diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index 3b249843f4f1..d160030a52cb 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -252,6 +252,7 @@ in with passthru; stdenv.mkDerivation (finalAttrs: {
     # (since it will do a futile invocation of gcc (!) to find
     # libuuid, slowing down program startup a lot).
     noldconfigPatch
+  ] ++ optionals (!isPy312 && !isPy313) [
     # https://www.cve.org/CVERecord?id=CVE-2025-0938
     ./CVE-2025-0938.patch
   ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform && stdenv.hostPlatform.isFreeBSD) [
@@ -296,7 +297,7 @@ in with passthru; stdenv.mkDerivation (finalAttrs: {
   ] ++ optionals (pythonOlder "3.12") [
     # https://github.com/python/cpython/issues/90656
     ./loongarch-support.patch
-  ] ++ optionals (pythonAtLeast "3.12" && pythonOlder "3.14") [
+  ] ++ optionals isPy314 [
     ./3.12/CVE-2024-12254.patch
   ] ++ optionals (pythonAtLeast "3.11" && pythonOlder "3.13") [
     # backport fix for https://github.com/python/cpython/issues/95855
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 582c37cd2c79..7c0036ea1b1e 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -20,10 +20,10 @@
       sourceVersion = {
         major = "3";
         minor = "12";
-        patch = "8";
+        patch = "9";
         suffix = "";
       };
-      hash = "sha256-yQkVe7JewRTlhpEkzCqcSk1MHpV8pP9VPx7caSEBFU4=";
+      hash = "sha256-ciCDXZ+Qs3wAbphCqN/0WAqspDGGdPlHMCuNKPP4ERI=";
     };
   };
 
@@ -87,10 +87,10 @@ in {
     sourceVersion = {
       major = "3";
       minor = "13";
-      patch = "1";
+      patch = "2";
       suffix = "";
     };
-    hash = "sha256-nPlCe+6eIkLjh33Q9rZBwYU8pGHznWUDziYKWcgL8Nk=";
+    hash = "sha256-2YS8xXzWfKqyb33vQuUjscAVu8XcB4Ns9PC2P6FZ61Y=";
     inherit passthruFun;
   };
 
diff --git a/pkgs/development/interpreters/python/passthrufun.nix b/pkgs/development/interpreters/python/passthrufun.nix
index fde2bab1e86c..d4e20aa24fc9 100644
--- a/pkgs/development/interpreters/python/passthrufun.nix
+++ b/pkgs/development/interpreters/python/passthrufun.nix
@@ -119,6 +119,8 @@ rec {
   isPy310 = pythonVersion == "3.10";
   isPy311 = pythonVersion == "3.11";
   isPy312 = pythonVersion == "3.12";
+  isPy313 = pythonVersion == "3.13";
+  isPy314 = pythonVersion == "3.14";
   isPy2 = lib.strings.substring 0 1 pythonVersion == "2";
   isPy3 = lib.strings.substring 0 1 pythonVersion == "3";
   isPy3k = isPy3;
diff --git a/pkgs/development/interpreters/python/python-packages-base.nix b/pkgs/development/interpreters/python/python-packages-base.nix
index 19c230a0b94e..66a7c823fecc 100644
--- a/pkgs/development/interpreters/python/python-packages-base.nix
+++ b/pkgs/development/interpreters/python/python-packages-base.nix
@@ -126,6 +126,8 @@ in
     isPy310
     isPy311
     isPy312
+    isPy313
+    isPy314
     isPy3k
     isPyPy
     pythonAtLeast
diff --git a/pkgs/development/python-modules/aiohttp/default.nix b/pkgs/development/python-modules/aiohttp/default.nix
index b9f1f9e1c72a..bf6a0326ff4e 100644
--- a/pkgs/development/python-modules/aiohttp/default.nix
+++ b/pkgs/development/python-modules/aiohttp/default.nix
@@ -3,6 +3,7 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch2,
   substituteAll,
   isPy310,
   isPyPy,
@@ -45,14 +46,14 @@
 
 buildPythonPackage rec {
   pname = "aiohttp";
-  version = "3.11.11";
+  version = "3.11.12";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aio-libs";
     repo = "aiohttp";
     tag = "v${version}";
-    hash = "sha256-a4h8oFJxo1TSuhIjdUC0wqJSsepmzq6vjn5mwjw4bIw=";
+    hash = "sha256-GveluMxw100ZllDF+MT4QkZVD9q7UWHwF7IBK85J/j0=";
   };
 
   patches = [
@@ -61,6 +62,12 @@ buildPythonPackage rec {
       llhttpDev = lib.getDev llhttp;
       llhttpLib = lib.getLib llhttp;
     })
+    (fetchpatch2 {
+      # https://github.com/aio-libs/aiohttp/issues/10421
+      # https://github.com/aio-libs/aiohttp/pull/10423
+      url = "https://github.com/aio-libs/aiohttp/commit/51daf7190e7674773c22011a4e443df8b5e66437.patch";
+      hash = "sha256-fADetk2tqg92J2sSgzKVTEhbQRSYl6430dxdVZuFx5I=";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/hypothesis/default.nix b/pkgs/development/python-modules/hypothesis/default.nix
index 7865b913a813..ceb79e3d04a0 100644
--- a/pkgs/development/python-modules/hypothesis/default.nix
+++ b/pkgs/development/python-modules/hypothesis/default.nix
@@ -13,6 +13,7 @@
   python,
   sortedcontainers,
   stdenv,
+  pythonAtLeast,
   pythonOlder,
   sphinxHook,
   sphinx-rtd-theme,
@@ -23,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "hypothesis";
-  version = "6.124.1";
+  version = "6.125.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -32,7 +33,7 @@ buildPythonPackage rec {
     owner = "HypothesisWorks";
     repo = "hypothesis";
     rev = "hypothesis-python-${version}";
-    hash = "sha256-d8uvkCiEASP5sF6kvuxqAss/KC0RNgG9n9ZdCcBTPCs=";
+    hash = "sha256-W+rTh9ymJTvq7KA4w8YrG6Z10tcfrtKGJ1MW716nVHs=";
   };
 
   # I tried to package sphinx-selective-exclude, but it throws
@@ -86,6 +87,9 @@ buildPythonPackage rec {
       "test_observability"
       "test_assume_has_status_reason"
       "test_observability_captures_stateful_reprs"
+    ]
+    ++ lib.optionals (pythonAtLeast "3.13") [
+      "test_clean_source"
     ];
 
   pythonImportsCheck = [ "hypothesis" ];