diff --git a/pkgs/misc/arm-trusted-firmware/default.nix b/pkgs/misc/arm-trusted-firmware/default.nix
index 743e429c0051..c4618ba9403e 100644
--- a/pkgs/misc/arm-trusted-firmware/default.nix
+++ b/pkgs/misc/arm-trusted-firmware/default.nix
@@ -39,13 +39,13 @@ let
       rec {
 
         pname = "arm-trusted-firmware${lib.optionalString (platform != null) "-${platform}"}";
-        version = "2.12.1";
+        version = "2.13.0";
 
         src = fetchFromGitHub {
           owner = "ARM-software";
           repo = "arm-trusted-firmware";
-          tag = "lts-v${version}";
-          hash = "sha256-yPWygW1swSwL3DrHPNIlTeTeV7XG4C9ALFA/+OTiz+4=";
+          tag = "v${version}";
+          hash = "sha256-rxm5RCjT/MyMCTxiEC8jQeFMrCggrb2DRbs/qDPXb20=";
         };
 
         patches = lib.optionals deleteHDCPBlobBeforeBuild [
@@ -96,6 +96,9 @@ let
         hardeningDisable = [ "all" ];
         dontStrip = true;
 
+        # breaks secondary CPU bringup on at least RK3588, maybe others
+        env.NIX_CFLAGS_COMPILE = "-fomit-frame-pointer";
+
         meta =
           with lib;
           {
diff --git a/pkgs/misc/uboot/0001-configs-rpi-allow-for-bigger-kernels.patch b/pkgs/misc/uboot/0001-configs-rpi-allow-for-bigger-kernels.patch
deleted file mode 100644
index 65497a6d4f06..000000000000
--- a/pkgs/misc/uboot/0001-configs-rpi-allow-for-bigger-kernels.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-diff --git a/board/raspberrypi/rpi/rpi.env b/board/raspberrypi/rpi/rpi.env
-index 30228285ed..0327ef74fa 100644
---- a/board/raspberrypi/rpi/rpi.env
-+++ b/board/raspberrypi/rpi/rpi.env
-@@ -69,9 +69,9 @@ fdt_high=ffffffff
- initrd_high=ffffffff
- #endif
- kernel_addr_r=0x00080000
--scriptaddr=0x02400000
--pxefile_addr_r=0x02500000
--fdt_addr_r=0x02600000
--ramdisk_addr_r=0x02700000
-+scriptaddr=0x05500000
-+pxefile_addr_r=0x05600000
-+fdt_addr_r=0x05700000
-+ramdisk_addr_r=0x05800000
- 
- boot_targets=mmc usb pxe dhcp
-
diff --git a/pkgs/misc/uboot/default.nix b/pkgs/misc/uboot/default.nix
index 90ad35aae031..8142ede3407d 100644
--- a/pkgs/misc/uboot/default.nix
+++ b/pkgs/misc/uboot/default.nix
@@ -32,10 +32,10 @@
 }@pkgs:
 
 let
-  defaultVersion = "2025.01";
+  defaultVersion = "2025.07";
   defaultSrc = fetchurl {
     url = "https://ftp.denx.de/pub/u-boot/u-boot-${defaultVersion}.tar.bz2";
-    hash = "sha256-ze99UHyT8bvZ8BXqm8IfoHQmhIFAVQGUWrxvhU1baG8=";
+    hash = "sha256-D5M/bFpCaJW/MG6T5qxTxghw5LVM2lbZUhG+yZ5jvsc=";
   };
 
   # Dependencies for the tools need to be included as either native or cross,
@@ -71,9 +71,7 @@ let
 
         src = if src == null then defaultSrc else src;
 
-        patches = [
-          ./0001-configs-rpi-allow-for-bigger-kernels.patch
-        ] ++ extraPatches;
+        patches = extraPatches;
 
         postPatch = ''
           ${lib.concatMapStrings (script: ''
@@ -222,7 +220,10 @@ in
 
   ubootAmx335xEVM = buildUBoot {
     defconfig = "am335x_evm_defconfig";
-    extraMeta.platforms = [ "armv7l-linux" ];
+    extraMeta = {
+      platforms = [ "armv7l-linux" ];
+      broken = true; # too big, exceeds memory size
+    };
     filesToInstall = [
       "MLO"
       "u-boot.img"
@@ -473,6 +474,19 @@ in
     ];
   };
 
+  ubootOrangePi5Max = buildUBoot {
+    defconfig = "orangepi-5-max-rk3588_defconfig";
+    extraMeta.platforms = [ "aarch64-linux" ];
+    BL31 = "${armTrustedFirmwareRK3588}/bl31.elf";
+    ROCKCHIP_TPL = rkbin.TPL_RK3588;
+    filesToInstall = [
+      "u-boot.itb"
+      "idbloader.img"
+      "u-boot-rockchip.bin"
+      "u-boot-rockchip-spi.bin"
+    ];
+  };
+
   ubootOrangePi5Plus = buildUBoot {
     defconfig = "orangepi-5-plus-rk3588_defconfig";
     extraMeta.platforms = [ "aarch64-linux" ];
@@ -752,13 +766,6 @@ in
   };
 
   ubootRockPro64 = buildUBoot {
-    extraPatches = [
-      # https://patchwork.ozlabs.org/project/uboot/list/?series=237654&archive=both&state=*
-      (fetchpatch {
-        url = "https://patchwork.ozlabs.org/series/237654/mbox/";
-        sha256 = "0aiw9zk8w4msd3v8nndhkspjify0yq6a5f0zdy6mhzs0ilq896c3";
-      })
-    ];
     defconfig = "rockpro64-rk3399_defconfig";
     extraMeta.platforms = [ "aarch64-linux" ];
     BL31 = "${armTrustedFirmwareRK3399}/bl31.elf";
@@ -781,7 +788,10 @@ in
 
   ubootSheevaplug = buildUBoot {
     defconfig = "sheevaplug_defconfig";
-    extraMeta.platforms = [ "armv5tel-linux" ];
+    extraMeta = {
+      platforms = [ "armv5tel-linux" ];
+      broken = true; # too big, exceeds partition size
+    };
     filesToInstall = [ "u-boot.kwb" ];
   };
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index acd8d3a0cdef..82cbad01aa57 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -11347,6 +11347,7 @@ with pkgs;
     ubootOrangePi3
     ubootOrangePi3B
     ubootOrangePi5
+    ubootOrangePi5Max
     ubootOrangePi5Plus
     ubootOrangePiPc
     ubootOrangePiZeroPlus2H5