diff --git a/pkgs/by-name/ba/baddns/package.nix b/pkgs/by-name/ba/baddns/package.nix
index 543036b7291e..260ec8e05a65 100644
--- a/pkgs/by-name/ba/baddns/package.nix
+++ b/pkgs/by-name/ba/baddns/package.nix
@@ -5,28 +5,26 @@
   python3,
 }:
 
-python3.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "baddns";
-  version = "1.12.294";
+  version = "2.4.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "blacklanternsecurity";
     repo = "baddns";
-    tag = version;
-    hash = "sha256-HAVoCyI7yxCdAR4qq7yXJz3YxkPnhBdeXLJZmzZpwF4=";
+    tag = finalAttrs.version;
+    hash = "sha256-3SKR94/KBjTxk7swPKaIn2zzAjYMSEqqLALeCBjwMFg=";
   };
 
-  pythonRelaxDeps = true;
-
-  build-system = with python3.pkgs; [
-    poetry-core
-    poetry-dynamic-versioning
-  ];
+  build-system = with python3.pkgs; [ hatchling ];
 
   dependencies = with python3.pkgs; [
     colorama
+    cloudcheck
     dnspython
+    blastdns
+    blasthttp
     httpx
     python-dateutil
     python-whois
@@ -49,23 +47,34 @@ python3.pkgs.buildPythonApplication rec {
   disabledTests = [
     # Tests require network access
     "test_cli_cname_http"
+    "test_cli_cname_nxdomain"
     "test_cli_direct"
     "test_cli_validation_customnameservers_valid"
     "test_cname_http_bigcartel_match"
     "test_cname_whois_unregistered_baddata"
     "test_cname_whois_unregistered_match"
     "test_cname_whois_unregistered_missingdata"
+    "test_custom_signatures_dir"
+    "test_debug_mode"
+    "test_default_resolver"
+    "test_dmarc"
+    "test_min_confidence_confirmed_excludes_high"
+    "test_min_confidence_filters_findings"
+    "test_min_severity_critical_excludes_medium"
+    "test_min_severity_low_includes_medium"
     "test_modules_customnameservers"
     "test_references_cname_css"
     "test_references_cname_js"
+    "test_silent_mode"
+    "test_spf"
   ];
 
   meta = {
     description = "Tool to check subdomains for subdomain takeovers and other DNS issues";
     homepage = "https://github.com/blacklanternsecurity/baddns/";
-    changelog = "https://github.com/blacklanternsecurity/baddns/releases/tag/${src.tag}";
+    changelog = "https://github.com/blacklanternsecurity/baddns/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "baddns";
   };
-}
+})
diff --git a/pkgs/development/python-modules/blastdns/default.nix b/pkgs/development/python-modules/blastdns/default.nix
new file mode 100644
index 000000000000..77c7ea11b3ac
--- /dev/null
+++ b/pkgs/development/python-modules/blastdns/default.nix
@@ -0,0 +1,84 @@
+{
+  lib,
+  buildPythonPackage,
+  cargo,
+  fetchFromGitHub,
+  nix-update-script,
+  orjson,
+  pydantic,
+  pytest-asyncio,
+  pytestCheckHook,
+  rustc,
+  rustPlatform,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "blastdns";
+  version = "1.9.1-unstable-2026-04-15";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  __darwinAllowLocalNetworking = true;
+
+  src = fetchFromGitHub {
+    owner = "blacklanternsecurity";
+    repo = "blastdns";
+    rev = "a35704b0ec2f6d800da8f85505bfff1893172869";
+    hash = "sha256-N0IbnKz/JdZogJhRHMNaZhhMt2LM9Vhs1ETLqeksE2k=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-wBC/T/XUSfxurujQy/B8zXxZthpUWczKT9qdnG4BK7w=";
+  };
+
+  build-system = [
+    cargo
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+    rustc
+  ];
+
+  dependencies = [
+    orjson
+    pydantic
+  ];
+
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
+  # Run tests outside the source package path so imports resolve to the
+  # installed wheel, which contains the compiled _native extension.
+  preCheck = ''
+    cd "$TMPDIR"
+    cp -r /build/source/blastdns/tests ./tests
+  '';
+
+  pytestFlags = [
+    "--import-mode=importlib"
+    "tests"
+  ];
+
+  disabledTests = [
+    # Tests requires host system DNS config files that are absent in sandboxed builds.
+    "test_get_system_resolvers"
+    "test_client_resolve"
+    "test_mock_matches_real_client"
+    "test_zone_transfer_success"
+    "test_zone_transfer_nonexistent_zone"
+  ];
+
+  pythonImportsCheck = [ "blastdns" ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Ultra-fast DNS resolver";
+    homepage = "https://github.com/blacklanternsecurity/blastdns";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/cloudcheck/default.nix b/pkgs/development/python-modules/cloudcheck/default.nix
index b9094e6ca190..aada97af0dce 100644
--- a/pkgs/development/python-modules/cloudcheck/default.nix
+++ b/pkgs/development/python-modules/cloudcheck/default.nix
@@ -2,56 +2,82 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  httpx,
-  poetry-core,
-  poetry-dynamic-versioning,
+  fetchurl,
+  openssl,
+  perl,
+  pkg-config,
   pydantic,
   pytest-asyncio,
   pytestCheckHook,
-  radixtarget,
-  regex,
+  requests,
+  rustPlatform,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "cloudcheck";
-  version = "7.2.11";
+  version = "11.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "blacklanternsecurity";
     repo = "cloudcheck";
-    tag = "v${version}";
-    hash = "sha256-z2KJ6EaqQLc2oQBZCfKMejPlTdgYGzmDPm/rGLHXCQA=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ao5NSGu2QOPn0P/51vjIu71IlhTWd1h4q9q++B+p4Po=";
   };
 
-  pythonRelaxDeps = [
-    "radixtarget"
-    "regex"
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-8uMyBhD8dybSFS4KqFHBfamyTdFYawoM0P4R6WAy10E=";
+  };
+
+  nativeBuildInputs = with rustPlatform; [
+    cargoSetupHook
+    maturinBuildHook
+    perl
+    pkg-config
   ];
 
-  build-system = [
-    poetry-core
-    poetry-dynamic-versioning
-  ];
+  env.SWAGGER_UI_DOWNLOAD_URL =
+    let
+      swaggerUi = fetchurl {
+        url = "https://github.com/swagger-api/swagger-ui/archive/refs/tags/v5.17.14.zip";
+        hash = "sha256-SBJE0IEgl7Efuu73n3HZQrFxYX+cn5UU5jrL4T5xzNw=";
+      };
+    in
+    "file://${swaggerUi}";
 
-  dependencies = [
-    httpx
-    pydantic
-    radixtarget
-    regex
-  ];
+  buildInputs = [ openssl ];
 
   nativeCheckInputs = [
+    pydantic
     pytest-asyncio
     pytestCheckHook
+    requests
   ];
 
   pythonImportsCheck = [ "cloudcheck" ];
 
+  disabledTestPaths = [
+    # Test requires network access
+    "cloudcheck_update/test_cloudcheck_update.py"
+  ];
+
+  disabledTests = [
+    # Tests require network access
+    "test_lookup_google_dns"
+    "test_lookup_amazon_domain"
+    "test_lookup_endpoint"
+  ];
+
+  preCheck = ''
+    rm -rf cloudcheck
+  '';
+
   meta = {
     description = "Module to check whether an IP address or hostname belongs to popular cloud providers";
     homepage = "https://github.com/blacklanternsecurity/cloudcheck";
+    changelog = "https://github.com/blacklanternsecurity/cloudcheck/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 83f0e6b08cdb..0a7fe3a0c65c 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2144,6 +2144,8 @@ self: super: with self; {
 
   blake3 = callPackage ../development/python-modules/blake3 { };
 
+  blastdns = callPackage ../development/python-modules/blastdns { };
+
   blasthttp = callPackage ../development/python-modules/blasthttp { };
 
   ble-serial = callPackage ../development/python-modules/ble-serial { };