diff --git a/pkgs/tools/system/netdata/dashboard-v3-add.patch b/pkgs/tools/system/netdata/dashboard-v3-add.patch
index a5d3dd17484b..2a80da941cdd 100644
--- a/pkgs/tools/system/netdata/dashboard-v3-add.patch
+++ b/pkgs/tools/system/netdata/dashboard-v3-add.patch
@@ -1,16 +1,22 @@
 diff --git a/packaging/cmake/Modules/NetdataDashboard.cmake b/packaging/cmake/Modules/NetdataDashboard.cmake
-index 098eaffcf..e52375bd0 100644
+index 098eaffcf..9f827d840 100644
 --- a/packaging/cmake/Modules/NetdataDashboard.cmake
 +++ b/packaging/cmake/Modules/NetdataDashboard.cmake
-@@ -26,29 +26,12 @@ function(bundle_dashboard)
+@@ -21,37 +21,11 @@ endfunction()
+ # This is unfortunately complicated due to how we need to handle the
+ # generation of the CMakeLists file for the dashboard code.
+ function(bundle_dashboard)
+-  include(ExternalProject)
+-
    set(dashboard_src_dir "${CMAKE_BINARY_DIR}/dashboard-src")
-   set(dashboard_src_prefix "${dashboard_src_dir}/dist/agent")
+-  set(dashboard_src_prefix "${dashboard_src_dir}/dist/agent")
++  set(dashboard_src_prefix "${dashboard_src_dir}/agent")
    set(dashboard_bin_dir "${CMAKE_BINARY_DIR}/dashboard-bin")
 -  set(DASHBOARD_URL "https://app.netdata.cloud/agent.tar.gz" CACHE STRING
 -      "URL used to fetch the local agent dashboard code")
-
-   message(STATUS "Preparing local agent dashboard code")
-
+-
+-  message(STATUS "Preparing local agent dashboard code")
+-
 -  message(STATUS "  Fetching ${DASHBOARD_URL}")
 -  file(DOWNLOAD
 -       "${DASHBOARD_URL}"
@@ -25,11 +31,14 @@ index 098eaffcf..e52375bd0 100644
 -  else()
 -    message(STATUS "  Fetching ${DASHBOARD_URL} -- Done")
 -  endif()
--
-   message(STATUS "  Extracting dashboard code")
-   extract_gzipped_tarball(
+ 
+-  message(STATUS "  Extracting dashboard code")
+-  extract_gzipped_tarball(
 -    "${CMAKE_BINARY_DIR}/dashboard.tar.gz"
-+    "@dashboardTarball@"
-     "${dashboard_src_dir}"
-   )
-   message(STATUS "  Extracting dashboard code -- Done")
+-    "${dashboard_src_dir}"
+-  )
+-  message(STATUS "  Extracting dashboard code -- Done")
++  file(COPY "@dashboardPath@/" DESTINATION "${dashboard_src_dir}" NO_SOURCE_PERMISSIONS)
+ 
+   handle_braindead_versioning_insanity("${dashboard_src_prefix}")
+ 
diff --git a/pkgs/tools/system/netdata/default.nix b/pkgs/tools/system/netdata/default.nix
index d52f51884f23..1140ae4d7086 100644
--- a/pkgs/tools/system/netdata/default.nix
+++ b/pkgs/tools/system/netdata/default.nix
@@ -9,7 +9,7 @@
   curl,
   dlib,
   fetchFromGitHub,
-  fetchurl,
+  fetchzip,
   flex,
   freeipmi,
   go,
@@ -67,13 +67,13 @@ stdenv.mkDerivation (
   finalAttrs:
   {
     pname = "netdata";
-    version = "2.9.0";
+    version = "2.10.3";
 
     src = fetchFromGitHub {
       owner = "netdata";
       repo = "netdata";
       rev = "v${finalAttrs.version}";
-      hash = "sha256-QA8YI1cHiPjrTZc9fy81i9YGgGTdE98Eo3xQtVn4/nY=";
+      hash = "sha256-ryX+C3zuY7vONPeB4ocXDPttU5aSYbj1ThTosCSxmys=";
       fetchSubmodules = true;
     };
 
@@ -141,16 +141,19 @@ stdenv.mkDerivation (
       #     https://github.com/netdata/netdata/security/advisories/GHSA-pmhq-4cxq-wj93
       ./ndsudo-fix-path.patch
 
+      ./disable-binary-permission-check.patch
+
       ./use-local-corrosion.patch
       ./use-local-libbacktrace.patch
     ]
     ++ lib.optional withCloudUi (
       replaceVars ./dashboard-v3-add.patch {
         # FIXME web.archive.org link can be replace once https://github.com/netdata/netdata-cloud/issues/1081 resolved
-        # last update 04/01/2025 04:45:14
-        dashboardTarball = fetchurl {
-          url = "https://web.archive.org/web/20250401044514/https://app.netdata.cloud/agent.tar.gz";
-          hash = "sha256-NtmM1I3VrvFErMoBl+w63Nt0DzOOsaB98cxE/axm8mE=";
+        # last update 12/10/2025 21:25:17
+        dashboardPath = fetchzip {
+          # The `if_` suffix is intentional, with out it the hash will vary depending on the region
+          url = "https://web.archive.org/web/20251210212517if_/https://app.netdata.cloud/agent.tar.gz";
+          hash = "sha256-8ovYkvt324l6f0YT6wTG+Y2u7VaVqotAdssnNTtHIEk=";
         };
       }
     );
@@ -308,7 +311,7 @@ stdenv.mkDerivation (
 
           sourceRoot = "${finalAttrs.src.name}/src/go/plugin/go.d";
 
-          vendorHash = "sha256-VBr6VZvTKh2GFtcVSHCVNhzS8gvl4VFTNLtrK81Y92I=";
+          vendorHash = "sha256-HRe1bcVIQVzwPZnGlAK5A8AO1VTcjFajkPwBVdl4UIA=";
           proxyVendor = true;
           doCheck = false;
 
@@ -361,7 +364,7 @@ stdenv.mkDerivation (
             src
             cargoRoot
             ;
-          hash = "sha256-M9XECeLu58vBTJE4hFkoshc/ze/HF6rBERcjbjAHOJ0=";
+          hash = "sha256-mxFpT95e+NMqjJOIRqM+yKHGQHfpWmIFHqFNiiiqXOY=";
         })
         (rustPlatform.fetchCargoVendor {
           pname = "${finalAttrs.pname}-nd-jf";
diff --git a/pkgs/tools/system/netdata/disable-binary-permission-check.patch b/pkgs/tools/system/netdata/disable-binary-permission-check.patch
new file mode 100644
index 000000000000..d28185f0e644
--- /dev/null
+++ b/pkgs/tools/system/netdata/disable-binary-permission-check.patch
@@ -0,0 +1,56 @@
+diff --git a/src/go/plugin/go.d/pkg/pathvalidate/validate_unix.go b/src/go/plugin/go.d/pkg/pathvalidate/validate_unix.go
+index fae97e7be..153999fa3 100644
+--- a/src/go/plugin/go.d/pkg/pathvalidate/validate_unix.go
++++ b/src/go/plugin/go.d/pkg/pathvalidate/validate_unix.go
+@@ -8,6 +8,7 @@ import (
+ 	"fmt"
+ 	"os"
+ 	"path/filepath"
++	"strings"
+ 	"syscall"
+ )
+ 
+@@ -42,13 +43,15 @@ func ValidateBinaryPath(path string) (string, error) {
+ 	if !ok {
+ 		return "", fmt.Errorf("unable to get file stat information for %s", absPath)
+ 	}
+-	if fileStat.Uid != 0 {
+-		return "", fmt.Errorf("binary at %s must be owned by root (current uid: %d)", absPath, fileStat.Uid)
+-	}
++	if !strings.HasPrefix(absPath, "/nix/store/") {
++		if fileStat.Uid != 0 {
++			return "", fmt.Errorf("binary at %s must be owned by root (current uid: %d)", absPath, fileStat.Uid)
++		}
+ 
+-	if perm := fileInfo.Mode().Perm(); perm&0022 != 0 {
+-		return "", fmt.Errorf("binary at %s must not be writable by group/others (current permissions: %s / %04o)",
+-			absPath, fileInfo.Mode().String(), perm)
++		if perm := fileInfo.Mode().Perm(); perm&0022 != 0 {
++			return "", fmt.Errorf("binary at %s must not be writable by group/others (current permissions: %s / %04o)",
++				absPath, fileInfo.Mode().String(), perm)
++		}
+ 	}
+ 
+ 	// Step 6: Check executable bit
+@@ -67,13 +70,15 @@ func ValidateBinaryPath(path string) (string, error) {
+ 		if !ok {
+ 			return "", fmt.Errorf("unable to get directory stat information for %s", dir)
+ 		}
+-		if dirStat.Uid != 0 {
+-			return "", fmt.Errorf("directory %s must be owned by root (current uid: %d)", dir, dirStat.Uid)
+-		}
++		if !strings.HasPrefix(dir, "/nix/store") {
++			if dirStat.Uid != 0 {
++				return "", fmt.Errorf("directory %s must be owned by root (current uid: %d)", dir, dirStat.Uid)
++			}
+ 
+-		if perm := dirInfo.Mode().Perm(); perm&0022 != 0 {
+-			return "", fmt.Errorf("directory %s must not be writable by group/others (current permissions: %s / %04o)",
+-				dir, dirInfo.Mode().String(), perm)
++			if perm := dirInfo.Mode().Perm(); perm&0022 != 0 {
++				return "", fmt.Errorf("directory %s must not be writable by group/others (current permissions: %s / %04o)",
++					dir, dirInfo.Mode().String(), perm)
++			}
+ 		}
+ 
+ 		if dir == filepath.Dir(dir) {