";
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index 25903de56d17..ee208018b454 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -278,7 +278,7 @@ in
 
         linux_6_12_hardened = hardenedKernelFor kernels.linux_6_12 { };
 
-        linux_hardened = hardenedKernelFor packageAliases.linux_default.kernel { };
+        linux_hardened = linux_6_12_hardened;
       }
       // lib.optionalAttrs config.allowAliases {
         linux_libre = throw "linux_libre has been removed due to lack of maintenance";
@@ -812,7 +812,7 @@ in
   );
 
   packageAliases = {
-    linux_default = packages.linux_6_12;
+    linux_default = packages.linux_6_18;
     # Update this when adding the newest kernel major version!
     linux_latest = packages.linux_6_19;
     linux_rt_default = packages.linux_rt_5_15;