diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 230358d5b068..9830b15a041a 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -5380,6 +5380,13 @@
     githubId = 176372446;
     name = "Katja Kwast";
   };
+  curious = {
+    email = "curious@curious.host";
+    matrix = "@curious:curious.host";
+    github = "Curious-r";
+    githubId = 19733878;
+    name = "Curious";
+  };
   curran = {
     email = "curran@mercury.com";
     github = "curranosaurus";
diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index dce9eed1f083..89da6c4844f8 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -141,6 +141,8 @@
 
 - `services.clamsmtp` is unmaintained and was removed from Nixpkgs.
 
+- `prosody` gained a config check option named `services.prosody.checkConfig` which runs `prosodyctl check config` and is turned on by default.
+
 - `services.dependency-track` removed its configuration of the JVM heap size. This lets the JVM choose its maximum heap size automatically, which should work much better in practice for most users. For deployments on systems with little RAM, it may now be necessary to manually configure a maximum heap size using  {option}`services.dependency-track.javaArgs`.
 
 - `services.dnscrypt-proxy2` gains a `package` option to specify dnscrypt-proxy package to use.
diff --git a/nixos/modules/services/networking/prosody.nix b/nixos/modules/services/networking/prosody.nix
index f4d9172bab3f..468549281fc8 100644
--- a/nixos/modules/services/networking/prosody.nix
+++ b/nixos/modules/services/networking/prosody.nix
@@ -9,31 +9,26 @@ with lib;
 let
   cfg = config.services.prosody;
 
-  sslOpts =
-    { ... }:
-    {
+  sslOpts = _: {
+    options = {
+      key = mkOption {
+        type = types.path;
+        description = "Path to the key file.";
+      };
 
-      options = {
-
-        key = mkOption {
-          type = types.path;
-          description = "Path to the key file.";
-        };
-
-        # TODO: rename to certificate to match the prosody config
-        cert = mkOption {
-          type = types.path;
-          description = "Path to the certificate file.";
-        };
-
-        extraOptions = mkOption {
-          type = types.attrs;
-          default = { };
-          description = "Extra SSL configuration options.";
-        };
+      # TODO: rename to certificate to match the prosody config
+      cert = mkOption {
+        type = types.path;
+        description = "Path to the certificate file.";
+      };
 
+      extraOptions = mkOption {
+        type = types.attrs;
+        default = { };
+        description = "Extra SSL configuration options.";
       };
     };
+  };
 
   discoOpts = {
     options = {
@@ -301,246 +296,349 @@ let
     };
   '';
 
-  mucOpts =
-    { ... }:
-    {
-      options = {
-        domain = mkOption {
-          type = types.str;
-          description = "Domain name of the MUC";
-        };
-        name = mkOption {
-          type = types.str;
-          description = "The name to return in service discovery responses for the MUC service itself";
-          default = "Prosody Chatrooms";
-        };
-        restrictRoomCreation = mkOption {
-          type = types.enum [
-            true
-            false
-            "admin"
-            "local"
-          ];
-          default = false;
-          description = "Restrict room creation to server admins";
-        };
-        maxHistoryMessages = mkOption {
-          type = types.int;
-          default = 20;
-          description = "Specifies a limit on what each room can be configured to keep";
-        };
-        roomLocking = mkOption {
-          type = types.bool;
-          default = true;
-          description = ''
-            Enables room locking, which means that a room must be
-            configured before it can be used. Locked rooms are invisible
-            and cannot be entered by anyone but the creator
-          '';
-        };
-        roomLockTimeout = mkOption {
-          type = types.int;
-          default = 300;
-          description = ''
-            Timeout after which the room is destroyed or unlocked if not
-            configured, in seconds
-          '';
-        };
-        tombstones = mkOption {
-          type = types.bool;
-          default = true;
-          description = ''
-            When a room is destroyed, it leaves behind a tombstone which
-            prevents the room being entered or recreated. It also allows
-            anyone who was not in the room at the time it was destroyed
-            to learn about it, and to update their bookmarks. Tombstones
-            prevents the case where someone could recreate a previously
-            semi-anonymous room in order to learn the real JIDs of those
-            who often join there.
-          '';
-        };
-        tombstoneExpiry = mkOption {
-          type = types.int;
-          default = 2678400;
-          description = ''
-            This settings controls how long a tombstone is considered
-            valid. It defaults to 31 days. After this time, the room in
-            question can be created again.
-          '';
-        };
-        allowners_muc = mkOption {
-          type = types.bool;
-          default = false;
-          description = ''
-            Add module allowners, any user in chat is able to
-            kick other. Usefull in jitsi-meet to kick ghosts.
-          '';
-        };
-        vcard_muc = mkOption {
-          type = types.bool;
-          default = true;
-          description = "Adds the ability to set vCard for Multi User Chat rooms";
-        };
-
-        # Extra parameters. Defaulting to prosody default values.
-        # Adding them explicitly to make them visible from the options
-        # documentation.
-        #
-        # See https://prosody.im/doc/modules/mod_muc for more details.
-        roomDefaultPublic = mkOption {
-          type = types.bool;
-          default = true;
-          description = "If set, the MUC rooms will be public by default.";
-        };
-        roomDefaultMembersOnly = mkOption {
-          type = types.bool;
-          default = false;
-          description = "If set, the MUC rooms will only be accessible to the members by default.";
-        };
-        roomDefaultModerated = mkOption {
-          type = types.bool;
-          default = false;
-          description = "If set, the MUC rooms will be moderated by default.";
-        };
-        roomDefaultPublicJids = mkOption {
-          type = types.bool;
-          default = false;
-          description = "If set, the MUC rooms will display the public JIDs by default.";
-        };
-        roomDefaultChangeSubject = mkOption {
-          type = types.bool;
-          default = false;
-          description = "If set, the rooms will display the public JIDs by default.";
-        };
-        roomDefaultHistoryLength = mkOption {
-          type = types.int;
-          default = 20;
-          description = "Number of history message sent to participants by default.";
-        };
-        roomDefaultLanguage = mkOption {
-          type = types.str;
-          default = "en";
-          description = "Default room language.";
-        };
-        extraConfig = mkOption {
-          type = types.lines;
-          default = "";
-          description = "Additional MUC specific configuration";
-        };
+  mucOpts = _: {
+    options = {
+      domain = mkOption {
+        type = types.str;
+        description = "Domain name of the MUC";
       };
-    };
-
-  uploadHttpOpts =
-    { ... }:
-    {
-      options = {
-        domain = mkOption {
-          type = types.nullOr types.str;
-          description = "Domain name for the http-upload service";
-        };
-        uploadFileSizeLimit = mkOption {
-          type = types.str;
-          default = "50 * 1024 * 1024";
-          description = "Maximum file size, in bytes. Defaults to 50MB.";
-        };
-        uploadExpireAfter = mkOption {
-          type = types.str;
-          default = "60 * 60 * 24 * 7";
-          description = "Max age of a file before it gets deleted, in seconds.";
-        };
-        userQuota = mkOption {
-          type = types.nullOr types.int;
-          default = null;
-          example = 1234;
-          description = ''
-            Maximum size of all uploaded files per user, in bytes. There
-            will be no quota if this option is set to null.
-          '';
-        };
-        httpUploadPath = mkOption {
-          type = types.str;
-          description = ''
-            Directory where the uploaded files will be stored when the http_upload module is used.
-            By default, uploaded files are put in a sub-directory of the default Prosody storage path (usually /var/lib/prosody).
-          '';
-          default = "/var/lib/prosody";
-        };
+      name = mkOption {
+        type = types.str;
+        description = "The name to return in service discovery responses for the MUC service itself";
+        default = "Prosody Chatrooms";
       };
-    };
-
-  httpFileShareOpts =
-    { ... }:
-    {
-      freeformType =
-        with types;
-        let
-          atom = oneOf [
-            int
-            bool
-            str
-            (listOf atom)
-          ];
-        in
-        attrsOf (nullOr atom)
-        // {
-          description = "int, bool, string or list of them";
-        };
-      options.domain = mkOption {
-        type = with types; nullOr str;
-        description = "Domain name for a http_file_share service.";
+      restrictRoomCreation = mkOption {
+        type = types.enum [
+          true
+          false
+          "admin"
+          "local"
+        ];
+        default = false;
+        description = "Restrict room creation to server admins";
       };
-    };
-
-  vHostOpts =
-    { ... }:
-    {
-
-      options = {
-
-        # TODO: require attribute
-        domain = mkOption {
-          type = types.str;
-          description = "Domain name";
-        };
-
-        enabled = mkOption {
-          type = types.bool;
-          default = false;
-          description = "Whether to enable the virtual host";
-        };
-
-        ssl = mkOption {
-          type = types.nullOr (types.submodule sslOpts);
-          default = null;
-          description = "Paths to SSL files";
-        };
-
-        extraConfig = mkOption {
-          type = types.lines;
-          default = "";
-          description = "Additional virtual host specific configuration";
-        };
-
+      maxHistoryMessages = mkOption {
+        type = types.int;
+        default = 20;
+        description = "Specifies a limit on what each room can be configured to keep";
+      };
+      roomLocking = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Enables room locking, which means that a room must be
+          configured before it can be used. Locked rooms are invisible
+          and cannot be entered by anyone but the creator
+        '';
+      };
+      roomLockTimeout = mkOption {
+        type = types.int;
+        default = 300;
+        description = ''
+          Timeout after which the room is destroyed or unlocked if not
+          configured, in seconds
+        '';
+      };
+      tombstones = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          When a room is destroyed, it leaves behind a tombstone which
+          prevents the room being entered or recreated. It also allows
+          anyone who was not in the room at the time it was destroyed
+          to learn about it, and to update their bookmarks. Tombstones
+          prevents the case where someone could recreate a previously
+          semi-anonymous room in order to learn the real JIDs of those
+          who often join there.
+        '';
+      };
+      tombstoneExpiry = mkOption {
+        type = types.int;
+        default = 2678400;
+        description = ''
+          This settings controls how long a tombstone is considered
+          valid. It defaults to 31 days. After this time, the room in
+          question can be created again.
+        '';
+      };
+      allowners_muc = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Add module allowners, any user in chat is able to
+          kick other. Useful in jitsi-meet to kick ghosts.
+        '';
+      };
+      vcard_muc = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Adds the ability to set vCard for Multi User Chat rooms";
       };
 
+      # Extra parameters. Defaulting to prosody default values.
+      # Adding them explicitly to make them visible from the options
+      # documentation.
+      #
+      # See https://prosody.im/doc/modules/mod_muc for more details.
+      roomDefaultPublic = mkOption {
+        type = types.bool;
+        default = true;
+        description = "If set, the MUC rooms will be public by default.";
+      };
+      roomDefaultMembersOnly = mkOption {
+        type = types.bool;
+        default = false;
+        description = "If set, the MUC rooms will only be accessible to the members by default.";
+      };
+      roomDefaultModerated = mkOption {
+        type = types.bool;
+        default = false;
+        description = "If set, the MUC rooms will be moderated by default.";
+      };
+      roomDefaultPublicJids = mkOption {
+        type = types.bool;
+        default = false;
+        description = "If set, the MUC rooms will display the public JIDs by default.";
+      };
+      roomDefaultChangeSubject = mkOption {
+        type = types.bool;
+        default = false;
+        description = "If set, the rooms will display the public JIDs by default.";
+      };
+      roomDefaultHistoryLength = mkOption {
+        type = types.int;
+        default = 20;
+        description = "Number of history message sent to participants by default.";
+      };
+      roomDefaultLanguage = mkOption {
+        type = types.str;
+        default = "en";
+        description = "Default room language.";
+      };
+      extraConfig = mkOption {
+        type = types.lines;
+        default = "";
+        description = "Additional MUC specific configuration";
+      };
     };
+  };
+
+  uploadHttpOpts = _: {
+    options = {
+      domain = mkOption {
+        type = types.nullOr types.str;
+        description = "Domain name for the http-upload service";
+      };
+      uploadFileSizeLimit = mkOption {
+        type = types.str;
+        default = "50 * 1024 * 1024";
+        description = "Maximum file size, in bytes. Defaults to 50MB.";
+      };
+      uploadExpireAfter = mkOption {
+        type = types.str;
+        default = "60 * 60 * 24 * 7";
+        description = "Max age of a file before it gets deleted, in seconds.";
+      };
+      userQuota = mkOption {
+        type = types.nullOr types.int;
+        default = null;
+        example = 1234;
+        description = ''
+          Maximum size of all uploaded files per user, in bytes. There
+          will be no quota if this option is set to null.
+        '';
+      };
+      httpUploadPath = mkOption {
+        type = types.str;
+        description = ''
+          Directory where the uploaded files will be stored when the http_upload module is used.
+          By default, uploaded files are put in a sub-directory of the default Prosody storage path (usually /var/lib/prosody).
+        '';
+        default = "/var/lib/prosody";
+      };
+    };
+  };
+
+  httpFileShareOpts = _: {
+    freeformType =
+      with types;
+      let
+        atom = oneOf [
+          int
+          bool
+          str
+          (listOf atom)
+        ];
+      in
+      attrsOf (nullOr atom)
+      // {
+        description = "int, bool, string or list of them";
+      };
+    options.domain = mkOption {
+      type = with types; nullOr str;
+      description = "Domain name for a http_file_share service.";
+    };
+  };
+
+  vHostOpts = _: {
+    options = {
+      # TODO: require attribute
+      domain = mkOption {
+        type = types.str;
+        description = "Domain name";
+      };
+
+      enabled = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Whether to enable the virtual host";
+      };
+
+      ssl = mkOption {
+        type = types.nullOr (types.submodule sslOpts);
+        default = null;
+        description = "Paths to SSL files";
+      };
+
+      extraConfig = mkOption {
+        type = types.lines;
+        default = "";
+        description = "Additional virtual host specific configuration";
+      };
+    };
+  };
+
+  configFile =
+    let
+      httpDiscoItems =
+        optional (cfg.uploadHttp != null) {
+          url = cfg.uploadHttp.domain;
+          description = "HTTP upload endpoint";
+        }
+        ++ optional (cfg.httpFileShare != null) {
+          url = cfg.httpFileShare.domain;
+          description = "HTTP file share endpoint";
+        };
+      mucDiscoItems = builtins.foldl' (
+        acc: muc:
+        [
+          {
+            url = muc.domain;
+            description = "${muc.domain} MUC endpoint";
+          }
+        ]
+        ++ acc
+      ) [ ] cfg.muc;
+      discoItems = cfg.disco_items ++ httpDiscoItems ++ mucDiscoItems;
+    in
+    pkgs.writeText "prosody.cfg.lua" ''
+      pidfile = "/run/prosody/prosody.pid"
+
+      log = ${cfg.log}
+
+      data_path = "${cfg.dataDir}"
+      plugin_paths = {
+        ${lib.concatStringsSep ", " (map (n: "\"${n}\"") cfg.extraPluginPaths)}
+      }
+
+      ${optionalString (cfg.ssl != null) (createSSLOptsStr cfg.ssl)}
+
+      admins = ${toLua cfg.admins}
+
+      modules_enabled = {
+
+        ${lib.concatStringsSep "\n  " (
+          lib.mapAttrsToList (name: val: optionalString val "${toLua name};") cfg.modules
+        )}
+        ${lib.concatStringsSep "\n" (map (x: "${toLua x};") cfg.package.communityModules)}
+        ${lib.concatStringsSep "\n" (map (x: "${toLua x};") cfg.extraModules)}
+      };
+
+      disco_items = {
+      ${lib.concatStringsSep "\n" (builtins.map (x: ''{ "${x.url}", "${x.description}"};'') discoItems)}
+      };
+
+      allow_registration = ${toLua cfg.allowRegistration}
+
+      c2s_require_encryption = ${toLua cfg.c2sRequireEncryption}
+
+      s2s_require_encryption = ${toLua cfg.s2sRequireEncryption}
+      s2s_secure_auth = ${toLua cfg.s2sSecureAuth}
+      s2s_insecure_domains = ${toLua cfg.s2sInsecureDomains}
+      s2s_secure_domains = ${toLua cfg.s2sSecureDomains}
+
+      authentication = ${toLua cfg.authentication}
+
+      http_interfaces = ${toLua cfg.httpInterfaces}
+      https_interfaces = ${toLua cfg.httpsInterfaces}
+
+      http_ports = ${toLua cfg.httpPorts}
+      https_ports = ${toLua cfg.httpsPorts}
+
+      ${cfg.extraConfig}
+
+      ${lib.concatMapStrings (muc: ''
+        Component ${toLua muc.domain} "muc"
+            modules_enabled = { "muc_mam"; ${optionalString muc.vcard_muc ''"vcard_muc";''} ${optionalString muc.allowners_muc ''"muc_allowners";''}  }
+            name = ${toLua muc.name}
+            restrict_room_creation = ${toLua muc.restrictRoomCreation}
+            max_history_messages = ${toLua muc.maxHistoryMessages}
+            muc_room_locking = ${toLua muc.roomLocking}
+            muc_room_lock_timeout = ${toLua muc.roomLockTimeout}
+            muc_tombstones = ${toLua muc.tombstones}
+            muc_tombstone_expiry = ${toLua muc.tombstoneExpiry}
+            muc_room_default_public = ${toLua muc.roomDefaultPublic}
+            muc_room_default_members_only = ${toLua muc.roomDefaultMembersOnly}
+            muc_room_default_moderated = ${toLua muc.roomDefaultModerated}
+            muc_room_default_public_jids = ${toLua muc.roomDefaultPublicJids}
+            muc_room_default_change_subject = ${toLua muc.roomDefaultChangeSubject}
+            muc_room_default_history_length = ${toLua muc.roomDefaultHistoryLength}
+            muc_room_default_language = ${toLua muc.roomDefaultLanguage}
+            ${muc.extraConfig}
+      '') cfg.muc}
+
+      ${lib.optionalString (cfg.uploadHttp != null) ''
+        Component ${toLua cfg.uploadHttp.domain} "http_upload"
+            http_upload_file_size_limit = ${cfg.uploadHttp.uploadFileSizeLimit}
+            http_upload_expire_after = ${cfg.uploadHttp.uploadExpireAfter}
+            ${lib.optionalString (
+              cfg.uploadHttp.userQuota != null
+            ) "http_upload_quota = ${toLua cfg.uploadHttp.userQuota}"}
+            http_upload_path = ${toLua cfg.uploadHttp.httpUploadPath}
+      ''}
+
+      ${lib.optionalString (cfg.httpFileShare != null) ''
+        Component ${toLua cfg.httpFileShare.domain} "http_file_share"
+        ${settingsToLua "  http_file_share_" (cfg.httpFileShare // { domain = null; })}
+      ''}
+
+      ${lib.concatStringsSep "\n" (
+        lib.mapAttrsToList (n: v: ''
+          VirtualHost "${v.domain}"
+            enabled = ${boolToString v.enabled};
+            ${optionalString (v.ssl != null) (createSSLOptsStr v.ssl)}
+            ${v.extraConfig}
+        '') cfg.virtualHosts
+      )}
+    '';
 
 in
-
 {
-
-  ###### interface
-
   options = {
-
     services.prosody = {
-
       enable = mkOption {
         type = types.bool;
         default = false;
         description = "Whether to enable the prosody server";
       };
 
+      checkConfig = mkOption {
+        type = types.bool;
+        default = true;
+        example = false;
+        description = "Check the configuration file with `prosodyctl check config`";
+      };
+
       xmppComplianceSuite = mkOption {
         type = types.bool;
         default = true;
@@ -818,14 +916,10 @@ in
           }
         '';
       };
-
     };
   };
 
-  ###### implementation
-
   config = mkIf cfg.enable {
-
     assertions =
       let
         genericErrMsg = ''
@@ -860,125 +954,23 @@ in
 
     environment.systemPackages = [ cfg.package ];
 
-    environment.etc."prosody/prosody.cfg.lua".text =
-      let
-        httpDiscoItems =
-          optional (cfg.uploadHttp != null) {
-            url = cfg.uploadHttp.domain;
-            description = "HTTP upload endpoint";
+    environment.etc."prosody/prosody.cfg.lua".source =
+      if cfg.checkConfig then
+        pkgs.runCommandLocal "prosody.cfg.lua"
+          {
+            nativeBuildInputs = [ cfg.package ];
           }
-          ++ optional (cfg.httpFileShare != null) {
-            url = cfg.httpFileShare.domain;
-            description = "HTTP file share endpoint";
-          };
-        mucDiscoItems = builtins.foldl' (
-          acc: muc:
-          [
-            {
-              url = muc.domain;
-              description = "${muc.domain} MUC endpoint";
-            }
-          ]
-          ++ acc
-        ) [ ] cfg.muc;
-        discoItems = cfg.disco_items ++ httpDiscoItems ++ mucDiscoItems;
-      in
-      ''
-
-        pidfile = "/run/prosody/prosody.pid"
-
-        log = ${cfg.log}
-
-        data_path = "${cfg.dataDir}"
-        plugin_paths = {
-          ${lib.concatStringsSep ", " (map (n: "\"${n}\"") cfg.extraPluginPaths)}
-        }
-
-        ${optionalString (cfg.ssl != null) (createSSLOptsStr cfg.ssl)}
-
-        admins = ${toLua cfg.admins}
-
-        modules_enabled = {
-
-          ${lib.concatStringsSep "\n  " (
-            lib.mapAttrsToList (name: val: optionalString val "${toLua name};") cfg.modules
-          )}
-          ${lib.concatStringsSep "\n" (map (x: "${toLua x};") cfg.package.communityModules)}
-          ${lib.concatStringsSep "\n" (map (x: "${toLua x};") cfg.extraModules)}
-        };
-
-        disco_items = {
-        ${lib.concatStringsSep "\n" (builtins.map (x: ''{ "${x.url}", "${x.description}"};'') discoItems)}
-        };
-
-        allow_registration = ${toLua cfg.allowRegistration}
-
-        c2s_require_encryption = ${toLua cfg.c2sRequireEncryption}
-
-        s2s_require_encryption = ${toLua cfg.s2sRequireEncryption}
-
-        s2s_secure_auth = ${toLua cfg.s2sSecureAuth}
-
-        s2s_insecure_domains = ${toLua cfg.s2sInsecureDomains}
-
-        s2s_secure_domains = ${toLua cfg.s2sSecureDomains}
-
-        authentication = ${toLua cfg.authentication}
-
-        http_interfaces = ${toLua cfg.httpInterfaces}
-
-        https_interfaces = ${toLua cfg.httpsInterfaces}
-
-        http_ports = ${toLua cfg.httpPorts}
-
-        https_ports = ${toLua cfg.httpsPorts}
-
-        ${cfg.extraConfig}
-
-        ${lib.concatMapStrings (muc: ''
-          Component ${toLua muc.domain} "muc"
-              modules_enabled = { "muc_mam"; ${optionalString muc.vcard_muc ''"vcard_muc";''} ${optionalString muc.allowners_muc ''"muc_allowners";''}  }
-              name = ${toLua muc.name}
-              restrict_room_creation = ${toLua muc.restrictRoomCreation}
-              max_history_messages = ${toLua muc.maxHistoryMessages}
-              muc_room_locking = ${toLua muc.roomLocking}
-              muc_room_lock_timeout = ${toLua muc.roomLockTimeout}
-              muc_tombstones = ${toLua muc.tombstones}
-              muc_tombstone_expiry = ${toLua muc.tombstoneExpiry}
-              muc_room_default_public = ${toLua muc.roomDefaultPublic}
-              muc_room_default_members_only = ${toLua muc.roomDefaultMembersOnly}
-              muc_room_default_moderated = ${toLua muc.roomDefaultModerated}
-              muc_room_default_public_jids = ${toLua muc.roomDefaultPublicJids}
-              muc_room_default_change_subject = ${toLua muc.roomDefaultChangeSubject}
-              muc_room_default_history_length = ${toLua muc.roomDefaultHistoryLength}
-              muc_room_default_language = ${toLua muc.roomDefaultLanguage}
-              ${muc.extraConfig}
-        '') cfg.muc}
-
-        ${lib.optionalString (cfg.uploadHttp != null) ''
-          Component ${toLua cfg.uploadHttp.domain} "http_upload"
-              http_upload_file_size_limit = ${cfg.uploadHttp.uploadFileSizeLimit}
-              http_upload_expire_after = ${cfg.uploadHttp.uploadExpireAfter}
-              ${lib.optionalString (
-                cfg.uploadHttp.userQuota != null
-              ) "http_upload_quota = ${toLua cfg.uploadHttp.userQuota}"}
-              http_upload_path = ${toLua cfg.uploadHttp.httpUploadPath}
-        ''}
-
-        ${lib.optionalString (cfg.httpFileShare != null) ''
-          Component ${toLua cfg.httpFileShare.domain} "http_file_share"
-          ${settingsToLua "  http_file_share_" (cfg.httpFileShare // { domain = null; })}
-        ''}
-
-        ${lib.concatStringsSep "\n" (
-          lib.mapAttrsToList (n: v: ''
-            VirtualHost "${v.domain}"
-              enabled = ${boolToString v.enabled};
-              ${optionalString (v.ssl != null) (createSSLOptsStr v.ssl)}
-              ${v.extraConfig}
-          '') cfg.virtualHosts
-        )}
-      '';
+          ''
+            cp ${configFile} prosody.cfg.lua
+            # Replace the hardcoded path to cacerts with one that is accessible in the build sandbox
+            sed 's|/etc/ssl/certs/ca-bundle.crt|${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt|' -i prosody.cfg.lua
+            # For some reason prosody hard fails to "find" certificates when this directory does not exist
+            mkdir certs
+            prosodyctl --config ./prosody.cfg.lua check config
+            cp prosody.cfg.lua $out
+          ''
+      else
+        configFile;
 
     users.users.prosody = mkIf (cfg.user == "prosody") {
       uid = config.ids.uids.prosody;
@@ -1025,7 +1017,6 @@ in
         })
       ];
     };
-
   };
 
   meta.doc = ./prosody.md;
diff --git a/nixos/modules/services/web-apps/drupal.nix b/nixos/modules/services/web-apps/drupal.nix
index 2a51e3672278..f214d2c1789b 100644
--- a/nixos/modules/services/web-apps/drupal.nix
+++ b/nixos/modules/services/web-apps/drupal.nix
@@ -58,6 +58,35 @@ let
       '';
     });
 
+  drupalSettings =
+    hostName: cfg:
+    pkgs.writeTextFile {
+      name = "settings.nixos-${hostName}.php";
+      text = ''
+        <?php
+
+          // NixOS automatically generated settings
+          $settings['file_private_path'] = '${cfg.privateFilesDir}';
+          $settings['config_sync_directory'] = '${cfg.configSyncDir}';
+
+          // Extra config
+          ${cfg.extraConfig}
+      '';
+      checkPhase = "${pkgs.php}/bin/php --syntax-check $target";
+    };
+
+  appendSettings =
+    hostName:
+    pkgs.writeTextFile {
+      name = "append-drupal-settings-${hostName}";
+      text = ''
+
+        // NixOS settings file import.
+        require dirname(__FILE__) . '/settings.nixos-${hostName}.php';
+
+      '';
+    };
+
   siteOpts =
     {
       options,
@@ -87,6 +116,26 @@ let
           description = "The location of the Drupal private files directory.";
         };
 
+        configSyncDir = mkOption {
+          type = types.path;
+          default = "/var/lib/drupal/${name}/config/sync";
+          defaultText = "/var/lib/drupal/<name>/config/sync";
+          description = "The location of the Drupal config sync directory.";
+        };
+
+        extraConfig = mkOption {
+          type = types.lines;
+          default = "";
+          description = ''
+            Extra configuration values that you want to insert into settings.php.
+            All configuration must be written as PHP script.
+          '';
+          example = ''
+            $config['user.settings']['anonymous'] = 'Visitor';
+            $settings['entity_update_backup'] = TRUE;
+          '';
+        };
+
         stateDir = mkOption {
           type = types.path;
           default = "/var/lib/drupal/${name}";
@@ -308,6 +357,7 @@ in
           "d '${cfg.themesDir}' 0750 ${user} ${webserver.group} - -"
           "Z '${cfg.themesDir}' 0750 ${user} ${webserver.group} - -"
           "d '${cfg.privateFilesDir}' 0750 ${user} ${webserver.group} - -"
+          "d '${cfg.configSyncDir}' 0750 ${user} ${webserver.group} - -"
         ]) eachSite
       );
 
@@ -330,6 +380,8 @@ in
             serviceConfig = {
               Type = "oneshot";
               User = "root";
+              RemainAfterExit = true;
+
               ExecStart = writeShellScript "drupal-state-init-${hostName}" ''
                 set -e
 
@@ -345,22 +397,29 @@ in
                 fi
 
                 settings_file="${cfg.stateDir}/sites/default/settings.php"
-                defaultSettings="${cfg.package}/share/php/drupal/sites/default/default.settings.php"
+                default_settings="${cfg.package}/share/php/drupal/sites/default/default.settings.php"
 
-                if [ ! -f "$settings" ]; then
+                if [ ! -f "$settings_file" ]; then
                   echo "Preparing settings.php for ${hostName}..."
-                  cp "$defaultSettings" "$settings_file"
+                  cp "$default_settings" "$settings_file"
+                  cat < ${appendSettings hostName} >> "$settings_file"
                   chmod 644 "$settings_file"
-
-                  # Append settings to settings file
-                  printf "\n\n// NixOS Automatically Generated Settings\n" >> $settings_file
-                  printf "\$settings['file_private_path'] = '${cfg.privateFilesDir}';" >> $settings_file
                 fi
 
+                # Link the NixOS-managed settings file to the state directory.
+                ln -sf ${drupalSettings hostName cfg} ${cfg.stateDir}/sites/default/settings.nixos-${hostName}.php
+
                 # Set or reset file permissions so that the web user and webserver owns them.
                 chown -R ${user}:${webserver.group} ${cfg.stateDir}
               '';
             };
+
+            # Rerun this service if certain settings were updated
+            reloadTriggers = [
+              cfg.extraConfig
+              cfg.privateFilesDir
+              cfg.configSyncDir
+            ];
           })
         ) eachSite)
 
diff --git a/pkgs/by-name/at/athens/package.nix b/pkgs/by-name/at/athens/package.nix
index 55ab92826851..f2980e7d0086 100644
--- a/pkgs/by-name/at/athens/package.nix
+++ b/pkgs/by-name/at/athens/package.nix
@@ -2,8 +2,8 @@
   lib,
   fetchFromGitHub,
   buildGoModule,
-  testers,
-  athens,
+  nix-update-script,
+  versionCheckHook,
 }:
 
 buildGoModule (finalAttrs: {
@@ -31,9 +31,10 @@ buildGoModule (finalAttrs: {
     mv $out/bin/proxy $out/bin/athens
   '';
 
-  passthru = {
-    tests.version = testers.testVersion { package = athens; };
-  };
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "Go module datastore and proxy";
diff --git a/pkgs/by-name/aw/aws-lc/package.nix b/pkgs/by-name/aw/aws-lc/package.nix
index 61f3a8497df2..51da17e1f2ab 100644
--- a/pkgs/by-name/aw/aws-lc/package.nix
+++ b/pkgs/by-name/aw/aws-lc/package.nix
@@ -10,13 +10,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "aws-lc";
-  version = "1.55.0";
+  version = "1.56.0";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-lc";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Ul+PoOItv7FU7v7NkpaCrZrr/ULnI9FSv6T8ePzTMCs=";
+    hash = "sha256-h7GrR86h/Z9pfJowABJFwBf/TlQzsMMG2x0/dsepbmQ=";
   };
 
   outputs = [
@@ -60,6 +60,8 @@ stdenv.mkDerivation (finalAttrs: {
     done
   '';
 
+  __darwinAllowLocalNetworking = true;
+
   passthru.tests = {
     version = testers.testVersion {
       package = aws-lc;
diff --git a/pkgs/by-name/bl/blender/package.nix b/pkgs/by-name/bl/blender/package.nix
index 11e9b3a0fe91..9cae88fc7820 100644
--- a/pkgs/by-name/bl/blender/package.nix
+++ b/pkgs/by-name/bl/blender/package.nix
@@ -115,12 +115,12 @@ in
 
 stdenv'.mkDerivation (finalAttrs: {
   pname = "blender";
-  version = "4.5.0";
+  version = "4.5.1";
 
   src = fetchzip {
     name = "source";
     url = "https://download.blender.org/source/blender-${finalAttrs.version}.tar.xz";
-    hash = "sha256-ERT/apulQ9ogA7Uk/AfjBee0rLjxEXItw6GwDOoysXk=";
+    hash = "sha256-x1zeBQ0aTBFUpB7c4XfP6b2p+ENRFEnTGa4m/7Pl24k=";
   };
 
   postPatch =
diff --git a/pkgs/by-name/bo/boring/package.nix b/pkgs/by-name/bo/boring/package.nix
index 4b855a586ee3..d4d199ff8cd5 100644
--- a/pkgs/by-name/bo/boring/package.nix
+++ b/pkgs/by-name/bo/boring/package.nix
@@ -10,20 +10,20 @@
 
 buildGoModule (finalAttrs: {
   pname = "boring";
-  version = "0.11.5";
+  version = "0.11.6";
 
   src = fetchFromGitHub {
     owner = "alebeck";
     repo = "boring";
     tag = finalAttrs.version;
-    hash = "sha256-s/mkC/6FvzytKJ9wpAIU36HhClGqEO0XFaAyErhD3Mo=";
+    hash = "sha256-mIR12OkdZll3MqlKF3OMqrc3C73SPmqypj0as9Y5LRQ=";
   };
 
   nativeBuildInputs = [
     installShellFiles
   ];
 
-  vendorHash = "sha256-j8A0F+o3EnzJdge+T/gHAwRGwzC86oD6ddZejUs/C7o=";
+  vendorHash = "sha256-1FVSKjsPDe4faaIioJG89556ibREcJt6xi28mp68Ea0=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ca/caido/package.nix b/pkgs/by-name/ca/caido/package.nix
index 310c3913605f..ebc0bce399ce 100644
--- a/pkgs/by-name/ca/caido/package.nix
+++ b/pkgs/by-name/ca/caido/package.nix
@@ -15,14 +15,14 @@ let
     "cli"
     "desktop"
   ];
-  version = "0.50.0";
+  version = "0.50.1";
   cli = fetchurl {
     url = "https://caido.download/releases/v${version}/caido-cli-v${version}-linux-x86_64.tar.gz";
-    hash = "sha256-Hb+Ul/DAK+ciay4N56r/lX4q43u0gWrJv5o03rmoqhk=";
+    hash = "sha256-mHB0nyU0nQg7duPcQf3NNz5vcnIfZcPLkAc+LoWdH58=";
   };
   desktop = fetchurl {
     url = "https://caido.download/releases/v${version}/caido-desktop-v${version}-linux-x86_64.AppImage";
-    hash = "sha256-GLEtAm2XQCYjgYeZpQUTd46sPbsxdDoanLBYNpHT1Do=";
+    hash = "sha256-mVK/valleYH3qZdxRBCbmC7MTEE/Cn6MJwZviMgHL08=";
   };
   appimageContents = appimageTools.extractType2 {
     inherit pname version;
diff --git a/pkgs/by-name/cy/cypress/package.nix b/pkgs/by-name/cy/cypress/package.nix
index fd4bea26ea8d..c6a06f607b98 100644
--- a/pkgs/by-name/cy/cypress/package.nix
+++ b/pkgs/by-name/cy/cypress/package.nix
@@ -19,19 +19,19 @@ let
   availableBinaries = {
     x86_64-linux = {
       platform = "linux-x64";
-      hash = "sha256-LcpIiPQWH4ny31abrjL7fYZ4coWphRVCGJlJibt5iqQ=";
+      hash = "sha256-3zuKJ99/AJ2bG2MWs6J4YPznNeW+Cf5vkdM+wpfFZb0=";
     };
     aarch64-linux = {
       platform = "linux-arm64";
-      hash = "sha256-4eGIklTtF08WLdYanjQPvWX+vEUalhMV1WwiJpVayfc=";
+      hash = "sha256-73MtXLJLPUdrYKpdna4869f9JjDYhjlCkjKrv9qw5yk=";
     };
     aarch64-darwin = {
       platform = "darwin-arm64";
-      hash = "sha256-C8TknPDv0NwHzDJzIHHBfpMB0mSsXTnXkUxO3l5v5zY=";
+      hash = "sha256-c8acBIdTVInl6C+BCegu91jTfc5Ug1hG7yXAvDnyuuQ=";
     };
     x86_64-darwin = {
       platform = "darwin-x64";
-      hash = "sha256-fvZT7bBV331iVuzvwosIvh8C/XMHLvCvQpQyeM3bt2E=";
+      hash = "sha256-7pGw2AP2T4PtYhQdWzdP0oKzDCPiJqnkR70cj8382Y4=";
     };
   };
   inherit (stdenv.hostPlatform) system;
@@ -41,7 +41,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "cypress";
-  version = "14.5.2";
+  version = "14.5.3";
 
   src = fetchzip {
     url = "https://cdn.cypress.io/desktop/${version}/${platform}/cypress.zip";
diff --git a/pkgs/by-name/go/gotlsaflare/package.nix b/pkgs/by-name/go/gotlsaflare/package.nix
new file mode 100644
index 000000000000..d331b3933537
--- /dev/null
+++ b/pkgs/by-name/go/gotlsaflare/package.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  stdenv,
+  installShellFiles,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "gotlsaflare";
+  version = "2.7.2";
+
+  src = fetchFromGitHub {
+    owner = "Stenstromen";
+    repo = "gotlsaflare";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-MryKBTFTdjoi8Bn39kCcyCVsj/C/lPJUaEgliLkHXuQ=";
+  };
+
+  vendorHash = "sha256-ZC1OD7TYE0CL8Vsopgeh+K13Rcm0mI9I2BpdDNpDSWE=";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd gotlsaflare \
+      --bash <($out/bin/gotlsaflare completion bash) \
+      --fish <($out/bin/gotlsaflare completion fish) \
+      --zsh <($out/bin/gotlsaflare completion zsh)
+  '';
+
+  meta = {
+    description = "Update TLSA DANE records on cloudflare from x509 certificates";
+    homepage = "https://github.com/Stenstromen/gotlsaflare";
+    changelog = "https://github.com/Stenstromen/gotlsaflare/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ szlend ];
+    mainProgram = "gotlsaflare";
+  };
+})
diff --git a/pkgs/by-name/li/linux-manual/package.nix b/pkgs/by-name/li/linux-manual/package.nix
index 62111043d782..d16ed1c9e82f 100644
--- a/pkgs/by-name/li/linux-manual/package.nix
+++ b/pkgs/by-name/li/linux-manual/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   linuxPackages_latest,
   perl,
+  python3,
   man,
 }:
 
@@ -10,7 +11,10 @@ stdenv.mkDerivation {
   pname = "linux-manual";
   inherit (linuxPackages_latest.kernel) version src;
 
-  nativeBuildInputs = [ perl ];
+  nativeBuildInputs = [
+    perl
+    python3
+  ];
   nativeInstallCheckInputs = [ man ];
 
   dontConfigure = true;
@@ -18,8 +22,11 @@ stdenv.mkDerivation {
   doInstallCheck = true;
 
   postPatch = ''
+    # Use scripts/kernel-doc.py here, not scripts/kernel-doc because
+    # patchShebangs skips symlinks
+
     patchShebangs --build \
-      scripts/kernel-doc \
+      scripts/kernel-doc.py \
       scripts/split-man.pl
   '';
 
diff --git a/pkgs/development/libraries/science/biology/mirtk/default.nix b/pkgs/by-name/mi/mirtk/package.nix
similarity index 75%
rename from pkgs/development/libraries/science/biology/mirtk/default.nix
rename to pkgs/by-name/mi/mirtk/package.nix
index 6726fe3002bf..e1fbd437fef0 100644
--- a/pkgs/development/libraries/science/biology/mirtk/default.nix
+++ b/pkgs/by-name/mi/mirtk/package.nix
@@ -8,7 +8,6 @@
   eigen,
   libGLU,
   fltk,
-  itk,
   vtk,
   zlib,
   tbb,
@@ -28,18 +27,16 @@ stdenv.mkDerivation {
 
   cmakeFlags = [
     "-DWITH_VTK=ON"
-    "-DBUILD_ALL_MODULES=ON"
+    "-DMODULE_Deformable=ON"
+    "-DMODULE_Mapping=ON"
+    "-DMODULE_Scripting=ON"
+    "-DMODULE_Viewer=ON"
+    "-DMODULE_DrawEM=OFF"
     "-DWITH_TBB=ON"
-    "-DWITH_ITK=ON"
     "-DWITH_GIFTICLIB=ON"
     "-DWITH_NIFTILIB=ON"
   ];
 
-  # tries to download data during configuration
-  postPatch = ''
-    substituteInPlace Packages/DrawEM/CMakeLists.txt --replace "include(Atlases.cmake)" ""
-  '';
-
   # tests don't seem to be maintained and gtest fails to link with BUILD_TESTING=ON;
   # unclear if specific to Nixpkgs
   doCheck = false;
@@ -55,7 +52,6 @@ stdenv.mkDerivation {
     boost186
     eigen
     fltk
-    itk
     libGLU
     python3
     tbb
@@ -63,12 +59,12 @@ stdenv.mkDerivation {
     zlib
   ];
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/BioMedIA/MIRTK";
     description = "Medical image registration library and tools";
     mainProgram = "mirtk";
-    maintainers = with maintainers; [ bcdarwin ];
-    platforms = platforms.linux;
-    license = licenses.asl20;
+    maintainers = with lib.maintainers; [ bcdarwin ];
+    platforms = lib.platforms.linux;
+    license = lib.licenses.asl20;
   };
 }
diff --git a/pkgs/by-name/ng/ngrok/versions.json b/pkgs/by-name/ng/ngrok/versions.json
index 8831f0240f5c..cfdea158e908 100644
--- a/pkgs/by-name/ng/ngrok/versions.json
+++ b/pkgs/by-name/ng/ngrok/versions.json
@@ -1,38 +1,38 @@
 {
   "linux-386": {
     "sys": "linux-386",
-    "url": "https://bin.equinox.io/a/fK7zHbUXRW4/ngrok-v3-3.22.1-linux-386",
-    "sha256": "25d1317d5f2014b6ee8e27408256c96efb68e5ae855ae31ec78f39a16c6af2c9",
-    "version": "3.22.1"
+    "url": "https://bin.equinox.io/a/9q4HZ8StRme/ngrok-v3-3.25.0-linux-386",
+    "sha256": "69a76dacb52e568977d105d0d8945c70d1702f9516d42959a4236daaab53559e",
+    "version": "3.25.0"
   },
   "linux-amd64": {
     "sys": "linux-amd64",
-    "url": "https://bin.equinox.io/a/jBvFVwnCxra/ngrok-v3-3.22.1-linux-amd64",
-    "sha256": "edf3b724fd9768c380257aec415ea0636f3e1e8d4f67318e3e1ad71c71fb7c3d",
-    "version": "3.22.1"
+    "url": "https://bin.equinox.io/a/9smpcEP9X6q/ngrok-v3-3.25.0-linux-amd64",
+    "sha256": "13ec4a15ab815f29cd6d9eafc4bde3b6bb3a7c6ed5d96c3dd093884fb41c7b27",
+    "version": "3.25.0"
   },
   "linux-arm": {
     "sys": "linux-arm",
-    "url": "https://bin.equinox.io/a/3nCe4mzMEnu/ngrok-v3-3.22.1-linux-arm",
-    "sha256": "ef9e6d0796d9e73e3811a6b45f40dc534b2bafdf2c53e9d837d633417916bf0e",
-    "version": "3.22.1"
+    "url": "https://bin.equinox.io/a/jyXJJfSXXDP/ngrok-v3-3.25.0-linux-arm",
+    "sha256": "60901e0ce54f2730b27f76797c2b96f40b9af859403da6c4be81d9d6330bca9f",
+    "version": "3.25.0"
   },
   "linux-arm64": {
     "sys": "linux-arm64",
-    "url": "https://bin.equinox.io/a/7qiGrRXJ1od/ngrok-v3-3.22.1-linux-arm64",
-    "sha256": "ef154e04bbc0d48a28f387c20ccf7a57d38485fbdad2c7e46c04749cd79e42b5",
-    "version": "3.22.1"
+    "url": "https://bin.equinox.io/a/7TpsSBE1k4y/ngrok-v3-3.25.0-linux-arm64",
+    "sha256": "dd49f434b64c1b4646a2e287f939d77f4dfc8d0a314e39c69a89e8cf5275f55b",
+    "version": "3.25.0"
   },
   "darwin-amd64": {
     "sys": "darwin-amd64",
-    "url": "https://bin.equinox.io/a/bCPsqUE6DvJ/ngrok-v3-3.22.1-darwin-amd64",
-    "sha256": "7b2fb1bb04a4e18756ff59903bc5dc06a99a3426713058259f5359965a699b70",
-    "version": "3.22.1"
+    "url": "https://bin.equinox.io/a/9pCLo8uquic/ngrok-v3-3.25.0-darwin-amd64",
+    "sha256": "1199c6c6f6f4d5fc7c91ed5dbbbda2cf212568d7397e0785d92b1d1c4bd87a25",
+    "version": "3.25.0"
   },
   "darwin-arm64": {
     "sys": "darwin-arm64",
-    "url": "https://bin.equinox.io/a/4XSXTVcG6uw/ngrok-v3-3.22.1-darwin-arm64",
-    "sha256": "7911865275673426fc8bc24afbbe079a3047e61300ffe622b6e6214d4da85786",
-    "version": "3.22.1"
+    "url": "https://bin.equinox.io/a/2PceGNze17x/ngrok-v3-3.25.0-darwin-arm64",
+    "sha256": "a3799883672ed868036ec71353e9feec8389568b75e5d704a32a52a409f37133",
+    "version": "3.25.0"
   }
 }
diff --git a/pkgs/by-name/nh/nhost-cli/package.nix b/pkgs/by-name/nh/nhost-cli/package.nix
index 3cdc0281414a..0a5045fcb14b 100644
--- a/pkgs/by-name/nh/nhost-cli/package.nix
+++ b/pkgs/by-name/nh/nhost-cli/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "nhost-cli";
-  version = "1.31.0";
+  version = "1.31.1";
 
   src = fetchFromGitHub {
     owner = "nhost";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-JMRFvJv/Ynnk0maT27sprTpWjCgGDw0x2sK+woS9uQk=";
+    hash = "sha256-UfcQh8jdnNKn5AMerh+J83yuTY/cX20/8UA0NoPBJ14=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/op/openscad-lsp/package.nix b/pkgs/by-name/op/openscad-lsp/package.nix
index 2bdefa2e49c3..a3961988b61e 100644
--- a/pkgs/by-name/op/openscad-lsp/package.nix
+++ b/pkgs/by-name/op/openscad-lsp/package.nix
@@ -34,6 +34,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
     homepage = "https://github.com/Leathong/openscad-LSP";
     changelog = "https://github.com/Leathong/openscad-LSP/releases/tag/${finalAttrs.src.tag}";
     license = licenses.asl20;
-    maintainers = with maintainers; [ c-h-johnson ];
+    maintainers = with maintainers; [
+      c-h-johnson
+      curious
+    ];
   };
 })
diff --git a/pkgs/by-name/pa/particle-cli/package.nix b/pkgs/by-name/pa/particle-cli/package.nix
index 6b3d6f59cb9f..f51ea4d0319d 100644
--- a/pkgs/by-name/pa/particle-cli/package.nix
+++ b/pkgs/by-name/pa/particle-cli/package.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "particle-cli";
-  version = "3.38.2";
+  version = "3.40.0";
 
   src = fetchFromGitHub {
     owner = "particle-iot";
     repo = "particle-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/MfT7+g3l+5Y3mRGl0yiDMRXL2heWZzVNm+LfTmy9SA=";
+    hash = "sha256-qfwj0hs+4p00pALrIMAjHCM7Cdoj6+sxV/nMyI2rYNg=";
   };
 
-  npmDepsHash = "sha256-L/DfZWvJRZzHvf9pP7bHEJt85KT0s46+KErkTNRgH04=";
+  npmDepsHash = "sha256-o8G6+xYOg80vgjJ6Skm7ydysuH71uN9erj7Nd4QOB2I=";
 
   buildInputs = [
     udev
diff --git a/pkgs/by-name/re/redo-apenwarr/package.nix b/pkgs/by-name/re/redo-apenwarr/package.nix
index 45ea6d9c2d76..cffdff90ba64 100644
--- a/pkgs/by-name/re/redo-apenwarr/package.nix
+++ b/pkgs/by-name/re/redo-apenwarr/package.nix
@@ -31,20 +31,23 @@ stdenv.mkDerivation rec {
     unset CC CXX
 
     substituteInPlace minimal/do.test \
-      --replace "/bin/pwd" "${coreutils}/bin/pwd"
+      --replace-fail "/bin/pwd" "${coreutils}/bin/pwd"
 
     substituteInPlace t/105-sympath/all.do \
-      --replace "/bin/pwd" "${coreutils}/bin/pwd"
+      --replace-fail "/bin/pwd" "${coreutils}/bin/pwd"
 
     substituteInPlace t/all.do \
-      --replace "/bin/ls" "ls"
+      --replace-fail "/bin/ls" "ls"
 
     substituteInPlace t/110-compile/hello.o.do \
-      --replace "/usr/include" "${lib.getDev stdenv.cc.libc}/include"
+      --replace-fail "/usr/include" "${lib.getDev stdenv.cc.libc}/include"
 
     substituteInPlace t/200-shell/nonshelltest.do \
-      --replace "/usr/bin/env perl" "${perl}/bin/perl"
+      --replace-fail "/usr/bin/env perl" "${perl}/bin/perl"
 
+    # See https://github.com/apenwarr/redo/pull/47
+    substituteInPlace minimal/do \
+      --replace-fail 'cd "$dodir"' 'cd "''${dodir:-.}"'
   '';
 
   inherit doCheck;
diff --git a/pkgs/by-name/s7/s7/package.nix b/pkgs/by-name/s7/s7/package.nix
index 37088e7a3183..a63eedeb3231 100644
--- a/pkgs/by-name/s7/s7/package.nix
+++ b/pkgs/by-name/s7/s7/package.nix
@@ -25,14 +25,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "s7";
-  version = "11.5-unstable-2025-07-22";
+  version = "11.5-unstable-2025-07-31";
 
   src = fetchFromGitLab {
     domain = "cm-gitlab.stanford.edu";
     owner = "bil";
     repo = "s7";
-    rev = "03939f855e15f84f9113a92271cdfa0a09b28a67";
-    hash = "sha256-n6Uattns9TxXRi1lz/adexa13nlYXSp0usTT9uZ47JY=";
+    rev = "71e547b1a210d1ff06daeb4dee5247cd949d0178";
+    hash = "sha256-gMZCmpGPSgM73PRbRY5BgyaTeRnojduNnZntvr75jzw=";
   };
 
   buildInputs =
diff --git a/pkgs/by-name/st/steamworks/package.nix b/pkgs/by-name/st/steamworks/package.nix
new file mode 100644
index 000000000000..c528c6897c95
--- /dev/null
+++ b/pkgs/by-name/st/steamworks/package.nix
@@ -0,0 +1,65 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  bison,
+  cmake,
+  flex,
+  arpa2cm,
+  arpa2common,
+  catch2,
+  log4cpp,
+  openldap,
+  sqlite,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "steamworks";
+  version = "0.97.2";
+
+  src = fetchFromGitLab {
+    owner = "arpa2";
+    repo = "steamworks";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-hD1nTyv/t7MQdopqivfSE0o4Qk1ymG8zQVg56lY+t9o=";
+  };
+
+  # src/common/logger.h:254:63: error: 'uint8_t' does not name a type
+  postPatch = ''
+    sed -i "38i #include <cstdint>" src/common/logger.h
+  '';
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    bison
+    cmake
+    flex
+  ];
+
+  buildInputs = [
+    arpa2cm
+    arpa2common
+    flex
+    log4cpp
+    openldap
+    sqlite
+  ];
+
+  # Currently doesn't build in `Release` since a macro is messing with some code
+  # when building in `Release`.
+  cmakeBuildType = "Debug";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Configuration information distributed over LDAP in near realtime";
+    homepage = "https://gitlab.com/arpa2/steamworks";
+    changelog = "https://gitlab.com/arpa2/steamworks/-/blob/v${finalAttrs.version}/CHANGES";
+    license = lib.licenses.bsd2;
+    maintainers = [ lib.maintainers.ethancedwards8 ];
+    teams = [ lib.teams.ngi ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/st/strawberry/package.nix b/pkgs/by-name/st/strawberry/package.nix
index e6dc0d4ff71a..853213f4e720 100644
--- a/pkgs/by-name/st/strawberry/package.nix
+++ b/pkgs/by-name/st/strawberry/package.nix
@@ -31,6 +31,9 @@
   util-linux,
   sparsehash,
   rapidjson,
+
+  # tests
+  gtest,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -99,6 +102,14 @@ stdenv.mkDerivation (finalAttrs: {
 
   cmakeFlags = [ (lib.cmakeBool "ENABLE_GPOD" false) ];
 
+  checkInputs = [ gtest ];
+  checkTarget = "strawberry_tests";
+  preCheck = ''
+    # defaults to "xcb" otherwise, which requires a display
+    export QT_QPA_PLATFORM=offscreen
+  '';
+  doCheck = true;
+
   postInstall = ''
     qtWrapperArgs+=(
       --prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0"
diff --git a/pkgs/by-name/us/usque/package.nix b/pkgs/by-name/us/usque/package.nix
new file mode 100644
index 000000000000..7ecd7503c709
--- /dev/null
+++ b/pkgs/by-name/us/usque/package.nix
@@ -0,0 +1,61 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  stdenv,
+  nix-update-script,
+  buildPackages,
+  installShellFiles,
+  versionCheckHook,
+}:
+buildGoModule (finalAttrs: {
+  pname = "usque";
+  version = "1.4.1";
+  src = fetchFromGitHub {
+    owner = "Diniboy1123";
+    repo = "usque";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-/4/hsoWGdNe5vF22hFXuItXlYiLZ5BKrfg5XSFyljhE=";
+  };
+
+  vendorHash = "sha256-ngLlG9HP0KJPjIBVsNZuwnlJj2egMEh9U0xVQpVEg1Q=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/Diniboy1123/usque/cmd.version=${finalAttrs.version}"
+  ];
+  nativeBuildInputs = [ installShellFiles ];
+  postInstall =
+    let
+      exe =
+        if stdenv.buildPlatform.canExecute stdenv.hostPlatform then
+          "$out/bin/usque"
+        else
+          lib.getExe buildPackages.usque;
+    in
+    ''
+      installShellCompletion --cmd usque \
+        --bash <(${exe} completion bash) \
+        --fish <(${exe} completion fish) \
+        --zsh <(${exe} completion zsh)
+    '';
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+  versionCheckProgram = "${placeholder "out"}/bin/${finalAttrs.meta.mainProgram}";
+  versionCheckProgramArg = "version";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    mainProgram = "usque";
+    maintainers = with lib.maintainers; [ xddxdd ];
+    description = "Open-source reimplementation of the Cloudflare WARP client's MASQUE protocol";
+    homepage = "https://github.com/Diniboy1123/usque";
+    license = lib.licenses.mit;
+    changelog = "https://github.com/Diniboy1123/usque/releases/tag/v${finalAttrs.version}";
+  };
+})
diff --git a/pkgs/by-name/wo/wofi/package.nix b/pkgs/by-name/wo/wofi/package.nix
index ac3692d854fc..ab73d5bc8b11 100644
--- a/pkgs/by-name/wo/wofi/package.nix
+++ b/pkgs/by-name/wo/wofi/package.nix
@@ -12,7 +12,7 @@
 }:
 stdenv.mkDerivation rec {
   pname = "wofi";
-  version = "1.5";
+  version = "1.5.1";
 
   outputs = [
     "out"
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     repo = "wofi";
     owner = "~scoopta";
     rev = "v${version}";
-    sha256 = "sha256-7C4rO1Uf7qmzYAr60auILzYyKrJ//TJzTwU1PrBWdVA=";
+    sha256 = "sha256-r+p8WDJw8aO1Gdgy6+UwT5QJdejIjcPFSs/Gfzq+D/c=";
     vc = "hg";
   };
 
diff --git a/pkgs/by-name/wr/wrangler/package.nix b/pkgs/by-name/wr/wrangler/package.nix
index e24252360729..d40490a3733f 100644
--- a/pkgs/by-name/wr/wrangler/package.nix
+++ b/pkgs/by-name/wr/wrangler/package.nix
@@ -12,18 +12,18 @@
   xorg,
   jq,
   moreutils,
-  gitUpdater,
+  nix-update-script,
   versionCheckHook,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "wrangler";
-  version = "4.22.0";
+  version = "4.26.1";
 
   src = fetchFromGitHub {
     owner = "cloudflare";
     repo = "workers-sdk";
     rev = "wrangler@${finalAttrs.version}";
-    hash = "sha256-4uE1Jv70aDqAUk7GWmFr65SNXLnDDIZiFN87DQxluKg=";
+    hash = "sha256-7Z2MCG9YKwIkZ2eJucSgFr9R+rR+GFKiSXQX0xR5Xas=";
   };
 
   pnpmDeps = pnpm_9.fetchDeps {
@@ -33,15 +33,19 @@ stdenv.mkDerivation (finalAttrs: {
       src
       postPatch
       ;
-    fetcherVersion = 1;
-    hash = "sha256-r3QswmqP6CNufnsFM0KeKojm/HjHogrfYO/TdL3SrmA=";
+    fetcherVersion = 2;
+    hash = "sha256-Gsiq0+PIA3rJ0D9JryqaO0ThQcY+hC02AtzxdS+wSPg=";
   };
   # pnpm packageManager version in workers-sdk root package.json may not match nixpkgs
   postPatch = ''
     jq 'del(.packageManager)' package.json | sponge package.json
   '';
 
-  passthru.updateScript = gitUpdater { rev-prefix = "wrangler@"; };
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex=wrangler@(.*)"
+    ];
+  };
 
   buildInputs = [
     llvmPackages.libcxx
diff --git a/pkgs/data/themes/kwin-decorations/kde-rounded-corners/default.nix b/pkgs/data/themes/kwin-decorations/kde-rounded-corners/default.nix
index 9c00d8dc2158..517de6438917 100644
--- a/pkgs/data/themes/kwin-decorations/kde-rounded-corners/default.nix
+++ b/pkgs/data/themes/kwin-decorations/kde-rounded-corners/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "kde-rounded-corners";
-  version = "0.7.2";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "matinlotfali";
     repo = "KDE-Rounded-Corners";
     rev = "v${version}";
-    hash = "sha256-idcQ4ANud31qOCmEnPvKjstK9fCp6+cwcmSO7/8aCaY=";
+    hash = "sha256-dgeB+N0Ye/O5y/o/yc9Vj1Ia8d2uUOGjxBddyPHaDQc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/cramjam/default.nix b/pkgs/development/python-modules/cramjam/default.nix
index 76a8825b703e..c6bf9311cc24 100644
--- a/pkgs/development/python-modules/cramjam/default.nix
+++ b/pkgs/development/python-modules/cramjam/default.nix
@@ -13,19 +13,19 @@
 
 buildPythonPackage rec {
   pname = "cramjam";
-  version = "2.10.0";
+  version = "2.11.0.post1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "milesgranger";
     repo = "cramjam";
-    tag = version;
-    hash = "sha256-zM3EIo7KQYWK7W3LSGaY72iYQQcRB84opLqj/lrSwwY=";
+    tag = "v${version}";
+    hash = "sha256-iYx/cPQpZVVPAH+HTiYH/E9tmdnHvKf3Cel4yZpXSIA=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname src version;
-    hash = "sha256-eMVUDF6DWNzdNfzWuwDF0UBbJ5wQU4/DHaNkP/k2SJ8=";
+    hash = "sha256-jLGCyrVHtauWhiDghtYgt5MhgOl8wNiM7TAQhrCk2xU=";
   };
 
   nativeBuildInputs = with rustPlatform; [
diff --git a/pkgs/development/python-modules/docling-jobkit/default.nix b/pkgs/development/python-modules/docling-jobkit/default.nix
index 348b073ee35f..c9e6e82b2dec 100644
--- a/pkgs/development/python-modules/docling-jobkit/default.nix
+++ b/pkgs/development/python-modules/docling-jobkit/default.nix
@@ -95,6 +95,10 @@ buildPythonPackage rec {
     "test_convert_url"
     "test_convert_file"
     "test_convert_warmup"
+
+    # Flaky due to comparison with magic object
+    # https://github.com/docling-project/docling-jobkit/issues/45
+    "test_options_validator"
   ];
 
   meta = {
diff --git a/pkgs/development/tools/pnpm/generic.nix b/pkgs/development/tools/pnpm/generic.nix
index 54f463b1990b..626849d7b680 100644
--- a/pkgs/development/tools/pnpm/generic.nix
+++ b/pkgs/development/tools/pnpm/generic.nix
@@ -91,7 +91,11 @@ stdenvNoCC.mkDerivation (finalAttrs: {
             curl -L ''${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} "$@"
         }
 
-        latestTag=$(curl_github https://api.github.com/repos/pnpm/pnpm/releases?per_page=100 | jq -r --arg major "v${majorVersion}" '[.[].tag_name | select(startswith($major))][0]')
+        latestTag=$(
+          curl_github https://api.github.com/repos/pnpm/pnpm/releases?per_page=100 | \
+          jq -r --arg major "v${majorVersion}" \
+            '[.[] | select(.tag_name | startswith($major)) | select(.prerelease == false)][0].tag_name'
+        )
 
         # Exit if there is no tag with this major version
         if [ "$latestTag" = "null" ]; then
diff --git a/pkgs/shells/carapace/default.nix b/pkgs/shells/carapace/default.nix
index 96830ccfcb1d..67d0f5531625 100644
--- a/pkgs/shells/carapace/default.nix
+++ b/pkgs/shells/carapace/default.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "carapace";
-  version = "1.3.3";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     owner = "carapace-sh";
     repo = "carapace-bin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-dVM5XFFNXAVoN2xshq5k0Y6vSrfSNS0bIptcloX/uSg=";
+    hash = "sha256-aI69LQuyXUGqxjcUIH3J8AG7cgn/onBg0mZc+zz+YrA=";
   };
 
-  vendorHash = "sha256-XRbqxL2ANWi2aZbB30tNBxJoBIoDoMxKXMpOx++JJ6M=";
+  vendorHash = "sha256-AwR+Oh1Rlg1z/pYdc9VDvp/FLH1ZiPsP/q4lks3VqqE=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/shells/fish/plugins/forgit.nix b/pkgs/shells/fish/plugins/forgit.nix
index fe4c20e9c27a..5df1aa8526d2 100644
--- a/pkgs/shells/fish/plugins/forgit.nix
+++ b/pkgs/shells/fish/plugins/forgit.nix
@@ -6,13 +6,13 @@
 
 buildFishPlugin rec {
   pname = "forgit";
-  version = "25.07.0";
+  version = "25.08.0";
 
   src = fetchFromGitHub {
     owner = "wfxr";
     repo = "forgit";
     rev = version;
-    hash = "sha256-h9li2nwKG6SnOQntWZpdeBbU3RrwO4+4yO7tAwuOwhE=";
+    hash = "sha256-45NeIRSTNiCqctdwBaS/qOeOI/8f4L+KVI/I6grYm+0=";
   };
 
   postInstall = ''
diff --git a/pkgs/tools/package-management/nix-index/default.nix b/pkgs/tools/package-management/nix-index/default.nix
index 6ec589774219..36aba06ad9e3 100644
--- a/pkgs/tools/package-management/nix-index/default.nix
+++ b/pkgs/tools/package-management/nix-index/default.nix
@@ -32,6 +32,9 @@ rustPlatform.buildRustPackage rec {
     substituteInPlace command-not-found.sh \
       --subst-var out
     install -Dm555 command-not-found.sh -t $out/etc/profile.d
+    substituteInPlace command-not-found.nu \
+      --subst-var out
+    install -Dm555 command-not-found.nu -t $out/etc/profile.d
   '';
 
   meta = with lib; {
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a159bbc614fb..6bc96152a7bb 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -15188,8 +15188,6 @@ with pkgs;
     inherit (llvmPackages) openmp;
   };
 
-  mirtk = callPackage ../development/libraries/science/biology/mirtk { itk = itk_5_2; };
-
   nest = callPackage ../applications/science/biology/nest { };
 
   nest-mpi = callPackage ../applications/science/biology/nest { withMpi = true; };
diff --git a/pkgs/top-level/unixtools.nix b/pkgs/top-level/unixtools.nix
index 21c2ede1794e..f0ed6b55dd36 100644
--- a/pkgs/top-level/unixtools.nix
+++ b/pkgs/top-level/unixtools.nix
@@ -44,6 +44,7 @@ let
         };
         passthru = {
           inherit provider;
+          inherit (provider) version;
         }
         // lib.optionalAttrs (builtins.hasAttr "binlore" providers) {
           binlore.out = (binlore.synthesize (getBin bins.${cmd}) providers.binlore);