diff --git a/doc/languages-frameworks/beam.section.md b/doc/languages-frameworks/beam.section.md
index a7882ba25f57..ada05b0ddc22 100644
--- a/doc/languages-frameworks/beam.section.md
+++ b/doc/languages-frameworks/beam.section.md
@@ -375,16 +375,7 @@ let
     nodePackages.prettier
   ];
 
-  inputs =
-    basePackages
-    ++ lib.optionals stdenv.hostPlatform.isLinux [ inotify-tools ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        CoreFoundation
-        CoreServices
-      ]
-    );
+  inputs = basePackages ++ lib.optionals stdenv.hostPlatform.isLinux [ inotify-tools ];
 
   # define shell startup command
   hooks = ''
diff --git a/doc/redirects.json b/doc/redirects.json
index 8b431d383bf2..77c2ffba7b1e 100644
--- a/doc/redirects.json
+++ b/doc/redirects.json
@@ -43,6 +43,9 @@
   "no-broken-symlinks.sh": [
     "index.html#no-broken-symlinks.sh"
   ],
+  "nostrictaliasing": [
+    "index.html#nostrictaliasing"
+  ],
   "pkgs-replacevars": [
     "index.html#pkgs-replacevars",
     "index.html#pkgs-substituteall",
diff --git a/doc/release-notes/rl-2505.section.md b/doc/release-notes/rl-2505.section.md
index ae689d171cd9..ff4ec21f6173 100644
--- a/doc/release-notes/rl-2505.section.md
+++ b/doc/release-notes/rl-2505.section.md
@@ -206,6 +206,8 @@
 
 - `mkBinaryCache` now defaults to using `zstd` compression for the binary caches it creates. The previous `xz` compression method can be used by passing `compression = "xz";`.
 
+- `nodejs_latest` was updated from 23.x to 24.x. `nodejs_23` has been removed in favor of `nodejs_24`.
+
 - `nodejs_18` package was removed due to upstream End-of-Life in April 2025.
 
 - `nodePackages."@commitlint/config-conventional"` has been removed, as it is a library, and projects should depend on it instead.
diff --git a/doc/stdenv/stdenv.chapter.md b/doc/stdenv/stdenv.chapter.md
index c7c907da44bc..2574de140b73 100644
--- a/doc/stdenv/stdenv.chapter.md
+++ b/doc/stdenv/stdenv.chapter.md
@@ -1600,6 +1600,10 @@ This flag adds the `-fstack-clash-protection` compiler option, which causes grow
 
 The following flags are disabled by default and should be enabled with `hardeningEnable` for packages that take untrusted input like network services.
 
+#### `nostrictaliasing` {#nostrictaliasing}
+
+This flag adds the `-fno-strict-aliasing` compiler option, which prevents the compiler from assuming code has been written strictly following the standard in regards to pointer aliasing and therefore performing optimizations that may be unsafe for code that has not followed these rules.
+
 #### `pie` {#pie}
 
 This flag is disabled by default for normal `glibc` based NixOS package builds, but enabled by default for
diff --git a/lib/licenses.nix b/lib/licenses.nix
index 301beb4ea4ae..2aa16bc0f305 100644
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@@ -257,6 +257,11 @@ lib.mapAttrs mkLicense (
       fullName = "BSD Protection License";
     };
 
+    bsdSourceCode = {
+      spdxId = "BSD-Source-Code";
+      fullName = "BSD Source Code Attribution";
+    };
+
     bsl11 = {
       spdxId = "BUSL-1.1";
       fullName = "Business Source License 1.1";
@@ -452,6 +457,11 @@ lib.mapAttrs mkLicense (
       fullName = "Common Public License 1.0";
     };
 
+    cronyx = {
+      spdxId = "Cronyx";
+      fullName = "Cronyx License";
+    };
+
     curl = {
       spdxId = "curl";
       fullName = "curl License";
@@ -937,6 +947,11 @@ lib.mapAttrs mkLicense (
       fullName = "MIT No Attribution";
     };
 
+    mitOpenGroup = {
+      spdxId = "MIT-open-group";
+      fullName = "MIT Open Group variant";
+    };
+
     mpl10 = {
       spdxId = "MPL-1.0";
       fullName = "Mozilla Public License 1.0";
@@ -1328,6 +1343,11 @@ lib.mapAttrs mkLicense (
       fullName = "Unicode License Agreement - Data Files and Software (2016)";
     };
 
+    unicodeTOU = {
+      spdxId = "Unicode-TOU";
+      fullName = "Unicode Terms of Use";
+    };
+
     unlicense = {
       spdxId = "Unlicense";
       fullName = "The Unlicense";
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index ccf5e1021c1f..7ccce16b410d 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -68,6 +68,16 @@ with lib.maintainers;
     ];
   };
 
+  apparmor = {
+    scope = "AppArmor-related modules, userspace tool packages and profiles";
+    shortName = "apparmor";
+    members = [
+      julm
+      thoughtpolice
+      grimmauld
+    ];
+  };
+
   bazel = {
     members = [
       mboes
diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index 3ab1a6d34872..d5e3f409ea6b 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -22,6 +22,8 @@
   - the global Mesa version can now be managed without a mass rebuild by setting `hardware.graphics.package`
   - packages that used to depend on Mesa for libgbm or libdri should use `libgbm` or `dri-pkgconfig-stub` as inputs, respectively
 
+- OpenSSH has been updated from 9.9p2 to 10.0p2, dropping support for DSA keys and adding a new `ssh-auth` binary to handle user authentication in a different address space from unauthenticated sessions. Additionally, we now enable a configure option by default that attempts to lock sshd into RAM to prevent it from being swapped out, which may improve performance if the system is under memory pressure. See the [full changelog](https://www.openwall.com/lists/oss-security/2025/04/09/1) for more details.
+
 - The `intel` video driver for X.org (from the xf86-video-intel package) which was previously removed because it was non-functional has been fixed and the driver has been re-introduced.
 
 - The Mattermost module ({option}`services.mattermost`) and packages (`mattermost` and `mmctl`) have been substantially updated:
@@ -164,6 +166,8 @@
 
 - [OliveTin](https://www.olivetin.app/), gives safe and simple access to predefined shell commands from a web interface. Available as [services.olivetin](#opt-services.olivetin.enable).
 
+- [alertmanager-ntfy](https://github.com/alexbakker/alertmanager-ntfy), forwards Prometheus Alertmanager notifications to ntfy.sh. Available as [services.prometheus.alertmanager-ntfy](#opt-services.prometheus.alertmanager-ntfy.enable).
+
 - [Stash](https://github.com/stashapp/stash), An organizer for your adult videos/images, written in Go. Available as [services.stash](#opt-services.stash.enable).
 
 - [vsmartcard-vpcd](https://frankmorgner.github.io/vsmartcard/virtualsmartcard/README.html), a virtual smart card driver. Available as [services.vsmartcard-vpcd](#opt-services.vsmartcard-vpcd.enable).
@@ -267,6 +271,8 @@
   to review the new defaults and description of
   [](#opt-services.nextcloud.poolSettings).
 
+- In `users.users` allocation on systems with multiple users it could happen that collided with others. Now these users get new subuid ranges assigned. When this happens, a warning is issued on the first activation. If the subuids were used (e.g. with rootless container managers like podman), please change the ownership of affected files accordingly.
+
 - The `services.locate` module does no longer support findutil's `locate` due to its inferior performance compared to `mlocate` and `plocate`. The new default is `plocate`.
   As the `service.locate.localuser` option only applied when using findutil's `locate`, it has also been removed.
 
@@ -522,6 +528,8 @@
 
 - `services.avahi.ipv6` now defaults to true.
 
+- A new hardening flag, `nostrictaliasing` was made available, corresponding to the gcc/clang option `-fno-strict-aliasing`.
+
 - In the `services.xserver.displayManager.startx` module, two new options [generateScript](#opt-services.xserver.displayManager.startx.generateScript) and [extraCommands](#opt-services.xserver.displayManager.startx.extraCommands) have been added to to declaratively configure the .xinitrc script.
 
 - All services that require a root certificate bundle now use the value of a new read-only option, `security.pki.caBundle`.
diff --git a/nixos/modules/config/update-users-groups.pl b/nixos/modules/config/update-users-groups.pl
index a2be448d625b..0d192ae04073 100644
--- a/nixos/modules/config/update-users-groups.pl
+++ b/nixos/modules/config/update-users-groups.pl
@@ -54,15 +54,14 @@ sub dry_print {
 # Functions for allocating free GIDs/UIDs. FIXME: respect ID ranges in
 # /etc/login.defs.
 sub allocId {
-    my ($used, $prevUsed, $idMin, $idMax, $up, $getid) = @_;
-    my $id = $up ? $idMin : $idMax;
+    my ($used, $prevUsed, $idMin, $idMax, $delta, $getid) = @_;
+    my $id = $delta > 0 ? $idMin : $idMax;
     while ($id >= $idMin && $id <= $idMax) {
         if (!$used->{$id} && !$prevUsed->{$id} && !defined &$getid($id)) {
             $used->{$id} = 1;
             return $id;
         }
-        $used->{$id} = 1;
-        if ($up) { $id++; } else { $id--; }
+        $id += $delta;
     }
     die "$0: out of free UIDs or GIDs\n";
 }
@@ -77,19 +76,19 @@ sub allocGid {
         $gidsUsed{$prevGid} = 1;
         return $prevGid;
     }
-    return allocId(\%gidsUsed, \%gidsPrevUsed, 400, 999, 0, sub { my ($gid) = @_; getgrgid($gid) });
+    return allocId(\%gidsUsed, \%gidsPrevUsed, 400, 999, -1, sub { my ($gid) = @_; getgrgid($gid) });
 }
 
 sub allocUid {
     my ($name, $isSystemUser) = @_;
-    my ($min, $max, $up) = $isSystemUser ? (400, 999, 0) : (1000, 29999, 1);
+    my ($min, $max, $delta) = $isSystemUser ? (400, 999, -1) : (1000, 29999, 1);
     my $prevUid = $uidMap->{$name};
     if (defined $prevUid && $prevUid >= $min && $prevUid <= $max && !defined $uidsUsed{$prevUid}) {
         dry_print("reviving", "would revive", "user '$name' with UID $prevUid");
         $uidsUsed{$prevUid} = 1;
         return $prevUid;
     }
-    return allocId(\%uidsUsed, \%uidsPrevUsed, $min, $max, $up, sub { my ($uid) = @_; getpwuid($uid) });
+    return allocId(\%uidsUsed, \%uidsPrevUsed, $min, $max, $delta, sub { my ($uid) = @_; getpwuid($uid) });
 }
 
 # Read the declared users/groups
@@ -336,18 +335,14 @@ sub allocSubUid {
     my ($name, @rest) = @_;
 
     # TODO: No upper bounds?
-    my ($min, $max, $up) = (100000, 100000 * 100, 1);
+    my ($min, $max, $delta) = (100000, 100000 + 100 * 65536, 65536);
     my $prevId = $subUidMap->{$name};
     if (defined $prevId && !defined $subUidsUsed{$prevId}) {
         $subUidsUsed{$prevId} = 1;
         return $prevId;
     }
 
-    my $id = allocId(\%subUidsUsed, \%subUidsPrevUsed, $min, $max, $up, sub { my ($uid) = @_; getpwuid($uid) });
-    my $offset = $id - 100000;
-    my $count = $offset * 65536;
-    my $subordinate = 100000 + $count;
-    return $subordinate;
+    return allocId(\%subUidsUsed, \%subUidsPrevUsed, $min, $max, $delta, sub { undef });
 }
 
 my @subGids;
@@ -367,6 +362,14 @@ foreach my $u (values %usersOut) {
 
     if($u->{autoSubUidGidRange}) {
         my $subordinate = allocSubUid($name);
+        if (defined $subUidMap->{$name} && $subUidMap->{$name} != $subordinate) {
+          print STDERR "warning: The subuids for '$name' changed, as they coincided with the subuids of a different user (see /etc/subuid). "
+            . "The range now starts with $subordinate instead of $subUidMap->{$name}. "
+            . "If the subuids were used (e.g. with rootless container managers like podman), please change the ownership of affected files accordingly. "
+            . "Alternatively, to keep the old overlapping ranges, add this to the system configuration: "
+            . "users.users.$name.subUidRanges = [{startUid = $subUidMap->{$name}; count = 65536;}]; "
+            . "users.users.$name.subGidRanges = [{startGid = $subUidMap->{$name}; count = 65536;}];\n";
+        }
         $subUidMap->{$name} = $subordinate;
         my $value = join(":", ($name, $subordinate, 65536));
         push @subUids, $value;
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index da51043b91a5..44e75561bc6b 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -985,6 +985,7 @@
   ./services/monitoring/pgscv.nix
   ./services/monitoring/prometheus/alertmanager-gotify-bridge.nix
   ./services/monitoring/prometheus/alertmanager-irc-relay.nix
+  ./services/monitoring/prometheus/alertmanager-ntfy.nix
   ./services/monitoring/prometheus/alertmanager-webhook-logger.nix
   ./services/monitoring/prometheus/alertmanager.nix
   ./services/monitoring/prometheus/default.nix
diff --git a/nixos/modules/security/apparmor.nix b/nixos/modules/security/apparmor.nix
index e0b768b60af4..2a20a673d5af 100644
--- a/nixos/modules/security/apparmor.nix
+++ b/nixos/modules/security/apparmor.nix
@@ -172,7 +172,7 @@ in
               logfiles = /dev/stdin
 
               parser = ${pkgs.apparmor-parser}/bin/apparmor_parser
-              ldd = ${pkgs.glibc.bin}/bin/ldd
+              ldd = ${lib.getExe' pkgs.stdenv.cc.libc "ldd"}
               logger = ${pkgs.util-linux}/bin/logger
 
               # customize how file ownership permissions are presented
@@ -275,8 +275,5 @@ in
     };
   };
 
-  meta.maintainers = with lib.maintainers; [
-    julm
-    grimmauld
-  ];
+  meta.maintainers = lib.teams.apparmor.members;
 }
diff --git a/nixos/modules/services/matrix/mjolnir.nix b/nixos/modules/services/matrix/mjolnir.nix
index d0160765a357..46007d4e1118 100644
--- a/nixos/modules/services/matrix/mjolnir.nix
+++ b/nixos/modules/services/matrix/mjolnir.nix
@@ -40,7 +40,7 @@ let
 
   # these config files will be merged one after the other to build the final config
   configFiles = [
-    "${pkgs.mjolnir}/libexec/mjolnir/deps/mjolnir/config/default.yaml"
+    "${pkgs.mjolnir}/lib/node_modules/mjolnir/config/default.yaml"
     moduleConfigFile
   ];
 
diff --git a/nixos/modules/services/monitoring/prometheus/alertmanager-ntfy.nix b/nixos/modules/services/monitoring/prometheus/alertmanager-ntfy.nix
new file mode 100644
index 000000000000..5237a24406b1
--- /dev/null
+++ b/nixos/modules/services/monitoring/prometheus/alertmanager-ntfy.nix
@@ -0,0 +1,201 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.prometheus.alertmanager-ntfy;
+
+  settingsFormat = pkgs.formats.yaml { };
+  settingsFile = settingsFormat.generate "settings.yml" cfg.settings;
+
+  configsArg = lib.concatStringsSep "," (
+    [ settingsFile ] ++ lib.imap0 (i: _: "%d/config-${toString i}.yml") cfg.extraConfigFiles
+  );
+in
+
+{
+  meta.maintainers = with lib.maintainers; [ defelo ];
+
+  options.services.prometheus.alertmanager-ntfy = {
+    enable = lib.mkEnableOption "alertmanager-ntfy";
+
+    package = lib.mkPackageOption pkgs "alertmanager-ntfy" { };
+
+    settings = lib.mkOption {
+      description = ''
+        Configuration of alertmanager-ntfy.
+        See <https://github.com/alexbakker/alertmanager-ntfy> for more information.
+      '';
+      default = { };
+
+      type = lib.types.submodule {
+        freeformType = settingsFormat.type;
+
+        options = {
+          http.addr = lib.mkOption {
+            type = lib.types.str;
+            description = "The address to listen on.";
+            default = "127.0.0.1:8000";
+            example = ":8000";
+          };
+
+          ntfy = {
+            baseurl = lib.mkOption {
+              type = lib.types.str;
+              description = "The base URL of the ntfy.sh instance.";
+              example = "https://ntfy.sh";
+            };
+
+            notification = {
+              topic = lib.mkOption {
+                type = lib.types.str;
+                description = ''
+                  The topic to which alerts should be published.
+                  Can either be a hardcoded string or a gval expression that evaluates to a string.
+                '';
+                example = "alertmanager";
+              };
+
+              priority = lib.mkOption {
+                type = lib.types.str;
+                description = ''
+                  The ntfy.sh message priority (see <https://docs.ntfy.sh/publish/#message-priority> for more information).
+                  Can either be a hardcoded string or a gval expression that evaluates to a string.
+                '';
+                default = ''status == "firing" ? "high" : "default"'';
+              };
+
+              tags = lib.mkOption {
+                type = lib.types.listOf (
+                  lib.types.submodule {
+                    options = {
+                      tag = lib.mkOption {
+                        type = lib.types.str;
+                        description = ''
+                          The tag to add.
+                          See <https://docs.ntfy.sh/emojis> for a list of all supported emojis.
+                        '';
+                        example = "rotating_light";
+                      };
+
+                      condition = lib.mkOption {
+                        type = lib.types.nullOr lib.types.str;
+                        description = ''
+                          The condition under which this tag should be added.
+                          Tags with no condition are always included.
+                        '';
+                        default = null;
+                        example = ''status == "firing"'';
+                      };
+                    };
+                  }
+                );
+                description = ''
+                  Tags to add to ntfy.sh messages.
+                  See <https://docs.ntfy.sh/publish/#tags-emojis> for more information.
+                '';
+                default = [
+                  {
+                    tag = "green_circle";
+                    condition = ''status == "resolved"'';
+                  }
+                  {
+                    tag = "red_circle";
+                    condition = ''status == "firing"'';
+                  }
+                ];
+              };
+
+              templates = {
+                title = lib.mkOption {
+                  type = lib.types.str;
+                  description = "The ntfy.sh message title template.";
+                  default = ''
+                    {{ if eq .Status "resolved" }}Resolved: {{ end }}{{ index .Annotations "summary" }}
+                  '';
+                };
+
+                description = lib.mkOption {
+                  type = lib.types.str;
+                  description = "The ntfy.sh message description template.";
+                  default = ''
+                    {{ index .Annotations "description" }}
+                  '';
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+
+    extraConfigFiles = lib.mkOption {
+      type = lib.types.listOf lib.types.path;
+      default = [ ];
+      example = [ "/run/secrets/alertmanager-ntfy.yml" ];
+      description = ''
+        Config files to merge into the settings defined in [](#opt-services.prometheus.alertmanager-ntfy.settings).
+        This is useful to avoid putting secrets into the Nix store.
+        See <https://github.com/alexbakker/alertmanager-ntfy> for more information.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.alertmanager-ntfy = {
+      wantedBy = [ "multi-user.target" ];
+
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+
+      serviceConfig = {
+        User = "alertmanager-ntfy";
+        Group = "alertmanager-ntfy";
+        DynamicUser = true;
+
+        LoadCredential = lib.imap0 (i: path: "config-${toString i}.yml:${path}") cfg.extraConfigFiles;
+
+        ExecStart = "${lib.getExe cfg.package} --configs ${configsArg}";
+
+        Restart = "always";
+        RestartSec = 5;
+
+        # Hardening
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = [ "" ];
+        DevicePolicy = "closed";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [ "AF_INET AF_INET6" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+        UMask = "0077";
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/coturn.nix b/nixos/modules/services/networking/coturn.nix
index 2c89c3a12fb5..044d3ba0b791 100644
--- a/nixos/modules/services/networking/coturn.nix
+++ b/nixos/modules/services/networking/coturn.nix
@@ -363,7 +363,7 @@ in
               chmod 640 ${runConfig}
             '';
             serviceConfig = rec {
-              Type = "simple";
+              Type = "notify";
               ExecStart = utils.escapeSystemdExecArgs [
                 (lib.getExe' pkgs.coturn "turnserver")
                 "-c"
@@ -413,6 +413,7 @@ in
                 [
                   "AF_INET"
                   "AF_INET6"
+                  "AF_UNIX"
                 ]
                 ++ lib.optionals (cfg.listening-ips == [ ]) [
                   # only used for interface discovery when no listening ips are configured
diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
index 5f34d74cd71f..65845156fc49 100644
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -382,7 +382,7 @@ in
       '';
       example = literalExpression ''
         {
-          inherit (pkgs.nextcloud31Packages.apps) mail calendar contact;
+          inherit (pkgs.nextcloud31Packages.apps) mail calendar contacts;
           phonetrack = pkgs.fetchNextcloudApp {
             name = "phonetrack";
             sha256 = "0qf366vbahyl27p9mshfma1as4nvql6w75zy2zk5xwwbp343vsbc";
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index a00ce39bdf4f..ce22a46e600c 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1117,7 +1117,7 @@ in
   private-gpt = handleTest ./private-gpt.nix { };
   privatebin = runTest ./privatebin.nix;
   privoxy = handleTest ./privoxy.nix { };
-  prometheus = handleTest ./prometheus { };
+  prometheus = import ./prometheus { inherit runTest; };
   prometheus-exporters = handleTest ./prometheus-exporters.nix { };
   prosody = handleTest ./xmpp/prosody.nix { };
   prosody-mysql = handleTest ./xmpp/prosody-mysql.nix { };
diff --git a/nixos/tests/openssh.nix b/nixos/tests/openssh.nix
index 074d36e3fbe5..d7ddf478d91a 100644
--- a/nixos/tests/openssh.nix
+++ b/nixos/tests/openssh.nix
@@ -35,38 +35,6 @@ import ./make-test-python.nix (
           ];
         };
 
-      server-x11 =
-        { ... }:
-
-        {
-          environment.systemPackages = [ pkgs.xorg.xauth ];
-          services.openssh = {
-            enable = true;
-            settings.X11Forwarding = true;
-          };
-          users.users.root.openssh.authorizedKeys.keys = [
-            snakeOilPublicKey
-          ];
-        };
-
-      server-x11-disable =
-        { ... }:
-
-        {
-          environment.systemPackages = [ pkgs.xorg.xauth ];
-          services.openssh = {
-            enable = true;
-            settings = {
-              X11Forwarding = true;
-              # CVE-2025-32728: the following line is ineffectual
-              DisableForwarding = true;
-            };
-          };
-          users.users.root.openssh.authorizedKeys.keys = [
-            snakeOilPublicKey
-          ];
-        };
-
       server-allowed-users =
         { ... }:
 
@@ -272,8 +240,6 @@ import ./make-test-python.nix (
       start_all()
 
       server.wait_for_unit("sshd", timeout=30)
-      server_x11.wait_for_unit("sshd", timeout=30)
-      server_x11_disable.wait_for_unit("sshd", timeout=30)
       server_allowed_users.wait_for_unit("sshd", timeout=30)
       server_localhost_only.wait_for_unit("sshd", timeout=30)
       server_match_rule.wait_for_unit("sshd", timeout=30)
@@ -341,16 +307,6 @@ import ./make-test-python.nix (
               timeout=30
           )
 
-      with subtest("x11-forwarding"):
-          client.succeed(
-              "[ \"$(ssh -Y -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil server-x11 'xauth list' | tee /dev/stderr | wc -l)\" -eq 1 ]",
-              timeout=30
-          )
-          client.succeed(
-              "[ \"$(ssh -Y -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil server-x11-disable 'xauth list' | tee /dev/stderr | wc -l)\" -eq 0 ]",
-              timeout=30
-          )
-
       with subtest("localhost-only"):
           server_localhost_only.succeed("ss -nlt | grep '127.0.0.1:22'")
           server_localhost_only_lazy.succeed("ss -nlt | grep '127.0.0.1:22'")
diff --git a/nixos/tests/paretosecurity.nix b/nixos/tests/paretosecurity.nix
index bafdffaddecb..5f9562013011 100644
--- a/nixos/tests/paretosecurity.nix
+++ b/nixos/tests/paretosecurity.nix
@@ -117,15 +117,17 @@
     xfce.succeed("xdotool click 1")
     xfce.wait_for_text("Run Checks")
 
-    # Test 5: paretosecurity:// URL handler is registered
-    xfce.succeed("su - alice -c 'xdg-open paretosecurity://foo'")
-
-    # Test 6: Desktop entry
+    # Test 5: Desktop entry
     xfce.succeed("xdotool mousemove 10 10")
     xfce.succeed("xdotool click 1")  # hide the tray icon window
     xfce.succeed("xdotool click 1")  # show the Applications menu
     xfce.succeed("xdotool mousemove 10 200")
     xfce.succeed("xdotool click 1")
     xfce.wait_for_text("Pareto Security")
+
+    # Test 6: paretosecurity:// URL handler is registered
+    xfce.execute("su - alice -c 'xdg-open paretosecurity://foo >/dev/null &'")
+    xfce.wait_for_text("Failed to add device")
+
   '';
 }
diff --git a/nixos/tests/postgresql/anonymizer.nix b/nixos/tests/postgresql/anonymizer.nix
index d59a26f101e8..77c38f9344ef 100644
--- a/nixos/tests/postgresql/anonymizer.nix
+++ b/nixos/tests/postgresql/anonymizer.nix
@@ -20,7 +20,6 @@ let
           services.postgresql = {
             inherit package;
             enable = true;
-            enableJIT = lib.hasInfix "-jit-" package.name;
             extensions = ps: [ ps.anonymizer ];
             settings.shared_preload_libraries = [ "anon" ];
           };
diff --git a/nixos/tests/postgresql/pgjwt.nix b/nixos/tests/postgresql/pgjwt.nix
index f00d9a939d3d..9a5e12bc3d7d 100644
--- a/nixos/tests/postgresql/pgjwt.nix
+++ b/nixos/tests/postgresql/pgjwt.nix
@@ -24,7 +24,6 @@ let
           services.postgresql = {
             inherit package;
             enable = true;
-            enableJIT = lib.hasInfix "-jit-" package.name;
             extensions =
               ps: with ps; [
                 pgjwt
diff --git a/nixos/tests/postgresql/postgresql-jit.nix b/nixos/tests/postgresql/postgresql-jit.nix
index e082ff141327..53d35b3e9d64 100644
--- a/nixos/tests/postgresql/postgresql-jit.nix
+++ b/nixos/tests/postgresql/postgresql-jit.nix
@@ -51,5 +51,4 @@ let
 in
 genTests {
   inherit makeTestFor;
-  filter = n: _: lib.hasSuffix "_jit" n;
 }
diff --git a/nixos/tests/postgresql/postgresql-tls-client-cert.nix b/nixos/tests/postgresql/postgresql-tls-client-cert.nix
index 117b9b0e24a9..6cb86d1ff8fc 100644
--- a/nixos/tests/postgresql/postgresql-tls-client-cert.nix
+++ b/nixos/tests/postgresql/postgresql-tls-client-cert.nix
@@ -51,7 +51,6 @@ let
           services.postgresql = {
             inherit package;
             enable = true;
-            enableJIT = lib.hasInfix "-jit-" package.name;
             enableTCPIP = true;
             ensureUsers = [
               {
diff --git a/nixos/tests/postgresql/postgresql-wal-receiver.nix b/nixos/tests/postgresql/postgresql-wal-receiver.nix
index c99c3889c027..70f9983700c2 100644
--- a/nixos/tests/postgresql/postgresql-wal-receiver.nix
+++ b/nixos/tests/postgresql/postgresql-wal-receiver.nix
@@ -32,7 +32,6 @@ let
           services.postgresql = {
             inherit package;
             enable = true;
-            enableJIT = lib.hasInfix "-jit-" package.name;
             settings = {
               max_replication_slots = 10;
               max_wal_senders = 10;
diff --git a/nixos/tests/postgresql/postgresql.nix b/nixos/tests/postgresql/postgresql.nix
index 7741d14808eb..a88143c6421a 100644
--- a/nixos/tests/postgresql/postgresql.nix
+++ b/nixos/tests/postgresql/postgresql.nix
@@ -15,41 +15,33 @@ let
       postgresql-clauses = makeEnsureTestFor package;
     };
 
-  test-sql =
-    enablePLv8Test:
-    pkgs.writeText "postgresql-test" (
-      ''
-        CREATE EXTENSION pgcrypto; -- just to check if lib loading works
-        CREATE TABLE sth (
-          id int
-        );
-        INSERT INTO sth (id) VALUES (1);
-        INSERT INTO sth (id) VALUES (1);
-        INSERT INTO sth (id) VALUES (1);
-        INSERT INTO sth (id) VALUES (1);
-        INSERT INTO sth (id) VALUES (1);
-        CREATE TABLE xmltest ( doc xml );
-        INSERT INTO xmltest (doc) VALUES ('<test>ok</test>'); -- check if libxml2 enabled
-      ''
-      + lib.optionalString enablePLv8Test ''
-        -- check if hardening gets relaxed
-        CREATE EXTENSION plv8;
-        -- try to trigger the V8 JIT, which requires MemoryDenyWriteExecute
-        DO $$
-          let xs = [];
-          for (let i = 0, n = 400000; i < n; i++) {
-              xs.push(Math.round(Math.random() * n))
-          }
-          console.log(xs.reduce((acc, x) => acc + x, 0));
-        $$ LANGUAGE plv8;
-      ''
+  test-sql = pkgs.writeText "postgresql-test" (''
+    CREATE EXTENSION pgcrypto; -- just to check if lib loading works
+    CREATE TABLE sth (
+      id int
     );
+    INSERT INTO sth (id) VALUES (1);
+    INSERT INTO sth (id) VALUES (1);
+    INSERT INTO sth (id) VALUES (1);
+    INSERT INTO sth (id) VALUES (1);
+    INSERT INTO sth (id) VALUES (1);
+    CREATE TABLE xmltest ( doc xml );
+    INSERT INTO xmltest (doc) VALUES ('<test>ok</test>'); -- check if libxml2 enabled
+
+    -- check if hardening gets relaxed
+    CREATE EXTENSION plv8;
+    -- try to trigger the V8 JIT, which requires MemoryDenyWriteExecute
+    DO $$
+      let xs = [];
+      for (let i = 0, n = 400000; i < n; i++) {
+          xs.push(Math.round(Math.random() * n))
+      }
+      console.log(xs.reduce((acc, x) => acc + x, 0));
+    $$ LANGUAGE plv8;
+  '');
 
   makeTestForWithBackupAll =
     package: backupAll:
-    let
-      enablePLv8Check = !package.pkgs.plv8.meta.broken;
-    in
     makeTest {
       name = "postgresql${lib.optionalString backupAll "-backup-all"}-${package.name}";
       meta = with lib.maintainers; {
@@ -62,12 +54,9 @@ let
           services.postgresql = {
             inherit package;
             enable = true;
-            enableJIT = lib.hasInfix "-jit-" package.name;
-            # plv8 doesn't support postgresql with JIT, so we only run the test
-            # for the non-jit variant.
             # TODO(@Ma27) split this off into its own VM test and move a few other
             # extension tests to use postgresqlTestExtension.
-            extensions = lib.mkIf enablePLv8Check (ps: with ps; [ plv8 ]);
+            extensions = ps: with ps; [ plv8 ];
           };
 
           services.postgresqlBackup = {
@@ -94,7 +83,7 @@ let
 
           with subtest("Postgresql is available just after unit start"):
               machine.succeed(
-                  "cat ${test-sql enablePLv8Check} | sudo -u postgres psql"
+                  "cat ${test-sql} | sudo -u postgres psql"
               )
 
           with subtest("Postgresql survives restart (bug #1735)"):
@@ -184,7 +173,6 @@ let
           services.postgresql = {
             inherit package;
             enable = true;
-            enableJIT = lib.hasInfix "-jit-" package.name;
             ensureUsers = [
               {
                 name = "all-clauses";
diff --git a/nixos/tests/postgresql/wal2json.nix b/nixos/tests/postgresql/wal2json.nix
index abfe60673753..1252264353f8 100644
--- a/nixos/tests/postgresql/wal2json.nix
+++ b/nixos/tests/postgresql/wal2json.nix
@@ -17,7 +17,6 @@ let
         services.postgresql = {
           inherit package;
           enable = true;
-          enableJIT = lib.hasInfix "-jit-" package.name;
           extensions = with package.pkgs; [ wal2json ];
           settings = {
             wal_level = "logical";
diff --git a/nixos/tests/prometheus/alertmanager-ntfy.nix b/nixos/tests/prometheus/alertmanager-ntfy.nix
new file mode 100644
index 000000000000..8015354cbb57
--- /dev/null
+++ b/nixos/tests/prometheus/alertmanager-ntfy.nix
@@ -0,0 +1,99 @@
+{ lib, ... }:
+
+let
+  ports = {
+    alertmanager-ntfy = 8000;
+    ntfy-sh = 8001;
+    alertmanager = 8002;
+  };
+in
+
+{
+  name = "alertmanager-ntfy";
+  meta.maintainers = with lib.maintainers; [ defelo ];
+
+  nodes.machine = {
+    services.prometheus.alertmanager = {
+      enable = true;
+      listenAddress = "127.0.0.1";
+      port = ports.alertmanager;
+
+      configuration = {
+        route = {
+          receiver = "test";
+          group_by = [ "..." ];
+          group_wait = "0s";
+          group_interval = "1s";
+          repeat_interval = "2h";
+        };
+
+        receivers = [
+          {
+            name = "test";
+            webhook_configs = [ { url = "http://127.0.0.1:${toString ports.alertmanager-ntfy}/hook"; } ];
+          }
+        ];
+      };
+    };
+
+    services.prometheus.alertmanager-ntfy = {
+      enable = true;
+      settings = {
+        http.addr = "127.0.0.1:${toString ports.alertmanager-ntfy}";
+        ntfy = {
+          baseurl = "http://127.0.0.1:${toString ports.ntfy-sh}";
+          notification.topic = "alertmanager";
+        };
+      };
+    };
+
+    services.ntfy-sh = {
+      enable = true;
+      settings = {
+        listen-http = "127.0.0.1:${toString ports.ntfy-sh}";
+        base-url = "http://127.0.0.1:${toString ports.ntfy-sh}";
+      };
+    };
+  };
+
+  interactive.nodes.machine = {
+    services.prometheus.alertmanager.listenAddress = lib.mkForce "0.0.0.0";
+    services.prometheus.alertmanager-ntfy.settings.http.addr =
+      lib.mkForce "0.0.0.0:${toString ports.alertmanager-ntfy}";
+    services.ntfy-sh.settings.listen-http = lib.mkForce "0.0.0.0:${toString ports.ntfy-sh}";
+    networking.firewall.enable = false;
+    virtualisation.forwardPorts = lib.mapAttrsToList (_: port: {
+      from = "host";
+      host = { inherit port; };
+      guest = { inherit port; };
+    }) ports;
+  };
+
+  testScript = ''
+    import json
+    import time
+
+    machine.wait_for_unit("alertmanager.service")
+    machine.wait_for_unit("alertmanager-ntfy.service")
+    machine.wait_for_unit("ntfy-sh.service")
+    machine.wait_for_open_port(${toString ports.alertmanager})
+    machine.wait_for_open_port(${toString ports.alertmanager-ntfy})
+    machine.wait_for_open_port(${toString ports.ntfy-sh})
+
+    machine.succeed("""curl 127.0.0.1:${toString ports.alertmanager}/api/v2/alerts \
+      -X POST -H 'Content-Type: application/json' \
+      -d '[{ \
+        "labels": {"alertname": "test"},
+        "annotations": {"summary": "alert summary", "description": "alert description"} \
+      }]'""")
+
+    while not (resp := machine.succeed("curl '127.0.0.1:${toString ports.ntfy-sh}/alertmanager/json?poll=1'")):
+      time.sleep(1)
+
+    msg = json.loads(resp)
+    assert msg["title"] == "alert summary"
+    assert msg["message"] == "alert description"
+    assert msg["priority"] == 4
+    assert "red_circle" in msg["tags"]
+  '';
+}
diff --git a/nixos/tests/prometheus/alertmanager.nix b/nixos/tests/prometheus/alertmanager.nix
index 51151cbab534..794bbb8aab90 100644
--- a/nixos/tests/prometheus/alertmanager.nix
+++ b/nixos/tests/prometheus/alertmanager.nix
@@ -1,160 +1,146 @@
-import ../make-test-python.nix (
-  { lib, pkgs, ... }:
+{ pkgs, ... }:
 
-  {
-    name = "prometheus-alertmanager";
+{
+  name = "prometheus-alertmanager";
 
-    nodes = {
-      prometheus =
-        { config, pkgs, ... }:
-        {
-          environment.systemPackages = [ pkgs.jq ];
+  nodes = {
+    prometheus =
+      { config, pkgs, ... }:
+      {
+        environment.systemPackages = [ pkgs.jq ];
 
-          networking.firewall.allowedTCPPorts = [ config.services.prometheus.port ];
+        networking.firewall.allowedTCPPorts = [ config.services.prometheus.port ];
 
-          services.prometheus = {
-            enable = true;
-            globalConfig.scrape_interval = "2s";
+        services.prometheus = {
+          enable = true;
+          globalConfig.scrape_interval = "2s";
 
-            alertmanagers = [
-              {
-                scheme = "http";
-                static_configs = [
-                  {
-                    targets = [
-                      "alertmanager:${toString config.services.prometheus.alertmanager.port}"
-                    ];
-                  }
-                ];
-              }
-            ];
-
-            rules = [
-              ''
-                groups:
-                  - name: test
-                    rules:
-                      - alert: InstanceDown
-                        expr: up == 0
-                        for: 5s
-                        labels:
-                          severity: page
-                        annotations:
-                          summary: "Instance {{ $labels.instance }} down"
-              ''
-            ];
-
-            scrapeConfigs = [
-              {
-                job_name = "alertmanager";
-                static_configs = [
-                  {
-                    targets = [
-                      "alertmanager:${toString config.services.prometheus.alertmanager.port}"
-                    ];
-                  }
-                ];
-              }
-              {
-                job_name = "node";
-                static_configs = [
-                  {
-                    targets = [
-                      "node:${toString config.services.prometheus.exporters.node.port}"
-                    ];
-                  }
-                ];
-              }
-            ];
-          };
-        };
-
-      alertmanager =
-        { config, pkgs, ... }:
-        {
-          services.prometheus.alertmanager = {
-            enable = true;
-            openFirewall = true;
-
-            configuration = {
-              global = {
-                resolve_timeout = "1m";
-              };
-
-              route = {
-                # Root route node
-                receiver = "test";
-                group_by = [ "..." ];
-                continue = false;
-                group_wait = "1s";
-                group_interval = "15s";
-                repeat_interval = "24h";
-              };
-
-              receivers = [
-                {
-                  name = "test";
-                  webhook_configs = [
-                    {
-                      url = "http://logger:6725";
-                      send_resolved = true;
-                      max_alerts = 0;
-                    }
-                  ];
-                }
+          alertmanagers = [
+            {
+              scheme = "http";
+              static_configs = [
+                { targets = [ "alertmanager:${toString config.services.prometheus.alertmanager.port}" ]; }
               ];
+            }
+          ];
+
+          rules = [
+            ''
+              groups:
+                - name: test
+                  rules:
+                    - alert: InstanceDown
+                      expr: up == 0
+                      for: 5s
+                      labels:
+                        severity: page
+                      annotations:
+                        summary: "Instance {{ $labels.instance }} down"
+            ''
+          ];
+
+          scrapeConfigs = [
+            {
+              job_name = "alertmanager";
+              static_configs = [
+                { targets = [ "alertmanager:${toString config.services.prometheus.alertmanager.port}" ]; }
+              ];
+            }
+            {
+              job_name = "node";
+              static_configs = [
+                { targets = [ "node:${toString config.services.prometheus.exporters.node.port}" ]; }
+              ];
+            }
+          ];
+        };
+      };
+
+    alertmanager =
+      { config, pkgs, ... }:
+      {
+        services.prometheus.alertmanager = {
+          enable = true;
+          openFirewall = true;
+
+          configuration = {
+            global = {
+              resolve_timeout = "1m";
             };
+
+            route = {
+              # Root route node
+              receiver = "test";
+              group_by = [ "..." ];
+              continue = false;
+              group_wait = "1s";
+              group_interval = "15s";
+              repeat_interval = "24h";
+            };
+
+            receivers = [
+              {
+                name = "test";
+                webhook_configs = [
+                  {
+                    url = "http://logger:6725";
+                    send_resolved = true;
+                    max_alerts = 0;
+                  }
+                ];
+              }
+            ];
           };
         };
+      };
 
-      logger =
-        { config, pkgs, ... }:
-        {
-          networking.firewall.allowedTCPPorts = [ 6725 ];
+    logger =
+      { config, pkgs, ... }:
+      {
+        networking.firewall.allowedTCPPorts = [ 6725 ];
 
-          services.prometheus.alertmanagerWebhookLogger.enable = true;
-        };
-    };
+        services.prometheus.alertmanagerWebhookLogger.enable = true;
+      };
+  };
 
-    testScript = ''
-      alertmanager.wait_for_unit("alertmanager")
-      alertmanager.wait_for_open_port(9093)
-      alertmanager.wait_until_succeeds("curl -s http://127.0.0.1:9093/-/ready")
-      #alertmanager.wait_until_succeeds("journalctl -o cat -u alertmanager.service | grep 'version=${pkgs.prometheus-alertmanager.version}'")
+  testScript = ''
+    alertmanager.wait_for_unit("alertmanager")
+    alertmanager.wait_for_open_port(9093)
+    alertmanager.wait_until_succeeds("curl -s http://127.0.0.1:9093/-/ready")
+    #alertmanager.wait_until_succeeds("journalctl -o cat -u alertmanager.service | grep 'version=${pkgs.prometheus-alertmanager.version}'")
 
-      logger.wait_for_unit("alertmanager-webhook-logger")
-      logger.wait_for_open_port(6725)
+    logger.wait_for_unit("alertmanager-webhook-logger")
+    logger.wait_for_open_port(6725)
 
-      prometheus.wait_for_unit("prometheus")
-      prometheus.wait_for_open_port(9090)
+    prometheus.wait_for_unit("prometheus")
+    prometheus.wait_for_open_port(9090)
 
-      prometheus.wait_until_succeeds(
-        "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=count(up\{job=\"alertmanager\"\}==1)' | "
-        + "jq '.data.result[0].value[1]' | grep '\"1\"'"
-      )
+    prometheus.wait_until_succeeds(
+      "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=count(up\{job=\"alertmanager\"\}==1)' | "
+      + "jq '.data.result[0].value[1]' | grep '\"1\"'"
+    )
 
-      prometheus.wait_until_succeeds(
-        "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=sum(alertmanager_build_info)%20by%20(version)' | "
-        + "jq '.data.result[0].metric.version' | grep '\"${pkgs.prometheus-alertmanager.version}\"'"
-      )
+    prometheus.wait_until_succeeds(
+      "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=sum(alertmanager_build_info)%20by%20(version)' | "
+      + "jq '.data.result[0].metric.version' | grep '\"${pkgs.prometheus-alertmanager.version}\"'"
+    )
 
-      prometheus.wait_until_succeeds(
-        "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=count(up\{job=\"node\"\}!=1)' | "
-        + "jq '.data.result[0].value[1]' | grep '\"1\"'"
-      )
+    prometheus.wait_until_succeeds(
+      "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=count(up\{job=\"node\"\}!=1)' | "
+      + "jq '.data.result[0].value[1]' | grep '\"1\"'"
+    )
 
-      prometheus.wait_until_succeeds(
-        "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=alertmanager_notifications_total\{integration=\"webhook\"\}' | "
-        + "jq '.data.result[0].value[1]' | grep -v '\"0\"'"
-      )
+    prometheus.wait_until_succeeds(
+      "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=alertmanager_notifications_total\{integration=\"webhook\"\}' | "
+      + "jq '.data.result[0].value[1]' | grep -v '\"0\"'"
+    )
 
-      logger.wait_until_succeeds(
-        "journalctl -o cat -u alertmanager-webhook-logger.service | grep '\"alertname\":\"InstanceDown\"'"
-      )
+    logger.wait_until_succeeds(
+      "journalctl -o cat -u alertmanager-webhook-logger.service | grep '\"alertname\":\"InstanceDown\"'"
+    )
 
-      logger.log(logger.succeed("systemd-analyze security alertmanager-webhook-logger.service | grep -v '✓'"))
+    logger.log(logger.succeed("systemd-analyze security alertmanager-webhook-logger.service | grep -v '✓'"))
 
-      alertmanager.log(alertmanager.succeed("systemd-analyze security alertmanager.service | grep -v '✓'"))
-    '';
-  }
-)
+    alertmanager.log(alertmanager.succeed("systemd-analyze security alertmanager.service | grep -v '✓'"))
+  '';
+}
diff --git a/nixos/tests/prometheus/config-reload.nix b/nixos/tests/prometheus/config-reload.nix
index 60f5bc6a1d23..bb20d249fe9c 100644
--- a/nixos/tests/prometheus/config-reload.nix
+++ b/nixos/tests/prometheus/config-reload.nix
@@ -1,120 +1,108 @@
-import ../make-test-python.nix (
-  { lib, pkgs, ... }:
+{
+  name = "prometheus-config-reload";
 
-  {
-    name = "prometheus-config-reload";
+  nodes = {
+    prometheus =
+      { config, pkgs, ... }:
+      {
+        environment.systemPackages = [ pkgs.jq ];
 
-    nodes = {
-      prometheus =
-        { config, pkgs, ... }:
-        {
-          environment.systemPackages = [ pkgs.jq ];
+        networking.firewall.allowedTCPPorts = [ config.services.prometheus.port ];
 
-          networking.firewall.allowedTCPPorts = [ config.services.prometheus.port ];
+        services.prometheus = {
+          enable = true;
+          enableReload = true;
+          globalConfig.scrape_interval = "2s";
+          scrapeConfigs = [
+            {
+              job_name = "prometheus";
+              static_configs = [ { targets = [ "prometheus:${toString config.services.prometheus.port}" ]; } ];
+            }
+          ];
+        };
 
-          services.prometheus = {
-            enable = true;
-            enableReload = true;
-            globalConfig.scrape_interval = "2s";
-            scrapeConfigs = [
-              {
-                job_name = "prometheus";
-                static_configs = [
+        specialisation = {
+          "prometheus-config-change" = {
+            configuration = {
+              environment.systemPackages = [ pkgs.yq ];
+
+              # This configuration just adds a new prometheus job
+              # to scrape the node_exporter metrics of the s3 machine.
+              services.prometheus = {
+                scrapeConfigs = [
                   {
-                    targets = [
-                      "prometheus:${toString config.services.prometheus.port}"
+                    job_name = "node";
+                    static_configs = [
+                      { targets = [ "node:${toString config.services.prometheus.exporters.node.port}" ]; }
                     ];
                   }
                 ];
-              }
-            ];
-          };
-
-          specialisation = {
-            "prometheus-config-change" = {
-              configuration = {
-                environment.systemPackages = [ pkgs.yq ];
-
-                # This configuration just adds a new prometheus job
-                # to scrape the node_exporter metrics of the s3 machine.
-                services.prometheus = {
-                  scrapeConfigs = [
-                    {
-                      job_name = "node";
-                      static_configs = [
-                        {
-                          targets = [ "node:${toString config.services.prometheus.exporters.node.port}" ];
-                        }
-                      ];
-                    }
-                  ];
-                };
               };
             };
           };
         };
-    };
+      };
+  };
 
-    testScript = ''
-      prometheus.wait_for_unit("prometheus")
-      prometheus.wait_for_open_port(9090)
+  testScript = ''
+    prometheus.wait_for_unit("prometheus")
+    prometheus.wait_for_open_port(9090)
 
-      # Check if switching to a NixOS configuration that changes the prometheus
-      # configuration reloads (instead of restarts) prometheus before the switch
-      # finishes successfully:
-      with subtest("config change reloads prometheus"):
-        import json
-        # We check if prometheus has finished reloading by looking for the message
-        # "Completed loading of configuration file" in the journal between the start
-        # and finish of switching to the new NixOS configuration.
-        #
-        # To mark the start we record the journal cursor before starting the switch:
-        cursor_before_switching = json.loads(
-            prometheus.succeed("journalctl -n1 -o json --output-fields=__CURSOR")
-        )["__CURSOR"]
+    # Check if switching to a NixOS configuration that changes the prometheus
+    # configuration reloads (instead of restarts) prometheus before the switch
+    # finishes successfully:
+    with subtest("config change reloads prometheus"):
+      import json
+      # We check if prometheus has finished reloading by looking for the message
+      # "Completed loading of configuration file" in the journal between the start
+      # and finish of switching to the new NixOS configuration.
+      #
+      # To mark the start we record the journal cursor before starting the switch:
+      cursor_before_switching = json.loads(
+          prometheus.succeed("journalctl -n1 -o json --output-fields=__CURSOR")
+      )["__CURSOR"]
 
-        # Now we switch:
-        prometheus_config_change = prometheus.succeed(
-            "readlink /run/current-system/specialisation/prometheus-config-change"
-        ).strip()
-        prometheus.succeed(prometheus_config_change + "/bin/switch-to-configuration test")
+      # Now we switch:
+      prometheus_config_change = prometheus.succeed(
+          "readlink /run/current-system/specialisation/prometheus-config-change"
+      ).strip()
+      prometheus.succeed(prometheus_config_change + "/bin/switch-to-configuration test")
 
-        # Next we retrieve all logs since the start of switching:
-        logs_after_starting_switching = prometheus.succeed(
-            """
-              journalctl --after-cursor='{cursor_before_switching}' -o json --output-fields=MESSAGE
-            """.format(
-                cursor_before_switching=cursor_before_switching
-            )
-        )
-
-        # Finally we check if the message "Completed loading of configuration file"
-        # occurs before the "finished switching to system configuration" message:
-        finished_switching_msg = (
-            "finished switching to system configuration " + prometheus_config_change
-        )
-        reloaded_before_switching_finished = False
-        finished_switching = False
-        for log_line in logs_after_starting_switching.split("\n"):
-            msg = json.loads(log_line)["MESSAGE"]
-            if "Completed loading of configuration file" in msg:
-                reloaded_before_switching_finished = True
-            if msg == finished_switching_msg:
-                finished_switching = True
-                break
-
-        assert reloaded_before_switching_finished
-        assert finished_switching
-
-        # Check if the reloaded config includes the new node job:
-        prometheus.succeed(
+      # Next we retrieve all logs since the start of switching:
+      logs_after_starting_switching = prometheus.succeed(
           """
-            curl -sf http://127.0.0.1:9090/api/v1/status/config \
-              | jq -r .data.yaml \
-              | yq '.scrape_configs | any(.job_name == "node")' \
-              | grep true
-          """
-        )
-    '';
-  }
-)
+            journalctl --after-cursor='{cursor_before_switching}' -o json --output-fields=MESSAGE
+          """.format(
+              cursor_before_switching=cursor_before_switching
+          )
+      )
+
+      # Finally we check if the message "Completed loading of configuration file"
+      # occurs before the "finished switching to system configuration" message:
+      finished_switching_msg = (
+          "finished switching to system configuration " + prometheus_config_change
+      )
+      reloaded_before_switching_finished = False
+      finished_switching = False
+      for log_line in logs_after_starting_switching.split("\n"):
+          msg = json.loads(log_line)["MESSAGE"]
+          if "Completed loading of configuration file" in msg:
+              reloaded_before_switching_finished = True
+          if msg == finished_switching_msg:
+              finished_switching = True
+              break
+
+      assert reloaded_before_switching_finished
+      assert finished_switching
+
+      # Check if the reloaded config includes the new node job:
+      prometheus.succeed(
+        """
+          curl -sf http://127.0.0.1:9090/api/v1/status/config \
+            | jq -r .data.yaml \
+            | yq '.scrape_configs | any(.job_name == "node")' \
+            | grep true
+        """
+      )
+  '';
+}
diff --git a/nixos/tests/prometheus/default.nix b/nixos/tests/prometheus/default.nix
index ea6c61c85b80..53cfc80e8f64 100644
--- a/nixos/tests/prometheus/default.nix
+++ b/nixos/tests/prometheus/default.nix
@@ -1,14 +1,11 @@
-{
-  system ? builtins.currentSystem,
-  config ? { },
-  pkgs ? import ../../.. { inherit system config; },
-}:
+{ runTest }:
 
 {
-  alertmanager = import ./alertmanager.nix { inherit system pkgs; };
-  config-reload = import ./config-reload.nix { inherit system pkgs; };
-  federation = import ./federation.nix { inherit system pkgs; };
-  prometheus-pair = import ./prometheus-pair.nix { inherit system pkgs; };
-  pushgateway = import ./pushgateway.nix { inherit system pkgs; };
-  remote-write = import ./remote-write.nix { inherit system pkgs; };
+  alertmanager = runTest ./alertmanager.nix;
+  alertmanager-ntfy = runTest ./alertmanager-ntfy.nix;
+  config-reload = runTest ./config-reload.nix;
+  federation = runTest ./federation.nix;
+  prometheus-pair = runTest ./prometheus-pair.nix;
+  pushgateway = runTest ./pushgateway.nix;
+  remote-write = runTest ./remote-write.nix;
 }
diff --git a/nixos/tests/prometheus/federation.nix b/nixos/tests/prometheus/federation.nix
index 15f84b2d88af..e81418dfba93 100644
--- a/nixos/tests/prometheus/federation.nix
+++ b/nixos/tests/prometheus/federation.nix
@@ -1,227 +1,203 @@
-import ../make-test-python.nix (
-  { lib, pkgs, ... }:
+{
+  name = "prometheus-federation";
 
-  {
-    name = "prometheus-federation";
+  nodes = {
+    global1 =
+      { config, pkgs, ... }:
+      {
+        environment.systemPackages = [ pkgs.jq ];
 
-    nodes = {
-      global1 =
-        { config, pkgs, ... }:
-        {
-          environment.systemPackages = [ pkgs.jq ];
+        networking.firewall.allowedTCPPorts = [ config.services.prometheus.port ];
 
-          networking.firewall.allowedTCPPorts = [ config.services.prometheus.port ];
+        services.prometheus = {
+          enable = true;
+          globalConfig.scrape_interval = "2s";
 
-          services.prometheus = {
-            enable = true;
-            globalConfig.scrape_interval = "2s";
+          scrapeConfigs = [
+            {
+              job_name = "federate";
+              honor_labels = true;
+              metrics_path = "/federate";
 
-            scrapeConfigs = [
-              {
-                job_name = "federate";
-                honor_labels = true;
-                metrics_path = "/federate";
+              params = {
+                "match[]" = [
+                  "{job=\"node\"}"
+                  "{job=\"prometheus\"}"
+                ];
+              };
 
-                params = {
-                  "match[]" = [
-                    "{job=\"node\"}"
-                    "{job=\"prometheus\"}"
+              static_configs = [
+                {
+                  targets = [
+                    "prometheus1:${toString config.services.prometheus.port}"
+                    "prometheus2:${toString config.services.prometheus.port}"
                   ];
-                };
-
-                static_configs = [
-                  {
-                    targets = [
-                      "prometheus1:${toString config.services.prometheus.port}"
-                      "prometheus2:${toString config.services.prometheus.port}"
-                    ];
-                  }
-                ];
-              }
-              {
-                job_name = "prometheus";
-                static_configs = [
-                  {
-                    targets = [
-                      "global1:${toString config.services.prometheus.port}"
-                      "global2:${toString config.services.prometheus.port}"
-                    ];
-                  }
-                ];
-              }
-            ];
-          };
-        };
-
-      global2 =
-        { config, pkgs, ... }:
-        {
-          environment.systemPackages = [ pkgs.jq ];
-
-          networking.firewall.allowedTCPPorts = [ config.services.prometheus.port ];
-
-          services.prometheus = {
-            enable = true;
-            globalConfig.scrape_interval = "2s";
-
-            scrapeConfigs = [
-              {
-                job_name = "federate";
-                honor_labels = true;
-                metrics_path = "/federate";
-
-                params = {
-                  "match[]" = [
-                    "{job=\"node\"}"
-                    "{job=\"prometheus\"}"
+                }
+              ];
+            }
+            {
+              job_name = "prometheus";
+              static_configs = [
+                {
+                  targets = [
+                    "global1:${toString config.services.prometheus.port}"
+                    "global2:${toString config.services.prometheus.port}"
                   ];
-                };
-
-                static_configs = [
-                  {
-                    targets = [
-                      "prometheus1:${toString config.services.prometheus.port}"
-                      "prometheus2:${toString config.services.prometheus.port}"
-                    ];
-                  }
-                ];
-              }
-              {
-                job_name = "prometheus";
-                static_configs = [
-                  {
-                    targets = [
-                      "global1:${toString config.services.prometheus.port}"
-                      "global2:${toString config.services.prometheus.port}"
-                    ];
-                  }
-                ];
-              }
-            ];
-          };
+                }
+              ];
+            }
+          ];
         };
+      };
 
-      prometheus1 =
-        { config, pkgs, ... }:
-        {
-          environment.systemPackages = [ pkgs.jq ];
+    global2 =
+      { config, pkgs, ... }:
+      {
+        environment.systemPackages = [ pkgs.jq ];
 
-          networking.firewall.allowedTCPPorts = [ config.services.prometheus.port ];
+        networking.firewall.allowedTCPPorts = [ config.services.prometheus.port ];
 
-          services.prometheus = {
-            enable = true;
-            globalConfig.scrape_interval = "2s";
+        services.prometheus = {
+          enable = true;
+          globalConfig.scrape_interval = "2s";
 
-            scrapeConfigs = [
-              {
-                job_name = "node";
-                static_configs = [
-                  {
-                    targets = [
-                      "node1:${toString config.services.prometheus.exporters.node.port}"
-                    ];
-                  }
+          scrapeConfigs = [
+            {
+              job_name = "federate";
+              honor_labels = true;
+              metrics_path = "/federate";
+
+              params = {
+                "match[]" = [
+                  "{job=\"node\"}"
+                  "{job=\"prometheus\"}"
                 ];
-              }
-              {
-                job_name = "prometheus";
-                static_configs = [
-                  {
-                    targets = [
-                      "prometheus1:${toString config.services.prometheus.port}"
-                    ];
-                  }
-                ];
-              }
-            ];
-          };
+              };
+
+              static_configs = [
+                {
+                  targets = [
+                    "prometheus1:${toString config.services.prometheus.port}"
+                    "prometheus2:${toString config.services.prometheus.port}"
+                  ];
+                }
+              ];
+            }
+            {
+              job_name = "prometheus";
+              static_configs = [
+                {
+                  targets = [
+                    "global1:${toString config.services.prometheus.port}"
+                    "global2:${toString config.services.prometheus.port}"
+                  ];
+                }
+              ];
+            }
+          ];
         };
+      };
 
-      prometheus2 =
-        { config, pkgs, ... }:
-        {
-          environment.systemPackages = [ pkgs.jq ];
+    prometheus1 =
+      { config, pkgs, ... }:
+      {
+        environment.systemPackages = [ pkgs.jq ];
 
-          networking.firewall.allowedTCPPorts = [ config.services.prometheus.port ];
+        networking.firewall.allowedTCPPorts = [ config.services.prometheus.port ];
 
-          services.prometheus = {
-            enable = true;
-            globalConfig.scrape_interval = "2s";
+        services.prometheus = {
+          enable = true;
+          globalConfig.scrape_interval = "2s";
 
-            scrapeConfigs = [
-              {
-                job_name = "node";
-                static_configs = [
-                  {
-                    targets = [
-                      "node2:${toString config.services.prometheus.exporters.node.port}"
-                    ];
-                  }
-                ];
-              }
-              {
-                job_name = "prometheus";
-                static_configs = [
-                  {
-                    targets = [
-                      "prometheus2:${toString config.services.prometheus.port}"
-                    ];
-                  }
-                ];
-              }
-            ];
-          };
+          scrapeConfigs = [
+            {
+              job_name = "node";
+              static_configs = [
+                { targets = [ "node1:${toString config.services.prometheus.exporters.node.port}" ]; }
+              ];
+            }
+            {
+              job_name = "prometheus";
+              static_configs = [ { targets = [ "prometheus1:${toString config.services.prometheus.port}" ]; } ];
+            }
+          ];
         };
+      };
 
-      node1 =
-        { config, pkgs, ... }:
-        {
-          services.prometheus.exporters.node = {
-            enable = true;
-            openFirewall = true;
-          };
+    prometheus2 =
+      { config, pkgs, ... }:
+      {
+        environment.systemPackages = [ pkgs.jq ];
+
+        networking.firewall.allowedTCPPorts = [ config.services.prometheus.port ];
+
+        services.prometheus = {
+          enable = true;
+          globalConfig.scrape_interval = "2s";
+
+          scrapeConfigs = [
+            {
+              job_name = "node";
+              static_configs = [
+                { targets = [ "node2:${toString config.services.prometheus.exporters.node.port}" ]; }
+              ];
+            }
+            {
+              job_name = "prometheus";
+              static_configs = [ { targets = [ "prometheus2:${toString config.services.prometheus.port}" ]; } ];
+            }
+          ];
         };
+      };
 
-      node2 =
-        { config, pkgs, ... }:
-        {
-          services.prometheus.exporters.node = {
-            enable = true;
-            openFirewall = true;
-          };
+    node1 =
+      { config, pkgs, ... }:
+      {
+        services.prometheus.exporters.node = {
+          enable = true;
+          openFirewall = true;
         };
-    };
+      };
 
-    testScript = ''
-      for machine in node1, node2:
-        machine.wait_for_unit("prometheus-node-exporter")
-        machine.wait_for_open_port(9100)
+    node2 =
+      { config, pkgs, ... }:
+      {
+        services.prometheus.exporters.node = {
+          enable = true;
+          openFirewall = true;
+        };
+      };
+  };
 
-      for machine in prometheus1, prometheus2, global1, global2:
-        machine.wait_for_unit("prometheus")
-        machine.wait_for_open_port(9090)
+  testScript = ''
+    for machine in node1, node2:
+      machine.wait_for_unit("prometheus-node-exporter")
+      machine.wait_for_open_port(9100)
 
-      # Verify both servers got the same data from the exporter
-      for machine in prometheus1, prometheus2:
-        machine.wait_until_succeeds(
-          "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=count(up\{job=\"node\"\})' | "
-          + "jq '.data.result[0].value[1]' | grep '\"1\"'"
-        )
-        machine.wait_until_succeeds(
-          "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=count(prometheus_build_info)' | "
-          + "jq '.data.result[0].value[1]' | grep '\"1\"'"
-        )
+    for machine in prometheus1, prometheus2, global1, global2:
+      machine.wait_for_unit("prometheus")
+      machine.wait_for_open_port(9090)
 
-      for machine in global1, global2:
-        machine.wait_until_succeeds(
-          "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=count(up\{job=\"node\"\})' | "
-          + "jq '.data.result[0].value[1]' | grep '\"2\"'"
-        )
+    # Verify both servers got the same data from the exporter
+    for machine in prometheus1, prometheus2:
+      machine.wait_until_succeeds(
+        "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=count(up\{job=\"node\"\})' | "
+        + "jq '.data.result[0].value[1]' | grep '\"1\"'"
+      )
+      machine.wait_until_succeeds(
+        "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=count(prometheus_build_info)' | "
+        + "jq '.data.result[0].value[1]' | grep '\"1\"'"
+      )
 
-        machine.wait_until_succeeds(
-          "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=count(prometheus_build_info)' | "
-          + "jq '.data.result[0].value[1]' | grep '\"4\"'"
-        )
-    '';
-  }
-)
+    for machine in global1, global2:
+      machine.wait_until_succeeds(
+        "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=count(up\{job=\"node\"\})' | "
+        + "jq '.data.result[0].value[1]' | grep '\"2\"'"
+      )
+
+      machine.wait_until_succeeds(
+        "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=count(prometheus_build_info)' | "
+        + "jq '.data.result[0].value[1]' | grep '\"4\"'"
+      )
+  '';
+}
diff --git a/nixos/tests/prometheus/prometheus-pair.nix b/nixos/tests/prometheus/prometheus-pair.nix
index 98860fa6bf95..6d8d5900480f 100644
--- a/nixos/tests/prometheus/prometheus-pair.nix
+++ b/nixos/tests/prometheus/prometheus-pair.nix
@@ -1,93 +1,91 @@
-import ../make-test-python.nix (
-  { lib, pkgs, ... }:
+{ pkgs, ... }:
 
-  {
-    name = "prometheus-pair";
+{
+  name = "prometheus-pair";
 
-    nodes = {
-      prometheus1 =
-        { config, pkgs, ... }:
-        {
-          environment.systemPackages = [ pkgs.jq ];
+  nodes = {
+    prometheus1 =
+      { config, pkgs, ... }:
+      {
+        environment.systemPackages = [ pkgs.jq ];
 
-          networking.firewall.allowedTCPPorts = [ config.services.prometheus.port ];
+        networking.firewall.allowedTCPPorts = [ config.services.prometheus.port ];
 
-          services.prometheus = {
-            enable = true;
-            globalConfig.scrape_interval = "2s";
-            scrapeConfigs = [
-              {
-                job_name = "prometheus";
-                static_configs = [
-                  {
-                    targets = [
-                      "prometheus1:${toString config.services.prometheus.port}"
-                      "prometheus2:${toString config.services.prometheus.port}"
-                    ];
-                  }
-                ];
-              }
-            ];
-          };
+        services.prometheus = {
+          enable = true;
+          globalConfig.scrape_interval = "2s";
+          scrapeConfigs = [
+            {
+              job_name = "prometheus";
+              static_configs = [
+                {
+                  targets = [
+                    "prometheus1:${toString config.services.prometheus.port}"
+                    "prometheus2:${toString config.services.prometheus.port}"
+                  ];
+                }
+              ];
+            }
+          ];
         };
+      };
 
-      prometheus2 =
-        { config, pkgs, ... }:
-        {
-          environment.systemPackages = [ pkgs.jq ];
+    prometheus2 =
+      { config, pkgs, ... }:
+      {
+        environment.systemPackages = [ pkgs.jq ];
 
-          networking.firewall.allowedTCPPorts = [ config.services.prometheus.port ];
+        networking.firewall.allowedTCPPorts = [ config.services.prometheus.port ];
 
-          services.prometheus = {
-            enable = true;
-            globalConfig.scrape_interval = "2s";
-            scrapeConfigs = [
-              {
-                job_name = "prometheus";
-                static_configs = [
-                  {
-                    targets = [
-                      "prometheus1:${toString config.services.prometheus.port}"
-                      "prometheus2:${toString config.services.prometheus.port}"
-                    ];
-                  }
-                ];
-              }
-            ];
-          };
+        services.prometheus = {
+          enable = true;
+          globalConfig.scrape_interval = "2s";
+          scrapeConfigs = [
+            {
+              job_name = "prometheus";
+              static_configs = [
+                {
+                  targets = [
+                    "prometheus1:${toString config.services.prometheus.port}"
+                    "prometheus2:${toString config.services.prometheus.port}"
+                  ];
+                }
+              ];
+            }
+          ];
         };
-    };
+      };
+  };
 
-    testScript = ''
-      for machine in prometheus1, prometheus2:
-        machine.wait_for_unit("prometheus")
-        machine.wait_for_open_port(9090)
-        machine.wait_until_succeeds("journalctl -o cat -u prometheus.service | grep 'version=${pkgs.prometheus.version}'")
-        machine.wait_until_succeeds("curl -sSf http://localhost:9090/-/healthy")
+  testScript = ''
+    for machine in prometheus1, prometheus2:
+      machine.wait_for_unit("prometheus")
+      machine.wait_for_open_port(9090)
+      machine.wait_until_succeeds("journalctl -o cat -u prometheus.service | grep 'version=${pkgs.prometheus.version}'")
+      machine.wait_until_succeeds("curl -sSf http://localhost:9090/-/healthy")
 
-      # Prometheii ready - run some queries
-      for machine in prometheus1, prometheus2:
-        machine.wait_until_succeeds(
-          "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=prometheus_build_info\{instance=\"prometheus1:9090\",version=\"${pkgs.prometheus.version}\"\}' | "
-          + "jq '.data.result[0].value[1]' | grep '\"1\"'"
-        )
+    # Prometheii ready - run some queries
+    for machine in prometheus1, prometheus2:
+      machine.wait_until_succeeds(
+        "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=prometheus_build_info\{instance=\"prometheus1:9090\",version=\"${pkgs.prometheus.version}\"\}' | "
+        + "jq '.data.result[0].value[1]' | grep '\"1\"'"
+      )
 
-        machine.wait_until_succeeds(
-          "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=prometheus_build_info\{instance=\"prometheus1:9090\"\}' | "
-          + "jq '.data.result[0].value[1]' | grep '\"1\"'"
-        )
+      machine.wait_until_succeeds(
+        "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=prometheus_build_info\{instance=\"prometheus1:9090\"\}' | "
+        + "jq '.data.result[0].value[1]' | grep '\"1\"'"
+      )
 
-        machine.wait_until_succeeds(
-          "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=sum(prometheus_build_info)%20by%20(version)' | "
-          + "jq '.data.result[0].metric.version' | grep '\"${pkgs.prometheus.version}\"'"
-        )
+      machine.wait_until_succeeds(
+        "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=sum(prometheus_build_info)%20by%20(version)' | "
+        + "jq '.data.result[0].metric.version' | grep '\"${pkgs.prometheus.version}\"'"
+      )
 
-        machine.wait_until_succeeds(
-          "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=sum(prometheus_build_info)%20by%20(version)' | "
-          + "jq '.data.result[0].value[1]' | grep '\"2\"'"
-        )
+      machine.wait_until_succeeds(
+        "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=sum(prometheus_build_info)%20by%20(version)' | "
+        + "jq '.data.result[0].value[1]' | grep '\"2\"'"
+      )
 
-      prometheus1.log(prometheus1.succeed("systemd-analyze security prometheus.service | grep -v '✓'"))
-    '';
-  }
-)
+    prometheus1.log(prometheus1.succeed("systemd-analyze security prometheus.service | grep -v '✓'"))
+  '';
+}
diff --git a/nixos/tests/prometheus/pushgateway.nix b/nixos/tests/prometheus/pushgateway.nix
index fb8b6c091aa1..6b13447085d9 100644
--- a/nixos/tests/prometheus/pushgateway.nix
+++ b/nixos/tests/prometheus/pushgateway.nix
@@ -1,102 +1,91 @@
-import ../make-test-python.nix (
-  { lib, pkgs, ... }:
+{ pkgs, ... }:
 
-  {
-    name = "prometheus-pushgateway";
+{
+  name = "prometheus-pushgateway";
 
-    nodes = {
-      prometheus =
-        { config, pkgs, ... }:
-        {
-          environment.systemPackages = [ pkgs.jq ];
+  nodes = {
+    prometheus =
+      { config, pkgs, ... }:
+      {
+        environment.systemPackages = [ pkgs.jq ];
 
-          networking.firewall.allowedTCPPorts = [ config.services.prometheus.port ];
+        networking.firewall.allowedTCPPorts = [ config.services.prometheus.port ];
 
-          services.prometheus = {
-            enable = true;
-            globalConfig.scrape_interval = "2s";
+        services.prometheus = {
+          enable = true;
+          globalConfig.scrape_interval = "2s";
 
-            scrapeConfigs = [
-              {
-                job_name = "pushgateway";
-                static_configs = [
-                  {
-                    targets = [
-                      "pushgateway:9091"
-                    ];
-                  }
-                ];
-              }
-            ];
-          };
+          scrapeConfigs = [
+            {
+              job_name = "pushgateway";
+              static_configs = [ { targets = [ "pushgateway:9091" ]; } ];
+            }
+          ];
         };
+      };
 
-      pushgateway =
-        { config, pkgs, ... }:
-        {
-          networking.firewall.allowedTCPPorts = [ 9091 ];
+    pushgateway =
+      { config, pkgs, ... }:
+      {
+        networking.firewall.allowedTCPPorts = [ 9091 ];
 
-          services.prometheus.pushgateway = {
-            enable = true;
-          };
+        services.prometheus.pushgateway = {
+          enable = true;
         };
+      };
 
-      client =
-        { config, pkgs, ... }:
-        {
-        };
-    };
+    client = { config, pkgs, ... }: { };
+  };
 
-    testScript = ''
-      pushgateway.wait_for_unit("pushgateway")
-      pushgateway.wait_for_open_port(9091)
-      pushgateway.wait_until_succeeds("curl -s http://127.0.0.1:9091/-/ready")
-      pushgateway.wait_until_succeeds("journalctl -o cat -u pushgateway.service | grep 'version=${pkgs.prometheus-pushgateway.version}'")
+  testScript = ''
+    pushgateway.wait_for_unit("pushgateway")
+    pushgateway.wait_for_open_port(9091)
+    pushgateway.wait_until_succeeds("curl -s http://127.0.0.1:9091/-/ready")
+    pushgateway.wait_until_succeeds("journalctl -o cat -u pushgateway.service | grep 'version=${pkgs.prometheus-pushgateway.version}'")
 
-      prometheus.wait_for_unit("prometheus")
-      prometheus.wait_for_open_port(9090)
+    prometheus.wait_for_unit("prometheus")
+    prometheus.wait_for_open_port(9090)
 
-      prometheus.wait_until_succeeds(
-        "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=count(up\{job=\"pushgateway\"\})' | "
-        + "jq '.data.result[0].value[1]' | grep '\"1\"'"
-      )
+    prometheus.wait_until_succeeds(
+      "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=count(up\{job=\"pushgateway\"\})' | "
+      + "jq '.data.result[0].value[1]' | grep '\"1\"'"
+    )
 
-      prometheus.wait_until_succeeds(
-        "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=sum(pushgateway_build_info)%20by%20(version)' | "
-        + "jq '.data.result[0].metric.version' | grep '\"${pkgs.prometheus-pushgateway.version}\"'"
-      )
+    prometheus.wait_until_succeeds(
+      "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=sum(pushgateway_build_info)%20by%20(version)' | "
+      + "jq '.data.result[0].metric.version' | grep '\"${pkgs.prometheus-pushgateway.version}\"'"
+    )
 
-      # Add a metric and check in Prometheus
-      client.wait_until_succeeds(
-        "echo 'some_metric 3.14' | curl --data-binary @- http://pushgateway:9091/metrics/job/some_job"
-      )
+    # Add a metric and check in Prometheus
+    client.wait_until_succeeds(
+      "echo 'some_metric 3.14' | curl --data-binary @- http://pushgateway:9091/metrics/job/some_job"
+    )
 
-      prometheus.wait_until_succeeds(
-        "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=some_metric' | "
-        + "jq '.data.result[0].value[1]' | grep '\"3.14\"'"
-      )
+    prometheus.wait_until_succeeds(
+      "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=some_metric' | "
+      + "jq '.data.result[0].value[1]' | grep '\"3.14\"'"
+    )
 
-      prometheus.wait_until_succeeds(
-        "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=absent(some_metric)' | "
-        + "jq '.data.result[0].value[1]' | grep 'null'"
-      )
+    prometheus.wait_until_succeeds(
+      "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=absent(some_metric)' | "
+      + "jq '.data.result[0].value[1]' | grep 'null'"
+    )
 
-      # Delete the metric, check not in Prometheus
-      client.wait_until_succeeds(
-        "curl -X DELETE http://pushgateway:9091/metrics/job/some_job"
-      )
+    # Delete the metric, check not in Prometheus
+    client.wait_until_succeeds(
+      "curl -X DELETE http://pushgateway:9091/metrics/job/some_job"
+    )
 
-      prometheus.wait_until_fails(
-        "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=some_metric' | "
-        + "jq '.data.result[0].value[1]' | grep '\"3.14\"'"
-      )
+    prometheus.wait_until_fails(
+      "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=some_metric' | "
+      + "jq '.data.result[0].value[1]' | grep '\"3.14\"'"
+    )
 
-      prometheus.wait_until_succeeds(
-        "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=absent(some_metric)' | "
-        + "jq '.data.result[0].value[1]' | grep '\"1\"'"
-      )
+    prometheus.wait_until_succeeds(
+      "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=absent(some_metric)' | "
+      + "jq '.data.result[0].value[1]' | grep '\"1\"'"
+    )
 
-      pushgateway.log(pushgateway.succeed("systemd-analyze security pushgateway.service | grep -v '✓'"))
-    '';
-  }
-)
+    pushgateway.log(pushgateway.succeed("systemd-analyze security pushgateway.service | grep -v '✓'"))
+  '';
+}
diff --git a/nixos/tests/prometheus/remote-write.nix b/nixos/tests/prometheus/remote-write.nix
index 86c14901a6b0..23458c737e1a 100644
--- a/nixos/tests/prometheus/remote-write.nix
+++ b/nixos/tests/prometheus/remote-write.nix
@@ -1,81 +1,69 @@
-import ../make-test-python.nix (
-  { lib, pkgs, ... }:
+{
+  name = "prometheus-remote-write";
 
-  {
-    name = "prometheus-remote-write";
+  nodes = {
+    receiver =
+      { config, pkgs, ... }:
+      {
+        environment.systemPackages = [ pkgs.jq ];
 
-    nodes = {
-      receiver =
-        { config, pkgs, ... }:
-        {
-          environment.systemPackages = [ pkgs.jq ];
+        networking.firewall.allowedTCPPorts = [ config.services.prometheus.port ];
 
-          networking.firewall.allowedTCPPorts = [ config.services.prometheus.port ];
+        services.prometheus = {
+          enable = true;
+          globalConfig.scrape_interval = "2s";
 
-          services.prometheus = {
-            enable = true;
-            globalConfig.scrape_interval = "2s";
-
-            extraFlags = [ "--web.enable-remote-write-receiver" ];
-          };
+          extraFlags = [ "--web.enable-remote-write-receiver" ];
         };
+      };
 
-      prometheus =
-        { config, pkgs, ... }:
-        {
-          environment.systemPackages = [ pkgs.jq ];
+    prometheus =
+      { config, pkgs, ... }:
+      {
+        environment.systemPackages = [ pkgs.jq ];
 
-          networking.firewall.allowedTCPPorts = [ config.services.prometheus.port ];
+        networking.firewall.allowedTCPPorts = [ config.services.prometheus.port ];
 
-          services.prometheus = {
-            enable = true;
-            globalConfig.scrape_interval = "2s";
+        services.prometheus = {
+          enable = true;
+          globalConfig.scrape_interval = "2s";
 
-            remoteWrite = [
-              {
-                url = "http://receiver:9090/api/v1/write";
-              }
-            ];
+          remoteWrite = [ { url = "http://receiver:9090/api/v1/write"; } ];
 
-            scrapeConfigs = [
-              {
-                job_name = "node";
-                static_configs = [
-                  {
-                    targets = [
-                      "node:${toString config.services.prometheus.exporters.node.port}"
-                    ];
-                  }
-                ];
-              }
-            ];
-          };
+          scrapeConfigs = [
+            {
+              job_name = "node";
+              static_configs = [
+                { targets = [ "node:${toString config.services.prometheus.exporters.node.port}" ]; }
+              ];
+            }
+          ];
         };
+      };
 
-      node =
-        { config, pkgs, ... }:
-        {
-          services.prometheus.exporters.node = {
-            enable = true;
-            openFirewall = true;
-          };
+    node =
+      { config, pkgs, ... }:
+      {
+        services.prometheus.exporters.node = {
+          enable = true;
+          openFirewall = true;
         };
-    };
+      };
+  };
 
-    testScript = ''
-      node.wait_for_unit("prometheus-node-exporter")
-      node.wait_for_open_port(9100)
+  testScript = ''
+    node.wait_for_unit("prometheus-node-exporter")
+    node.wait_for_open_port(9100)
 
-      for machine in prometheus, receiver:
-        machine.wait_for_unit("prometheus")
-        machine.wait_for_open_port(9090)
+    for machine in prometheus, receiver:
+      machine.wait_for_unit("prometheus")
+      machine.wait_for_open_port(9090)
 
-      # Verify both servers got the same data from the exporter
-      for machine in prometheus, receiver:
-        machine.wait_until_succeeds(
-          "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=node_exporter_build_info\{instance=\"node:9100\"\}' | "
-          + "jq '.data.result[0].value[1]' | grep '\"1\"'"
-        )
-    '';
-  }
-)
+    # Verify both servers got the same data from the exporter
+    for machine in prometheus, receiver:
+      machine.wait_until_succeeds(
+        "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=node_exporter_build_info\{instance=\"node:9100\"\}' | "
+        + "jq '.data.result[0].value[1]' | grep '\"1\"'"
+      )
+  '';
+}
diff --git a/pkgs/applications/audio/cd-discid/default.nix b/pkgs/applications/audio/cd-discid/default.nix
index 25898ef8bd27..7360ec62239c 100644
--- a/pkgs/applications/audio/cd-discid/default.nix
+++ b/pkgs/applications/audio/cd-discid/default.nix
@@ -2,7 +2,6 @@
   fetchurl,
   lib,
   stdenv,
-  IOKit ? null,
 }:
 
 stdenv.mkDerivation rec {
@@ -19,8 +18,6 @@ stdenv.mkDerivation rec {
     "INSTALL=install"
   ];
 
-  buildInputs = [ ] ++ lib.optional stdenv.hostPlatform.isDarwin IOKit;
-
   meta = with lib; {
     homepage = "http://linukz.org/cd-discid.shtml";
     license = licenses.gpl2Plus;
diff --git a/pkgs/applications/audio/chuck/default.nix b/pkgs/applications/audio/chuck/default.nix
index 54fe24415840..aa640b573ddd 100644
--- a/pkgs/applications/audio/chuck/default.nix
+++ b/pkgs/applications/audio/chuck/default.nix
@@ -9,13 +9,6 @@
   which,
   DarwinTools,
   xcbuild,
-  AppKit,
-  Carbon,
-  CoreAudio,
-  CoreMIDI,
-  CoreServices,
-  Kernel,
-  MultitouchSupport,
 }:
 
 stdenv.mkDerivation rec {
@@ -38,18 +31,7 @@ stdenv.mkDerivation rec {
       xcbuild
     ];
 
-  buildInputs =
-    [ libsndfile ]
-    ++ lib.optional (!stdenv.hostPlatform.isDarwin) alsa-lib
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AppKit
-      Carbon
-      CoreAudio
-      CoreMIDI
-      CoreServices
-      Kernel
-      MultitouchSupport
-    ];
+  buildInputs = [ libsndfile ] ++ lib.optional (!stdenv.hostPlatform.isDarwin) alsa-lib;
 
   patches = [ ./darwin-limits.patch ];
 
diff --git a/pkgs/applications/audio/cmus/default.nix b/pkgs/applications/audio/cmus/default.nix
index d4fef58281d0..167330ef6c6d 100644
--- a/pkgs/applications/audio/cmus/default.nix
+++ b/pkgs/applications/audio/cmus/default.nix
@@ -6,9 +6,6 @@
   ncurses,
   pkg-config,
   libiconv,
-  CoreAudio,
-  AudioUnit,
-  VideoToolbox,
 
   alsaSupport ? stdenv.hostPlatform.isLinux,
   alsa-lib ? null,
@@ -152,9 +149,6 @@ stdenv.mkDerivation rec {
     [ ncurses ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       libiconv
-      CoreAudio
-      AudioUnit
-      VideoToolbox
     ]
     ++ lib.flatten (lib.concatMap (a: a.deps) opts);
 
diff --git a/pkgs/applications/audio/csound/default.nix b/pkgs/applications/audio/csound/default.nix
index 430bd1cb9fed..f4ae7383d4e6 100644
--- a/pkgs/applications/audio/csound/default.nix
+++ b/pkgs/applications/audio/csound/default.nix
@@ -9,10 +9,6 @@
   bison,
   boost,
   gettext,
-  Accelerate,
-  AudioUnit,
-  CoreAudio,
-  CoreMIDI,
   portaudio,
   alsa-lib ? null,
   libpulseaudio ? null,
@@ -61,10 +57,6 @@ stdenv.mkDerivation {
       boost
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Accelerate
-      AudioUnit
-      CoreAudio
-      CoreMIDI
       portaudio
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux (
diff --git a/pkgs/applications/audio/espeak-ng/default.nix b/pkgs/applications/audio/espeak-ng/default.nix
index 14835a9e0b60..19b5dd800b5b 100644
--- a/pkgs/applications/audio/espeak-ng/default.nix
+++ b/pkgs/applications/audio/espeak-ng/default.nix
@@ -17,9 +17,6 @@
   pcaudiolib,
   sonicSupport ? true,
   sonic,
-  CoreAudio,
-  AudioToolbox,
-  AudioUnit,
   alsa-plugins,
   makeWrapper,
 }:
@@ -63,12 +60,7 @@ stdenv.mkDerivation rec {
   buildInputs =
     lib.optional mbrolaSupport mbrola
     ++ lib.optional pcaudiolibSupport pcaudiolib
-    ++ lib.optional sonicSupport sonic
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CoreAudio
-      AudioToolbox
-      AudioUnit
-    ];
+    ++ lib.optional sonicSupport sonic;
 
   # touch ChangeLog to avoid below error on darwin:
   # Makefile.am: error: required file './ChangeLog.md' not found
diff --git a/pkgs/applications/audio/ft2-clone/default.nix b/pkgs/applications/audio/ft2-clone/default.nix
index 90e3d80ad14d..17058192ecdb 100644
--- a/pkgs/applications/audio/ft2-clone/default.nix
+++ b/pkgs/applications/audio/ft2-clone/default.nix
@@ -7,10 +7,6 @@
   alsa-lib,
   SDL2,
   libiconv,
-  CoreAudio,
-  CoreMIDI,
-  CoreServices,
-  Cocoa,
 }:
 
 stdenv.mkDerivation rec {
@@ -30,10 +26,6 @@ stdenv.mkDerivation rec {
     ++ lib.optional stdenv.hostPlatform.isLinux alsa-lib
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       libiconv
-      CoreAudio
-      CoreMIDI
-      CoreServices
-      Cocoa
     ];
 
   passthru.tests = {
diff --git a/pkgs/applications/audio/grandorgue/default.nix b/pkgs/applications/audio/grandorgue/default.nix
index e31dbbed38b2..0c6e804aeceb 100644
--- a/pkgs/applications/audio/grandorgue/default.nix
+++ b/pkgs/applications/audio/grandorgue/default.nix
@@ -16,7 +16,6 @@
   libicns,
   yaml-cpp,
   makeWrapper,
-  Cocoa,
   includeDemo ? true,
 }:
 
@@ -54,7 +53,6 @@ stdenv.mkDerivation rec {
       alsa-lib
       udev
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ Cocoa ]
     ++ lib.optional jackaudioSupport libjack2;
 
   cmakeFlags =
diff --git a/pkgs/applications/audio/listenbrainz-mpd/default.nix b/pkgs/applications/audio/listenbrainz-mpd/default.nix
index f7c33347e13e..63ac2e3b1040 100644
--- a/pkgs/applications/audio/listenbrainz-mpd/default.nix
+++ b/pkgs/applications/audio/listenbrainz-mpd/default.nix
@@ -7,9 +7,6 @@
   openssl,
   libiconv,
   sqlite,
-  Security,
-  SystemConfiguration,
-  CoreFoundation,
   installShellFiles,
   asciidoctor,
 }:
@@ -41,9 +38,6 @@ rustPlatform.buildRustPackage rec {
       if stdenv.hostPlatform.isDarwin then
         [
           libiconv
-          Security
-          SystemConfiguration
-          CoreFoundation
         ]
       else
         [
diff --git a/pkgs/applications/audio/littlegptracker/default.nix b/pkgs/applications/audio/littlegptracker/default.nix
index ef6d8402ce49..12e6940ccc87 100644
--- a/pkgs/applications/audio/littlegptracker/default.nix
+++ b/pkgs/applications/audio/littlegptracker/default.nix
@@ -5,7 +5,6 @@
   SDL2,
   python3,
   jack2,
-  Foundation,
   alsa-lib,
   pkg-config,
 }:
@@ -31,7 +30,6 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs =
     [ SDL2 ]
     ++ lib.optional (lib.meta.availableOn stdenv.hostPlatform alsa-lib) alsa-lib
-    ++ lib.optional stdenv.hostPlatform.isDarwin Foundation
     ++ lib.optional stdenv.hostPlatform.isLinux jack2;
 
   preBuild = ''
diff --git a/pkgs/applications/audio/master_me/default.nix b/pkgs/applications/audio/master_me/default.nix
index 3c766b701cf9..3f62b0f62d03 100644
--- a/pkgs/applications/audio/master_me/default.nix
+++ b/pkgs/applications/audio/master_me/default.nix
@@ -8,7 +8,6 @@
   libXrandr,
   pkg-config,
   python3,
-  Cocoa,
 }:
 stdenv.mkDerivation rec {
   pname = "master_me";
@@ -28,7 +27,6 @@ stdenv.mkDerivation rec {
       libGL
       python3
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ Cocoa ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       libX11
       libXext
diff --git a/pkgs/applications/audio/midivisualizer/default.nix b/pkgs/applications/audio/midivisualizer/default.nix
index eb409930a3b2..911d9688d286 100644
--- a/pkgs/applications/audio/midivisualizer/default.nix
+++ b/pkgs/applications/audio/midivisualizer/default.nix
@@ -12,13 +12,6 @@
   libXcursor,
   gtk3,
   ffmpeg-full,
-  AppKit,
-  Carbon,
-  Cocoa,
-  CoreAudio,
-  CoreMIDI,
-  CoreServices,
-  Kernel,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -49,15 +42,6 @@ stdenv.mkDerivation (finalAttrs: {
       libXinerama
       libXcursor
       gtk3
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AppKit
-      Carbon
-      Cocoa
-      CoreAudio
-      CoreMIDI
-      CoreServices
-      Kernel
     ];
 
   installPhase =
diff --git a/pkgs/applications/audio/minidsp/default.nix b/pkgs/applications/audio/minidsp/default.nix
index 37f87257bdf3..0be81f52a4d5 100644
--- a/pkgs/applications/audio/minidsp/default.nix
+++ b/pkgs/applications/audio/minidsp/default.nix
@@ -4,8 +4,6 @@
   rustPlatform,
   stdenv,
   libusb1,
-  AppKit,
-  IOKit,
   pkg-config,
 }:
 rustPlatform.buildRustPackage rec {
@@ -24,12 +22,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoBuildFlags = [ "-p minidsp -p minidsp-daemon" ];
 
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [ libusb1 ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AppKit
-      IOKit
-    ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ libusb1 ];
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ pkg-config ];
 
diff --git a/pkgs/applications/audio/mmlgui/default.nix b/pkgs/applications/audio/mmlgui/default.nix
index c8ceef846e1f..24665b7ddc55 100644
--- a/pkgs/applications/audio/mmlgui/default.nix
+++ b/pkgs/applications/audio/mmlgui/default.nix
@@ -9,8 +9,6 @@
   libX11,
   libXau,
   libXdmcp,
-  Carbon,
-  Cocoa,
   cppunit,
 }:
 
@@ -61,10 +59,6 @@ stdenv.mkDerivation {
       libX11
       libXau
       libXdmcp
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Carbon
-      Cocoa
     ];
 
   checkInputs = [
diff --git a/pkgs/applications/audio/moc/default.nix b/pkgs/applications/audio/moc/default.nix
index 581ace1d3c3c..08d71f5b1684 100644
--- a/pkgs/applications/audio/moc/default.nix
+++ b/pkgs/applications/audio/moc/default.nix
@@ -11,7 +11,6 @@
   popt,
   libtool,
   libiconv,
-  CoreServices,
   # Sound sub-systems
   alsaSupport ? (!stdenv.hostPlatform.isDarwin),
   alsa-lib,
@@ -125,7 +124,6 @@ stdenv.mkDerivation {
     ++ lib.optional samplerateSupport libsamplerate
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       libiconv
-      CoreServices
     ];
 
   configureFlags = [
diff --git a/pkgs/applications/audio/mpg123/default.nix b/pkgs/applications/audio/mpg123/default.nix
index d89c9c65838e..a919a0d98c4f 100644
--- a/pkgs/applications/audio/mpg123/default.nix
+++ b/pkgs/applications/audio/mpg123/default.nix
@@ -10,8 +10,6 @@
   withPulse ? stdenv.hostPlatform.isLinux,
   libpulseaudio,
   withCoreAudio ? stdenv.hostPlatform.isDarwin,
-  AudioUnit,
-  AudioToolbox,
   withJack ? stdenv.hostPlatform.isUnix,
   jack,
   withConplay ? !stdenv.hostPlatform.isWindows,
@@ -45,8 +43,6 @@ stdenv.mkDerivation rec {
     ++ lib.optionals withAlsa [ alsa-lib ]
     ++ lib.optionals withPulse [ libpulseaudio ]
     ++ lib.optionals withCoreAudio [
-      AudioUnit
-      AudioToolbox
     ]
     ++ lib.optionals withJack [ jack ]
   );
diff --git a/pkgs/applications/audio/muso/default.nix b/pkgs/applications/audio/muso/default.nix
index ac807528f509..029d728a7305 100644
--- a/pkgs/applications/audio/muso/default.nix
+++ b/pkgs/applications/audio/muso/default.nix
@@ -5,7 +5,6 @@
   rustPlatform,
   pkg-config,
   wrapGAppsHook3,
-  CoreServices,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -23,7 +22,6 @@ rustPlatform.buildRustPackage rec {
     pkg-config
     wrapGAppsHook3
   ];
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin CoreServices;
 
   preConfigure = ''
     substituteInPlace lib/utils.rs \
diff --git a/pkgs/applications/audio/parrot/default.nix b/pkgs/applications/audio/parrot/default.nix
index 7dee1402f30a..1d8c4e5ae0e6 100644
--- a/pkgs/applications/audio/parrot/default.nix
+++ b/pkgs/applications/audio/parrot/default.nix
@@ -9,9 +9,7 @@
   unstableGitUpdater,
   openssl,
   pkg-config,
-  stdenv,
   yt-dlp,
-  Security,
 }:
 rustPlatform.buildRustPackage {
   pname = "parrot";
@@ -36,7 +34,7 @@ rustPlatform.buildRustPackage {
   buildInputs = [
     libopus
     openssl
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
+  ];
 
   postInstall = ''
     wrapProgram $out/bin/parrot \
diff --git a/pkgs/applications/audio/schismtracker/default.nix b/pkgs/applications/audio/schismtracker/default.nix
index 5d10db730f4f..738a85d9d2ac 100644
--- a/pkgs/applications/audio/schismtracker/default.nix
+++ b/pkgs/applications/audio/schismtracker/default.nix
@@ -9,7 +9,6 @@
   SDL2,
   libX11,
   libXext,
-  Cocoa,
   utf8proc,
   nix-update-script,
 }:
@@ -64,8 +63,7 @@ stdenv.mkDerivation rec {
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       alsa-lib
       libXext
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ Cocoa ];
+    ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/applications/audio/snapcast/default.nix b/pkgs/applications/audio/snapcast/default.nix
index f6cbf58d8954..205f8cd80749 100644
--- a/pkgs/applications/audio/snapcast/default.nix
+++ b/pkgs/applications/audio/snapcast/default.nix
@@ -13,8 +13,6 @@
   libvorbis,
   libopus,
   soxr,
-  IOKit,
-  AudioToolbox,
   aixlog,
   popl,
   pulseaudioSupport ? false,
@@ -55,11 +53,7 @@ stdenv.mkDerivation rec {
       openssl
     ]
     ++ lib.optional pulseaudioSupport libpulseaudio
-    ++ lib.optional stdenv.hostPlatform.isLinux alsa-lib
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      IOKit
-      AudioToolbox
-    ];
+    ++ lib.optional stdenv.hostPlatform.isLinux alsa-lib;
 
   TARGET = lib.optionalString stdenv.hostPlatform.isDarwin "MACOS";
 
diff --git a/pkgs/applications/audio/xmp/default.nix b/pkgs/applications/audio/xmp/default.nix
index dace69315ac1..f0b88dea3bed 100644
--- a/pkgs/applications/audio/xmp/default.nix
+++ b/pkgs/applications/audio/xmp/default.nix
@@ -6,8 +6,6 @@
   pkg-config,
   alsa-lib,
   libxmp,
-  AudioUnit,
-  CoreAudio,
 }:
 
 stdenv.mkDerivation rec {
@@ -25,13 +23,7 @@ stdenv.mkDerivation rec {
     autoreconfHook
     pkg-config
   ];
-  buildInputs =
-    [ libxmp ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [ alsa-lib ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AudioUnit
-      CoreAudio
-    ];
+  buildInputs = [ libxmp ] ++ lib.optionals stdenv.hostPlatform.isLinux [ alsa-lib ];
 
   meta = with lib; {
     description = "Extended module player";
diff --git a/pkgs/applications/blockchains/alfis/default.nix b/pkgs/applications/blockchains/alfis/default.nix
index c644d6662775..d6a3a2d93618 100644
--- a/pkgs/applications/blockchains/alfis/default.nix
+++ b/pkgs/applications/blockchains/alfis/default.nix
@@ -7,9 +7,6 @@
   makeWrapper,
   webkitgtk_4_0,
   zenity,
-  Cocoa,
-  Security,
-  WebKit,
   withGui ? true,
 }:
 
@@ -31,13 +28,7 @@ rustPlatform.buildRustPackage rec {
     pkg-config
     makeWrapper
   ];
-  buildInputs =
-    lib.optional stdenv.hostPlatform.isDarwin Security
-    ++ lib.optional (withGui && stdenv.hostPlatform.isLinux) webkitgtk_4_0
-    ++ lib.optionals (withGui && stdenv.hostPlatform.isDarwin) [
-      Cocoa
-      WebKit
-    ];
+  buildInputs = lib.optional (withGui && stdenv.hostPlatform.isLinux) webkitgtk_4_0;
 
   buildNoDefaultFeatures = true;
   buildFeatures = [ "doh" ] ++ lib.optional withGui "webgui";
diff --git a/pkgs/applications/blockchains/electrs/default.nix b/pkgs/applications/blockchains/electrs/default.nix
index d06ce837c0a3..01e1b624821b 100644
--- a/pkgs/applications/blockchains/electrs/default.nix
+++ b/pkgs/applications/blockchains/electrs/default.nix
@@ -1,10 +1,8 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitHub,
   rocksdb_7_10,
-  Security,
 }:
 
 let
@@ -31,8 +29,6 @@ rustPlatform.buildRustPackage rec {
   ROCKSDB_INCLUDE_DIR = "${rocksdb}/include";
   ROCKSDB_LIB_DIR = "${rocksdb}/lib";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
-
   passthru.updateScript = ./update.sh;
 
   meta = with lib; {
diff --git a/pkgs/applications/blockchains/lighthouse/default.nix b/pkgs/applications/blockchains/lighthouse/default.nix
index 8361c2e23f94..c024b07db1ab 100644
--- a/pkgs/applications/blockchains/lighthouse/default.nix
+++ b/pkgs/applications/blockchains/lighthouse/default.nix
@@ -1,6 +1,5 @@
 {
   cmake,
-  CoreFoundation,
   fetchFromGitHub,
   fetchurl,
   lib,
@@ -11,10 +10,8 @@
   protobuf,
   rustPlatform,
   rust-jemalloc-sys,
-  Security,
   sqlite,
   stdenv,
-  SystemConfiguration,
   testers,
 }:
 
@@ -59,11 +56,6 @@ rustPlatform.buildRustPackage rec {
     ]
     ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
       openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CoreFoundation
-      Security
-      SystemConfiguration
     ];
 
   depositContractSpec = fetchurl {
diff --git a/pkgs/applications/blockchains/monero-cli/default.nix b/pkgs/applications/blockchains/monero-cli/default.nix
index e39d5374b9ad..0ad489b74309 100644
--- a/pkgs/applications/blockchains/monero-cli/default.nix
+++ b/pkgs/applications/blockchains/monero-cli/default.nix
@@ -16,10 +16,6 @@
   unbound,
   zeromq,
 
-  # darwin
-  CoreData,
-  IOKit,
-
   trezorSupport ? true,
   hidapi,
   libusb1,
@@ -88,10 +84,6 @@ stdenv.mkDerivation rec {
       unbound
       zeromq
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      IOKit
-      CoreData
-    ]
     ++ lib.optionals trezorSupport [
       python3
       hidapi
diff --git a/pkgs/applications/blockchains/optimism/geth.nix b/pkgs/applications/blockchains/optimism/geth.nix
index e88ce594cd8d..c4b66ebe829b 100644
--- a/pkgs/applications/blockchains/optimism/geth.nix
+++ b/pkgs/applications/blockchains/optimism/geth.nix
@@ -1,10 +1,7 @@
 {
-  stdenv,
   lib,
   buildGoModule,
   fetchFromGitHub,
-  libobjc,
-  IOKit,
 }:
 
 buildGoModule rec {
@@ -36,12 +33,6 @@ buildGoModule rec {
 
   vendorHash = "sha256-pcIydpKWZt3vwShwzGlPKGq+disdxYFOB8gxHou3mVU=";
 
-  # Fix for usb-related segmentation faults on darwin
-  propagatedBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    libobjc
-    IOKit
-  ];
-
   ldflags = [
     "-s"
     "-w"
diff --git a/pkgs/applications/blockchains/polkadot/default.nix b/pkgs/applications/blockchains/polkadot/default.nix
index 8d74bc87909f..1ae808ec2d50 100644
--- a/pkgs/applications/blockchains/polkadot/default.nix
+++ b/pkgs/applications/blockchains/polkadot/default.nix
@@ -10,8 +10,6 @@
   rustPlatform,
   rustc,
   stdenv,
-  Security,
-  SystemConfiguration,
 }:
 
 let
@@ -60,13 +58,9 @@ rustPlatform.buildRustPackage rec {
   ];
 
   # NOTE: jemalloc is used by default on Linux with unprefixed enabled
-  buildInputs =
-    [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [ rust-jemalloc-sys-unprefixed ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Security
-      SystemConfiguration
-    ];
+  buildInputs = [
+    openssl
+  ] ++ lib.optionals stdenv.hostPlatform.isLinux [ rust-jemalloc-sys-unprefixed ];
 
   checkInputs = [
     cacert
diff --git a/pkgs/applications/blockchains/snarkos/default.nix b/pkgs/applications/blockchains/snarkos/default.nix
index 219e9f530f4c..f1c0bc66f641 100644
--- a/pkgs/applications/blockchains/snarkos/default.nix
+++ b/pkgs/applications/blockchains/snarkos/default.nix
@@ -3,7 +3,6 @@
   fetchFromGitHub,
   lib,
   rustPlatform,
-  Security,
   curl,
   pkg-config,
   openssl,
@@ -41,7 +40,6 @@ rustPlatform.buildRustPackage rec {
   # ROCKSDB_LIB_DIR="${rocksdb}/lib";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    Security
     curl
   ];
 
diff --git a/pkgs/applications/blockchains/teos/default.nix b/pkgs/applications/blockchains/teos/default.nix
index 66d28bd3bac8..ad3cced89007 100644
--- a/pkgs/applications/blockchains/teos/default.nix
+++ b/pkgs/applications/blockchains/teos/default.nix
@@ -4,8 +4,6 @@
   fetchFromGitHub,
   protobuf,
   rustfmt,
-  stdenv,
-  darwin,
   pkg-config,
   openssl,
 }:
@@ -42,10 +40,6 @@ in
       rustfmt
     ];
 
-    buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-    ];
-
     passthru.updateScript = updateScript;
 
     __darwinAllowLocalNetworking = true;
@@ -70,13 +64,9 @@ in
       rustfmt
     ];
 
-    buildInputs =
-      [
-        openssl
-      ]
-      ++ lib.optionals stdenv.hostPlatform.isDarwin [
-        darwin.apple_sdk.frameworks.SystemConfiguration
-      ];
+    buildInputs = [
+      openssl
+    ];
 
     passthru.updateScript = updateScript;
 
diff --git a/pkgs/applications/blockchains/zcash/default.nix b/pkgs/applications/blockchains/zcash/default.nix
index 2db86c9581a6..21f7b133f671 100644
--- a/pkgs/applications/blockchains/zcash/default.nix
+++ b/pkgs/applications/blockchains/zcash/default.nix
@@ -16,7 +16,6 @@
   rustc,
   rustPlatform,
   pkg-config,
-  Security,
   stdenv,
   testers,
   tl-expected,
@@ -60,19 +59,15 @@ stdenv.mkDerivation rec {
     rustPlatform.cargoSetupHook
   ];
 
-  buildInputs =
-    [
-      boost
-      db62
-      libevent
-      libsodium
-      tl-expected
-      utf8cpp
-      zeromq
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Security
-    ];
+  buildInputs = [
+    boost
+    db62
+    libevent
+    libsodium
+    tl-expected
+    utf8cpp
+    zeromq
+  ];
 
   CXXFLAGS = [
     "-I${lib.getDev utf8cpp}/include/utf8cpp"
diff --git a/pkgs/applications/editors/emacs/default.nix b/pkgs/applications/editors/emacs/default.nix
index 90189ee8b779..cc604b222f32 100644
--- a/pkgs/applications/editors/emacs/default.nix
+++ b/pkgs/applications/editors/emacs/default.nix
@@ -6,21 +6,6 @@ lib.makeScope pkgs.newScope (
     inherit (self) callPackage;
     inheritedArgs = {
       inherit (pkgs.darwin) sigtool;
-      inherit (pkgs.darwin.apple_sdk.frameworks)
-        Accelerate
-        AppKit
-        Carbon
-        Cocoa
-        GSS
-        ImageCaptureCore
-        ImageIO
-        IOKit
-        OSAKit
-        Quartz
-        QuartzCore
-        WebKit
-        ;
-      inherit (pkgs.darwin.apple_sdk_11_0.frameworks) UniformTypeIdentifiers;
     };
   in
   {
diff --git a/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix b/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
index 2e058bb5349b..e3ef4bd8e9c1 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
@@ -810,12 +810,6 @@ let
           osx-dictionary =
             if pkgs.stdenv.hostPlatform.isDarwin then
               super.osx-dictionary.overrideAttrs (old: {
-                buildInputs =
-                  old.buildInputs
-                  ++ (with pkgs.darwin.apple_sdk.frameworks; [
-                    CoreServices
-                    Foundation
-                  ]);
                 postBuild =
                   (old.postBuild or "")
                   + ''
diff --git a/pkgs/applications/editors/emacs/make-emacs.nix b/pkgs/applications/editors/emacs/make-emacs.nix
index 4f6fbd9a55c5..69f98acb6859 100644
--- a/pkgs/applications/editors/emacs/make-emacs.nix
+++ b/pkgs/applications/editors/emacs/make-emacs.nix
@@ -118,21 +118,6 @@
       "lucid"
   ),
 
-  # macOS dependencies for NS and macPort
-  Accelerate,
-  AppKit,
-  Carbon,
-  Cocoa,
-  GSS,
-  IOKit,
-  ImageCaptureCore,
-  ImageIO,
-  OSAKit,
-  Quartz,
-  QuartzCore,
-  UniformTypeIdentifiers,
-  WebKit,
-
   # test
   callPackage,
 }:
@@ -376,27 +361,6 @@ mkDerivation (finalAttrs: {
     ]
     ++ lib.optionals withNS [
       librsvg
-      AppKit
-      GSS
-      ImageIO
-    ]
-    ++ lib.optionals (variant == "macport") [
-      Accelerate
-      AppKit
-      Carbon
-      Cocoa
-      IOKit
-      OSAKit
-      Quartz
-      QuartzCore
-      WebKit
-      # TODO are these optional?
-      GSS
-      ImageCaptureCore
-      ImageIO
-    ]
-    ++ lib.optionals (variant == "macport" && stdenv.hostPlatform.isAarch64) [
-      UniformTypeIdentifiers
     ];
 
   # Emacs needs to find movemail at run time, see info (emacs) Movemail
diff --git a/pkgs/applications/editors/lapce/default.nix b/pkgs/applications/editors/lapce/default.nix
index 2dc71fabd3e2..ed189a4a0142 100644
--- a/pkgs/applications/editors/lapce/default.nix
+++ b/pkgs/applications/editors/lapce/default.nix
@@ -13,7 +13,6 @@
   gtk3,
   openssl,
   libGL,
-  libobjc,
   libxkbcommon,
   wrapGAppsHook3,
   wayland,
@@ -77,9 +76,6 @@ rustPlatform.buildRustPackage rec {
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       fontconfig
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      libobjc
     ];
 
   postInstall =
diff --git a/pkgs/applications/editors/libresprite/default.nix b/pkgs/applications/editors/libresprite/default.nix
index 14efdb52adcc..ce7e93fba84f 100644
--- a/pkgs/applications/editors/libresprite/default.nix
+++ b/pkgs/applications/editors/libresprite/default.nix
@@ -22,9 +22,6 @@
   SDL2,
   SDL2_image,
   lua,
-  AppKit,
-  Cocoa,
-  Foundation,
 
   nixosTests,
 }:
@@ -48,29 +45,23 @@ stdenv.mkDerivation (finalAttrs: {
     gtest
   ];
 
-  buildInputs =
-    [
-      curl
-      freetype
-      giflib
-      libjpeg
-      libpng
-      libwebp
-      libarchive
-      libX11
-      pixman
-      tinyxml-2
-      zlib
-      SDL2
-      SDL2_image
-      lua
-      # no v8 due to missing libplatform and libbase
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AppKit
-      Cocoa
-      Foundation
-    ];
+  buildInputs = [
+    curl
+    freetype
+    giflib
+    libjpeg
+    libpng
+    libwebp
+    libarchive
+    libX11
+    pixman
+    tinyxml-2
+    zlib
+    SDL2
+    SDL2_image
+    lua
+    # no v8 due to missing libplatform and libbase
+  ];
 
   cmakeFlags = [
     "-DWITH_DESKTOP_INTEGRATION=ON"
diff --git a/pkgs/applications/editors/lite-xl/default.nix b/pkgs/applications/editors/lite-xl/default.nix
index 8d6d1ac8bc04..44c478e7209e 100644
--- a/pkgs/applications/editors/lite-xl/default.nix
+++ b/pkgs/applications/editors/lite-xl/default.nix
@@ -1,6 +1,5 @@
 {
   fetchFromGitHub,
-  Foundation,
   freetype,
   lib,
   lua5_4,
@@ -29,16 +28,12 @@ stdenv.mkDerivation rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      freetype
-      lua5_4
-      pcre2
-      SDL2
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Foundation
-    ];
+  buildInputs = [
+    freetype
+    lua5_4
+    pcre2
+    SDL2
+  ];
 
   mesonFlags = [
     "-Duse_system_lua=true"
diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
index 09f0e088373a..860249fb6d3d 100644
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@@ -1,6 +1,6 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.1.1231";
+  version = "9.1.1336";
 
   outputs = [
     "out"
@@ -11,7 +11,7 @@ rec {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-buqA6OM2FcxPefGQIGm8kD8ZWcskw7K/VO3xCRw7SbI=";
+    hash = "sha256-fF1qRPdVzQiYH/R0PSmKR/zFVVuCtT6lPN1x1Th5SgA=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/editors/vim/default.nix b/pkgs/applications/editors/vim/default.nix
index 837e0b9085a0..ec267de59e44 100644
--- a/pkgs/applications/editors/vim/default.nix
+++ b/pkgs/applications/editors/vim/default.nix
@@ -14,9 +14,6 @@
     url = "https://raw.githubusercontent.com/archlinux/svntogit-packages/68f6d131750aa778807119e03eed70286a17b1cb/trunk/archlinux.vim";
     sha256 = "18ifhv5q9prd175q3vxbqf6qyvkk6bc7d2lhqdk0q78i68kv9y0c";
   },
-  # apple frameworks
-  Carbon,
-  Cocoa,
 }:
 
 let
@@ -41,16 +38,11 @@ stdenv.mkDerivation {
     gettext
     pkg-config
   ];
-  buildInputs =
-    [
-      ncurses
-      bash
-      gawk
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Carbon
-      Cocoa
-    ];
+  buildInputs = [
+    ncurses
+    bash
+    gawk
+  ];
 
   strictDeps = true;
 
diff --git a/pkgs/applications/editors/vim/full.nix b/pkgs/applications/editors/vim/full.nix
index 34aa8e84721a..9b20629618ae 100644
--- a/pkgs/applications/editors/vim/full.nix
+++ b/pkgs/applications/editors/vim/full.nix
@@ -30,13 +30,6 @@
   makeWrapper,
   wrapGAppsHook3,
 
-  # apple frameworks
-  CoreServices,
-  CoreData,
-  Cocoa,
-  Foundation,
-  libobjc,
-
   features ? "huge", # One of tiny, small, normal, big or huge
   wrapPythonDrv ? false,
   guiSupport ? config.vim.gui or (if stdenv.hostPlatform.isDarwin then "gtk2" else "gtk3"),
@@ -195,13 +188,6 @@ stdenv.mkDerivation {
     ]
     ++ lib.optional (guiSupport == "gtk2") gtk2-x11
     ++ lib.optional (guiSupport == "gtk3") gtk3-x11
-    ++ lib.optionals darwinSupport [
-      CoreServices
-      CoreData
-      Cocoa
-      Foundation
-      libobjc
-    ]
     ++ lib.optional luaSupport lua
     ++ lib.optional pythonSupport python3
     ++ lib.optional tclSupport tcl
diff --git a/pkgs/applications/editors/vim/macvim.nix b/pkgs/applications/editors/vim/macvim.nix
index 3d401f553f35..a92d97d57e3d 100644
--- a/pkgs/applications/editors/vim/macvim.nix
+++ b/pkgs/applications/editors/vim/macvim.nix
@@ -150,7 +150,6 @@ stdenv.mkDerivation (finalAttrs: {
   postConfigure = ''
     substituteInPlace src/auto/config.mk \
       --replace " -L${stdenv.cc.libc}/lib" "" \
-      --replace " -L${darwin.libobjc}/lib" "" \
       --replace " -L${darwin.libunwind}/lib" "" \
       --replace " -L${libiconv}/lib" ""
 
diff --git a/pkgs/applications/editors/vscode/extensions/rust-lang.rust-analyzer/default.nix b/pkgs/applications/editors/vscode/extensions/rust-lang.rust-analyzer/default.nix
index 5abec4f2f08c..0c42097b509c 100644
--- a/pkgs/applications/editors/vscode/extensions/rust-lang.rust-analyzer/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/rust-lang.rust-analyzer/default.nix
@@ -10,8 +10,6 @@
   esbuild,
   pkg-config,
   libsecret,
-  stdenv,
-  darwin,
   setDefaultServerPath ? true,
 }:
 
@@ -39,18 +37,13 @@ let
     buildInputs = [
       pkgsBuildBuild.libsecret
     ];
-    nativeBuildInputs =
-      [
-        jq
-        moreutils
-        esbuild
-        # Required by `keytar`, which is a dependency of `vsce`.
-        pkg-config
-      ]
-      ++ lib.optionals stdenv.hostPlatform.isDarwin [
-        darwin.apple_sdk.frameworks.AppKit
-        darwin.apple_sdk.frameworks.Security
-      ];
+    nativeBuildInputs = [
+      jq
+      moreutils
+      esbuild
+      # Required by `keytar`, which is a dependency of `vsce`.
+      pkg-config
+    ];
 
     # Follows https://github.com/rust-lang/rust-analyzer/blob/41949748a6123fd6061eb984a47f4fe780525e63/xtask/src/dist.rs#L39-L65
     installPhase = ''
diff --git a/pkgs/applications/emulators/dosbox-x/default.nix b/pkgs/applications/emulators/dosbox-x/default.nix
index b60e9ddd38ad..fc6e25d3ab38 100644
--- a/pkgs/applications/emulators/dosbox-x/default.nix
+++ b/pkgs/applications/emulators/dosbox-x/default.nix
@@ -3,10 +3,7 @@
   stdenv,
   fetchFromGitHub,
   alsa-lib,
-  AudioUnit,
   autoreconfHook,
-  Carbon,
-  Cocoa,
   ffmpeg,
   fluidsynth,
   freetype,
@@ -86,11 +83,6 @@ stdenv.mkDerivation (finalAttrs: {
       alsa-lib
       libxkbfile
       libXrandr
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AudioUnit
-      Carbon
-      Cocoa
     ];
 
   # Tests for SDL_net.h for modem & IPX support, not automatically picked up due to being in SDL2 subdirectory
diff --git a/pkgs/applications/emulators/dosbox/default.nix b/pkgs/applications/emulators/dosbox/default.nix
index 5f22f277952a..7026d2f2598f 100644
--- a/pkgs/applications/emulators/dosbox/default.nix
+++ b/pkgs/applications/emulators/dosbox/default.nix
@@ -11,7 +11,6 @@
   graphicsmagick,
   libGL,
   libGLU,
-  OpenGL,
   libpng,
   binutils,
   makeDesktopItem,
@@ -54,17 +53,10 @@ stdenv.mkDerivation rec {
       SDL_sound
       libpng
     ]
-    ++ (
-      if stdenv.hostPlatform.isDarwin then
-        [
-          OpenGL
-        ]
-      else
-        [
-          libGL
-          libGLU
-        ]
-    );
+    ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
+      libGL
+      libGLU
+    ];
 
   # Tests for SDL_net.h for modem & IPX support, not automatically picked up due to being in SDL subdirectory
   env.NIX_CFLAGS_COMPILE = "-I${lib.getDev SDL_net}/include/SDL";
diff --git a/pkgs/applications/emulators/mame/default.nix b/pkgs/applications/emulators/mame/default.nix
index 5bb99274f3fc..70da877684b3 100644
--- a/pkgs/applications/emulators/mame/default.nix
+++ b/pkgs/applications/emulators/mame/default.nix
@@ -32,12 +32,8 @@
   which,
   writeScript,
   zlib,
-  darwin,
 }:
 
-let
-  inherit (darwin.apple_sdk.frameworks) CoreAudioKit ForceFeedback;
-in
 stdenv.mkDerivation rec {
   pname = "mame";
   version = "0.276";
@@ -105,8 +101,6 @@ stdenv.mkDerivation rec {
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       libpcap
-      CoreAudioKit
-      ForceFeedback
     ];
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/gis/whitebox-tools/default.nix b/pkgs/applications/gis/whitebox-tools/default.nix
index 8ed38cd849e4..b8b432ef0b40 100644
--- a/pkgs/applications/gis/whitebox-tools/default.nix
+++ b/pkgs/applications/gis/whitebox-tools/default.nix
@@ -1,6 +1,5 @@
 {
   lib,
-  stdenv,
   cmake,
   rustPlatform,
   pkg-config,
@@ -9,7 +8,6 @@
   gtk3,
   glib,
   openssl,
-  Security,
   nix-update-script,
 }:
 
@@ -32,7 +30,7 @@ rustPlatform.buildRustPackage rec {
     glib
     gtk3
     openssl
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin Security;
+  ];
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/applications/graphics/ImageMagick/6.x.nix b/pkgs/applications/graphics/ImageMagick/6.x.nix
index 3dd69d56b19d..f1ec2668577b 100644
--- a/pkgs/applications/graphics/ImageMagick/6.x.nix
+++ b/pkgs/applications/graphics/ImageMagick/6.x.nix
@@ -45,8 +45,6 @@
   libde265Support ? true,
   libde265,
   fftw,
-  ApplicationServices,
-  Foundation,
   testers,
 }:
 
@@ -124,11 +122,7 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optional djvulibreSupport djvulibre
     ++ lib.optional openexrSupport openexr
     ++ lib.optional librsvgSupport librsvg
-    ++ lib.optional openjpegSupport openjpeg
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      ApplicationServices
-      Foundation
-    ];
+    ++ lib.optional openjpegSupport openjpeg;
 
   propagatedBuildInputs =
     [ fftw ]
diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index c04bada3d3ed..8f5b155b6534 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -52,8 +52,6 @@
   potrace,
   coreutils,
   curl,
-  ApplicationServices,
-  Foundation,
   testers,
   nixos-icons,
   perlPackages,
@@ -147,11 +145,7 @@ stdenv.mkDerivation (finalAttrs: {
       librsvg
       pango
     ]
-    ++ lib.optional openjpegSupport openjpeg
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      ApplicationServices
-      Foundation
-    ];
+    ++ lib.optional openjpegSupport openjpeg;
 
   propagatedBuildInputs =
     [ curl ]
diff --git a/pkgs/applications/graphics/c3d/default.nix b/pkgs/applications/graphics/c3d/default.nix
index 52aeb7cfb995..ceb1f60c8a6c 100644
--- a/pkgs/applications/graphics/c3d/default.nix
+++ b/pkgs/applications/graphics/c3d/default.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   cmake,
   itk,
-  Cocoa,
 }:
 
 stdenv.mkDerivation {
@@ -19,7 +18,7 @@ stdenv.mkDerivation {
   };
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = [ itk ] ++ lib.optional stdenv.hostPlatform.isDarwin Cocoa;
+  buildInputs = [ itk ];
 
   cmakeFlags = [ "-DCONVERT3D_USE_ITK_REMOTE_MODULES=OFF" ];
 
diff --git a/pkgs/applications/graphics/djview/default.nix b/pkgs/applications/graphics/djview/default.nix
index e207d3c68373..2b78ac0d9ca8 100644
--- a/pkgs/applications/graphics/djview/default.nix
+++ b/pkgs/applications/graphics/djview/default.nix
@@ -12,7 +12,6 @@
   qttools,
   xorg,
   libtiff,
-  darwin,
 }:
 
 mkDerivation rec {
@@ -42,7 +41,7 @@ mkDerivation rec {
     qtbase
     xorg.libXt
     libtiff
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.frameworks.AGL;
+  ];
 
   preConfigure = ''
     NOCONFIGURE=1 ./autogen.sh
diff --git a/pkgs/applications/graphics/emulsion/default.nix b/pkgs/applications/graphics/emulsion/default.nix
index 89014afb8eb4..c6fe5dc4fc7f 100644
--- a/pkgs/applications/graphics/emulsion/default.nix
+++ b/pkgs/applications/graphics/emulsion/default.nix
@@ -16,11 +16,6 @@
   libxcb,
   libxkbcommon,
   wayland,
-  AppKit,
-  CoreGraphics,
-  CoreServices,
-  Foundation,
-  OpenGL,
 }:
 let
   rpathLibs =
@@ -59,15 +54,7 @@ rustPlatform.buildRustPackage rec {
     python3
   ];
 
-  buildInputs =
-    rpathLibs
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AppKit
-      CoreGraphics
-      CoreServices
-      Foundation
-      OpenGL
-    ];
+  buildInputs = rpathLibs;
 
   postFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
     patchelf --set-rpath "${lib.makeLibraryPath rpathLibs}" $out/bin/emulsion
diff --git a/pkgs/applications/graphics/epick/default.nix b/pkgs/applications/graphics/epick/default.nix
index 91731416199b..14bfac54b081 100644
--- a/pkgs/applications/graphics/epick/default.nix
+++ b/pkgs/applications/graphics/epick/default.nix
@@ -9,7 +9,6 @@
   freetype,
   libGL,
   xorg,
-  AppKit,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -31,19 +30,15 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [
-      expat
-      fontconfig
-      freetype
-      xorg.libX11
-      xorg.libXcursor
-      xorg.libXi
-      xorg.libXrandr
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AppKit
-    ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    expat
+    fontconfig
+    freetype
+    xorg.libX11
+    xorg.libXcursor
+    xorg.libXi
+    xorg.libXrandr
+  ];
 
   postInstall = ''
     install -Dm444 assets/epick.desktop -t $out/share/applications
diff --git a/pkgs/applications/graphics/f3d/default.nix b/pkgs/applications/graphics/f3d/default.nix
index 2117a65a821b..7ffd861b9508 100644
--- a/pkgs/applications/graphics/f3d/default.nix
+++ b/pkgs/applications/graphics/f3d/default.nix
@@ -11,8 +11,6 @@
   # See https://github.com/NixOS/nixpkgs/pull/324022. This may change later.
   vtk_9,
   autoPatchelfHook,
-  Cocoa,
-  OpenGL,
   python3Packages,
   opencascade-occt,
   assimp,
@@ -64,10 +62,6 @@ stdenv.mkDerivation rec {
       assimp
       fontconfig
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Cocoa
-      OpenGL
-    ]
     ++ lib.optionals withPythonBinding [
       python3Packages.python
       # Using C++ header files, not Python import
diff --git a/pkgs/applications/graphics/foxotron/default.nix b/pkgs/applications/graphics/foxotron/default.nix
index f25c1064a7ac..fd541500c049 100644
--- a/pkgs/applications/graphics/foxotron/default.nix
+++ b/pkgs/applications/graphics/foxotron/default.nix
@@ -17,12 +17,6 @@
   libGLU,
   alsa-lib,
   fontconfig,
-  AVFoundation,
-  Carbon,
-  Cocoa,
-  CoreAudio,
-  Kernel,
-  OpenGL,
 }:
 
 stdenv.mkDerivation rec {
@@ -75,14 +69,6 @@ stdenv.mkDerivation rec {
       alsa-lib
       fontconfig
       libGLU
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AVFoundation
-      Carbon
-      Cocoa
-      CoreAudio
-      Kernel
-      OpenGL
     ];
 
   env.NIX_CFLAGS_COMPILE = toString [
diff --git a/pkgs/applications/graphics/gimp/2.0/default.nix b/pkgs/applications/graphics/gimp/2.0/default.nix
index 1d64cc10806f..d91dd67a1913 100644
--- a/pkgs/applications/graphics/gimp/2.0/default.nix
+++ b/pkgs/applications/graphics/gimp/2.0/default.nix
@@ -47,8 +47,6 @@
   libgudev,
   openexr,
   desktopToDarwinBundle,
-  AppKit,
-  Cocoa,
   gtk-mac-integration-gtk2,
   withPython ? false,
   python2,
@@ -144,8 +142,6 @@ stdenv.mkDerivation (finalAttrs: {
       mypaint-brushes1
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AppKit
-      Cocoa
       gtk-mac-integration-gtk2
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
diff --git a/pkgs/applications/graphics/gimp/default.nix b/pkgs/applications/graphics/gimp/default.nix
index 0b2406c89f8b..639719d8d32d 100644
--- a/pkgs/applications/graphics/gimp/default.nix
+++ b/pkgs/applications/graphics/gimp/default.nix
@@ -66,8 +66,6 @@
   adwaita-icon-theme,
   alsa-lib,
   desktopToDarwinBundle,
-  AppKit,
-  Cocoa,
 }:
 
 let
@@ -202,8 +200,6 @@ stdenv.mkDerivation (finalAttrs: {
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       llvmPackages.openmp
-      AppKit
-      Cocoa
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       libgudev
diff --git a/pkgs/applications/graphics/gnome-obfuscate/default.nix b/pkgs/applications/graphics/gnome-obfuscate/default.nix
index 3be87560bada..a36d7c8ad0d5 100644
--- a/pkgs/applications/graphics/gnome-obfuscate/default.nix
+++ b/pkgs/applications/graphics/gnome-obfuscate/default.nix
@@ -17,7 +17,6 @@
   gtk4,
   gdk-pixbuf,
   libadwaita,
-  Foundation,
   nix-update-script,
 }:
 
@@ -60,16 +59,12 @@ stdenv.mkDerivation (finalAttrs: {
     desktop-file-utils
   ];
 
-  buildInputs =
-    [
-      glib
-      gtk4
-      gdk-pixbuf
-      libadwaita
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Foundation
-    ];
+  buildInputs = [
+    glib
+    gtk4
+    gdk-pixbuf
+    libadwaita
+  ];
 
   passthru = {
     updateScript = nix-update-script { };
diff --git a/pkgs/applications/graphics/menyoki/default.nix b/pkgs/applications/graphics/menyoki/default.nix
index a0e757cc536f..34f657bf71e9 100644
--- a/pkgs/applications/graphics/menyoki/default.nix
+++ b/pkgs/applications/graphics/menyoki/default.nix
@@ -8,7 +8,6 @@
   withSixel ? false,
   libsixel,
   xorg,
-  AppKit,
   withSki ? true,
 }:
 
@@ -36,8 +35,7 @@ rustPlatform.buildRustPackage rec {
         libX11
         libXrandr
       ]
-    )
-    ++ lib.optional stdenv.hostPlatform.isDarwin AppKit;
+    );
 
   buildNoDefaultFeatures = !withSki;
   buildFeatures = lib.optional withSixel "sixel";
diff --git a/pkgs/applications/graphics/ovito/default.nix b/pkgs/applications/graphics/ovito/default.nix
index 209dc697817b..19c02eeec154 100644
--- a/pkgs/applications/graphics/ovito/default.nix
+++ b/pkgs/applications/graphics/ovito/default.nix
@@ -18,7 +18,6 @@
   qtbase,
   qtsvg,
   qttools,
-  VideoDecodeAcceleration,
   wrapQtAppsHook,
   copyDesktopItems,
   # needed to run natively on wayland
@@ -44,26 +43,22 @@ stdenv.mkDerivation rec {
     copyDesktopItems
   ];
 
-  buildInputs =
-    [
-      boost
-      bzip2
-      ffmpeg
-      fftwSinglePrec
-      hdf5
-      muparser
-      netcdf
-      openssl
-      python3
-      qscintilla
-      qtbase
-      qtsvg
-      qttools
-      qtwayland
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      VideoDecodeAcceleration
-    ];
+  buildInputs = [
+    boost
+    bzip2
+    ffmpeg
+    fftwSinglePrec
+    hdf5
+    muparser
+    netcdf
+    openssl
+    python3
+    qscintilla
+    qtbase
+    qtsvg
+    qttools
+    qtwayland
+  ];
 
   # manually create a desktop file
   desktopItems = [
diff --git a/pkgs/applications/graphics/tesseract/default.nix b/pkgs/applications/graphics/tesseract/default.nix
index 16b15a555172..fe173e376ba5 100644
--- a/pkgs/applications/graphics/tesseract/default.nix
+++ b/pkgs/applications/graphics/tesseract/default.nix
@@ -1,17 +1,12 @@
 {
   callPackage,
   lowPrio,
-  Accelerate,
-  CoreGraphics,
-  CoreVideo,
 }:
 
 let
   base3 = callPackage ./tesseract3.nix { };
   base4 = callPackage ./tesseract4.nix { };
-  base5 = callPackage ./tesseract5.nix {
-    inherit Accelerate CoreGraphics CoreVideo;
-  };
+  base5 = callPackage ./tesseract5.nix { };
   languages = callPackage ./languages.nix { };
 in
 {
diff --git a/pkgs/applications/graphics/tesseract/tesseract5.nix b/pkgs/applications/graphics/tesseract/tesseract5.nix
index 22059873e4bb..4c1442b42b96 100644
--- a/pkgs/applications/graphics/tesseract/tesseract5.nix
+++ b/pkgs/applications/graphics/tesseract/tesseract5.nix
@@ -12,9 +12,6 @@
   libtiff,
   icu,
   pango,
-  Accelerate,
-  CoreGraphics,
-  CoreVideo,
 }:
 
 stdenv.mkDerivation rec {
@@ -35,21 +32,15 @@ stdenv.mkDerivation rec {
     autoreconfHook
   ];
 
-  buildInputs =
-    [
-      curl
-      leptonica
-      libarchive
-      libpng
-      libtiff
-      icu
-      pango
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Accelerate
-      CoreGraphics
-      CoreVideo
-    ];
+  buildInputs = [
+    curl
+    leptonica
+    libarchive
+    libpng
+    libtiff
+    icu
+    pango
+  ];
 
   passthru.updateScript = nix-update-script { };
   meta = {
diff --git a/pkgs/applications/misc/audio/sox/default.nix b/pkgs/applications/misc/audio/sox/default.nix
index 6d6b3b7a1887..1a7f6081b301 100644
--- a/pkgs/applications/misc/audio/sox/default.nix
+++ b/pkgs/applications/misc/audio/sox/default.nix
@@ -6,7 +6,6 @@
   autoreconfHook,
   autoconf-archive,
   pkg-config,
-  CoreAudio,
   enableAlsa ? true,
   alsa-lib,
   enableLibao ? true,
@@ -84,8 +83,7 @@ stdenv.mkDerivation {
       amrnb
       amrwb
     ]
-    ++ lib.optional enableLibpulseaudio libpulseaudio
-    ++ lib.optional stdenv.hostPlatform.isDarwin CoreAudio;
+    ++ lib.optional enableLibpulseaudio libpulseaudio;
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/applications/misc/binocle/default.nix b/pkgs/applications/misc/binocle/default.nix
index e2afd9d91b14..8c35e3ff33c2 100644
--- a/pkgs/applications/misc/binocle/default.nix
+++ b/pkgs/applications/misc/binocle/default.nix
@@ -4,13 +4,6 @@
   rustPlatform,
   fetchFromGitHub,
   makeWrapper,
-  AppKit,
-  CoreFoundation,
-  CoreGraphics,
-  CoreVideo,
-  Foundation,
-  Metal,
-  QuartzCore,
   xorg,
   vulkan-loader,
 }:
@@ -33,16 +26,6 @@ rustPlatform.buildRustPackage rec {
     makeWrapper
   ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    AppKit
-    CoreFoundation
-    CoreGraphics
-    CoreVideo
-    Foundation
-    Metal
-    QuartzCore
-  ];
-
   postInstall = lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
     wrapProgram $out/bin/binocle \
       --suffix LD_LIBRARY_PATH : ${
diff --git a/pkgs/applications/misc/diff-pdf/default.nix b/pkgs/applications/misc/diff-pdf/default.nix
index 4302d6cde399..0adaf746640f 100644
--- a/pkgs/applications/misc/diff-pdf/default.nix
+++ b/pkgs/applications/misc/diff-pdf/default.nix
@@ -8,7 +8,6 @@
   cairo,
   poppler,
   wxGTK,
-  Cocoa,
 }:
 
 stdenv.mkDerivation rec {
@@ -31,7 +30,7 @@ stdenv.mkDerivation rec {
     cairo
     poppler
     wxGTK
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Cocoa ];
+  ];
 
   preConfigure = "./bootstrap";
 
diff --git a/pkgs/applications/misc/eureka-ideas/default.nix b/pkgs/applications/misc/eureka-ideas/default.nix
index d43afca3250c..094497db1697 100644
--- a/pkgs/applications/misc/eureka-ideas/default.nix
+++ b/pkgs/applications/misc/eureka-ideas/default.nix
@@ -5,8 +5,6 @@
   pkg-config,
   libgit2,
   openssl,
-  stdenv,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -25,14 +23,10 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    [
-      libgit2
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Security
-    ];
+  buildInputs = [
+    libgit2
+    openssl
+  ];
 
   useNextest = true;
 
diff --git a/pkgs/applications/misc/far2l/default.nix b/pkgs/applications/misc/far2l/default.nix
index e9de83749987..501f360f0493 100644
--- a/pkgs/applications/misc/far2l/default.nix
+++ b/pkgs/applications/misc/far2l/default.nix
@@ -17,12 +17,6 @@
   gnutar,
   p7zip,
   xz,
-  IOKit,
-  Carbon,
-  Cocoa,
-  AudioToolbox,
-  OpenGL,
-  System,
   withTTYX ? true,
   libX11,
   withGUI ? true,
@@ -94,15 +88,7 @@ stdenv.mkDerivation rec {
         debugpy
         pcpp
       ]
-    )
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      IOKit
-      Carbon
-      Cocoa
-      AudioToolbox
-      OpenGL
-      System
-    ];
+    );
 
   postPatch = ''
     patchShebangs python/src/prebuild.sh
diff --git a/pkgs/applications/misc/inherd-quake/default.nix b/pkgs/applications/misc/inherd-quake/default.nix
index a05800414a79..a9b41c42c5c3 100644
--- a/pkgs/applications/misc/inherd-quake/default.nix
+++ b/pkgs/applications/misc/inherd-quake/default.nix
@@ -4,9 +4,6 @@
   rustPlatform,
   pkg-config,
   openssl,
-  stdenv,
-  CoreServices,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -25,14 +22,9 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CoreServices
-      Security
-    ];
+  buildInputs = [
+    openssl
+  ];
 
   meta = with lib; {
     description = "Knowledge management meta-framework for geeks";
diff --git a/pkgs/applications/misc/inlyne/default.nix b/pkgs/applications/misc/inlyne/default.nix
index f7f302628b8c..98dbc260bc31 100644
--- a/pkgs/applications/misc/inlyne/default.nix
+++ b/pkgs/applications/misc/inlyne/default.nix
@@ -11,7 +11,6 @@
   wayland,
   libGL,
   openssl,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -36,20 +35,16 @@ rustPlatform.buildRustPackage rec {
       pkg-config
     ];
 
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [
-      fontconfig
-      xorg.libXcursor
-      xorg.libXi
-      xorg.libXrandr
-      xorg.libxcb
-      wayland
-      libxkbcommon
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk_11_0.frameworks.AppKit
-    ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    fontconfig
+    xorg.libXcursor
+    xorg.libXi
+    xorg.libXrandr
+    xorg.libxcb
+    wayland
+    libxkbcommon
+    openssl
+  ];
 
   checkFlags = lib.optionals stdenv.hostPlatform.isDarwin [
     # time out on darwin
diff --git a/pkgs/applications/misc/klipper-estimator/default.nix b/pkgs/applications/misc/klipper-estimator/default.nix
index 609414f21d7f..0e863c58be61 100644
--- a/pkgs/applications/misc/klipper-estimator/default.nix
+++ b/pkgs/applications/misc/klipper-estimator/default.nix
@@ -6,8 +6,6 @@
   pkg-config,
   openssl,
   libgit2,
-  Security,
-  SystemConfiguration,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -30,8 +28,6 @@ rustPlatform.buildRustPackage rec {
     [ openssl ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       libgit2
-      Security
-      SystemConfiguration
     ];
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/applications/misc/mdzk/default.nix b/pkgs/applications/misc/mdzk/default.nix
index ce1897b4aed2..12994582e9d4 100644
--- a/pkgs/applications/misc/mdzk/default.nix
+++ b/pkgs/applications/misc/mdzk/default.nix
@@ -3,7 +3,6 @@
   stdenv,
   fetchFromGitHub,
   rustPlatform,
-  CoreServices,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -25,8 +24,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-+x4pOtszvdzI/zR55ezcxlS52GrWQTuBn7vbnqDTVac=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ CoreServices ];
-
   meta = with lib; {
     description = "Plain text Zettelkasten based on mdBook";
     homepage = "https://github.com/mdzk-rs/mdzk/";
diff --git a/pkgs/applications/misc/opencpn/default.nix b/pkgs/applications/misc/opencpn/default.nix
index 967fdb27e09a..32b73a4d52f4 100644
--- a/pkgs/applications/misc/opencpn/default.nix
+++ b/pkgs/applications/misc/opencpn/default.nix
@@ -1,7 +1,6 @@
 {
   stdenv,
   lib,
-  AppKit,
   DarwinTools,
   alsa-utils,
   at-spi2-core,
@@ -84,9 +83,6 @@ stdenv.mkDerivation (finalAttrs: {
       flac
       gitMinimal
     ]
-    ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
-      AppKit
-    ]
     ++ [
       glew
       jasper
diff --git a/pkgs/applications/misc/pastel/default.nix b/pkgs/applications/misc/pastel/default.nix
index 3265a1b61299..01f2f3623b3a 100644
--- a/pkgs/applications/misc/pastel/default.nix
+++ b/pkgs/applications/misc/pastel/default.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,8 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-u+1KDcC2KGqvmOk6k7hOHE16TMvDg92eMOdNMQQszug=";
 
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin Security;
-
   meta = with lib; {
     description = "Command-line tool to generate, analyze, convert and manipulate colors";
     homepage = "https://github.com/sharkdp/pastel";
diff --git a/pkgs/applications/misc/pomodoro/default.nix b/pkgs/applications/misc/pomodoro/default.nix
index a5049d253d73..c34dd208893c 100644
--- a/pkgs/applications/misc/pomodoro/default.nix
+++ b/pkgs/applications/misc/pomodoro/default.nix
@@ -3,7 +3,6 @@
   stdenv,
   fetchFromGitHub,
   rustPlatform,
-  Foundation,
 }:
 
 rustPlatform.buildRustPackage {
@@ -19,7 +18,6 @@ rustPlatform.buildRustPackage {
 
   useFetchCargoVendor = true;
   cargoHash = "sha256-oXOf9G0BMSbFFAsmRaAZzaquFva1i1gJ4ISqJkqSx4k=";
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ Foundation ];
 
   meta = with lib; {
     description = "Simple CLI pomodoro timer using desktop notifications written in Rust";
diff --git a/pkgs/applications/misc/prusa-slicer/default.nix b/pkgs/applications/misc/prusa-slicer/default.nix
index 50dad04f82f1..de0e544b8054 100644
--- a/pkgs/applications/misc/prusa-slicer/default.nix
+++ b/pkgs/applications/misc/prusa-slicer/default.nix
@@ -11,7 +11,6 @@
   cereal,
   cgal,
   curl,
-  darwin,
   dbus,
   eigen,
   expat,
@@ -140,9 +139,6 @@ stdenv.mkDerivation (finalAttrs: {
     ]
     ++ lib.optionals withSystemd [
       systemd
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk_11_0.frameworks.CoreWLAN
     ];
 
   strictDeps = true;
diff --git a/pkgs/applications/misc/pueue/default.nix b/pkgs/applications/misc/pueue/default.nix
index 8a3717a8eefc..6412b1e21a8f 100644
--- a/pkgs/applications/misc/pueue/default.nix
+++ b/pkgs/applications/misc/pueue/default.nix
@@ -2,8 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  Libsystem,
-  SystemConfiguration,
   installShellFiles,
   libiconv,
   rustPlatform,
@@ -32,8 +30,6 @@ rustPlatform.buildRustPackage rec {
     ];
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    Libsystem
-    SystemConfiguration
     libiconv
   ];
 
diff --git a/pkgs/applications/misc/reddsaver/default.nix b/pkgs/applications/misc/reddsaver/default.nix
index 435da18f8abe..e9017cf243a4 100644
--- a/pkgs/applications/misc/reddsaver/default.nix
+++ b/pkgs/applications/misc/reddsaver/default.nix
@@ -1,11 +1,9 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
   openssl,
   pkg-config,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -23,7 +21,7 @@ rustPlatform.buildRustPackage rec {
   cargoHash = "sha256-xYtdGhuieFudfJz+LxUjP7mV8uItaIvLahCH7vBWTtg=";
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ openssl ] ++ lib.optional stdenv.hostPlatform.isDarwin Security;
+  buildInputs = [ openssl ];
 
   # package does not contain tests as of v0.3.3
   docCheck = false;
diff --git a/pkgs/applications/misc/redshift/default.nix b/pkgs/applications/misc/redshift/default.nix
index 63957b2bd4ea..3c10b317bf10 100644
--- a/pkgs/applications/misc/redshift/default.nix
+++ b/pkgs/applications/misc/redshift/default.nix
@@ -19,7 +19,6 @@
   pyxdg,
 
   withQuartz ? stdenv.hostPlatform.isDarwin,
-  ApplicationServices,
   withRandr ? stdenv.hostPlatform.isLinux,
   libxcb,
   withDrm ? stdenv.hostPlatform.isLinux,
@@ -29,9 +28,6 @@
 
   withGeolocation ? true,
   withCoreLocation ? withGeolocation && stdenv.hostPlatform.isDarwin,
-  CoreLocation,
-  Foundation,
-  Cocoa,
   withGeoclue ? withGeolocation && stdenv.hostPlatform.isLinux,
   geoclue,
   withAppIndicator ? stdenv.hostPlatform.isLinux,
@@ -99,12 +95,6 @@ let
         ++ lib.optional withGeoclue geoclue
         ++ lib.optional withDrm libdrm
         ++ lib.optional withVidmode libXxf86vm
-        ++ lib.optional withQuartz ApplicationServices
-        ++ lib.optionals withCoreLocation [
-          CoreLocation
-          Foundation
-          Cocoa
-        ]
         ++ lib.optional withAppIndicator (
           if (pname != "gammastep") then libappindicator else libayatana-appindicator
         );
diff --git a/pkgs/applications/misc/slstatus/default.nix b/pkgs/applications/misc/slstatus/default.nix
index 090c0454def1..503c4292713c 100644
--- a/pkgs/applications/misc/slstatus/default.nix
+++ b/pkgs/applications/misc/slstatus/default.nix
@@ -15,12 +15,12 @@
 
 stdenv.mkDerivation rec {
   pname = "slstatus";
-  version = "1.0";
+  version = "1.1";
 
   src = fetchgit {
     url = "https://git.suckless.org/slstatus";
     rev = version;
-    hash = "sha256-cFah6EgApslLSlJaOy/5W9ZV9Z1lzfKye/rRh9Om3T4=";
+    hash = "sha256-MRDovZpQsvnLEvsbJNBzprkzQQ4nIs1T9BLT+tSGta8=";
   };
 
   preBuild =
diff --git a/pkgs/applications/misc/stork/default.nix b/pkgs/applications/misc/stork/default.nix
index f103e1f17e88..de81e69aa228 100644
--- a/pkgs/applications/misc/stork/default.nix
+++ b/pkgs/applications/misc/stork/default.nix
@@ -4,8 +4,6 @@
   fetchFromGitHub,
   openssl,
   pkg-config,
-  stdenv,
-  Security,
   versionCheckHook,
 }:
 
@@ -31,7 +29,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ openssl ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
+  buildInputs = [ openssl ];
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
diff --git a/pkgs/applications/misc/survex/default.nix b/pkgs/applications/misc/survex/default.nix
index e0809944f444..20970de616f5 100644
--- a/pkgs/applications/misc/survex/default.nix
+++ b/pkgs/applications/misc/survex/default.nix
@@ -2,8 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  Carbon,
-  Cocoa,
   ffmpeg,
   glib,
   libGLU,
@@ -43,10 +41,6 @@ stdenv.mkDerivation rec {
       gdal
       wxGTK32
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Carbon
-      Cocoa
-    ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       # TODO: libGLU doesn't build for macOS because of Mesa issues
       # (#233265); is it required for anything?
diff --git a/pkgs/applications/misc/synergy/default.nix b/pkgs/applications/misc/synergy/default.nix
index df841710a11c..a8c77f1d821b 100644
--- a/pkgs/applications/misc/synergy/default.nix
+++ b/pkgs/applications/misc/synergy/default.nix
@@ -27,13 +27,6 @@
   xinput,
   avahi-compat,
 
-  # MacOS / darwin
-  ApplicationServices,
-  Carbon,
-  Cocoa,
-  CoreServices,
-  ScreenSaver,
-  UserNotifications,
 }:
 
 stdenv.mkDerivation rec {
@@ -74,14 +67,6 @@ stdenv.mkDerivation rec {
       openssl
       pcre
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      ApplicationServices
-      Carbon
-      Cocoa
-      CoreServices
-      ScreenSaver
-      UserNotifications
-    ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       util-linux
       libselinux
diff --git a/pkgs/applications/misc/terminal-typeracer/default.nix b/pkgs/applications/misc/terminal-typeracer/default.nix
index 76013b492330..4e3e7e441369 100644
--- a/pkgs/applications/misc/terminal-typeracer/default.nix
+++ b/pkgs/applications/misc/terminal-typeracer/default.nix
@@ -8,7 +8,6 @@
   openssl,
   sqlite,
   libiconv,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -35,7 +34,6 @@ rustPlatform.buildRustPackage rec {
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       libiconv
-      Security
     ];
 
   OPENSSL_NO_VENDOR = 1;
diff --git a/pkgs/applications/misc/wordnet/default.nix b/pkgs/applications/misc/wordnet/default.nix
index 0772cd2d01a2..95c92c7c8e18 100644
--- a/pkgs/applications/misc/wordnet/default.nix
+++ b/pkgs/applications/misc/wordnet/default.nix
@@ -4,7 +4,6 @@
   fetchurl,
   tcl,
   tk,
-  Cocoa,
   makeWrapper,
 }:
 
@@ -20,7 +19,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     tcl
     tk
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Cocoa ];
+  ];
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/applications/networking/browsers/asuka/default.nix b/pkgs/applications/networking/browsers/asuka/default.nix
index 8b5e672d690f..32ae8dfc7d8c 100644
--- a/pkgs/applications/networking/browsers/asuka/default.nix
+++ b/pkgs/applications/networking/browsers/asuka/default.nix
@@ -1,12 +1,10 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromSourcehut,
   pkg-config,
   ncurses,
   openssl,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -28,7 +26,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [
     ncurses
     openssl
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin Security;
+  ];
 
   meta = with lib; {
     description = "Gemini Project client written in Rust with NCurses";
diff --git a/pkgs/applications/networking/browsers/lagrange/default.nix b/pkgs/applications/networking/browsers/lagrange/default.nix
index 482a692d164a..68fdce4c3cc7 100644
--- a/pkgs/applications/networking/browsers/lagrange/default.nix
+++ b/pkgs/applications/networking/browsers/lagrange/default.nix
@@ -14,7 +14,6 @@
   opusfile,
   SDL2,
   the-foundation,
-  AppKit,
   zip,
   enableTUI ? false,
   ncurses,
@@ -53,8 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optionals enableTUI [
       ncurses
       sealcurses
-    ]
-    ++ lib.optional stdenv.hostPlatform.isDarwin AppKit;
+    ];
 
   cmakeFlags = [
     (lib.cmakeBool "ENABLE_TUI" enableTUI)
diff --git a/pkgs/applications/networking/browsers/librewolf/librewolf.nix b/pkgs/applications/networking/browsers/librewolf/librewolf.nix
index a87745795204..37f959dcd901 100644
--- a/pkgs/applications/networking/browsers/librewolf/librewolf.nix
+++ b/pkgs/applications/networking/browsers/librewolf/librewolf.nix
@@ -15,8 +15,12 @@ rec {
 
   extraPostPatch = ''
     while read patch_name; do
-      echo "applying LibreWolf patch: $patch_name"
-      patch -p1 < ${source}/$patch_name
+      if [ "$patch_name" -neq "patches/macos-import-vector.patch"]; then
+        echo "applying LibreWolf patch: $patch_name"
+        patch -p1 < ${source}/$patch_name
+      else
+        echo "skipping LibreWolf patch: $patch"
+      fi
     done <${source}/assets/patches.txt
 
     cp -r ${source}/themes/browser .
diff --git a/pkgs/applications/networking/browsers/librewolf/src.json b/pkgs/applications/networking/browsers/librewolf/src.json
index 37aadf891aa6..dac8db4bc863 100644
--- a/pkgs/applications/networking/browsers/librewolf/src.json
+++ b/pkgs/applications/networking/browsers/librewolf/src.json
@@ -1,11 +1,11 @@
 {
-  "packageVersion": "137.0.2-1",
+  "packageVersion": "138.0.1-2",
   "source": {
-    "rev": "137.0.2-1",
-    "hash": "sha256-PZapXnpVGdQrTXWjlNuFj3idqelTKTpwapuwx+XuwW8="
+    "rev": "138.0.1-2",
+    "hash": "sha256-H4GvKTrx0+GdUFOjW+E53VwZcZnrrBiXiMvR6aCEKDE="
   },
   "firefox": {
-    "version": "137.0.2",
-    "hash": "sha512-ghQMQyUjPqLi9XkIjOu5jA6NuISLQBjP+V1O1Cv4RwSe1lIPwFHZMO4melrLAIkIFwgl04FYnaDRCcoEph4cJA=="
+    "version": "138.0.1",
+    "hash": "sha512-vFqNZYFAxMPbKdURNMlxBaAiVWfVzhR1f2lZQGa/akShPgYmzr3it6B4usEooUaQ7gYIPQMG13id4qXp2DlLIw=="
   }
 }
diff --git a/pkgs/applications/networking/cluster/kubectl-view-allocations/default.nix b/pkgs/applications/networking/cluster/kubectl-view-allocations/default.nix
index 6866703b4454..bdf200e92865 100644
--- a/pkgs/applications/networking/cluster/kubectl-view-allocations/default.nix
+++ b/pkgs/applications/networking/cluster/kubectl-view-allocations/default.nix
@@ -3,7 +3,6 @@
   stdenv,
   rustPlatform,
   fetchFromGitHub,
-  Security ? null,
   versionCheckHook,
 }:
 
@@ -21,8 +20,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-6sRpsXydzKB0ZaV1HeagINgb6ol9dj3XT0+pd53QOCw=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
-
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "--version";
diff --git a/pkgs/applications/networking/cluster/minikube/default.nix b/pkgs/applications/networking/cluster/minikube/default.nix
index a9638bd40ffe..74788f7c5224 100644
--- a/pkgs/applications/networking/cluster/minikube/default.nix
+++ b/pkgs/applications/networking/cluster/minikube/default.nix
@@ -7,7 +7,6 @@
   pkg-config,
   which,
   libvirt,
-  vmnet,
   withQemu ? false,
   qemu,
   makeWrapper,
@@ -49,13 +48,7 @@ buildGoModule rec {
     makeWrapper
   ];
 
-  buildInputs =
-    if stdenv.hostPlatform.isDarwin then
-      [ vmnet ]
-    else if stdenv.hostPlatform.isLinux then
-      [ libvirt ]
-    else
-      null;
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ libvirt ];
 
   buildPhase = ''
     make COMMIT=${src.rev}
diff --git a/pkgs/applications/networking/feedreaders/tuifeed/default.nix b/pkgs/applications/networking/feedreaders/tuifeed/default.nix
index acb9a3cd87e7..ef4915dc524f 100644
--- a/pkgs/applications/networking/feedreaders/tuifeed/default.nix
+++ b/pkgs/applications/networking/feedreaders/tuifeed/default.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   fetchCrate,
   rustPlatform,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -18,8 +16,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-A7kD46gfXWK/OlFVMULlMa7Z9Q1it9/rhGo6pjFa38k=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
-
   doCheck = false;
 
   meta = with lib; {
diff --git a/pkgs/applications/networking/ftp/filezilla/default.nix b/pkgs/applications/networking/ftp/filezilla/default.nix
index 71ac15ef0cac..82906428ea9a 100644
--- a/pkgs/applications/networking/ftp/filezilla/default.nix
+++ b/pkgs/applications/networking/ftp/filezilla/default.nix
@@ -18,8 +18,6 @@
   wxGTK32,
   gtk3,
   xdg-utils,
-  CoreServices,
-  Security,
 }:
 
 stdenv.mkDerivation {
@@ -43,26 +41,21 @@ stdenv.mkDerivation {
     wrapGAppsHook3
   ];
 
-  buildInputs =
-    [
-      boost
-      dbus
-      gettext
-      gnutls
-      libfilezilla
-      libidn
-      nettle
-      pugixml
-      sqlite
-      tinyxml
-      wxGTK32
-      gtk3
-      xdg-utils
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CoreServices
-      Security
-    ];
+  buildInputs = [
+    boost
+    dbus
+    gettext
+    gnutls
+    libfilezilla
+    libidn
+    nettle
+    pugixml
+    sqlite
+    tinyxml
+    wxGTK32
+    gtk3
+    xdg-utils
+  ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/applications/networking/gopher/phetch/default.nix b/pkgs/applications/networking/gopher/phetch/default.nix
index e5c90097e765..a198f7c0443b 100644
--- a/pkgs/applications/networking/gopher/phetch/default.nix
+++ b/pkgs/applications/networking/gopher/phetch/default.nix
@@ -1,13 +1,11 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   installShellFiles,
   rustPlatform,
   pkg-config,
   openssl,
   scdoc,
-  Security,
   which,
 }:
 
@@ -36,7 +34,7 @@ rustPlatform.buildRustPackage rec {
     scdoc
     which
   ];
-  buildInputs = [ openssl ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
+  buildInputs = [ openssl ];
 
   postInstall = ''
     make manual
diff --git a/pkgs/applications/networking/irc/tiny/default.nix b/pkgs/applications/networking/irc/tiny/default.nix
index 30023e00057d..3003e119d279 100644
--- a/pkgs/applications/networking/irc/tiny/default.nix
+++ b/pkgs/applications/networking/irc/tiny/default.nix
@@ -4,7 +4,6 @@
   rustPlatform,
   fetchFromGitHub,
   pkg-config,
-  Foundation,
   dbusSupport ? stdenv.hostPlatform.isLinux,
   dbus,
   # rustls will be used for TLS if useOpenSSL=false
@@ -28,10 +27,7 @@ rustPlatform.buildRustPackage rec {
   cargoHash = "sha256-lyjTl0kbtfQdqSqxti1181+oDVYP4U++v2JEOYvI7aM=";
 
   nativeBuildInputs = lib.optional stdenv.hostPlatform.isLinux pkg-config;
-  buildInputs =
-    lib.optionals dbusSupport [ dbus ]
-    ++ lib.optionals useOpenSSL [ openssl ]
-    ++ lib.optional stdenv.hostPlatform.isDarwin Foundation;
+  buildInputs = lib.optionals dbusSupport [ dbus ] ++ lib.optionals useOpenSSL [ openssl ];
 
   buildFeatures = lib.optional notificationSupport "desktop-notifications";
 
diff --git a/pkgs/applications/networking/irc/weechat/default.nix b/pkgs/applications/networking/irc/weechat/default.nix
index 1d79561fc235..0195baabcee4 100644
--- a/pkgs/applications/networking/irc/weechat/default.nix
+++ b/pkgs/applications/networking/irc/weechat/default.nix
@@ -13,7 +13,6 @@
   pkg-config,
   libgcrypt,
   cmake,
-  libobjc,
   libresolv,
   libiconv,
   asciidoctor, # manpages
@@ -150,7 +149,6 @@ stdenv.mkDerivation rec {
       libgcrypt
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      libobjc
       libresolv
     ]
     ++ lib.concatMap (p: p.buildInputs) enabledPlugins
diff --git a/pkgs/applications/networking/mailreaders/sylpheed/default.nix b/pkgs/applications/networking/mailreaders/sylpheed/default.nix
index 42f6c8597701..26aeb6f93388 100644
--- a/pkgs/applications/networking/mailreaders/sylpheed/default.nix
+++ b/pkgs/applications/networking/mailreaders/sylpheed/default.nix
@@ -9,7 +9,6 @@
   gpgSupport ? true,
   sslSupport ? true,
   fetchpatch,
-  Foundation,
 }:
 
 assert gpgSupport -> gpgme != null;
@@ -42,10 +41,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs =
-    [ gtk2 ]
-    ++ lib.optionals gpgSupport [ gpgme ]
-    ++ lib.optionals sslSupport [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ Foundation ];
+    [ gtk2 ] ++ lib.optionals gpgSupport [ gpgme ] ++ lib.optionals sslSupport [ openssl ];
 
   configureFlags = lib.optional gpgSupport "--enable-gpgme" ++ lib.optional sslSupport "--enable-ssl";
 
diff --git a/pkgs/applications/networking/mhost/default.nix b/pkgs/applications/networking/mhost/default.nix
index aade921aa809..436ac744cb4b 100644
--- a/pkgs/applications/networking/mhost/default.nix
+++ b/pkgs/applications/networking/mhost/default.nix
@@ -1,10 +1,7 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
-  Security,
-  SystemConfiguration,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -21,11 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-n+ZVsdR+X7tMqZFYsjsWSUr6OkD90s44EFORqRldCNE=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    Security
-    SystemConfiguration
-  ];
-
   CARGO_CRATE_NAME = "mhost";
 
   doCheck = false;
diff --git a/pkgs/applications/networking/mpop/default.nix b/pkgs/applications/networking/mpop/default.nix
index 7cd4d9349997..1fea4be45eba 100644
--- a/pkgs/applications/networking/mpop/default.nix
+++ b/pkgs/applications/networking/mpop/default.nix
@@ -7,7 +7,6 @@
   gsasl,
   libidn,
   pkg-config,
-  Security,
   nlsSupport ? true,
   idnSupport ? true,
   gsaslSupport ? true,
@@ -33,8 +32,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs =
-    lib.optional stdenv.hostPlatform.isDarwin Security
-    ++ lib.optional gsaslSupport gsasl
+    lib.optional gsaslSupport gsasl
     ++ lib.optional idnSupport libidn
     ++ lib.optional (sslLibrary == "gnutls") gnutls
     ++ lib.optional (sslLibrary == "openssl") openssl;
diff --git a/pkgs/applications/networking/msmtp/default.nix b/pkgs/applications/networking/msmtp/default.nix
index 96934461c2e7..60946106d0dd 100644
--- a/pkgs/applications/networking/msmtp/default.nix
+++ b/pkgs/applications/networking/msmtp/default.nix
@@ -15,7 +15,6 @@
   netcat-gnu,
   texinfo,
   which,
-  Security,
   withKeyring ? true,
   libsecret,
   withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
@@ -56,14 +55,11 @@ let
       "--with-libgsasl"
     ] ++ optionals stdenv.hostPlatform.isDarwin [ "--with-macosx-keyring" ];
 
-    buildInputs =
-      [
-        gnutls
-        gsasl
-        libidn2
-      ]
-      ++ optionals stdenv.hostPlatform.isDarwin [ Security ]
-      ++ optionals withKeyring [ libsecret ];
+    buildInputs = [
+      gnutls
+      gsasl
+      libidn2
+    ] ++ optionals withKeyring [ libsecret ];
 
     nativeBuildInputs = [
       autoreconfHook
diff --git a/pkgs/applications/networking/mujmap/default.nix b/pkgs/applications/networking/mujmap/default.nix
index a37177426b10..bda3f618763f 100644
--- a/pkgs/applications/networking/mujmap/default.nix
+++ b/pkgs/applications/networking/mujmap/default.nix
@@ -3,8 +3,6 @@
   fetchFromGitHub,
   rustPlatform,
   notmuch,
-  stdenv,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -23,7 +21,7 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = [
     notmuch
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin Security;
+  ];
 
   meta = with lib; {
     description = "JMAP integration for notmuch mail";
diff --git a/pkgs/applications/networking/p2p/synapse-bt/default.nix b/pkgs/applications/networking/p2p/synapse-bt/default.nix
index 798d4b906b44..e99d00a8064e 100644
--- a/pkgs/applications/networking/p2p/synapse-bt/default.nix
+++ b/pkgs/applications/networking/p2p/synapse-bt/default.nix
@@ -1,12 +1,9 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
   pkg-config,
   openssl,
-  CoreServices,
-  Security,
 }:
 
 rustPlatform.buildRustPackage {
@@ -24,12 +21,7 @@ rustPlatform.buildRustPackage {
   cargoHash = "sha256-ebqUH01h4B3Aq3apSKpae8ncaFirbrZiDxjiQM9kzg4=";
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs =
-    [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CoreServices
-      Security
-    ];
+  buildInputs = [ openssl ];
 
   cargoBuildFlags = [ "--all" ];
 
diff --git a/pkgs/applications/networking/p2p/transmission/4.nix b/pkgs/applications/networking/p2p/transmission/4.nix
index 45dcb717f2b8..30614b8b7f1f 100644
--- a/pkgs/applications/networking/p2p/transmission/4.nix
+++ b/pkgs/applications/networking/p2p/transmission/4.nix
@@ -23,7 +23,6 @@
   dht,
   libnatpmp,
   libiconv,
-  Foundation,
   # Build options
   enableGTK3 ? false,
   gtkmm3,
diff --git a/pkgs/applications/networking/pjsip/default.nix b/pkgs/applications/networking/pjsip/default.nix
index 240979abe9d2..5d0e9484c838 100644
--- a/pkgs/applications/networking/pjsip/default.nix
+++ b/pkgs/applications/networking/pjsip/default.nix
@@ -7,9 +7,6 @@
   libsamplerate,
   swig,
   alsa-lib,
-  AppKit,
-  CoreFoundation,
-  Security,
   python3,
   pythonSupport ? true,
   runCommand,
@@ -45,17 +42,10 @@ stdenv.mkDerivation (finalAttrs: {
     python3.pkgs.wheel
   ];
 
-  buildInputs =
-    [
-      openssl
-      libsamplerate
-    ]
-    ++ lib.optional stdenv.hostPlatform.isLinux alsa-lib
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AppKit
-      CoreFoundation
-      Security
-    ];
+  buildInputs = [
+    openssl
+    libsamplerate
+  ] ++ lib.optional stdenv.hostPlatform.isLinux alsa-lib;
 
   env =
     lib.optionalAttrs stdenv.cc.isClang { CXXFLAGS = "-std=c++11"; }
diff --git a/pkgs/applications/networking/remote/putty/default.nix b/pkgs/applications/networking/remote/putty/default.nix
index fd3e768c71d9..fa3d0fc67f68 100644
--- a/pkgs/applications/networking/remote/putty/default.nix
+++ b/pkgs/applications/networking/remote/putty/default.nix
@@ -7,7 +7,6 @@
   pkg-config,
   gtk3,
   ncurses,
-  darwin,
   copyDesktopItems,
   makeDesktopItem,
 }:
@@ -30,12 +29,10 @@ stdenv.mkDerivation rec {
     pkg-config
     copyDesktopItems
   ];
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isUnix [
-      gtk3
-      ncurses
-    ]
-    ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.libs.utmp;
+  buildInputs = lib.optionals stdenv.hostPlatform.isUnix [
+    gtk3
+    ncurses
+  ];
   enableParallelBuilding = true;
 
   desktopItems = [
diff --git a/pkgs/applications/networking/rymdport/default.nix b/pkgs/applications/networking/rymdport/default.nix
index c25585d74701..c45c6a659d4a 100644
--- a/pkgs/applications/networking/rymdport/default.nix
+++ b/pkgs/applications/networking/rymdport/default.nix
@@ -1,13 +1,10 @@
 {
   lib,
-  stdenv,
   buildGoModule,
   fetchFromGitHub,
   pkg-config,
   libGL,
   xorg,
-  Carbon,
-  Cocoa,
 }:
 
 buildGoModule rec {
@@ -27,23 +24,16 @@ buildGoModule rec {
     pkg-config
   ];
 
-  buildInputs =
-    with xorg;
-    [
-      libGL
-      libX11
-      libXcursor
-      libXext
-      libXi
-      libXinerama
-      libXrandr
-      libXxf86vm
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Carbon
-      Cocoa
-      IOKit
-    ];
+  buildInputs = with xorg; [
+    libGL
+    libX11
+    libXcursor
+    libXext
+    libXi
+    libXinerama
+    libXrandr
+    libXxf86vm
+  ];
 
   postInstall = ''
     for res in $(ls internal/assets/icons | sed -e 's/icon-//g' -e 's/.png//g'); do
diff --git a/pkgs/applications/networking/sniffers/wireshark/default.nix b/pkgs/applications/networking/sniffers/wireshark/default.nix
index d0c2d6f91649..575151378b5f 100644
--- a/pkgs/applications/networking/sniffers/wireshark/default.nix
+++ b/pkgs/applications/networking/sniffers/wireshark/default.nix
@@ -3,7 +3,6 @@
   stdenv,
   fetchFromGitLab,
 
-  ApplicationServices,
   asciidoctor,
   bcg729,
   bison,
@@ -43,7 +42,6 @@
   snappy,
   spandsp3,
   speexdsp,
-  SystemConfiguration,
   wrapGAppsHook3,
   zlib-ng,
   zstd,
@@ -148,9 +146,7 @@ stdenv.mkDerivation rec {
       sbc
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      ApplicationServices
       gmp
-      SystemConfiguration
     ];
 
   strictDeps = true;
diff --git a/pkgs/applications/office/jameica/default.nix b/pkgs/applications/office/jameica/default.nix
index c724658db2aa..671254fdad4b 100644
--- a/pkgs/applications/office/jameica/default.nix
+++ b/pkgs/applications/office/jameica/default.nix
@@ -12,7 +12,6 @@
   gtk2,
   glib,
   libXtst,
-  Cocoa,
 }:
 
 let
@@ -62,13 +61,11 @@ stdenv.mkDerivation rec {
     makeWrapper
     stripJavaArchivesHook
   ];
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [
-      gtk2
-      glib
-      libXtst
-    ]
-    ++ lib.optional stdenv.hostPlatform.isDarwin Cocoa;
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    gtk2
+    glib
+    libXtst
+  ];
 
   dontWrapGApps = true;
 
diff --git a/pkgs/applications/radio/cubicsdr/default.nix b/pkgs/applications/radio/cubicsdr/default.nix
index a6608f926967..ab7e8d6ac8aa 100644
--- a/pkgs/applications/radio/cubicsdr/default.nix
+++ b/pkgs/applications/radio/cubicsdr/default.nix
@@ -14,8 +14,6 @@
   soapysdr-with-plugins,
   wxGTK32,
   enableDigitalLab ? false,
-  Cocoa,
-  WebKit,
 }:
 
 stdenv.mkDerivation rec {
@@ -54,10 +52,6 @@ stdenv.mkDerivation rec {
       libpulseaudio
       libGL
       libX11
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Cocoa
-      WebKit
     ];
 
   cmakeFlags = [ "-DUSE_HAMLIB=ON" ] ++ lib.optional enableDigitalLab "-DENABLE_DIGITAL_LAB=ON";
diff --git a/pkgs/applications/radio/limesuite/default.nix b/pkgs/applications/radio/limesuite/default.nix
index 2679132bdb8f..40929d11910d 100644
--- a/pkgs/applications/radio/limesuite/default.nix
+++ b/pkgs/applications/radio/limesuite/default.nix
@@ -11,7 +11,6 @@
   libX11,
   gnuplot,
   fltk,
-  GLUT,
   withGui ? false,
 }:
 
@@ -40,9 +39,6 @@ stdenv.mkDerivation rec {
       libusb1
       soapysdr
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      GLUT
-    ]
     ++ lib.optionals withGui [
       fltk
       libX11
diff --git a/pkgs/applications/radio/sdrangel/default.nix b/pkgs/applications/radio/sdrangel/default.nix
index 4f076ddf605b..aad4b36ed8ad 100644
--- a/pkgs/applications/radio/sdrangel/default.nix
+++ b/pkgs/applications/radio/sdrangel/default.nix
@@ -3,6 +3,7 @@
   stdenv,
   airspy,
   airspyhf,
+  apple-sdk_12,
   aptdec,
   boost,
   cm256cc,
@@ -114,6 +115,7 @@ stdenv.mkDerivation (finalAttrs: {
       zlib
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [ qtwayland ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [ apple-sdk_12 ]
     ++ lib.optionals withSDRplay [ sdrplay ];
 
   patches = [
diff --git a/pkgs/applications/radio/sdrpp/default.nix b/pkgs/applications/radio/sdrpp/default.nix
index 6e140c25bffd..8e486eee2594 100644
--- a/pkgs/applications/radio/sdrpp/default.nix
+++ b/pkgs/applications/radio/sdrpp/default.nix
@@ -10,7 +10,6 @@
   fftwFloat,
   volk,
   zstd,
-  AppKit,
   # Sources
   airspy_source ? true,
   airspy,
@@ -107,7 +106,6 @@ stdenv.mkDerivation rec {
       volk
       zstd
     ]
-    ++ lib.optional stdenv.hostPlatform.isDarwin AppKit
     ++ lib.optional stdenv.hostPlatform.isLinux libX11
     ++ lib.optional airspy_source airspy
     ++ lib.optional airspyhf_source airspyhf
diff --git a/pkgs/applications/radio/soapyairspy/default.nix b/pkgs/applications/radio/soapyairspy/default.nix
index 975a7dc1c261..d6094e550b49 100644
--- a/pkgs/applications/radio/soapyairspy/default.nix
+++ b/pkgs/applications/radio/soapyairspy/default.nix
@@ -5,9 +5,6 @@
   cmake,
   airspy,
   soapysdr,
-  libobjc,
-  IOKit,
-  Security,
 }:
 
 stdenv.mkDerivation rec {
@@ -22,16 +19,10 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ cmake ];
-  buildInputs =
-    [
-      airspy
-      soapysdr
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      libobjc
-      IOKit
-      Security
-    ];
+  buildInputs = [
+    airspy
+    soapysdr
+  ];
 
   cmakeFlags = [ "-DSoapySDR_DIR=${soapysdr}/share/cmake/SoapySDR/" ];
 
diff --git a/pkgs/applications/radio/soapyaudio/default.nix b/pkgs/applications/radio/soapyaudio/default.nix
index 003561495c1b..ce2be6ec8a68 100644
--- a/pkgs/applications/radio/soapyaudio/default.nix
+++ b/pkgs/applications/radio/soapyaudio/default.nix
@@ -11,8 +11,6 @@
   libjack2,
   libusb1,
   soapysdr,
-  Accelerate,
-  CoreAudio,
 }:
 
 stdenv.mkDerivation rec {
@@ -41,10 +39,6 @@ stdenv.mkDerivation rec {
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       alsa-lib
       libpulseaudio
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Accelerate
-      CoreAudio
     ];
 
   cmakeFlags = [
diff --git a/pkgs/applications/radio/soapybladerf/default.nix b/pkgs/applications/radio/soapybladerf/default.nix
index 31747781cbda..473376de9477 100644
--- a/pkgs/applications/radio/soapybladerf/default.nix
+++ b/pkgs/applications/radio/soapybladerf/default.nix
@@ -6,9 +6,6 @@
   pkg-config,
   libbladeRF,
   soapysdr,
-  libobjc,
-  IOKit,
-  Security,
 }:
 
 let
@@ -30,16 +27,10 @@ stdenv.mkDerivation {
     cmake
     pkg-config
   ];
-  buildInputs =
-    [
-      libbladeRF
-      soapysdr
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      libobjc
-      IOKit
-      Security
-    ];
+  buildInputs = [
+    libbladeRF
+    soapysdr
+  ];
 
   cmakeFlags = [ "-DSoapySDR_DIR=${soapysdr}/share/cmake/SoapySDR/" ];
 
diff --git a/pkgs/applications/radio/soapyhackrf/default.nix b/pkgs/applications/radio/soapyhackrf/default.nix
index 949e5b5bff9d..7bcc40719a37 100644
--- a/pkgs/applications/radio/soapyhackrf/default.nix
+++ b/pkgs/applications/radio/soapyhackrf/default.nix
@@ -6,9 +6,6 @@
   pkg-config,
   hackrf,
   soapysdr,
-  libobjc,
-  IOKit,
-  Security,
 }:
 
 let
@@ -30,16 +27,10 @@ stdenv.mkDerivation {
     cmake
     pkg-config
   ];
-  buildInputs =
-    [
-      hackrf
-      soapysdr
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      libobjc
-      IOKit
-      Security
-    ];
+  buildInputs = [
+    hackrf
+    soapysdr
+  ];
 
   cmakeFlags = [ "-DSoapySDR_DIR=${soapysdr}/share/cmake/SoapySDR/" ];
 
diff --git a/pkgs/applications/radio/soapyrtlsdr/default.nix b/pkgs/applications/radio/soapyrtlsdr/default.nix
index 16dd80a12cbc..31154d62b863 100644
--- a/pkgs/applications/radio/soapyrtlsdr/default.nix
+++ b/pkgs/applications/radio/soapyrtlsdr/default.nix
@@ -6,9 +6,6 @@
   pkg-config,
   rtl-sdr,
   soapysdr,
-  libobjc,
-  IOKit,
-  Security,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -26,16 +23,10 @@ stdenv.mkDerivation (finalAttrs: {
     cmake
     pkg-config
   ];
-  buildInputs =
-    [
-      rtl-sdr
-      soapysdr
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      libobjc
-      IOKit
-      Security
-    ];
+  buildInputs = [
+    rtl-sdr
+    soapysdr
+  ];
 
   cmakeFlags = [ "-DSoapySDR_DIR=${soapysdr}/share/cmake/SoapySDR/" ];
 
diff --git a/pkgs/applications/radio/soapyuhd/default.nix b/pkgs/applications/radio/soapyuhd/default.nix
index 062a5c17bf03..722d41bb37cc 100644
--- a/pkgs/applications/radio/soapyuhd/default.nix
+++ b/pkgs/applications/radio/soapyuhd/default.nix
@@ -7,9 +7,6 @@
   uhd,
   boost,
   soapysdr,
-  libobjc,
-  IOKit,
-  Security,
 }:
 
 stdenv.mkDerivation rec {
@@ -27,17 +24,11 @@ stdenv.mkDerivation rec {
     cmake
     pkg-config
   ];
-  buildInputs =
-    [
-      uhd
-      boost
-      soapysdr
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      libobjc
-      IOKit
-      Security
-    ];
+  buildInputs = [
+    uhd
+    boost
+    soapysdr
+  ];
 
   cmakeFlags = [ "-DSoapySDR_DIR=${soapysdr}/share/cmake/SoapySDR/" ];
 
diff --git a/pkgs/applications/science/biology/ants/default.nix b/pkgs/applications/science/biology/ants/default.nix
index 1f7966a64271..f2595124a1ad 100644
--- a/pkgs/applications/science/biology/ants/default.nix
+++ b/pkgs/applications/science/biology/ants/default.nix
@@ -6,7 +6,6 @@
   makeBinaryWrapper,
   itk,
   vtk,
-  Cocoa,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -25,14 +24,10 @@ stdenv.mkDerivation (finalAttrs: {
     makeBinaryWrapper
   ];
 
-  buildInputs =
-    [
-      itk
-      vtk
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Cocoa
-    ];
+  buildInputs = [
+    itk
+    vtk
+  ];
 
   cmakeFlags = [
     "-DANTS_SUPERBUILD=FALSE"
diff --git a/pkgs/applications/science/biology/blast/default.nix b/pkgs/applications/science/biology/blast/default.nix
index 239011dd7807..cbbc6ab194de 100644
--- a/pkgs/applications/science/biology/blast/default.nix
+++ b/pkgs/applications/science/biology/blast/default.nix
@@ -9,7 +9,6 @@
   cpio,
   gawk,
   coreutils,
-  ApplicationServices,
 }:
 
 stdenv.mkDerivation rec {
@@ -101,7 +100,7 @@ stdenv.mkDerivation rec {
     gawk
     zlib
     bzip2
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ ApplicationServices ];
+  ];
 
   strictDeps = true;
 
diff --git a/pkgs/applications/science/electronics/kicad/base.nix b/pkgs/applications/science/electronics/kicad/base.nix
index 728aba18b1df..9bbf2c3f19c6 100644
--- a/pkgs/applications/science/electronics/kicad/base.nix
+++ b/pkgs/applications/science/electronics/kicad/base.nix
@@ -47,7 +47,7 @@
   opencascade-occt_7_6,
   libngspice,
   valgrind,
-  protobuf,
+  protobuf_29,
   nng,
 
   stable,
@@ -186,7 +186,7 @@ stdenv.mkDerivation rec {
       unixODBC
       libdeflate
       opencascade-occt
-      protobuf
+      protobuf_29
 
       # This would otherwise cause a linking requirement for mbedtls.
       (nng.override { mbedtlsSupport = false; })
diff --git a/pkgs/applications/science/machine-learning/finalfrontier/default.nix b/pkgs/applications/science/machine-learning/finalfrontier/default.nix
index 2fb6e386346a..ab17053cf6e2 100644
--- a/pkgs/applications/science/machine-learning/finalfrontier/default.nix
+++ b/pkgs/applications/science/machine-learning/finalfrontier/default.nix
@@ -7,7 +7,6 @@
   pkg-config,
   libiconv,
   openssl,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -33,7 +32,6 @@ rustPlatform.buildRustPackage rec {
     [ openssl ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       libiconv
-      Security
     ];
 
   postInstall = ''
diff --git a/pkgs/applications/science/machine-learning/finalfusion-utils/default.nix b/pkgs/applications/science/machine-learning/finalfusion-utils/default.nix
index ec1e20a91329..82c0c8fa015f 100644
--- a/pkgs/applications/science/machine-learning/finalfusion-utils/default.nix
+++ b/pkgs/applications/science/machine-learning/finalfusion-utils/default.nix
@@ -1,6 +1,5 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitHub,
   installShellFiles,
@@ -8,7 +7,6 @@
   gfortran,
   lapack,
   openssl,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -27,16 +25,12 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  buildInputs =
-    [
-      blas
-      gfortran.cc.lib
-      lapack
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Security
-    ];
+  buildInputs = [
+    blas
+    gfortran.cc.lib
+    lapack
+    openssl
+  ];
 
   # Enables build against a generic BLAS.
   buildFeatures = [ "netlib" ];
diff --git a/pkgs/applications/science/math/R/default.nix b/pkgs/applications/science/math/R/default.nix
index e89df9ef4119..027a8b202582 100644
--- a/pkgs/applications/science/math/R/default.nix
+++ b/pkgs/applications/science/math/R/default.nix
@@ -33,9 +33,6 @@
   blas,
   lapack,
   curl,
-  Cocoa,
-  Foundation,
-  libobjc,
   tzdata,
   withRecommendedPackages ? true,
   enableStrictBarrier ? false,
@@ -76,50 +73,44 @@ stdenv.mkDerivation (finalAttrs: {
     tzdata
     which
   ];
-  buildInputs =
-    [
-      bzip2
-      gfortran
-      libX11
-      libXmu
-      libXt
-      libXt
-      libjpeg
-      libpng
-      libtiff
-      ncurses
-      pango
-      pcre2
-      readline
-      (texliveSmall.withPackages (
-        ps: with ps; [
-          inconsolata
-          helvetic
-          ps.texinfo
-          fancyvrb
-          cm-super
-          rsfs
-        ]
-      ))
-      xz
-      zlib
-      less
-      texinfo
-      graphviz
-      icu
-      which
-      blas
-      lapack
-      curl
-      tcl
-      tk
-      jdk
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Cocoa
-      Foundation
-      libobjc
-    ];
+  buildInputs = [
+    bzip2
+    gfortran
+    libX11
+    libXmu
+    libXt
+    libXt
+    libjpeg
+    libpng
+    libtiff
+    ncurses
+    pango
+    pcre2
+    readline
+    (texliveSmall.withPackages (
+      ps: with ps; [
+        inconsolata
+        helvetic
+        ps.texinfo
+        fancyvrb
+        cm-super
+        rsfs
+      ]
+    ))
+    xz
+    zlib
+    less
+    texinfo
+    graphviz
+    icu
+    which
+    blas
+    lapack
+    curl
+    tcl
+    tk
+    jdk
+  ];
   strictDeps = true;
 
   patches = [
diff --git a/pkgs/applications/science/math/caffe/default.nix b/pkgs/applications/science/math/caffe/default.nix
index 4b9bd9e6fdcc..6314ee84599c 100644
--- a/pkgs/applications/science/math/caffe/default.nix
+++ b/pkgs/applications/science/math/caffe/default.nix
@@ -14,9 +14,6 @@
   protobuf,
   doxygen,
   blas,
-  Accelerate,
-  CoreGraphics,
-  CoreVideo,
   lmdbSupport ? true,
   lmdb,
   leveldbSupport ? true,
@@ -82,11 +79,6 @@ stdenv.mkDerivation rec {
     ++ lib.optionals pythonSupport [
       python
       numpy
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Accelerate
-      CoreGraphics
-      CoreVideo
     ];
 
   propagatedBuildInputs = lib.optionals pythonSupport (
diff --git a/pkgs/applications/science/misc/rink/default.nix b/pkgs/applications/science/misc/rink/default.nix
index dfa7fbf8daf4..622030ebfd98 100644
--- a/pkgs/applications/science/misc/rink/default.nix
+++ b/pkgs/applications/science/misc/rink/default.nix
@@ -10,7 +10,6 @@
   installShellFiles,
   asciidoctor,
   libiconv,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -39,7 +38,6 @@ rustPlatform.buildRustPackage rec {
         [
           curl
           libiconv
-          Security
         ]
       else
         [ openssl ]
diff --git a/pkgs/applications/version-management/git-gone/default.nix b/pkgs/applications/version-management/git-gone/default.nix
index b131fa6ee7f2..76a8bb0ca03f 100644
--- a/pkgs/applications/version-management/git-gone/default.nix
+++ b/pkgs/applications/version-management/git-gone/default.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
-  Security,
   installShellFiles,
   asciidoctor,
 }:
@@ -36,8 +34,6 @@ rustPlatform.buildRustPackage rec {
     asciidoctor
   ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
-
   postInstall = ''
     asciidoctor --backend=manpage git-gone.1.adoc -o git-gone.1
     installManPage git-gone.1
diff --git a/pkgs/applications/version-management/git-stack/default.nix b/pkgs/applications/version-management/git-stack/default.nix
index 5107fef5426f..f5e23de6893a 100644
--- a/pkgs/applications/version-management/git-stack/default.nix
+++ b/pkgs/applications/version-management/git-stack/default.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
-  Security,
   testers,
   git-stack,
 }:
@@ -22,10 +20,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-338iRd6zoy2O55sZ0h+s6i8kg4yXFBowRQLge9R9Bqs=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    Security
-  ];
-
   # Many tests try to access the file system.
   doCheck = false;
 
diff --git a/pkgs/applications/version-management/git/default.nix b/pkgs/applications/version-management/git/default.nix
index 974d878f264b..e79f78a7dab5 100644
--- a/pkgs/applications/version-management/git/default.nix
+++ b/pkgs/applications/version-management/git/default.nix
@@ -41,8 +41,6 @@
   pythonSupport ? true,
   withpcre2 ? true,
   sendEmailSupport ? perlSupport,
-  Security,
-  CoreServices,
   nixosTests,
   withLibsecret ? false,
   pkg-config,
@@ -160,10 +158,6 @@ stdenv.mkDerivation (finalAttrs: {
       tk
     ]
     ++ lib.optionals withpcre2 [ pcre2 ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Security
-      CoreServices
-    ]
     ++ lib.optionals withLibsecret [
       glib
       libsecret
@@ -238,7 +232,7 @@ stdenv.mkDerivation (finalAttrs: {
       # Need to build the main Git documentation before building the
       # contrib/subtree documentation, as the latter depends on the
       # asciidoc.conf file created by the former.
-      make -C Documentation "''${flagsArray[@]}"
+      make -C Documentation PERL_PATH=${lib.getExe buildPackages.perlPackages.perl} "''${flagsArray[@]}"
     ''
     + ''
       make -C contrib/subtree "''${flagsArray[@]}" all ${lib.optionalString withManual "doc"}
@@ -265,13 +259,23 @@ stdenv.mkDerivation (finalAttrs: {
 
   preInstall =
     lib.optionalString osxkeychainSupport ''
+      mkdir -p $out/libexec/git-core
+      ln -s $out/share/git/contrib/credential/osxkeychain/git-credential-osxkeychain $out/libexec/git-core/
+
+      # ideally unneeded, but added for backwards compatibility
       mkdir -p $out/bin
-      ln -s $out/share/git/contrib/credential/osxkeychain/git-credential-osxkeychain $out/bin/
+      ln -s $out/libexec/git-core/git-credential-osxkeychain $out/bin/
+
       rm -f $PWD/contrib/credential/osxkeychain/git-credential-osxkeychain.o
     ''
     + lib.optionalString withLibsecret ''
+      mkdir -p $out/libexec/git-core
+      ln -s $out/share/git/contrib/credential/libsecret/git-credential-libsecret $out/libexec/git-core/
+
+      # ideally unneeded, but added for backwards compatibility
       mkdir -p $out/bin
-      ln -s $out/share/git/contrib/credential/libsecret/git-credential-libsecret $out/bin/
+      ln -s $out/libexec/git-core/git-credential-libsecret $out/bin/
+
       rm -f $PWD/contrib/credential/libsecret/git-credential-libsecret.o
     '';
 
@@ -340,8 +344,11 @@ stdenv.mkDerivation (finalAttrs: {
     ''
     + lib.optionalString perlSupport ''
       # wrap perl commands
-      makeWrapper "$out/share/git/contrib/credential/netrc/git-credential-netrc.perl" $out/bin/git-credential-netrc \
+      makeWrapper "$out/share/git/contrib/credential/netrc/git-credential-netrc.perl" $out/libexec/git-core/git-credential-netrc \
                   --set PERL5LIB   "$out/${perlPackages.perl.libPrefix}:${perlPackages.makePerlPath perlLibs}"
+      # ideally unneeded, but added for backwards compatibility
+      ln -s $out/libexec/git-core/git-credential-netrc $out/bin/
+
       wrapProgram $out/libexec/git-core/git-cvsimport \
                   --set GITPERLLIB "$out/${perlPackages.perl.libPrefix}:${perlPackages.makePerlPath perlLibs}"
       wrapProgram $out/libexec/git-core/git-archimport \
@@ -419,7 +426,6 @@ stdenv.mkDerivation (finalAttrs: {
         ''
     )
     + lib.optionalString osxkeychainSupport ''
-      ln -s $out/share/git/contrib/credential/osxkeychain/git-credential-osxkeychain $out/libexec/git-core/
       # enable git-credential-osxkeychain on darwin if desired (default)
       mkdir -p $out/etc
       cat > $out/etc/gitconfig << EOF
diff --git a/pkgs/applications/version-management/gittyup/default.nix b/pkgs/applications/version-management/gittyup/default.nix
index cfe26c2de044..25e65657ce8d 100644
--- a/pkgs/applications/version-management/gittyup/default.nix
+++ b/pkgs/applications/version-management/gittyup/default.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   cmake,
   cmark,
-  darwin,
   git,
   libssh2,
   lua5_4,
@@ -60,24 +59,16 @@ stdenv.mkDerivation rec {
     wrapQtAppsHook
   ];
 
-  buildInputs =
-    [
-      cmark
-      git
-      hunspell
-      libssh2
-      lua5_4
-      openssl
-      qtbase
-      qttools
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        CoreFoundation
-        Security
-      ]
-    );
+  buildInputs = [
+    cmark
+    git
+    hunspell
+    libssh2
+    lua5_4
+    openssl
+    qtbase
+    qttools
+  ];
 
   postInstall = ''
     # Those are not program libs, just some Qt5 libs that the build system leaks for some reason
diff --git a/pkgs/applications/version-management/lucky-commit/default.nix b/pkgs/applications/version-management/lucky-commit/default.nix
index 3b5c389e70ed..f2295c428aa9 100644
--- a/pkgs/applications/version-management/lucky-commit/default.nix
+++ b/pkgs/applications/version-management/lucky-commit/default.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   withOpenCL ? true,
   stdenv,
-  OpenCL,
   ocl-icd,
 }:
 
@@ -22,7 +21,7 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-8Z/bfSDjSrvGbPOVpvIYzOz5wxjkMsuwOWASnOA8ziM=";
 
-  buildInputs = lib.optional withOpenCL (if stdenv.hostPlatform.isDarwin then OpenCL else ocl-icd);
+  buildInputs = lib.optional (withOpenCL && (!stdenv.hostPlatform.isDarwin)) ocl-icd;
 
   buildNoDefaultFeatures = !withOpenCL;
 
diff --git a/pkgs/applications/version-management/mercurial/default.nix b/pkgs/applications/version-management/mercurial/default.nix
index 3b6270bf8c65..bc60bd3fcb54 100644
--- a/pkgs/applications/version-management/mercurial/default.nix
+++ b/pkgs/applications/version-management/mercurial/default.nix
@@ -16,7 +16,6 @@
   guiSupport ? fullBuild,
   tk,
   highlightSupport ? fullBuild,
-  ApplicationServices,
   # test dependencies
   runCommand,
   unzip,
@@ -39,11 +38,11 @@ let
 
   self = python3Packages.buildPythonApplication rec {
     pname = "mercurial${lib.optionalString fullBuild "-full"}";
-    version = "6.9.1";
+    version = "6.9.4";
 
     src = fetchurl {
       url = "https://mercurial-scm.org/release/mercurial-${version}.tar.gz";
-      hash = "sha256-5XdXfumpep+E08NNU8y4uTVCY9arlkR1JQlPPgpWcnA=";
+      hash = "sha256-fqDoOeyDRSd90Z0HJQtEJhNNxdZoL/iAqGorCbTjjs0=";
     };
 
     format = "other";
@@ -78,7 +77,7 @@ let
         cargo
         rustc
       ];
-    buildInputs = [ docutils ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ ApplicationServices ];
+    buildInputs = [ docutils ];
 
     makeFlags = [ "PREFIX=$(out)" ] ++ lib.optional rustSupport "PURE=--rust";
 
diff --git a/pkgs/applications/version-management/p4/default.nix b/pkgs/applications/version-management/p4/default.nix
index 56f2f8e463b1..68af1ce3c04c 100644
--- a/pkgs/applications/version-management/p4/default.nix
+++ b/pkgs/applications/version-management/p4/default.nix
@@ -7,9 +7,6 @@
   linkFarm,
   jam,
   openssl,
-  CoreServices,
-  Foundation,
-  Security,
   testers,
 }:
 
@@ -53,12 +50,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ jam ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    CoreServices
-    Foundation
-    Security
-  ];
-
   outputs = [
     "out"
     "bin"
diff --git a/pkgs/applications/version-management/sapling/default.nix b/pkgs/applications/version-management/sapling/default.nix
index 535abf792679..a44df071c8de 100644
--- a/pkgs/applications/version-management/sapling/default.nix
+++ b/pkgs/applications/version-management/sapling/default.nix
@@ -16,12 +16,6 @@
   fixup-yarn-lock,
   glibcLocales,
   libiconv,
-  Cocoa,
-  CoreFoundation,
-  CoreGraphics,
-  CoreServices,
-  Security,
-  WebKit,
 
   enableMinimal ? false,
 }:
@@ -166,12 +160,6 @@ python311Packages.buildPythonApplication {
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       curl
       libiconv
-      Cocoa
-      CoreFoundation
-      CoreGraphics
-      CoreServices
-      Security
-      WebKit
     ];
 
   HGNAME = "sl";
diff --git a/pkgs/applications/version-management/subversion/default.nix b/pkgs/applications/version-management/subversion/default.nix
index 353f567172b4..5513f8bfd0f5 100644
--- a/pkgs/applications/version-management/subversion/default.nix
+++ b/pkgs/applications/version-management/subversion/default.nix
@@ -16,8 +16,6 @@
   openssl,
   lz4,
   utf8proc,
-  CoreServices,
-  Security,
   autoconf,
   libtool,
   apacheHttpd ? null,
diff --git a/pkgs/applications/video/go2tv/default.nix b/pkgs/applications/video/go2tv/default.nix
index 77bf7cfb8517..f7ded32020b6 100644
--- a/pkgs/applications/video/go2tv/default.nix
+++ b/pkgs/applications/video/go2tv/default.nix
@@ -1,12 +1,7 @@
 {
   lib,
-  stdenv,
   buildGoModule,
   fetchFromGitHub,
-  Carbon,
-  Cocoa,
-  Kernel,
-  UserNotifications,
   xorg,
   libglvnd,
   pkg-config,
@@ -28,23 +23,16 @@ buildGoModule rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    [
-      xorg.libX11
-      xorg.libXcursor
-      xorg.libXrandr
-      xorg.libXinerama
-      xorg.libXi
-      xorg.libXext
-      xorg.libXxf86vm
-      libglvnd
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Carbon
-      Cocoa
-      Kernel
-      UserNotifications
-    ];
+  buildInputs = [
+    xorg.libX11
+    xorg.libXcursor
+    xorg.libXrandr
+    xorg.libXinerama
+    xorg.libXi
+    xorg.libXext
+    xorg.libXxf86vm
+    libglvnd
+  ];
 
   ldflags = [
     "-s"
diff --git a/pkgs/applications/video/jellyfin-media-player/default.nix b/pkgs/applications/video/jellyfin-media-player/default.nix
index cf660186976d..ebcdc89f4f1e 100644
--- a/pkgs/applications/video/jellyfin-media-player/default.nix
+++ b/pkgs/applications/video/jellyfin-media-player/default.nix
@@ -3,10 +3,6 @@
   fetchFromGitHub,
   mkDerivation,
   stdenv,
-  Cocoa,
-  CoreAudio,
-  CoreFoundation,
-  MediaPlayer,
   SDL2,
   cmake,
   libGL,
@@ -59,12 +55,6 @@ mkDerivation rec {
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       qtwayland
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Cocoa
-      CoreAudio
-      CoreFoundation
-      MediaPlayer
     ];
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/video/mplayer/default.nix b/pkgs/applications/video/mplayer/default.nix
index e156fee4a1ff..e880ffb89266 100644
--- a/pkgs/applications/video/mplayer/default.nix
+++ b/pkgs/applications/video/mplayer/default.nix
@@ -65,7 +65,6 @@
   libjpegSupport ? true,
   libjpeg,
   useUnfreeCodecs ? false,
-  darwin,
   buildPackages,
 }:
 
@@ -176,11 +175,7 @@ stdenv.mkDerivation {
     ++ lib.optional libpngSupport libpng
     ++ lib.optional libjpegSupport libjpeg
     ++ lib.optional bs2bSupport libbs2b
-    ++ lib.optional v4lSupport libv4l
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Cocoa
-      darwin.apple_sdk.frameworks.OpenGL
-    ];
+    ++ lib.optional v4lSupport libv4l;
 
   configurePlatforms = [ ];
   configureFlags =
diff --git a/pkgs/applications/video/olive-editor/default.nix b/pkgs/applications/video/olive-editor/default.nix
index 55cc0d18cfae..4a49b281adaa 100644
--- a/pkgs/applications/video/olive-editor/default.nix
+++ b/pkgs/applications/video/olive-editor/default.nix
@@ -8,7 +8,6 @@
   frei0r,
   opencolorio,
   ffmpeg_6,
-  CoreFoundation,
   cmake,
   wrapQtAppsHook,
   openimageio,
@@ -83,7 +82,7 @@ stdenv.mkDerivation {
     qtwayland
     qtmultimedia
     qttools
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin CoreFoundation;
+  ];
 
   meta = with lib; {
     description = "Professional open-source NLE video editor";
diff --git a/pkgs/applications/video/youtube-tui/default.nix b/pkgs/applications/video/youtube-tui/default.nix
index b2e2f38bc33d..7c2a4d7f3f60 100644
--- a/pkgs/applications/video/youtube-tui/default.nix
+++ b/pkgs/applications/video/youtube-tui/default.nix
@@ -10,9 +10,6 @@
   makeBinaryWrapper,
   libsixel,
   mpv,
-  CoreFoundation,
-  Security,
-  AppKit,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -35,18 +32,12 @@ rustPlatform.buildRustPackage rec {
     makeBinaryWrapper
   ];
 
-  buildInputs =
-    [
-      openssl
-      xorg.libxcb
-      libsixel
-      mpv
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CoreFoundation
-      Security
-      AppKit
-    ];
+  buildInputs = [
+    openssl
+    xorg.libxcb
+    libsixel
+    mpv
+  ];
 
   # sixel-sys is dynamically linked to libsixel
   postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index 1bb8bb429e64..841415a4b6e2 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -33,8 +33,6 @@
   libslirp,
   apple-sdk_13,
   darwinMinVersionHook,
-  rez,
-  setfile,
   guestAgentSupport ?
     (with stdenv.hostPlatform; isLinux || isNetBSD || isOpenBSD || isSunOS || isWindows) && !minimal,
   numaSupport ? stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isAarch32 && !minimal,
@@ -145,11 +143,11 @@ stdenv.mkDerivation (finalAttrs: {
     + lib.optionalString nixosTestRunner "-for-vm-tests"
     + lib.optionalString toolsOnly "-utils"
     + lib.optionalString userOnly "-user";
-  version = "9.2.2";
+  version = "9.2.3";
 
   src = fetchurl {
     url = "https://download.qemu.org/qemu-${finalAttrs.version}.tar.xz";
-    hash = "sha256-dS6u63cpI6c9U2sjHgW8wJybH1FpCkGtmXPZAOTsn78=";
+    hash = "sha256-uu1JQnDDYb9pgWrMhFEuPv7XHHoj92aRZCuAvD3naT4=";
   };
 
   depsBuildBuild =
@@ -179,8 +177,6 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optionals hexagonSupport [ glib ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       sigtool
-      rez
-      setfile
     ]
     ++ lib.optionals (!userOnly) [ dtc ];
 
@@ -263,6 +259,13 @@ stdenv.mkDerivation (finalAttrs: {
   patches = [
     ./fix-qemu-ga.patch
 
+    # On macOS, QEMU uses `Rez(1)` and `SetFile(1)` to attach its icon
+    # to the binary. Unfortunately, those commands are proprietary,
+    # deprecated since Xcode 6, and operate on resource forks, which
+    # these days are stored in extended attributes, which aren’t
+    # supported in the Nix store. So we patch out the calls.
+    ./skip-macos-icon.patch
+
     # Workaround for upstream issue with nested virtualisation: https://gitlab.com/qemu-project/qemu/-/issues/1008
     (fetchpatch {
       url = "https://gitlab.com/qemu-project/qemu/-/commit/3e4546d5bd38a1e98d4bd2de48631abf0398a3a2.diff";
diff --git a/pkgs/applications/virtualization/qemu/skip-macos-icon.patch b/pkgs/applications/virtualization/qemu/skip-macos-icon.patch
new file mode 100644
index 000000000000..4f6f3a9a9e4a
--- /dev/null
+++ b/pkgs/applications/virtualization/qemu/skip-macos-icon.patch
@@ -0,0 +1,14 @@
+diff --git a/scripts/entitlement.sh b/scripts/entitlement.sh
+index 0f412949ec..23f56d083a 100755
+--- a/scripts/entitlement.sh
++++ b/scripts/entitlement.sh
+@@ -25,9 +25,5 @@
+   codesign --entitlements "$ENTITLEMENT" --force -s - "$SRC"
+ fi
+ 
+-# Add the QEMU icon to the binary on Mac OS
+-Rez -append "$ICON" -o "$SRC"
+-SetFile -a C "$SRC"
+-
+ mv -f "$SRC" "$DST"
+ trap '' exit
diff --git a/pkgs/applications/virtualization/xhyve/default.nix b/pkgs/applications/virtualization/xhyve/default.nix
index c994cf7ec819..5d705eb3a20d 100644
--- a/pkgs/applications/virtualization/xhyve/default.nix
+++ b/pkgs/applications/virtualization/xhyve/default.nix
@@ -2,10 +2,6 @@
   stdenv,
   lib,
   fetchFromGitHub,
-  Hypervisor,
-  vmnet,
-  xpc,
-  libobjc,
   zlib,
 }:
 
@@ -21,10 +17,6 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [
-    Hypervisor
-    vmnet
-    xpc
-    libobjc
     zlib
   ];
 
diff --git a/pkgs/build-support/cc-wrapper/add-clang-cc-cflags-before.sh b/pkgs/build-support/cc-wrapper/add-clang-cc-cflags-before.sh
index 6a8c86258284..b56bb39c97a9 100644
--- a/pkgs/build-support/cc-wrapper/add-clang-cc-cflags-before.sh
+++ b/pkgs/build-support/cc-wrapper/add-clang-cc-cflags-before.sh
@@ -26,7 +26,7 @@ while (("$n" < "$nParams")); do
     esac
 done
 
-if $targetPassed && [[ "$targetValue" != "@defaultTarget@" ]]; then
+if $targetPassed && [[ "$targetValue" != "@defaultTarget@" ]] && (( "${NIX_CC_WRAPPER_SUPPRESS_TARGET_WARNING:-0}" < 1 )); then
     echo "Warning: supplying the --target $targetValue != @defaultTarget@ argument to a nix-wrapped compiler may not work correctly - cc-wrapper is currently not designed with multi-target compilers in mind. You may want to use an un-wrapped compiler instead." >&2
 elif [[ $0 != *cpp ]]; then
     extraBefore+=(-target @defaultTarget@ @machineFlags@)
diff --git a/pkgs/build-support/cc-wrapper/add-flags.sh b/pkgs/build-support/cc-wrapper/add-flags.sh
index 2c3dc8884023..90b6d9b04adc 100644
--- a/pkgs/build-support/cc-wrapper/add-flags.sh
+++ b/pkgs/build-support/cc-wrapper/add-flags.sh
@@ -30,7 +30,7 @@ done
 # Arocc does not support "-B"
 if [[ -z "@isArocc@" ]]; then
     # `-B@bintools@/bin' forces cc to use ld-wrapper.sh when calling ld.
-    NIX_CFLAGS_COMPILE_@suffixSalt@="-B@bintools@/bin/ $NIX_CFLAGS_COMPILE_@suffixSalt@"
+    NIX_CFLAGS_COMPILE_@suffixSalt@="-B@bintools@/bin/@bintools_targetPrefix@ $NIX_CFLAGS_COMPILE_@suffixSalt@"
 fi
 
 # Export and assign separately in order that a failing $(..) will fail
diff --git a/pkgs/build-support/cc-wrapper/add-hardening.sh b/pkgs/build-support/cc-wrapper/add-hardening.sh
index 4440d99ccaba..9fed30303ab8 100644
--- a/pkgs/build-support/cc-wrapper/add-hardening.sh
+++ b/pkgs/build-support/cc-wrapper/add-hardening.sh
@@ -32,7 +32,7 @@ if [[ -n "${hardeningEnableMap[fortify3]-}" ]]; then
 fi
 
 if (( "${NIX_DEBUG:-0}" >= 1 )); then
-  declare -a allHardeningFlags=(fortify fortify3 shadowstack stackprotector stackclashprotection pacret pie pic strictoverflow format trivialautovarinit zerocallusedregs)
+  declare -a allHardeningFlags=(fortify fortify3 shadowstack stackprotector stackclashprotection nostrictaliasing pacret pie pic strictoverflow format trivialautovarinit zerocallusedregs)
   declare -A hardeningDisableMap=()
 
   # Determine which flags were effectively disabled so we can report below.
@@ -91,6 +91,10 @@ for flag in "${!hardeningEnableMap[@]}"; do
       if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling stack-clash-protection >&2; fi
       hardeningCFlagsBefore+=('-fstack-clash-protection')
       ;;
+    nostrictaliasing)
+      if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling nostrictaliasing >&2; fi
+      hardeningCFlagsBefore+=('-fno-strict-aliasing')
+      ;;
     pie)
       # NB: we do not use `+=` here, because PIE flags must occur before any PIC flags
       if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling CFlags -fPIE >&2; fi
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 8101394088fd..f12fe4d18bec 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -880,6 +880,7 @@ stdenvNoCC.mkDerivation {
       cc = optionalString (!nativeTools) cc;
       wrapperName = "CC_WRAPPER";
       inherit suffixSalt coreutils_bin bintools;
+      bintools_targetPrefix = bintools.targetPrefix;
       inherit libc_bin libc_dev libc_lib;
       inherit darwinPlatformForCC;
       default_hardening_flags_str = builtins.toString defaultHardeningFlags;
diff --git a/pkgs/build-support/mitm-cache/default.nix b/pkgs/build-support/mitm-cache/default.nix
index e3f89bacf54c..9c4e89bf3d55 100644
--- a/pkgs/build-support/mitm-cache/default.nix
+++ b/pkgs/build-support/mitm-cache/default.nix
@@ -1,12 +1,10 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   callPackage,
   rustPlatform,
   replaceVars,
   openssl,
-  Security,
   python3Packages,
 }:
 
@@ -21,10 +19,6 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-eY8mgmQB8wXQ7YJbLvdjXEEgGD+/RDywjvehJYf7ckE=";
   };
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    Security
-  ];
-
   useFetchCargoVendor = true;
   cargoHash = "sha256-DTPlPCumkVI2naYoNdO8T3pQNSawBA0FZ9LxVpqKqN0=";
 
diff --git a/pkgs/build-support/wasm-bindgen-cli/default.nix b/pkgs/build-support/wasm-bindgen-cli/default.nix
index 40c120c14b79..1cdbd5d9906a 100644
--- a/pkgs/build-support/wasm-bindgen-cli/default.nix
+++ b/pkgs/build-support/wasm-bindgen-cli/default.nix
@@ -8,7 +8,6 @@
   openssl,
   stdenv,
   curl,
-  darwin,
 }:
 
 {
@@ -28,7 +27,6 @@ rustPlatform.buildRustPackage {
     [ openssl ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       curl
-      darwin.apple_sdk.frameworks.Security
     ];
 
   nativeCheckInputs = [ nodejs_latest ];
diff --git a/pkgs/by-name/ad/adguardian/package.nix b/pkgs/by-name/ad/adguardian/package.nix
index 10d98113e0c3..f4966916c8ef 100644
--- a/pkgs/by-name/ad/adguardian/package.nix
+++ b/pkgs/by-name/ad/adguardian/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,10 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-yPDysaslL/7N60eZ/hqZl5ZXIsof/pvlgHYfW1mIWtI=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-  ];
-
   meta = with lib; {
     description = "Terminal-based, real-time traffic monitoring and statistics for your AdGuard Home instance";
     mainProgram = "adguardian";
diff --git a/pkgs/by-name/ae/aemu/package.nix b/pkgs/by-name/ae/aemu/package.nix
index 03722e15320c..969ec27581df 100644
--- a/pkgs/by-name/ae/aemu/package.nix
+++ b/pkgs/by-name/ae/aemu/package.nix
@@ -3,7 +3,6 @@
   stdenv,
   fetchFromGitiles,
   cmake,
-  darwin,
 }:
 
 stdenv.mkDerivation {
@@ -23,9 +22,6 @@ stdenv.mkDerivation {
   ];
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Cocoa
-  ];
 
   cmakeFlags = [
     "-DAEMU_COMMON_GEN_PKGCONFIG=ON"
diff --git a/pkgs/by-name/ai/aiken/package.nix b/pkgs/by-name/ai/aiken/package.nix
index 305167f6ed5c..f39c4e8a6175 100644
--- a/pkgs/by-name/ai/aiken/package.nix
+++ b/pkgs/by-name/ai/aiken/package.nix
@@ -4,8 +4,6 @@
   pkg-config,
   rustPlatform,
   fetchFromGitHub,
-  darwin,
-  stdenv,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -22,16 +20,7 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-m6CFu0HA4e/9hWgYcRPjfa0h5vk0zwt5PqgvsuJuPNk=";
 
-  buildInputs =
-    [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        Security
-        CoreServices
-        SystemConfiguration
-      ]
-    );
+  buildInputs = [ openssl ];
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/al/alertmanager-ntfy/package.nix b/pkgs/by-name/al/alertmanager-ntfy/package.nix
new file mode 100644
index 000000000000..bbb08321b336
--- /dev/null
+++ b/pkgs/by-name/al/alertmanager-ntfy/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nixosTests,
+  nix-update-script,
+}:
+
+buildGoModule {
+  pname = "alertmanager-ntfy";
+  version = "0-unstable-2025-02-24";
+
+  src = fetchFromGitHub {
+    owner = "alexbakker";
+    repo = "alertmanager-ntfy";
+    rev = "4573b96077faf39c3d04df913e93d9ded1f1a16c";
+    hash = "sha256-JmXeDZBcbRDEaDVt7HuR9L9WZzrtqDrUMpHM7cHSQO0=";
+  };
+
+  vendorHash = "sha256-e1JAoDNm2+xB/bZcEGr5l4+va8GIg1R8pdj3d+/Y+UY=";
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    $out/bin/alertmanager-ntfy --help > /dev/null
+
+    runHook postInstallCheck
+  '';
+
+  passthru = {
+    tests = { inherit (nixosTests.prometheus) alertmanager-ntfy; };
+    updateScript = nix-update-script { extraArgs = [ "--version=branch=master" ]; };
+  };
+
+  meta = {
+    description = "Forwards Prometheus Alertmanager notifications to ntfy.sh";
+    homepage = "https://github.com/alexbakker/alertmanager-ntfy";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ defelo ];
+    mainProgram = "alertmanager-ntfy";
+  };
+}
diff --git a/pkgs/by-name/am/amber-secret/package.nix b/pkgs/by-name/am/amber-secret/package.nix
index c62940c467d1..a05d3fbab349 100644
--- a/pkgs/by-name/am/amber-secret/package.nix
+++ b/pkgs/by-name/am/amber-secret/package.nix
@@ -1,7 +1,5 @@
 {
   lib,
-  stdenv,
-  darwin,
   fetchFromGitHub,
   rustPlatform,
 }:
@@ -21,8 +19,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-Gwj0rnbKWifja5NJwskcrFpPoK15HjSQHXolGbgV784=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.Security ];
-
   meta = {
     description = "Manage secret values in-repo via public key cryptography";
     homepage = "https://github.com/fpco/amber";
diff --git a/pkgs/by-name/am/amp/package.nix b/pkgs/by-name/am/amp/package.nix
index 36f4a1ca6462..1c32dd578eba 100644
--- a/pkgs/by-name/am/amp/package.nix
+++ b/pkgs/by-name/am/amp/package.nix
@@ -9,7 +9,6 @@
   xorg,
   cmake,
   libgit2,
-  darwin,
   curl,
   writableTmpDirAsHomeHook,
 }:
@@ -41,14 +40,9 @@ rustPlatform.buildRustPackage rec {
       xorg.libxcb
       libgit2
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        curl
-        Security
-        AppKit
-      ]
-    );
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      curl
+    ];
 
   nativeCheckInputs = [
     writableTmpDirAsHomeHook
diff --git a/pkgs/by-name/ap/apparmor-bin-utils/package.nix b/pkgs/by-name/ap/apparmor-bin-utils/package.nix
new file mode 100644
index 000000000000..5c4c555abcf4
--- /dev/null
+++ b/pkgs/by-name/ap/apparmor-bin-utils/package.nix
@@ -0,0 +1,53 @@
+{
+  lib,
+  stdenv,
+  pkg-config,
+  which,
+  buildPackages,
+
+  # apparmor deps
+  libapparmor,
+
+  # testing
+  perl,
+}:
+stdenv.mkDerivation {
+  pname = "apparmor-bin-utils";
+  inherit (libapparmor)
+    version
+    src
+    ;
+
+  sourceRoot = "${libapparmor.src.name}/binutils";
+
+  nativeBuildInputs = [
+    pkg-config
+    libapparmor
+    which
+  ];
+
+  buildInputs = [
+    libapparmor
+  ];
+
+  makeFlags = [
+    "LANGS="
+    "USE_SYSTEM=1"
+    "POD2MAN=${lib.getExe' buildPackages.perl "pod2man"}"
+    "POD2HTML=${lib.getExe' buildPackages.perl "pod2html"}"
+    "MANDIR=share/man"
+  ];
+
+  doCheck = true;
+  checkInputs = [ perl ];
+
+  installFlags = [
+    "DESTDIR=$(out)"
+    "BINDIR=$(out)/bin"
+    "SBINDIR=$(out)/bin"
+  ];
+
+  meta = libapparmor.meta // {
+    description = "Mandatory access control system - binary user-land utilities";
+  };
+}
diff --git a/pkgs/by-name/ap/apparmor-pam/package.nix b/pkgs/by-name/ap/apparmor-pam/package.nix
new file mode 100644
index 000000000000..0ff8d62aa310
--- /dev/null
+++ b/pkgs/by-name/ap/apparmor-pam/package.nix
@@ -0,0 +1,40 @@
+{
+  stdenv,
+  pkg-config,
+  which,
+  pam,
+
+  # apparmor deps
+  libapparmor,
+}:
+stdenv.mkDerivation {
+  pname = "apparmor-pam";
+  inherit (libapparmor)
+    version
+    src
+    ;
+
+  postPatch = ''
+    substituteInPlace Makefile \
+      --replace-fail "pkg-config" "$PKG_CONFIG"
+  '';
+
+  nativeBuildInputs = [
+    pkg-config
+    which
+  ];
+
+  buildInputs = [
+    libapparmor
+    pam
+  ];
+
+  sourceRoot = "${libapparmor.src.name}/changehat/pam_apparmor";
+
+  makeFlags = [ "USE_SYSTEM=1" ];
+  installFlags = [ "DESTDIR=$(out)" ];
+
+  meta = libapparmor.meta // {
+    description = "Mandatory access control system - PAM service";
+  };
+}
diff --git a/pkgs/os-specific/linux/apparmor/fix-rc.apparmor.functions.sh b/pkgs/by-name/ap/apparmor-parser/fix-rc.apparmor.functions.sh
similarity index 100%
rename from pkgs/os-specific/linux/apparmor/fix-rc.apparmor.functions.sh
rename to pkgs/by-name/ap/apparmor-parser/fix-rc.apparmor.functions.sh
diff --git a/pkgs/by-name/ap/apparmor-parser/package.nix b/pkgs/by-name/ap/apparmor-parser/package.nix
new file mode 100644
index 000000000000..f3b884aa9b10
--- /dev/null
+++ b/pkgs/by-name/ap/apparmor-parser/package.nix
@@ -0,0 +1,75 @@
+{
+  lib,
+  stdenv,
+  which,
+  flex,
+  bison,
+  linuxHeaders ? stdenv.cc.libc.linuxHeaders,
+  buildPackages,
+
+  # apparmor deps
+  libapparmor,
+
+  # testing
+  perl,
+  python3,
+  bashInteractive,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "apparmor-parser";
+  inherit (libapparmor) version src;
+
+  postPatch = ''
+    patchShebangs .
+    cd parser
+
+    substituteInPlace Makefile \
+      --replace-fail "/usr/include/linux/capability.h" "${linuxHeaders}/include/linux/capability.h"
+    substituteInPlace rc.apparmor.functions \
+      --replace-fail "/sbin/apparmor_parser" "$out/bin/apparmor_parser" # FIXME
+    substituteInPlace rc.apparmor.functions \
+      --replace-fail "/usr/sbin/aa-status" '$(which aa-status)'
+    sed -i rc.apparmor.functions -e '2i . ${./fix-rc.apparmor.functions.sh}'
+  '';
+
+  nativeBuildInputs = [
+    bison
+    flex
+    which
+  ];
+
+  buildInputs = [ libapparmor ];
+
+  makeFlags = [
+    "LANGS="
+    "USE_SYSTEM=1"
+    "INCLUDEDIR=${libapparmor}/include"
+    "AR=${stdenv.cc.bintools.targetPrefix}ar"
+    "POD2MAN=${lib.getExe' buildPackages.perl "pod2man"}"
+    "POD2HTML=${lib.getExe' buildPackages.perl "pod2html"}"
+    "MANDIR=share/man"
+  ] ++ lib.optional finalAttrs.doCheck "PROVE=${lib.getExe' perl "prove"}";
+
+  installFlags = [
+    "DESTDIR=$(out)"
+    "DISTRO=unknown"
+  ];
+
+  preCheck = "pushd ./tst";
+
+  checkTarget = "tests";
+
+  postCheck = "popd";
+
+  doCheck = stdenv.hostPlatform == stdenv.buildPlatform && !stdenv.hostPlatform.isMusl;
+  checkInputs = [
+    bashInteractive
+    perl
+    python3
+  ];
+
+  meta = libapparmor.meta // {
+    description = "Mandatory access control system - core library";
+    mainProgram = "apparmor_parser";
+  };
+})
diff --git a/pkgs/by-name/ap/apparmor-profiles/package.nix b/pkgs/by-name/ap/apparmor-profiles/package.nix
new file mode 100644
index 000000000000..384249b8ac93
--- /dev/null
+++ b/pkgs/by-name/ap/apparmor-profiles/package.nix
@@ -0,0 +1,42 @@
+{
+  stdenv,
+  which,
+  callPackage,
+
+  # apparmor deps
+  libapparmor,
+  apparmor-parser,
+  apparmor-utils,
+}:
+stdenv.mkDerivation {
+  pname = "apparmor-profiles";
+  inherit (libapparmor) version src;
+
+  sourceRoot = "${libapparmor.src.name}/profiles";
+
+  nativeBuildInputs = [ which ];
+
+  installFlags = [
+    "DESTDIR=$(out)"
+    "EXTRAS_DEST=$(out)/share/apparmor/extra-profiles"
+  ];
+
+  checkTarget = "check";
+
+  checkInputs = [
+    apparmor-parser
+    apparmor-utils
+  ];
+
+  preCheck = ''
+    export USE_SYSTEM=1
+    export LOGPROF="aa-logprof --configdir ${callPackage ./test_config.nix { }} --no-check-mountpoint"
+  '';
+
+  doCheck = true;
+
+  meta = libapparmor.meta // {
+    description = "Mandatory access control system - profiles";
+    mainProgram = "apparmor_parser";
+  };
+}
diff --git a/pkgs/by-name/ap/apparmor-profiles/test_config.nix b/pkgs/by-name/ap/apparmor-profiles/test_config.nix
new file mode 100644
index 000000000000..3aa3d2ee2b32
--- /dev/null
+++ b/pkgs/by-name/ap/apparmor-profiles/test_config.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  runCommand,
+  util-linux,
+  stdenv,
+  runtimeShell,
+  bashInteractive,
+
+  # apparmor deps
+  libapparmor,
+  apparmor-parser,
+}:
+(runCommand "logprof_conf"
+  {
+    header = ''
+      [settings]
+        # /etc/apparmor.d/ is read-only on NixOS
+        profiledir = /var/cache/apparmor/logprof
+        inactive_profiledir = /etc/apparmor.d/disable
+        # Use: journalctl -b --since today --grep audit: | aa-logprof
+        logfiles = /dev/stdin
+
+        parser = ${lib.getExe apparmor-parser}
+        ldd = ${lib.getExe' stdenv.cc.libc "ldd"}
+        logger = ${util-linux}/bin/logger
+
+        # customize how file ownership permissions are presented
+        # 0 - off
+        # 1 - default of what ever mode the log reported
+        # 2 - force the new permissions to be user
+        # 3 - force all perms on the rule to be user
+        default_owner_prompt = 1
+
+      [qualifiers]
+        ${runtimeShell} = icnu
+        ${bashInteractive}/bin/sh = icnu
+        ${bashInteractive}/bin/bash = icnu
+    '';
+    passAsFile = [ "header" ];
+  }
+  ''
+    mkdir $out
+    cp $headerPath $out/logprof.conf
+    ln -s ${libapparmor.src}/utils/severity.db $out/severity.db
+    sed '1,/\[qualifiers\]/d' ${libapparmor.src}/utils/logprof.conf >> $out/logprof.conf
+  ''
+)
diff --git a/pkgs/by-name/ap/apparmor-teardown/package.nix b/pkgs/by-name/ap/apparmor-teardown/package.nix
new file mode 100644
index 000000000000..f5c299b24d76
--- /dev/null
+++ b/pkgs/by-name/ap/apparmor-teardown/package.nix
@@ -0,0 +1,33 @@
+{
+  writeShellApplication,
+  coreutils,
+  gnused,
+  gnugrep,
+  which,
+
+  # apparmor deps
+  apparmor-parser,
+  apparmor-bin-utils,
+  libapparmor,
+}:
+writeShellApplication {
+  name = "apparmor-teardown";
+  runtimeInputs = [
+    apparmor-parser
+    apparmor-bin-utils
+    coreutils
+    gnused
+    gnugrep
+    which
+  ];
+
+  text = ''
+    set +e # the imported script tries to `read` an empty line
+    # shellcheck source=/dev/null
+    . ${apparmor-parser}/lib/apparmor/rc.apparmor.functions
+    remove_profiles
+    exit 0
+  '';
+
+  inherit (libapparmor) meta;
+}
diff --git a/pkgs/by-name/ap/apparmor-utils/package.nix b/pkgs/by-name/ap/apparmor-utils/package.nix
new file mode 100644
index 000000000000..06e773dcc5f9
--- /dev/null
+++ b/pkgs/by-name/ap/apparmor-utils/package.nix
@@ -0,0 +1,86 @@
+{
+  lib,
+  makeWrapper,
+  gawk,
+  perl,
+  bash,
+  stdenv,
+  which,
+  linuxHeaders ? stdenv.cc.libc.linuxHeaders,
+  python3Packages,
+  bashNonInteractive,
+  buildPackages,
+
+  # apparmor deps
+  libapparmor,
+  apparmor-parser,
+  apparmor-teardown,
+}:
+python3Packages.buildPythonApplication {
+  pname = "apparmor-utils";
+  inherit (libapparmor) version src;
+
+  postPatch =
+    ''
+      patchShebangs .
+      cd utils
+
+      substituteInPlace aa-remove-unknown \
+        --replace-fail "/lib/apparmor/rc.apparmor.functions" "${apparmor-parser}/lib/apparmor/rc.apparmor.functions"
+      substituteInPlace Makefile \
+        --replace-fail "/usr/include/linux/capability.h" "${linuxHeaders}/include/linux/capability.h"
+      sed -i -E 's/^(DESTDIR|BINDIR|PYPREFIX)=.*//g' Makefile
+      sed -i aa-unconfined -e "/my_env\['PATH'\]/d"
+    ''
+    + (lib.optionalString stdenv.hostPlatform.isMusl ''
+      sed -i Makefile -e "/\<vim\>/d"
+    '');
+
+  format = "other";
+  strictDeps = true;
+
+  doCheck = true;
+
+  nativeBuildInputs = [
+    makeWrapper
+    which
+    bashNonInteractive
+    python3Packages.setuptools
+  ];
+
+  buildInputs = [
+    bash
+    perl
+  ];
+
+  pythonPath = [
+    python3Packages.notify2
+    python3Packages.psutil
+    libapparmor
+  ];
+
+  makeFlags = [
+    "LANGS="
+    "POD2MAN=${lib.getExe' buildPackages.perl "pod2man"}"
+    "POD2HTML=${lib.getExe' buildPackages.perl "pod2html"}"
+    "MANDIR=share/man"
+  ];
+
+  installFlags = [
+    "DESTDIR=$(out)"
+    "BINDIR=$(out)/bin"
+    "VIM_INSTALL_PATH=$(out)/share"
+    "PYPREFIX="
+  ];
+
+  postInstall = ''
+    wrapProgram $out/bin/aa-remove-unknown \
+     --prefix PATH : ${lib.makeBinPath [ gawk ]}
+
+    ln -s ${lib.getExe apparmor-teardown} $out/bin/aa-teardown
+  '';
+
+  meta = libapparmor.meta // {
+    description = "Mandatory access control system - script user-land utilities";
+  };
+}
diff --git a/pkgs/by-name/ap/apple-sdk/common/process-stubs.nix b/pkgs/by-name/ap/apple-sdk/common/process-stubs.nix
index d562816c17bd..0f87f9c326bd 100644
--- a/pkgs/by-name/ap/apple-sdk/common/process-stubs.nix
+++ b/pkgs/by-name/ap/apple-sdk/common/process-stubs.nix
@@ -35,7 +35,24 @@ self: super: {
           | .main_library.reexported_libraries[].names[] |= select([.] | inside($libs) | not)
         ' > usr/lib/$libSystem~
         # Convert libSystem back to tbd-v4 because not all tooling supports the JSON-based format yet.
-        llvm-readtapi -delete-input --filetype=tbd-v4 usr/lib/$libSystem~ -o usr/lib/$libSystem
+        llvm-readtapi --filetype=tbd-v4 usr/lib/$libSystem~ -o usr/lib/$libSystem
+        rm usr/lib/$libSystem~
       done
+
+      # Strip weak C++ symbols to work around `libc++` leakage in system
+      # frameworks for now. These are only present on `x86_64-darwin`, so
+      # it should hopefully be harmless.
+      #
+      # TODO FIXME: This is kind of horrible.
+      while read -r -d "" stub; do
+        printf 'Stripping weak C++ symbols from %s\n' "$stub"
+        llvm-readtapi --filetype=tbd-v5 "$stub" \
+        | jq '
+          (.main_library, .libraries[]?).exported_symbols[]?.data.weak[]? |=
+            select(startswith("__Z") | not)
+        ' > $stub~
+        llvm-readtapi --filetype=tbd-v4 $stub~ -o $stub
+        rm $stub~
+      done < <(find . -name '*.tbd' -print0)
     '';
 }
diff --git a/pkgs/by-name/ar/arrow-cpp/package.nix b/pkgs/by-name/ar/arrow-cpp/package.nix
index 8ecdbfd612f3..23b0d16d645c 100644
--- a/pkgs/by-name/ar/arrow-cpp/package.nix
+++ b/pkgs/by-name/ar/arrow-cpp/package.nix
@@ -36,7 +36,7 @@
   openssl,
   perl,
   pkg-config,
-  protobuf,
+  protobuf_29,
   python3,
   rapidjson,
   re2,
@@ -57,6 +57,9 @@
 }:
 
 let
+  # https://github.com/apache/arrow/issues/45807
+  protobuf = protobuf_29;
+
   arrow-testing = fetchFromGitHub {
     name = "arrow-testing";
     owner = "apache";
diff --git a/pkgs/by-name/ar/artem/package.nix b/pkgs/by-name/ar/artem/package.nix
index a04e31e6b3f5..9305dabc5f83 100644
--- a/pkgs/by-name/ar/artem/package.nix
+++ b/pkgs/by-name/ar/artem/package.nix
@@ -3,8 +3,6 @@
   rustPlatform,
   fetchFromGitHub,
   installShellFiles,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -25,10 +23,6 @@ rustPlatform.buildRustPackage rec {
     installShellFiles
   ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-  ];
-
   checkFlags = [
     # require internet access
     "--skip=arguments::input::url_input"
diff --git a/pkgs/by-name/as/asciinema-agg/package.nix b/pkgs/by-name/as/asciinema-agg/package.nix
index a79fa32aae9b..c5d94322405a 100644
--- a/pkgs/by-name/as/asciinema-agg/package.nix
+++ b/pkgs/by-name/as/asciinema-agg/package.nix
@@ -2,13 +2,8 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  darwin,
 }:
 
-let
-  inherit (darwin.apple_sdk.frameworks) Security;
-in
 rustPlatform.buildRustPackage rec {
   pname = "agg";
   version = "1.5.0";
@@ -25,10 +20,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-KQ4g4hWy8FZH4nLiB0874r8FCINXJboZ4C1dAAPA8Gc=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    Security
-  ];
-
   meta = with lib; {
     description = "Command-line tool for generating animated GIF files from asciicast v2 files produced by asciinema terminal recorder";
     homepage = "https://github.com/asciinema/agg";
diff --git a/pkgs/by-name/as/assimp/package.nix b/pkgs/by-name/as/assimp/package.nix
index 4aaa2ed60876..33a3a0b5de58 100644
--- a/pkgs/by-name/as/assimp/package.nix
+++ b/pkgs/by-name/as/assimp/package.nix
@@ -3,7 +3,6 @@
   stdenv,
   fetchFromGitHub,
   cmake,
-  boost,
   zlib,
 }:
 
@@ -25,7 +24,6 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [
-    boost
     zlib
   ];
 
diff --git a/pkgs/by-name/at/attic-client/package.nix b/pkgs/by-name/at/attic-client/package.nix
index 5e8c267dbf2d..99b38d0e0228 100644
--- a/pkgs/by-name/at/attic-client/package.nix
+++ b/pkgs/by-name/at/attic-client/package.nix
@@ -8,7 +8,6 @@
   pkg-config,
   stdenv,
   installShellFiles,
-  darwin,
   crates ? [ "attic-client" ],
 }:
 rustPlatform.buildRustPackage {
@@ -27,17 +26,10 @@ rustPlatform.buildRustPackage {
     installShellFiles
   ];
 
-  buildInputs =
-    [
-      nixVersions.nix_2_24
-      boost
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        SystemConfiguration
-      ]
-    );
+  buildInputs = [
+    nixVersions.nix_2_24
+    boost
+  ];
 
   cargoBuildFlags = lib.concatMapStrings (c: "-p ${c} ") crates;
   cargoHash = "sha256-AbpWnYfBMrR6oOfy2LkQvIPYsClCWE89bJav+iHTtLM=";
diff --git a/pkgs/by-name/au/authoscope/package.nix b/pkgs/by-name/au/authoscope/package.nix
index d46c6117c8ae..1c3350aabafb 100644
--- a/pkgs/by-name/au/authoscope/package.nix
+++ b/pkgs/by-name/au/authoscope/package.nix
@@ -1,7 +1,5 @@
 {
   lib,
-  stdenv,
-  darwin,
   fetchFromGitHub,
   installShellFiles,
   libcap,
@@ -31,15 +29,11 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      libcap
-      zlib
-      openssl
-    ]
-    ++ lib.optional stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = [
+    libcap
+    zlib
+    openssl
+  ];
 
   postInstall = ''
     installManPage docs/${pname}.1
diff --git a/pkgs/by-name/au/autotrace/package.nix b/pkgs/by-name/au/autotrace/package.nix
index 40be3cef2fa8..c6505c519f05 100644
--- a/pkgs/by-name/au/autotrace/package.nix
+++ b/pkgs/by-name/au/autotrace/package.nix
@@ -11,7 +11,6 @@
   imagemagick,
   libpng,
   pstoedit,
-  darwin,
 }:
 
 stdenv.mkDerivation rec {
@@ -41,16 +40,12 @@ stdenv.mkDerivation rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      glib
-      imagemagick
-      libpng
-      pstoedit
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Foundation
-    ];
+  buildInputs = [
+    glib
+    imagemagick
+    libpng
+    pstoedit
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/autotrace/autotrace";
diff --git a/pkgs/by-name/aw/aws-lc/package.nix b/pkgs/by-name/aw/aws-lc/package.nix
index 85ffce52b6fc..0bc1c349bb28 100644
--- a/pkgs/by-name/aw/aws-lc/package.nix
+++ b/pkgs/by-name/aw/aws-lc/package.nix
@@ -1,7 +1,6 @@
 {
   lib,
   stdenv,
-  overrideSDK,
   cmakeMinimal,
   fetchFromGitHub,
   ninja,
@@ -9,10 +8,7 @@
   aws-lc,
   useSharedLibraries ? !stdenv.hostPlatform.isStatic,
 }:
-let
-  awsStdenv = if stdenv.hostPlatform.isDarwin then overrideSDK stdenv "11.0" else stdenv;
-in
-awsStdenv.mkDerivation (finalAttrs: {
+stdenv.mkDerivation (finalAttrs: {
   pname = "aws-lc";
   version = "1.50.0";
 
diff --git a/pkgs/by-name/az/azure-cli/extensions-manual.nix b/pkgs/by-name/az/azure-cli/extensions-manual.nix
index 6e3d8c1a60de..5ca45de70311 100644
--- a/pkgs/by-name/az/azure-cli/extensions-manual.nix
+++ b/pkgs/by-name/az/azure-cli/extensions-manual.nix
@@ -16,9 +16,9 @@
 {
   application-insights = mkAzExtension rec {
     pname = "application-insights";
-    version = "1.2.3";
+    version = "2.0.0b1";
     url = "https://azcliprod.blob.core.windows.net/cli-extensions/application_insights-${version}-py2.py3-none-any.whl";
-    hash = "sha256-yUHCMtBDZmNuE1TP4AcIUhAT+IpbHnR0DYBH7EbZBZk=";
+    hash = "sha256-4akS+zbaKxFrs0x0uKP/xX28WyK5KLduOkgZaBYeANM=";
     description = "Support for managing Application Insights components and querying metrics, events, and logs from such components";
     propagatedBuildInputs = with python3Packages; [ isodate ];
     meta.maintainers = with lib.maintainers; [ andreasvoss ];
diff --git a/pkgs/by-name/az/azurite/package.nix b/pkgs/by-name/az/azurite/package.nix
index 979ddad79cca..24fb96652f95 100644
--- a/pkgs/by-name/az/azurite/package.nix
+++ b/pkgs/by-name/az/azurite/package.nix
@@ -3,7 +3,6 @@
   buildNpmPackage,
   fetchFromGitHub,
   stdenv,
-  darwin,
   libsecret,
   pkg-config,
   python3,
@@ -26,17 +25,9 @@ buildNpmPackage rec {
     pkg-config
     python3
   ];
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [
-      libsecret
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin;
-      [
-        Security
-        apple_sdk.frameworks.AppKit
-      ]
-    );
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    libsecret
+  ];
 
   meta = {
     description = "An open source Azure Storage API compatible server";
diff --git a/pkgs/by-name/ba/bandwhich/package.nix b/pkgs/by-name/ba/bandwhich/package.nix
index 65a9950e3061..234b5e1f176d 100644
--- a/pkgs/by-name/ba/bandwhich/package.nix
+++ b/pkgs/by-name/ba/bandwhich/package.nix
@@ -5,7 +5,6 @@
   rustPlatform,
   installShellFiles,
 
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -24,8 +23,6 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.frameworks.Security;
-
   # 10 passed; 47 failed https://hydra.nixos.org/build/148943783/nixlog/1
   doCheck = !stdenv.hostPlatform.isDarwin;
 
diff --git a/pkgs/by-name/bi/bigloo/package.nix b/pkgs/by-name/bi/bigloo/package.nix
index 054acfa7c8f1..c3bd3889c39d 100644
--- a/pkgs/by-name/bi/bigloo/package.nix
+++ b/pkgs/by-name/bi/bigloo/package.nix
@@ -6,7 +6,6 @@
   automake,
   libtool,
   gmp,
-  darwin,
   libunistring,
 }:
 
@@ -26,7 +25,6 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.ApplicationServices
     libunistring
   ];
 
diff --git a/pkgs/by-name/bi/bind/package.nix b/pkgs/by-name/bi/bind/package.nix
index c7220e10e5d7..699bb7a903b0 100644
--- a/pkgs/by-name/bi/bind/package.nix
+++ b/pkgs/by-name/bi/bind/package.nix
@@ -3,7 +3,6 @@
   lib,
   fetchurl,
   removeReferencesTo,
-  darwin,
   perl,
   pkg-config,
   libcap,
@@ -66,8 +65,7 @@ stdenv.mkDerivation (finalAttrs: {
     ]
     ++ lib.optional stdenv.hostPlatform.isLinux libcap
     ++ lib.optional enableGSSAPI libkrb5
-    ++ lib.optional enablePython (python3.withPackages (ps: with ps; [ ply ]))
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.CoreServices ];
+    ++ lib.optional enablePython (python3.withPackages (ps: with ps; [ ply ]));
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
 
diff --git a/pkgs/by-name/bi/binsider/package.nix b/pkgs/by-name/bi/binsider/package.nix
index e1fdd004f087..2ab6721f8c36 100644
--- a/pkgs/by-name/bi/binsider/package.nix
+++ b/pkgs/by-name/bi/binsider/package.nix
@@ -1,6 +1,5 @@
 {
   lib,
-  darwin,
   rustPlatform,
   fetchFromGitHub,
   stdenv,
@@ -21,14 +20,6 @@ rustPlatform.buildRustPackage rec {
 
   buildNoDefaultFeatures = !stdenv.hostPlatform.isLinux;
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin (
-    with darwin.apple_sdk.frameworks;
-    [
-      AppKit
-      CoreServices
-    ]
-  );
-
   checkType = "debug";
   checkFlags = [
     "--skip=test_extract_strings"
diff --git a/pkgs/by-name/bl/blender/package.nix b/pkgs/by-name/bl/blender/package.nix
index 62531b7ac2b9..38426f2c68e1 100644
--- a/pkgs/by-name/bl/blender/package.nix
+++ b/pkgs/by-name/bl/blender/package.nix
@@ -1,9 +1,4 @@
 {
-  Cocoa,
-  CoreGraphics,
-  ForceFeedback,
-  OpenAL,
-  OpenGL,
   SDL,
   addDriverRunpath,
   alembic,
@@ -283,11 +278,6 @@ stdenv'.mkDerivation (finalAttrs: {
         ]
       else
         [
-          Cocoa
-          CoreGraphics
-          ForceFeedback
-          OpenAL
-          OpenGL
           SDL
           brotli
           llvmPackages.openmp
diff --git a/pkgs/by-name/bo/boa/package.nix b/pkgs/by-name/bo/boa/package.nix
index bac18366f963..d1dc13fc8991 100644
--- a/pkgs/by-name/bo/boa/package.nix
+++ b/pkgs/by-name/bo/boa/package.nix
@@ -6,8 +6,6 @@
   bzip2,
   openssl,
   zstd,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -32,16 +30,11 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    [
-      bzip2
-      openssl
-      zstd
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.CoreFoundation
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = [
+    bzip2
+    openssl
+    zstd
+  ];
 
   env = {
     ZSTD_SYS_USE_PKG_CONFIG = true;
diff --git a/pkgs/by-name/bo/bochs/package.nix b/pkgs/by-name/bo/bochs/package.nix
index d609ef99196b..a28522dce7dd 100644
--- a/pkgs/by-name/bo/bochs/package.nix
+++ b/pkgs/by-name/bo/bochs/package.nix
@@ -2,7 +2,6 @@
   lib,
   SDL2,
   curl,
-  darwin,
   docbook_xml_dtd_45,
   docbook_xsl,
   fetchurl,
@@ -62,9 +61,6 @@ stdenv.mkDerivation (finalAttrs: {
       libGLU
       libX11
       libXpm
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.libobjc
     ];
 
   configureFlags =
diff --git a/pkgs/by-name/bo/boringtun/package.nix b/pkgs/by-name/bo/boringtun/package.nix
index c8aa82dedf76..7c76299df70c 100644
--- a/pkgs/by-name/bo/boringtun/package.nix
+++ b/pkgs/by-name/bo/boringtun/package.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -20,8 +18,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
   useFetchCargoVendor = true;
   cargoHash = "sha256-j1I16QC46MMxcK7rbZJgI8KiKJvF29hkuGKiYLc6uW0=";
 
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.frameworks.Security;
-
   # Testing this project requires sudo, Docker and network access, etc.
   doCheck = false;
 
diff --git a/pkgs/by-name/br/browsers/package.nix b/pkgs/by-name/br/browsers/package.nix
index b22741da77b0..d1e96531a95d 100644
--- a/pkgs/by-name/br/browsers/package.nix
+++ b/pkgs/by-name/br/browsers/package.nix
@@ -10,8 +10,6 @@
   glib,
   gtk3,
   pango,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -33,21 +31,14 @@ rustPlatform.buildRustPackage rec {
     wrapGAppsHook3
   ];
 
-  buildInputs =
-    [
-      atk
-      cairo
-      gdk-pixbuf
-      glib
-      gtk3
-      pango
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.AppKit
-      darwin.apple_sdk.frameworks.CoreGraphics
-      darwin.apple_sdk.frameworks.CoreText
-      darwin.apple_sdk.frameworks.Foundation
-    ];
+  buildInputs = [
+    atk
+    cairo
+    gdk-pixbuf
+    glib
+    gtk3
+    pango
+  ];
 
   postInstall = ''
     install -m 444 \
diff --git a/pkgs/by-name/bu/bunbun/package.nix b/pkgs/by-name/bu/bunbun/package.nix
index 1928ced398f6..6d73ad238382 100644
--- a/pkgs/by-name/bu/bunbun/package.nix
+++ b/pkgs/by-name/bu/bunbun/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  darwin,
   versionCheckHook,
   nix-update-script,
 }:
@@ -22,15 +20,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-2pgQB2myEnLvrU3ApNL/bwaVcGku+X/TjR6YBqXD7Xg=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin (
-    with darwin.apple_sdk.frameworks;
-    [
-      CoreFoundation
-      IOKit
-      SystemConfiguration
-    ]
-  );
-
   nativeInstallCheckInputs = [
     versionCheckHook
   ];
diff --git a/pkgs/by-name/bw/bws/package.nix b/pkgs/by-name/bw/bws/package.nix
index e7003dc22984..8bc8bdd91761 100644
--- a/pkgs/by-name/bw/bws/package.nix
+++ b/pkgs/by-name/bw/bws/package.nix
@@ -7,7 +7,6 @@
   oniguruma,
   openssl,
   stdenv,
-  darwin,
   python3,
   perl,
 }:
@@ -41,9 +40,6 @@ rustPlatform.buildRustPackage rec {
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.SystemConfiguration
     ];
 
   env = {
diff --git a/pkgs/by-name/ca/cairo/package.nix b/pkgs/by-name/ca/cairo/package.nix
index d8a4365afe6f..1d96951ac59c 100644
--- a/pkgs/by-name/ca/cairo/package.nix
+++ b/pkgs/by-name/ca/cairo/package.nix
@@ -21,7 +21,6 @@
   glib,
   xcbSupport ? x11Support,
   libxcb,
-  darwin,
   testers,
 }:
 
@@ -60,19 +59,9 @@ stdenv.mkDerivation (
       python3
     ];
 
-    buildInputs =
-      [
-        docbook_xsl
-      ]
-      ++ optionals stdenv.hostPlatform.isDarwin (
-        with darwin.apple_sdk.frameworks;
-        [
-          CoreGraphics
-          CoreText
-          ApplicationServices
-          Carbon
-        ]
-      );
+    buildInputs = [
+      docbook_xsl
+    ];
 
     patches = [
       # Pull upstream fix to fix "out of memory" errors:
diff --git a/pkgs/by-name/ca/cargo-about/package.nix b/pkgs/by-name/ca/cargo-about/package.nix
index 6495652b190b..ca43b5ba79cb 100644
--- a/pkgs/by-name/ca/cargo-about/package.nix
+++ b/pkgs/by-name/ca/cargo-about/package.nix
@@ -4,8 +4,6 @@
   fetchFromGitHub,
   pkg-config,
   zstd,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -24,12 +22,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    [ zstd ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [ zstd ];
 
   env = {
     ZSTD_SYS_USE_PKG_CONFIG = true;
diff --git a/pkgs/by-name/ca/cargo-binstall/package.nix b/pkgs/by-name/ca/cargo-binstall/package.nix
index f14a0081cd40..809edb20ac34 100644
--- a/pkgs/by-name/ca/cargo-binstall/package.nix
+++ b/pkgs/by-name/ca/cargo-binstall/package.nix
@@ -6,8 +6,6 @@
   bzip2,
   xz,
   zstd,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -28,15 +26,11 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      bzip2
-      xz
-      zstd
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    bzip2
+    xz
+    zstd
+  ];
 
   buildNoDefaultFeatures = true;
   buildFeatures = [
diff --git a/pkgs/by-name/ca/cargo-bisect-rustc/package.nix b/pkgs/by-name/ca/cargo-bisect-rustc/package.nix
index 3a4c056117ba..fd690616a5bf 100644
--- a/pkgs/by-name/ca/cargo-bisect-rustc/package.nix
+++ b/pkgs/by-name/ca/cargo-bisect-rustc/package.nix
@@ -2,7 +2,6 @@
   stdenv,
   lib,
   fetchFromGitHub,
-  darwin,
   rustPlatform,
   pkg-config,
   openssl,
@@ -43,12 +42,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [ openssl ];
 
   useFetchCargoVendor = true;
   cargoHash = "sha256-SigRm2ZC7jH1iCEGRpka1G/e9kBEieFVU0YDBl2LfTM=";
diff --git a/pkgs/by-name/ca/cargo-bump/package.nix b/pkgs/by-name/ca/cargo-bump/package.nix
index af31e5f60aab..d1985e7a460f 100644
--- a/pkgs/by-name/ca/cargo-bump/package.nix
+++ b/pkgs/by-name/ca/cargo-bump/package.nix
@@ -3,8 +3,6 @@
   rustPlatform,
   fetchFromGitHub,
   pkg-config,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -25,10 +23,6 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-  ];
-
   meta = with lib; {
     description = "Increments the version number of the current project";
     mainProgram = "cargo-bump";
diff --git a/pkgs/by-name/ca/cargo-bundle/package.nix b/pkgs/by-name/ca/cargo-bundle/package.nix
index 13c8f86603a9..3001f1ae4020 100644
--- a/pkgs/by-name/ca/cargo-bundle/package.nix
+++ b/pkgs/by-name/ca/cargo-bundle/package.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   pkg-config,
   stdenv,
-  darwin,
   libxkbcommon,
   wayland,
 }:
@@ -28,14 +27,10 @@ rustPlatform.buildRustPackage {
     pkg-config
   ];
 
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.AppKit
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [
-      libxkbcommon
-      wayland
-    ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    libxkbcommon
+    wayland
+  ];
 
   meta = with lib; {
     description = "Wrap rust executables in OS-specific app bundles";
diff --git a/pkgs/by-name/ca/cargo-component/package.nix b/pkgs/by-name/ca/cargo-component/package.nix
index 9d052d9df626..8deaf38fa346 100644
--- a/pkgs/by-name/ca/cargo-component/package.nix
+++ b/pkgs/by-name/ca/cargo-component/package.nix
@@ -4,8 +4,6 @@
   fetchFromGitHub,
   pkg-config,
   openssl,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -26,13 +24,9 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    openssl
+  ];
 
   # requires the wasm32-wasi target
   doCheck = false;
diff --git a/pkgs/by-name/ca/cargo-deny/package.nix b/pkgs/by-name/ca/cargo-deny/package.nix
index 61bfb416f9af..6e8cf25fc729 100644
--- a/pkgs/by-name/ca/cargo-deny/package.nix
+++ b/pkgs/by-name/ca/cargo-deny/package.nix
@@ -4,8 +4,6 @@
   fetchFromGitHub,
   pkg-config,
   zstd,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -26,14 +24,9 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      zstd
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    zstd
+  ];
 
   env = {
     ZSTD_SYS_USE_PKG_CONFIG = true;
diff --git a/pkgs/by-name/ca/cargo-dephell/package.nix b/pkgs/by-name/ca/cargo-dephell/package.nix
index d0fbd26e846e..2d20d48146b7 100644
--- a/pkgs/by-name/ca/cargo-dephell/package.nix
+++ b/pkgs/by-name/ca/cargo-dephell/package.nix
@@ -6,7 +6,6 @@
   stdenv,
   curl,
   openssl,
-  darwin,
   libgit2,
 }:
 
@@ -39,7 +38,6 @@ rustPlatform.buildRustPackage rec {
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       curl
-      darwin.apple_sdk.frameworks.Security
       libgit2
     ];
 
diff --git a/pkgs/by-name/ca/cargo-dist/package.nix b/pkgs/by-name/ca/cargo-dist/package.nix
index d97e19fb6a5e..072522b8d476 100644
--- a/pkgs/by-name/ca/cargo-dist/package.nix
+++ b/pkgs/by-name/ca/cargo-dist/package.nix
@@ -7,8 +7,6 @@
   bzip2,
   xz,
   zstd,
-  stdenv,
-  darwin,
   git,
   rustup,
 }:
@@ -31,15 +29,11 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      bzip2
-      xz
-      zstd
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    bzip2
+    xz
+    zstd
+  ];
 
   nativeCheckInputs = [
     git
diff --git a/pkgs/by-name/ca/cargo-duplicates/package.nix b/pkgs/by-name/ca/cargo-duplicates/package.nix
index 8ab9656c8c22..e2fb19230887 100644
--- a/pkgs/by-name/ca/cargo-duplicates/package.nix
+++ b/pkgs/by-name/ca/cargo-duplicates/package.nix
@@ -7,8 +7,6 @@
   libgit2,
   openssl,
   zlib,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -30,16 +28,12 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      curl
-      libgit2
-      openssl
-      zlib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = [
+    curl
+    libgit2
+    openssl
+    zlib
+  ];
 
   meta = with lib; {
     description = "Cargo subcommand for displaying when different versions of a same dependency are pulled in";
diff --git a/pkgs/by-name/ca/cargo-embassy/package.nix b/pkgs/by-name/ca/cargo-embassy/package.nix
index 23999a0c6c36..2ca2d86be880 100644
--- a/pkgs/by-name/ca/cargo-embassy/package.nix
+++ b/pkgs/by-name/ca/cargo-embassy/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   rustPlatform,
   fetchFromGitHub,
   pkg-config,
@@ -18,7 +19,7 @@ rustPlatform.buildRustPackage {
     hash = "sha256-C8eFQFHYIj2P+zPOKLVBNX97UDVbbcdjbqh5n53ktCU=";
   };
 
-  buildInputs = [
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
     udev
   ];
 
@@ -34,6 +35,7 @@ rustPlatform.buildRustPackage {
     homepage = "https://github.com/adinack/cargo-embassy";
     license = lib.licenses.gpl3Only;
     maintainers = [ lib.maintainers.samw ];
+    platforms = lib.platforms.unix;
     mainProgram = "cargo-embassy";
   };
 }
diff --git a/pkgs/by-name/ca/cargo-geiger/package.nix b/pkgs/by-name/ca/cargo-geiger/package.nix
index e0cff456712a..c32c8cd452b6 100644
--- a/pkgs/by-name/ca/cargo-geiger/package.nix
+++ b/pkgs/by-name/ca/cargo-geiger/package.nix
@@ -1,9 +1,13 @@
 {
+  stdenv,
   lib,
   fetchFromGitHub,
   rustPlatform,
   pkg-config,
   openssl,
+  # darwin dependencies
+  libiconv,
+  curl,
   # testing
   testers,
   cargo-geiger,
@@ -23,18 +27,22 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-aDgpEfX0QRkQD6c4ant6uSN18WLHVnZISRr7lyu9IzA=";
 
-  nativeBuildInputs = [
-    pkg-config
-  ];
-
-  buildInputs = [
-    openssl
-  ];
+  buildInputs =
+    [ openssl ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      libiconv
+      curl
+    ];
+  nativeBuildInputs =
+    [ pkg-config ]
+    # curl-sys wants to run curl-config on darwin
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [ curl.dev ];
 
   preCheck = ''
     export HOME=$(mktemp -d)
   '';
 
+  # skip tests with networking or other failures
   checkFlags = [
     # panics
     "--skip serialize_test2_quick_report"
diff --git a/pkgs/by-name/ca/cargo-generate/package.nix b/pkgs/by-name/ca/cargo-generate/package.nix
index 3c4d01d28f37..668174e7aede 100644
--- a/pkgs/by-name/ca/cargo-generate/package.nix
+++ b/pkgs/by-name/ca/cargo-generate/package.nix
@@ -7,7 +7,6 @@
   libgit2,
   openssl,
   stdenv,
-  darwin,
   gitMinimal,
 }:
 
@@ -36,14 +35,10 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    [
-      libgit2
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = [
+    libgit2
+    openssl
+  ];
 
   nativeCheckInputs = [ gitMinimal ];
 
diff --git a/pkgs/by-name/ca/cargo-guppy/package.nix b/pkgs/by-name/ca/cargo-guppy/package.nix
index e4d839f57aa4..f7ee8b1fc56e 100644
--- a/pkgs/by-name/ca/cargo-guppy/package.nix
+++ b/pkgs/by-name/ca/cargo-guppy/package.nix
@@ -4,8 +4,6 @@
   fetchFromGitHub,
   pkg-config,
   openssl,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage {
@@ -24,11 +22,7 @@ rustPlatform.buildRustPackage {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = [ openssl ];
 
   cargoBuildFlags = [
     "-p"
diff --git a/pkgs/by-name/ca/cargo-info/package.nix b/pkgs/by-name/ca/cargo-info/package.nix
index a9f2a69a3a1d..4225e0690651 100644
--- a/pkgs/by-name/ca/cargo-info/package.nix
+++ b/pkgs/by-name/ca/cargo-info/package.nix
@@ -4,8 +4,6 @@
   fetchFromGitLab,
   pkg-config,
   openssl,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -26,13 +24,9 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    openssl
+  ];
 
   meta = with lib; {
     description = "Cargo subcommand to show crates info from crates.io";
diff --git a/pkgs/by-name/ca/cargo-leptos/package.nix b/pkgs/by-name/ca/cargo-leptos/package.nix
index 51dde7bc7058..21527f9b2e59 100644
--- a/pkgs/by-name/ca/cargo-leptos/package.nix
+++ b/pkgs/by-name/ca/cargo-leptos/package.nix
@@ -1,19 +1,8 @@
 {
-  darwin,
   fetchFromGitHub,
   lib,
   rustPlatform,
-  stdenv,
 }:
-let
-  inherit (darwin.apple_sdk.frameworks)
-    CoreServices
-    SystemConfiguration
-    Security
-    ;
-  inherit (lib) optionals;
-  inherit (stdenv.hostPlatform) isDarwin;
-in
 rustPlatform.buildRustPackage rec {
   pname = "cargo-leptos";
   version = "0.2.28";
@@ -28,12 +17,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-Da9ei4yAOfhSQmQgrUDZCmMeJXTfGnYhI1+L0JT/ECs=";
 
-  buildInputs = optionals isDarwin [
-    SystemConfiguration
-    Security
-    CoreServices
-  ];
-
   # https://github.com/leptos-rs/cargo-leptos#dependencies
   buildFeatures = [ "no_downloads" ]; # cargo-leptos will try to install missing dependencies on its own otherwise
   doCheck = false; # Check phase tries to query crates.io
diff --git a/pkgs/by-name/ca/cargo-local-registry/package.nix b/pkgs/by-name/ca/cargo-local-registry/package.nix
index 33851806f7ea..f4b30c6b4250 100644
--- a/pkgs/by-name/ca/cargo-local-registry/package.nix
+++ b/pkgs/by-name/ca/cargo-local-registry/package.nix
@@ -7,8 +7,6 @@
   libgit2,
   openssl,
   zlib,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -30,19 +28,12 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      curl
-      libgit2
-      openssl
-      zlib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-    ]
-    ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
-      darwin.apple_sdk.frameworks.CoreFoundation
-    ];
+  buildInputs = [
+    curl
+    libgit2
+    openssl
+    zlib
+  ];
 
   # tests require internet access
   doCheck = false;
diff --git a/pkgs/by-name/ca/cargo-make/package.nix b/pkgs/by-name/ca/cargo-make/package.nix
index 5581bad62b2a..71ef2c04fe79 100644
--- a/pkgs/by-name/ca/cargo-make/package.nix
+++ b/pkgs/by-name/ca/cargo-make/package.nix
@@ -6,8 +6,6 @@
   installShellFiles,
   bzip2,
   openssl,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -29,14 +27,10 @@ rustPlatform.buildRustPackage rec {
     installShellFiles
   ];
 
-  buildInputs =
-    [
-      bzip2
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    bzip2
+    openssl
+  ];
 
   postInstall = ''
     installShellCompletion extra/shell/*.bash
diff --git a/pkgs/by-name/ca/cargo-mobile2/package.nix b/pkgs/by-name/ca/cargo-mobile2/package.nix
index 72813c771b27..c14cb9982ec1 100644
--- a/pkgs/by-name/ca/cargo-mobile2/package.nix
+++ b/pkgs/by-name/ca/cargo-mobile2/package.nix
@@ -1,17 +1,14 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitHub,
   pkg-config,
   openssl,
   git,
-  darwin,
   makeWrapper,
 }:
 
 let
-  inherit (darwin.apple_sdk.frameworks) CoreServices;
   pname = "cargo-mobile2";
   version = "0.20.0";
 in
@@ -37,7 +34,7 @@ rustPlatform.buildRustPackage {
     export CARGO_HOME=$out/share/
   '';
 
-  buildInputs = [ openssl ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ CoreServices ];
+  buildInputs = [ openssl ];
   nativeBuildInputs = [
     pkg-config
     git
diff --git a/pkgs/by-name/ca/cargo-public-api/package.nix b/pkgs/by-name/ca/cargo-public-api/package.nix
index c9d50be042e8..204189edcb52 100644
--- a/pkgs/by-name/ca/cargo-public-api/package.nix
+++ b/pkgs/by-name/ca/cargo-public-api/package.nix
@@ -5,8 +5,6 @@
   pkg-config,
   curl,
   openssl,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -26,7 +24,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [
     curl
     openssl
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.Security ];
+  ];
 
   # Tests fail
   doCheck = false;
diff --git a/pkgs/by-name/ca/cargo-raze/package.nix b/pkgs/by-name/ca/cargo-raze/package.nix
index b3e40543ed3f..380e4a737475 100644
--- a/pkgs/by-name/ca/cargo-raze/package.nix
+++ b/pkgs/by-name/ca/cargo-raze/package.nix
@@ -7,7 +7,6 @@
   curl,
   libgit2,
   openssl,
-  darwin,
 }:
 let
   version = "0.16.1";
@@ -37,7 +36,7 @@ rustPlatform.buildRustPackage {
     libgit2
     openssl
     curl
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.frameworks.Security;
+  ];
 
   preCheck = lib.optionalString stdenv.hostPlatform.isDarwin ''
     # Darwin issue: Os { code: 24, kind: Uncategorized, message: "Too many open files" }
diff --git a/pkgs/by-name/ca/cargo-rdme/package.nix b/pkgs/by-name/ca/cargo-rdme/package.nix
index c57bc18292b3..5594a8602be1 100644
--- a/pkgs/by-name/ca/cargo-rdme/package.nix
+++ b/pkgs/by-name/ca/cargo-rdme/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchCrate,
-  stdenv,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -15,10 +13,6 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-lVu9w8l3+SeqiMoQ8Bjoslf7tWz49jrrE4g/pDU1axI=";
   };
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    Security
-  ];
-
   useFetchCargoVendor = true;
   cargoHash = "sha256-W800jepxDv6OjbcxRKphAnDU2OuBGGGSLELe8gAfTr8=";
 
diff --git a/pkgs/by-name/ca/cargo-release/package.nix b/pkgs/by-name/ca/cargo-release/package.nix
index 8e91c3c5bb22..8d755e78ef27 100644
--- a/pkgs/by-name/ca/cargo-release/package.nix
+++ b/pkgs/by-name/ca/cargo-release/package.nix
@@ -7,7 +7,6 @@
   openssl,
   stdenv,
   curl,
-  darwin,
   git,
 }:
 
@@ -36,7 +35,6 @@ rustPlatform.buildRustPackage rec {
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       curl
-      darwin.apple_sdk.frameworks.SystemConfiguration
     ];
 
   nativeCheckInputs = [
diff --git a/pkgs/by-name/ca/cargo-semver-checks/package.nix b/pkgs/by-name/ca/cargo-semver-checks/package.nix
index d87083bb0853..58b0f9441552 100644
--- a/pkgs/by-name/ca/cargo-semver-checks/package.nix
+++ b/pkgs/by-name/ca/cargo-semver-checks/package.nix
@@ -4,8 +4,6 @@
   fetchFromGitHub,
   cmake,
   zlib,
-  stdenv,
-  darwin,
   testers,
   cargo-semver-checks,
   nix-update-script,
@@ -29,13 +27,9 @@ rustPlatform.buildRustPackage rec {
     cmake
   ];
 
-  buildInputs =
-    [
-      zlib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    zlib
+  ];
 
   checkFlags = [
     # requires internet access
diff --git a/pkgs/by-name/ca/cargo-shuttle/package.nix b/pkgs/by-name/ca/cargo-shuttle/package.nix
index 157a1f175e8c..2e34afa3bd49 100644
--- a/pkgs/by-name/ca/cargo-shuttle/package.nix
+++ b/pkgs/by-name/ca/cargo-shuttle/package.nix
@@ -5,8 +5,6 @@
   pkg-config,
   openssl,
   zlib,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -25,15 +23,10 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    [
-      openssl
-      zlib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.CoreServices
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    openssl
+    zlib
+  ];
 
   cargoBuildFlags = [
     "-p"
diff --git a/pkgs/by-name/ca/cargo-supply-chain/package.nix b/pkgs/by-name/ca/cargo-supply-chain/package.nix
index 95431b78947f..36b9aca3122c 100644
--- a/pkgs/by-name/ca/cargo-supply-chain/package.nix
+++ b/pkgs/by-name/ca/cargo-supply-chain/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,10 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-fsW3qTyFMcj/OTouOah1ZFskw075V8jBwhs02AxY7kU=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-  ];
-
   meta = with lib; {
     description = "Gather author, contributor and publisher data on crates in your dependency graph";
     mainProgram = "cargo-supply-chain";
diff --git a/pkgs/by-name/ca/cargo-tally/package.nix b/pkgs/by-name/ca/cargo-tally/package.nix
index 02b3ca664fe0..5f54ba0c9d87 100644
--- a/pkgs/by-name/ca/cargo-tally/package.nix
+++ b/pkgs/by-name/ca/cargo-tally/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchCrate,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -18,15 +16,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-gpGBXh1qR5cFZXDSYKDYg8d4/A/K88dYSUb9mNrmGno=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin (
-    with darwin.apple_sdk_11_0.frameworks;
-    [
-      DiskArbitration
-      Foundation
-      IOKit
-    ]
-  );
-
   meta = with lib; {
     description = "Graph the number of crates that depend on your crate over time";
     mainProgram = "cargo-tally";
diff --git a/pkgs/by-name/ca/cargo-ui/package.nix b/pkgs/by-name/ca/cargo-ui/package.nix
index 65a41aa8ca91..d59ff0f0ac72 100644
--- a/pkgs/by-name/ca/cargo-ui/package.nix
+++ b/pkgs/by-name/ca/cargo-ui/package.nix
@@ -10,7 +10,6 @@
   fontconfig,
   libGL,
   xorg,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -43,9 +42,6 @@ rustPlatform.buildRustPackage rec {
       xorg.libXi
       xorg.libXrandr
       xorg.libxcb
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.AppKit
     ];
 
   postFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
diff --git a/pkgs/by-name/ca/cargo-unused-features/package.nix b/pkgs/by-name/ca/cargo-unused-features/package.nix
index c669ab159ed6..7502501d53df 100644
--- a/pkgs/by-name/ca/cargo-unused-features/package.nix
+++ b/pkgs/by-name/ca/cargo-unused-features/package.nix
@@ -6,8 +6,6 @@
   pkg-config,
   libgit2,
   openssl,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -27,16 +25,11 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      curl
-      libgit2
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.CoreFoundation
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = [
+    curl
+    libgit2
+    openssl
+  ];
 
   env = {
     LIBGIT2_NO_VENDOR = 1;
diff --git a/pkgs/by-name/ca/cargo-update/package.nix b/pkgs/by-name/ca/cargo-update/package.nix
index 2dc1c2ca2082..034b7544eed2 100644
--- a/pkgs/by-name/ca/cargo-update/package.nix
+++ b/pkgs/by-name/ca/cargo-update/package.nix
@@ -12,7 +12,6 @@
   libssh2,
   openssl,
   zlib,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -47,7 +46,6 @@ rustPlatform.buildRustPackage rec {
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       curl
-      darwin.apple_sdk.frameworks.Security
     ];
 
   postBuild = ''
diff --git a/pkgs/by-name/ca/cargo-vibe/package.nix b/pkgs/by-name/ca/cargo-vibe/package.nix
index 841d7b57ea69..1f0afa5289b0 100644
--- a/pkgs/by-name/ca/cargo-vibe/package.nix
+++ b/pkgs/by-name/ca/cargo-vibe/package.nix
@@ -7,7 +7,6 @@
   dbus,
   udev,
   openssl,
-  darwin,
 }:
 rustPlatform.buildRustPackage {
   pname = "cargo-vibe";
@@ -26,20 +25,10 @@ rustPlatform.buildRustPackage {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      dbus
-      openssl
-    ]
-    ++ lib.optional stdenv.hostPlatform.isLinux udev
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        AppKit
-        IOKit
-        CoreBluetooth
-      ]
-    );
+  buildInputs = [
+    dbus
+    openssl
+  ] ++ lib.optional stdenv.hostPlatform.isLinux udev;
 
   meta = with lib; {
     description = "Cargo x Buttplug.io";
diff --git a/pkgs/by-name/ca/cargo-wasi/package.nix b/pkgs/by-name/ca/cargo-wasi/package.nix
index ce9289c1a8cf..52772adaaf6e 100644
--- a/pkgs/by-name/ca/cargo-wasi/package.nix
+++ b/pkgs/by-name/ca/cargo-wasi/package.nix
@@ -5,7 +5,6 @@
   pkg-config,
   stdenv,
   openssl,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -23,9 +22,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (with darwin.apple_sdk.frameworks; [ Security ]);
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ openssl ];
 
   # Checks need to be disabled here because the current test suite makes assumptions
   # about the surrounding environment that aren't Nix friendly. See these lines for specifics:
diff --git a/pkgs/by-name/ca/cargo-workspaces/package.nix b/pkgs/by-name/ca/cargo-workspaces/package.nix
index 219553af4b60..59befd9ae071 100644
--- a/pkgs/by-name/ca/cargo-workspaces/package.nix
+++ b/pkgs/by-name/ca/cargo-workspaces/package.nix
@@ -6,8 +6,6 @@
   libssh2,
   openssl,
   zlib,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -26,16 +24,11 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      libssh2
-      openssl
-      zlib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    libssh2
+    openssl
+    zlib
+  ];
 
   env = {
     LIBSSH2_SYS_USE_PKG_CONFIG = true;
diff --git a/pkgs/by-name/ce/cegui/package.nix b/pkgs/by-name/ce/cegui/package.nix
index b3293c2ef5c2..241624683aeb 100644
--- a/pkgs/by-name/ce/cegui/package.nix
+++ b/pkgs/by-name/ce/cegui/package.nix
@@ -7,7 +7,6 @@
   freetype,
   boost,
   expat,
-  darwin,
   libiconv,
   unstableGitUpdater,
 }:
@@ -37,8 +36,6 @@ stdenv.mkDerivation {
       expat
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Cocoa
-      darwin.apple_sdk.frameworks.Foundation
       libiconv
     ];
 
diff --git a/pkgs/by-name/ce/celeste/package.nix b/pkgs/by-name/ce/celeste/package.nix
index 48ef60083dde..acc76f8f5302 100644
--- a/pkgs/by-name/ce/celeste/package.nix
+++ b/pkgs/by-name/ce/celeste/package.nix
@@ -3,7 +3,6 @@
   stdenv,
   rustPlatform,
   fetchFromGitHub,
-  darwin,
   just,
   pkg-config,
   wrapGAppsHook4,
@@ -58,22 +57,17 @@ rustPlatform.buildRustPackage rec {
     wrapGAppsHook4
   ];
 
-  buildInputs =
-    [
-      cairo
-      dbus
-      gdk-pixbuf
-      glib
-      graphene
-      gtk4
-      libadwaita
-      librclone
-      pango
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Foundation
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = [
+    cairo
+    dbus
+    gdk-pixbuf
+    glib
+    graphene
+    gtk4
+    libadwaita
+    librclone
+    pango
+  ];
 
   env.NIX_CFLAGS_COMPILE = toString (
     lib.optionals stdenv.hostPlatform.isDarwin [
diff --git a/pkgs/by-name/ce/certinfo/package.nix b/pkgs/by-name/ce/certinfo/package.nix
index 073c6ce3ed9c..b5f79fdd1a86 100644
--- a/pkgs/by-name/ce/certinfo/package.nix
+++ b/pkgs/by-name/ce/certinfo/package.nix
@@ -4,7 +4,6 @@
   buildGo123Module,
   fetchFromGitHub,
   libX11,
-  darwin,
 }:
 
 buildGo123Module rec {
@@ -21,10 +20,7 @@ buildGo123Module rec {
   # clipboard functionality not working on Darwin
   doCheck = !(stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64);
 
-  buildInputs =
-    [ ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [ libX11 ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.Cocoa ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ libX11 ];
 
   vendorHash = null;
 
diff --git a/pkgs/by-name/ch/chatgpt/package.nix b/pkgs/by-name/ch/chatgpt/package.nix
index 0dc77de11805..9799e446af64 100644
--- a/pkgs/by-name/ch/chatgpt/package.nix
+++ b/pkgs/by-name/ch/chatgpt/package.nix
@@ -1,7 +1,6 @@
 {
   lib,
   stdenvNoCC,
-  darwin,
   fetchurl,
   _7zz,
   undmg,
diff --git a/pkgs/by-name/ch/checkpwn/package.nix b/pkgs/by-name/ch/checkpwn/package.nix
index a5147b3ae705..4c63aa50be43 100644
--- a/pkgs/by-name/ch/checkpwn/package.nix
+++ b/pkgs/by-name/ch/checkpwn/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchCrate,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -18,10 +16,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-8ALu1Ij4o2fdsRWhlWu6rOIfHZjIIC+fHJ07XIbH66s=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-  ];
-
   # requires internet access
   checkFlags = [
     "--skip=test_cli_"
diff --git a/pkgs/by-name/ch/cherrybomb/package.nix b/pkgs/by-name/ch/cherrybomb/package.nix
index ea40863dd6b6..b1ea2ba7875a 100644
--- a/pkgs/by-name/ch/cherrybomb/package.nix
+++ b/pkgs/by-name/ch/cherrybomb/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchCrate,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -18,10 +16,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-j9CT2HHFY4ANWKvx8t/jgCc3aOiSEJlq8CHstjSc+O4=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-  ];
-
   meta = with lib; {
     description = "CLI tool that helps you avoid undefined user behavior by validating your API specifications";
     mainProgram = "cherrybomb";
diff --git a/pkgs/by-name/ch/chit/package.nix b/pkgs/by-name/ch/chit/package.nix
index dc9fa955817f..218d867f4482 100644
--- a/pkgs/by-name/ch/chit/package.nix
+++ b/pkgs/by-name/ch/chit/package.nix
@@ -5,7 +5,6 @@
   pkg-config,
   stdenv,
   openssl,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -25,13 +24,9 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ pkg-config ];
 
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    openssl
+  ];
 
   # update Carg.lock to work with openssl 3
   postPatch = ''
diff --git a/pkgs/by-name/ch/chromaprint/package.nix b/pkgs/by-name/ch/chromaprint/package.nix
index 61b8766d6501..73175713bbe9 100644
--- a/pkgs/by-name/ch/chromaprint/package.nix
+++ b/pkgs/by-name/ch/chromaprint/package.nix
@@ -8,7 +8,6 @@
   cmake,
   ninja,
   ffmpeg-headless,
-  darwin,
   zlib,
   testers,
   validatePkgConfig,
@@ -57,15 +56,9 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs =
     [ ffmpeg-headless ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        Accelerate
-        CoreGraphics
-        CoreVideo
-        zlib
-      ]
-    );
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      zlib
+    ];
 
   cmakeFlags = [
     (lib.cmakeBool "BUILD_EXAMPLES" withExamples)
diff --git a/pkgs/by-name/ci/citations/package.nix b/pkgs/by-name/ci/citations/package.nix
index df3a9321f10c..85882d414c52 100644
--- a/pkgs/by-name/ci/citations/package.nix
+++ b/pkgs/by-name/ci/citations/package.nix
@@ -1,6 +1,5 @@
 {
   cargo,
-  darwin,
   desktop-file-utils,
   fetchFromGitLab,
   gettext,
@@ -52,17 +51,13 @@ stdenv.mkDerivation (finalAttrs: {
     wrapGAppsHook4
   ];
 
-  buildInputs =
-    [
-      glib
-      gtk4
-      gtksourceview5
-      libadwaita
-      poppler
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Foundation
-    ];
+  buildInputs = [
+    glib
+    gtk4
+    gtksourceview5
+    libadwaita
+    poppler
+  ];
 
   env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang (
     lib.concatStringsSep " " [
diff --git a/pkgs/by-name/cl/claude-code/package-lock.json b/pkgs/by-name/cl/claude-code/package-lock.json
index ee7222282e33..001f939a212e 100644
--- a/pkgs/by-name/cl/claude-code/package-lock.json
+++ b/pkgs/by-name/cl/claude-code/package-lock.json
@@ -5,13 +5,13 @@
   "packages": {
     "": {
       "dependencies": {
-        "@anthropic-ai/claude-code": "^0.2.94"
+        "@anthropic-ai/claude-code": "^0.2.97"
       }
     },
     "node_modules/@anthropic-ai/claude-code": {
-      "version": "0.2.94",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-0.2.94.tgz",
-      "integrity": "sha512-IHYUqgX9FJbKoMSf1S0727wdmXENABE+fZii0CL2mBYuQ+yxg2FApz2JNX9I7J3Ss8EXZaw3AkoQe6138sSdBw==",
+      "version": "0.2.97",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-0.2.97.tgz",
+      "integrity": "sha512-bAaxFyhlT3ZbHQwQdnw0UJ37qhCRwI6BTB4YssXgOe83A+vCpMJErE4g1gURMEPjmRAAALRXOvK2KpffW7djHA==",
       "hasInstallScript": true,
       "license": "SEE LICENSE IN README.md",
       "dependencies": {
diff --git a/pkgs/by-name/cl/claude-code/package.nix b/pkgs/by-name/cl/claude-code/package.nix
index 38324b3fbc39..1b9d8307aae0 100644
--- a/pkgs/by-name/cl/claude-code/package.nix
+++ b/pkgs/by-name/cl/claude-code/package.nix
@@ -6,14 +6,14 @@
 
 buildNpmPackage rec {
   pname = "claude-code";
-  version = "0.2.94";
+  version = "0.2.97";
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${version}.tgz";
-    hash = "sha256-n8K+gwlKjnQH3TPvoosOTUWhQ1iI9OdGuwUUF3raPKU=";
+    hash = "sha256-T8nJFFWFoISOxyJ5b0ZwIi1URnofFk4pgPtROb8Zmi0=";
   };
 
-  npmDepsHash = "sha256-1h/AbADvqWE0RnWFhlg01lLQNcvMN1wpOVh1ve2MlME=";
+  npmDepsHash = "sha256-ail4oHij4UbFdh6L1GgyaXI4pUie0O6dMFThSy6D7iE=";
 
   postPatch = ''
     cp ${./package-lock.json} package-lock.json
diff --git a/pkgs/by-name/cl/clfft/package.nix b/pkgs/by-name/cl/clfft/package.nix
index a7eedd645738..5b12ce60d3d1 100644
--- a/pkgs/by-name/cl/clfft/package.nix
+++ b/pkgs/by-name/cl/clfft/package.nix
@@ -8,11 +8,9 @@
   boost,
   opencl-clhpp,
   ocl-icd,
-  darwin,
 }:
 
 let
-  inherit (darwin.apple_sdk.frameworks) OpenCL;
   stdenv = gccStdenv;
 in
 stdenv.mkDerivation rec {
@@ -43,8 +41,7 @@ stdenv.mkDerivation rec {
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       opencl-clhpp
       ocl-icd
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ OpenCL ];
+    ];
 
   # https://github.com/clMathLibraries/clFFT/issues/237
   CXXFLAGS = "-std=c++98";
diff --git a/pkgs/by-name/cl/click/package.nix b/pkgs/by-name/cl/click/package.nix
index e1bd2d3d888a..96afcd703127 100644
--- a/pkgs/by-name/cl/click/package.nix
+++ b/pkgs/by-name/cl/click/package.nix
@@ -1,5 +1,4 @@
 {
-  darwin,
   fetchFromGitHub,
   rustPlatform,
   lib,
@@ -24,9 +23,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ pkg-config ];
 
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.Security ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ openssl ];
 
   meta = with lib; {
     description = ''The "Command Line Interactive Controller for Kubernetes"'';
diff --git a/pkgs/by-name/cl/clima/package.nix b/pkgs/by-name/cl/clima/package.nix
index 1e73159f8062..650ccfacf768 100644
--- a/pkgs/by-name/cl/clima/package.nix
+++ b/pkgs/by-name/cl/clima/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,10 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-3BNDo5ksra1d8X6yQZYSlS2CSiZfkuTHkQtIC2ckbKE=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-  ];
-
   meta = with lib; {
     description = "Minimal viewer for Termimad";
     homepage = "https://github.com/Canop/clima";
diff --git a/pkgs/by-name/cl/clipboard-jh/package.nix b/pkgs/by-name/cl/clipboard-jh/package.nix
index d2d0651f5123..5ed2283649a3 100644
--- a/pkgs/by-name/cl/clipboard-jh/package.nix
+++ b/pkgs/by-name/cl/clipboard-jh/package.nix
@@ -9,7 +9,6 @@
   wayland-scanner,
   wayland,
   xorg,
-  darwin,
   nix-update-script,
   alsa-lib,
   openssl,
@@ -44,9 +43,6 @@ stdenv.mkDerivation rec {
       wayland
       xorg.libX11
       alsa-lib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.AppKit
     ];
 
   cmakeBuildType = "MinSizeRel";
diff --git a/pkgs/by-name/cl/clipcat/package.nix b/pkgs/by-name/cl/clipcat/package.nix
index 22597dd1f781..66bfcc8dab99 100644
--- a/pkgs/by-name/cl/clipcat/package.nix
+++ b/pkgs/by-name/cl/clipcat/package.nix
@@ -5,7 +5,6 @@
   rustPlatform,
   protobuf,
   installShellFiles,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -22,12 +21,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-UA+NTtZ2qffUPUmvCidnTHwFzD3WOPTlxHR2e2vKwPQ=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Cocoa
-    darwin.apple_sdk.frameworks.Security
-    darwin.apple_sdk.frameworks.SystemConfiguration
-  ];
-
   nativeBuildInputs = [
     protobuf
     installShellFiles
diff --git a/pkgs/by-name/cm/cmake/package.nix b/pkgs/by-name/cm/cmake/package.nix
index 281570d99ab1..67fad206fe40 100644
--- a/pkgs/by-name/cm/cmake/package.nix
+++ b/pkgs/by-name/cm/cmake/package.nix
@@ -29,13 +29,11 @@
   useSharedLibraries ? (!isMinimalBuild && !stdenv.hostPlatform.isCygwin),
   uiToolkits ? [ ], # can contain "ncurses" and/or "qt5"
   buildDocs ? !(isMinimalBuild || (uiToolkits == [ ])),
-  darwin,
   libsForQt5,
   gitUpdater,
 }:
 
 let
-  inherit (darwin.apple_sdk.frameworks) CoreServices SystemConfiguration;
   inherit (libsForQt5) qtbase wrapQtAppsHook;
   cursesUI = lib.elem "ncurses" uiToolkits;
   qt5UI = lib.elem "qt5" uiToolkits;
@@ -117,9 +115,7 @@ stdenv.mkDerivation (finalAttrs: {
     ]
     ++ lib.optional useOpenSSL openssl
     ++ lib.optional cursesUI ncurses
-    ++ lib.optional qt5UI qtbase
-    ++ lib.optional stdenv.hostPlatform.isDarwin CoreServices
-    ++ lib.optional (stdenv.hostPlatform.isDarwin && !isMinimalBuild) SystemConfiguration;
+    ++ lib.optional qt5UI qtbase;
 
   preConfigure = ''
     fixCmakeFiles .
diff --git a/pkgs/by-name/cm/cminpack/package.nix b/pkgs/by-name/cm/cminpack/package.nix
index 08f5ea016148..7d2b48cd3d13 100644
--- a/pkgs/by-name/cm/cminpack/package.nix
+++ b/pkgs/by-name/cm/cminpack/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   cmake,
-  darwin,
   fetchFromGitHub,
   withBlas ? true,
   blas,
@@ -25,15 +24,9 @@ stdenv.mkDerivation rec {
     cmake
   ];
 
-  buildInputs =
-    lib.optionals withBlas [
-      blas
-    ]
-    ++ lib.optionals (withBlas && stdenv.hostPlatform.isDarwin) [
-      darwin.apple_sdk.frameworks.Accelerate
-      darwin.apple_sdk.frameworks.CoreGraphics
-      darwin.apple_sdk.frameworks.CoreVideo
-    ];
+  buildInputs = lib.optionals withBlas [
+    blas
+  ];
 
   cmakeFlags = [
     "-DUSE_BLAS=${if withBlas then "ON" else "OFF"}"
diff --git a/pkgs/by-name/co/code-cursor/package.nix b/pkgs/by-name/co/code-cursor/package.nix
index ffbb707574f9..e142c4026004 100644
--- a/pkgs/by-name/co/code-cursor/package.nix
+++ b/pkgs/by-name/co/code-cursor/package.nix
@@ -188,7 +188,6 @@ stdenvNoCC.mkDerivation {
     license = lib.licenses.unfree;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     maintainers = with lib.maintainers; [
-      sarahec
       aspauldingcode
     ];
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
diff --git a/pkgs/by-name/co/code2prompt/package.nix b/pkgs/by-name/co/code2prompt/package.nix
index 03c5e6e7b0a8..4170d25e5e63 100644
--- a/pkgs/by-name/co/code2prompt/package.nix
+++ b/pkgs/by-name/co/code2prompt/package.nix
@@ -4,8 +4,6 @@
   rustPlatform,
   pkg-config,
   openssl,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -30,12 +28,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.AppKit
-    ];
+  buildInputs = [ openssl ];
 
   meta = {
     description = "A CLI tool that converts your codebase into a single LLM prompt with a source tree, prompt templating, and token counting";
diff --git a/pkgs/by-name/co/codeberg-cli/package.nix b/pkgs/by-name/co/codeberg-cli/package.nix
index 30e5ad35d558..c832396b10ea 100644
--- a/pkgs/by-name/co/codeberg-cli/package.nix
+++ b/pkgs/by-name/co/codeberg-cli/package.nix
@@ -1,5 +1,4 @@
 {
-  darwin,
   fetchFromGitea,
   installShellFiles,
   lib,
@@ -27,18 +26,7 @@ rustPlatform.buildRustPackage rec {
     installShellFiles
   ];
 
-  buildInputs =
-    [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      let
-        d = darwin.apple_sdk.frameworks;
-      in
-      [
-        d.CoreServices
-        d.Security
-        d.SystemConfiguration
-      ]
-    );
+  buildInputs = [ openssl ];
 
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd berg \
diff --git a/pkgs/by-name/co/coinlive/package.nix b/pkgs/by-name/co/coinlive/package.nix
index f8c073ab8ce9..26d3d9eb6ba8 100644
--- a/pkgs/by-name/co/coinlive/package.nix
+++ b/pkgs/by-name/co/coinlive/package.nix
@@ -1,7 +1,5 @@
 {
   lib,
-  stdenv,
-  darwin,
   fetchFromGitHub,
   openssl,
   pkg-config,
@@ -25,13 +23,9 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = [
+    openssl
+  ];
 
   nativeInstallCheckInputs = [ versionCheckHook ];
 
diff --git a/pkgs/by-name/co/conserve/package.nix b/pkgs/by-name/co/conserve/package.nix
index 2095e4091881..831fc448615b 100644
--- a/pkgs/by-name/co/conserve/package.nix
+++ b/pkgs/by-name/co/conserve/package.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitHub,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,10 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-r14ApN9kGWIyeNlbqrb+vOvvmH2n+O5ovvtSVNTMASo=";
 
-  buildInputs = lib.optionals (stdenv.hostPlatform.isDarwin) [
-    darwin.apple_sdk.frameworks.Security
-  ];
-
   checkFlags = [
     # expected to panic if unix user has no secondary group,
     # which is the case in the nix sandbox
diff --git a/pkgs/by-name/co/convco/package.nix b/pkgs/by-name/co/convco/package.nix
index 2a56fd2830a7..81ca074ff9cb 100644
--- a/pkgs/by-name/co/convco/package.nix
+++ b/pkgs/by-name/co/convco/package.nix
@@ -7,7 +7,6 @@
   libiconv,
   openssl,
   pkg-config,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -33,7 +32,6 @@ rustPlatform.buildRustPackage rec {
     [ openssl ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       libiconv
-      darwin.apple_sdk.frameworks.Security
     ];
 
   checkFlags = [
diff --git a/pkgs/by-name/co/cook-cli/package.nix b/pkgs/by-name/co/cook-cli/package.nix
index a45cbf962503..5f873a8fdd61 100644
--- a/pkgs/by-name/co/cook-cli/package.nix
+++ b/pkgs/by-name/co/cook-cli/package.nix
@@ -1,12 +1,10 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   buildNpmPackage,
   rustPlatform,
   pkg-config,
   openssl,
-  darwin,
 }:
 rustPlatform.buildRustPackage rec {
   pname = "cook-cli";
@@ -29,7 +27,7 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = [
     openssl
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.SystemConfiguration ];
+  ];
 
   postPatch = ''
     rm -rf "ui/public"
diff --git a/pkgs/by-name/co/copilot-language-server/package.nix b/pkgs/by-name/co/copilot-language-server/package.nix
index c61f3de0d60a..177c173edba9 100644
--- a/pkgs/by-name/co/copilot-language-server/package.nix
+++ b/pkgs/by-name/co/copilot-language-server/package.nix
@@ -45,11 +45,11 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "copilot-language-server";
-  version = "1.311.0";
+  version = "1.312.0";
 
   src = fetchzip {
     url = "https://github.com/github/copilot-language-server-release/releases/download/${finalAttrs.version}/copilot-language-server-native-${finalAttrs.version}.zip";
-    hash = "sha256-wiEaQpdDyJ3K3BgFlpf8LtgRmRXSpdBGSnC5HAelrdc=";
+    hash = "sha256-glZR72+5lpghItwHuzDZKd/KONsCrjjCwcyNK0k9jr8=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/co/copycat/package.nix b/pkgs/by-name/co/copycat/package.nix
index 7569bdb81082..f088947528c2 100644
--- a/pkgs/by-name/co/copycat/package.nix
+++ b/pkgs/by-name/co/copycat/package.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitHub,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,10 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-gjFVvP2h+HJdDdNVtqTT1E1s4ZYXfWuhtMBRJkWRcDw=";
 
-  buildInputs = lib.optionals (stdenv.hostPlatform.isDarwin) [
-    darwin.apple_sdk_11_0.frameworks.AppKit
-  ];
-
   meta = {
     description = "Utility to copy project tree contents to clipboard";
     homepage = "https://github.com/DeeKahy/CopyCat";
diff --git a/pkgs/by-name/co/coturn/package.nix b/pkgs/by-name/co/coturn/package.nix
index d0eca5422fa1..9bd5ea132869 100644
--- a/pkgs/by-name/co/coturn/package.nix
+++ b/pkgs/by-name/co/coturn/package.nix
@@ -9,6 +9,7 @@
   libmicrohttpd,
   sqlite,
   nixosTests,
+  systemdMinimal,
 }:
 
 stdenv.mkDerivation rec {
@@ -26,13 +27,17 @@ stdenv.mkDerivation rec {
     pkg-config
   ];
 
-  buildInputs = [
-    openssl
-    (libevent.override { inherit openssl; })
-    libprom
-    libmicrohttpd
-    sqlite.dev
-  ];
+  buildInputs =
+    [
+      openssl
+      (libevent.override { inherit openssl; })
+      libprom
+      libmicrohttpd
+      sqlite.dev
+    ]
+    ++ lib.optionals (lib.meta.availableOn stdenv.hostPlatform systemdMinimal) [
+      systemdMinimal
+    ];
 
   patches = [
     ./pure-configure.patch
diff --git a/pkgs/by-name/cr/crabfit-api/package.nix b/pkgs/by-name/cr/crabfit-api/package.nix
index 7012a40ea5b2..abffd72bd555 100644
--- a/pkgs/by-name/cr/crabfit-api/package.nix
+++ b/pkgs/by-name/cr/crabfit-api/package.nix
@@ -8,8 +8,6 @@
   protobuf,
   openssl,
   sqlite,
-  stdenv,
-  darwin,
   adaptor ? "sql",
 }:
 
@@ -53,16 +51,10 @@ rustPlatform.buildRustPackage rec {
     protobuf
   ];
 
-  buildInputs =
-    [
-      openssl
-      sqlite
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.CoreFoundation
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    openssl
+    sqlite
+  ];
 
   buildFeatures = [ "${adaptor}-adaptor" ];
 
diff --git a/pkgs/by-name/cr/cryptsetup/package.nix b/pkgs/by-name/cr/cryptsetup/package.nix
index 3e2b74a4d588..8ba13330dfe1 100644
--- a/pkgs/by-name/cr/cryptsetup/package.nix
+++ b/pkgs/by-name/cr/cryptsetup/package.nix
@@ -60,6 +60,7 @@ stdenv.mkDerivation rec {
     [
       "--with-crypto_backend=openssl"
       "--disable-ssh-token"
+      "--with-tmpfilesdir=${placeholder "out"}/lib/tmpfiles.d"
     ]
     ++ lib.optionals (!rebuildMan) [
       "--disable-asciidoc"
diff --git a/pkgs/by-name/cs/csvlens/package.nix b/pkgs/by-name/cs/csvlens/package.nix
index b5842124d09e..6d84f0302b14 100644
--- a/pkgs/by-name/cs/csvlens/package.nix
+++ b/pkgs/by-name/cs/csvlens/package.nix
@@ -1,7 +1,5 @@
 {
   lib,
-  stdenv,
-  darwin,
   rustPlatform,
   fetchFromGitHub,
 }:
@@ -17,10 +15,6 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-JlyDw+VL/vpKTvvBlDIwVIovhKJX2pV4UTY47cLR1IE=";
   };
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.AppKit
-  ];
-
   useFetchCargoVendor = true;
   cargoHash = "sha256-nfw8mMauOTDCBh9O2ye96p8WXDFta4DXXb9kJVz7f3E=";
 
diff --git a/pkgs/by-name/cu/curlMinimal/package.nix b/pkgs/by-name/cu/curlMinimal/package.nix
index fe28b750ab15..c6fd0ebeee21 100644
--- a/pkgs/by-name/cu/curlMinimal/package.nix
+++ b/pkgs/by-name/cu/curlMinimal/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  darwin,
   pkg-config,
   perl,
   nixosTests,
@@ -158,15 +157,7 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optional wolfsslSupport wolfssl
     ++ lib.optional rustlsSupport rustls-ffi
     ++ lib.optional zlibSupport zlib
-    ++ lib.optional zstdSupport zstd
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        CoreFoundation
-        CoreServices
-        SystemConfiguration
-      ]
-    );
+    ++ lib.optional zstdSupport zstd;
 
   # for the second line see https://curl.haxx.se/mail/tracker-2014-03/0087.html
   preConfigure = ''
diff --git a/pkgs/by-name/cy/cypress/package.nix b/pkgs/by-name/cy/cypress/package.nix
index 649d3757879f..7bb238cd612c 100644
--- a/pkgs/by-name/cy/cypress/package.nix
+++ b/pkgs/by-name/cy/cypress/package.nix
@@ -13,7 +13,6 @@
   udev,
   unzip,
   xorg,
-  darwin,
 }:
 
 let
@@ -65,34 +64,20 @@ stdenv.mkDerivation rec {
       (buildPackages.wrapGAppsHook3.override { makeWrapper = buildPackages.makeShellWrapper; })
     ];
 
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux (
-      with xorg;
-      [
-        libXScrnSaver
-        libXdamage
-        libXtst
-        libxshmfence
-        nss
-        gtk2
-        alsa-lib
-        gtk3
-        libgbm
-      ]
-    )
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        Cocoa
-        CoreServices
-        CoreMedia
-        CoreAudio
-        AudioToolbox
-        AVFoundation
-        Foundation
-        ApplicationServices
-      ]
-    );
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux (
+    with xorg;
+    [
+      libXScrnSaver
+      libXdamage
+      libXtst
+      libxshmfence
+      nss
+      gtk2
+      alsa-lib
+      gtk3
+      libgbm
+    ]
+  );
 
   runtimeDependencies = lib.optional stdenv.hostPlatform.isLinux (lib.getLib udev);
 
diff --git a/pkgs/by-name/cz/czkawka/package.nix b/pkgs/by-name/cz/czkawka/package.nix
index a617fc7fa180..37804ca9e831 100644
--- a/pkgs/by-name/cz/czkawka/package.nix
+++ b/pkgs/by-name/cz/czkawka/package.nix
@@ -3,13 +3,11 @@
   atk,
   cairo,
   callPackage,
-  darwin,
   fetchFromGitHub,
   gdk-pixbuf,
   glib,
   gobject-introspection,
   gtk4,
-  overrideSDK,
   pango,
   pkg-config,
   rustPlatform,
@@ -21,11 +19,7 @@
 }:
 
 let
-  buildRustPackage' = rustPlatform.buildRustPackage.override {
-    stdenv = if stdenv.hostPlatform.isDarwin then overrideSDK stdenv "11.0" else stdenv;
-  };
-
-  self = buildRustPackage' {
+  self = rustPlatform.buildRustPackage {
     pname = "czkawka";
     version = "9.0.0";
 
@@ -45,22 +39,14 @@ let
       wrapGAppsHook4
     ];
 
-    buildInputs =
-      [
-        atk
-        cairo
-        gdk-pixbuf
-        glib
-        gtk4
-        pango
-      ]
-      ++ lib.optionals stdenv.hostPlatform.isDarwin (
-        with darwin.apple_sdk.frameworks;
-        [
-          AppKit
-          Foundation
-        ]
-      );
+    buildInputs = [
+      atk
+      cairo
+      gdk-pixbuf
+      glib
+      gtk4
+      pango
+    ];
 
     nativeCheckInputs = [ xvfb-run ];
 
diff --git a/pkgs/by-name/da/dailies/package.nix b/pkgs/by-name/da/dailies/package.nix
index ab126bda6876..6893c8f0502b 100644
--- a/pkgs/by-name/da/dailies/package.nix
+++ b/pkgs/by-name/da/dailies/package.nix
@@ -1,12 +1,10 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitHub,
-  darwin,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage {
   pname = "dailies";
   version = "0.1.0";
 
@@ -17,11 +15,6 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-hT+tffJ4F4VfblfYmb1o0hl5EZjU/QOgDYudKS8EvJg=";
   };
 
-  nativeBuildInputs = lib.optionals stdenv.isDarwin [
-    darwin.apple_sdk.frameworks.CoreFoundation
-    darwin.apple_sdk.frameworks.Security
-  ];
-
   cargoHash = "sha256-R8r6YFo0Ih7esJl/OpcNNmmmB9pGxOXCc+3/ZivaWSw=";
 
   meta = with lib; {
diff --git a/pkgs/by-name/da/daktilo/package.nix b/pkgs/by-name/da/daktilo/package.nix
index dde3104c7622..2fcd06953ac4 100644
--- a/pkgs/by-name/da/daktilo/package.nix
+++ b/pkgs/by-name/da/daktilo/package.nix
@@ -3,8 +3,6 @@
   rustPlatform,
   fetchFromGitHub,
   installShellFiles,
-  stdenv,
-  darwin,
   unixtools,
   pkg-config,
   alsa-lib,
@@ -30,16 +28,12 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      alsa-lib
-      xorg.libX11
-      xorg.libXi
-      xorg.libXtst
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = [
+    alsa-lib
+    xorg.libX11
+    xorg.libXi
+    xorg.libXtst
+  ];
 
   nativeCheckInputs = [
     unixtools.script
diff --git a/pkgs/by-name/da/darklua/package.nix b/pkgs/by-name/da/darklua/package.nix
index 29e620568ab5..666bc7ba60d5 100644
--- a/pkgs/by-name/da/darklua/package.nix
+++ b/pkgs/by-name/da/darklua/package.nix
@@ -1,7 +1,5 @@
 {
   lib,
-  stdenv,
-  darwin,
   rustPlatform,
   fetchFromGitHub,
 }:
@@ -20,10 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-DQkj4t+l6FJnJQ+g96CXypssbRzHbS6X9AOG0LGDclg=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.CoreServices
-  ];
-
   # error: linker `aarch64-linux-gnu-gcc` not found
   postPatch = ''
     rm .cargo/config.toml
diff --git a/pkgs/by-name/de/deltachat-desktop/package.nix b/pkgs/by-name/de/deltachat-desktop/package.nix
index ad7130123726..0f709042822f 100644
--- a/pkgs/by-name/de/deltachat-desktop/package.nix
+++ b/pkgs/by-name/de/deltachat-desktop/package.nix
@@ -12,7 +12,6 @@
   python3,
   rustPlatform,
   stdenv,
-  darwin,
   testers,
   deltachat-desktop,
   yq,
@@ -65,10 +64,6 @@ stdenv.mkDerivation (finalAttrs: {
       copyDesktopItems
     ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.CoreServices
-  ];
-
   env = {
     ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
     VERSION_INFO_GIT_REF = finalAttrs.src.tag;
diff --git a/pkgs/by-name/de/deploy-rs/package.nix b/pkgs/by-name/de/deploy-rs/package.nix
index f5f9e30197a2..e618554e01b5 100644
--- a/pkgs/by-name/de/deploy-rs/package.nix
+++ b/pkgs/by-name/de/deploy-rs/package.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage {
@@ -20,11 +18,6 @@ rustPlatform.buildRustPackage {
   useFetchCargoVendor = true;
   cargoHash = "sha256-e+Exc0lEamAieZ7QHJBYvmnmM/9YHdLRD3La4U5FRMo=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.CoreServices
-    darwin.apple_sdk.frameworks.SystemConfiguration
-  ];
-
   meta = {
     description = "Multi-profile Nix-flake deploy tool";
     homepage = "https://github.com/serokell/deploy-rs";
diff --git a/pkgs/by-name/de/dezoomify-rs/package.nix b/pkgs/by-name/de/dezoomify-rs/package.nix
index fa273a1b4040..01a3eebb0880 100644
--- a/pkgs/by-name/de/dezoomify-rs/package.nix
+++ b/pkgs/by-name/de/dezoomify-rs/package.nix
@@ -2,7 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
diff --git a/pkgs/by-name/di/diebahn/package.nix b/pkgs/by-name/di/diebahn/package.nix
index 66d24602a3f7..a5a95e663b4f 100644
--- a/pkgs/by-name/di/diebahn/package.nix
+++ b/pkgs/by-name/di/diebahn/package.nix
@@ -18,7 +18,6 @@
   libadwaita,
   pango,
   gettext,
-  darwin,
   blueprint-compiler,
   nix-update-script,
 }:
@@ -51,24 +50,15 @@ stdenv.mkDerivation rec {
     blueprint-compiler
   ];
 
-  buildInputs =
-    [
-      cairo
-      gdk-pixbuf
-      glib
-      gtk4
-      libadwaita
-      openssl
-      pango
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        CoreFoundation
-        Foundation
-        Security
-      ]
-    );
+  buildInputs = [
+    cairo
+    gdk-pixbuf
+    glib
+    gtk4
+    libadwaita
+    openssl
+    pango
+  ];
 
   # Darwin needs to link against gettext from nixpkgs instead of the one vendored by gettext-sys
   # because the vendored copy does not build with newer versions of clang.
diff --git a/pkgs/by-name/di/diffoscope/package.nix b/pkgs/by-name/di/diffoscope/package.nix
index 98e4e8d584b0..39f83389db5d 100644
--- a/pkgs/by-name/di/diffoscope/package.nix
+++ b/pkgs/by-name/di/diffoscope/package.nix
@@ -106,11 +106,11 @@ in
 # Note: when upgrading this package, please run the list-missing-tools.sh script as described below!
 python.pkgs.buildPythonApplication rec {
   pname = "diffoscope";
-  version = "293";
+  version = "294";
 
   src = fetchurl {
     url = "https://diffoscope.org/archive/diffoscope-${version}.tar.bz2";
-    hash = "sha256-DZLeZhhWHcBGbO0lCucs5+6kXfwKk71Iwxhjej0ClLE=";
+    hash = "sha256-9LwP/IL58OdKlB9X4zo0HDEG3nuR6HOBZmSp5166N6E=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/di/dim/package.nix b/pkgs/by-name/di/dim/package.nix
index 9369e055d850..2ead070f750d 100644
--- a/pkgs/by-name/di/dim/package.nix
+++ b/pkgs/by-name/di/dim/package.nix
@@ -4,7 +4,6 @@
   rustPlatform,
   fetchFromGitHub,
   buildNpmPackage,
-  darwin,
   makeWrapper,
   ffmpeg,
   git,
@@ -85,14 +84,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     git
   ];
 
-  buildInputs =
-    [ sqlite ]
-    ++ lib.optional stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.CoreServices
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ]
-    ++ lib.optional libvaSupport libva;
+  buildInputs = [ sqlite ] ++ lib.optional libvaSupport libva;
 
   buildFeatures = lib.optional libvaSupport "vaapi";
 
diff --git a/pkgs/by-name/di/diswall/package.nix b/pkgs/by-name/di/diswall/package.nix
index 5d491178bd3b..da7faadf9365 100644
--- a/pkgs/by-name/di/diswall/package.nix
+++ b/pkgs/by-name/di/diswall/package.nix
@@ -1,14 +1,9 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitHub,
-  darwin,
 }:
 
-let
-  inherit (darwin.apple_sdk.frameworks) Security;
-in
 rustPlatform.buildRustPackage rec {
   pname = "diswall";
   version = "0.6.1";
@@ -20,10 +15,6 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-t2ZBi3ab6OUWzc0L0Hq/ay+s3KNDMeu6mkYxti48BuE=";
   };
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    Security
-  ];
-
   useFetchCargoVendor = true;
   cargoHash = "sha256-I4jfeOtK+ho2jksGHgQqHE+L6UzS240t+7v3/Eb/xAs=";
 
diff --git a/pkgs/by-name/dm/dmd/generic.nix b/pkgs/by-name/dm/dmd/generic.nix
index 3c181f50deb4..0bd513a08e5c 100644
--- a/pkgs/by-name/dm/dmd/generic.nix
+++ b/pkgs/by-name/dm/dmd/generic.nix
@@ -15,7 +15,6 @@
   curl,
   tzdata,
   gdb,
-  Foundation,
   callPackage,
   targetPackages,
   fetchpatch,
@@ -138,14 +137,10 @@ stdenv.mkDerivation (finalAttrs: {
       git
     ];
 
-  buildInputs =
-    [
-      curl
-      tzdata
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Foundation
-    ];
+  buildInputs = [
+    curl
+    tzdata
+  ];
 
   nativeCheckInputs =
     [
diff --git a/pkgs/by-name/dn/dns-root-data/package.nix b/pkgs/by-name/dn/dns-root-data/package.nix
index 73846692747d..8d2a25648754 100644
--- a/pkgs/by-name/dn/dns-root-data/package.nix
+++ b/pkgs/by-name/dn/dns-root-data/package.nix
@@ -5,7 +5,6 @@
 }:
 
 let
-
   rootHints = fetchurl {
     # Original source https://www.internic.net/domain/named.root
     # occasionally suffers from pointless hash changes,
@@ -16,26 +15,21 @@ let
     ];
     hash = "sha256-4lG/uPnNHBNIZ/XIeDM1w3iukrpeW0JIjTnGSwkJ8U4=";
   };
-
-  rootKey = ./root.key;
-  rootDs = ./root.ds;
-
 in
-
 stdenv.mkDerivation {
   pname = "dns-root-data";
-  version = "2024-06-20";
+  version = "2025-04-14";
 
   buildCommand = ''
     mkdir $out
     cp ${rootHints} $out/root.hints
-    cp ${rootKey} $out/root.key
-    cp ${rootDs} $out/root.ds
+    cp ${./root.key} $out/root.key
+    cp ${./root.ds} $out/root.ds
   '';
 
   meta = with lib; {
     homepage = "https://www.iana.org/domains/root/files";
-    description = "DNS root data including root zone and DNSSEC key";
+    description = "DNS root data including root hints and DNSSEC root trust anchor + key";
     maintainers = with maintainers; [
       fpletz
       vcunat
diff --git a/pkgs/by-name/dn/dns-root-data/root.key b/pkgs/by-name/dn/dns-root-data/root.key
index edfc762ad602..a4764873b532 100644
--- a/pkgs/by-name/dn/dns-root-data/root.key
+++ b/pkgs/by-name/dn/dns-root-data/root.key
@@ -1 +1,2 @@
-.	172800	IN	DNSKEY	257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ;{id = 20326 (ksk), size = 2048b}
+.	86400	IN	DNSKEY	257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ;{id = 20326 (ksk), size = 2048b}
+.	86400	IN	DNSKEY	257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdpWWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwuMoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBevYtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ;{id = 38696 (ksk), size = 2048b}
diff --git a/pkgs/by-name/do/docfd/package.nix b/pkgs/by-name/do/docfd/package.nix
index b5356f4b1933..6e046bf81318 100644
--- a/pkgs/by-name/do/docfd/package.nix
+++ b/pkgs/by-name/do/docfd/package.nix
@@ -2,7 +2,6 @@
   lib,
   ocamlPackages,
   stdenv,
-  overrideSDK,
   fetchFromGitHub,
   python3,
   dune_3,
@@ -13,13 +12,7 @@
   docfd,
 }:
 
-let
-  # Needed for x86_64-darwin
-  buildDunePackage' = ocamlPackages.buildDunePackage.override {
-    stdenv = if stdenv.hostPlatform.isDarwin then overrideSDK stdenv "11.0" else stdenv;
-  };
-in
-buildDunePackage' rec {
+ocamlPackages.buildDunePackage rec {
   pname = "docfd";
   version = "11.0.1";
 
diff --git a/pkgs/by-name/do/dockutil/package.nix b/pkgs/by-name/do/dockutil/package.nix
index 264523e970fd..598f504eb993 100644
--- a/pkgs/by-name/do/dockutil/package.nix
+++ b/pkgs/by-name/do/dockutil/package.nix
@@ -8,7 +8,6 @@
   swiftpm,
   swiftpm2nix,
   swiftPackages,
-  darwin,
   libarchive,
   p7zip,
   # Building from source on x86_64 fails (among other things) due to:
@@ -56,8 +55,6 @@ let
       swiftpm
     ];
 
-    buildInputs = with darwin.apple_sdk.frameworks; [ Cocoa ];
-
     configurePhase = generated.configure;
 
     installPhase = ''
diff --git a/pkgs/by-name/do/doctave/package.nix b/pkgs/by-name/do/doctave/package.nix
index 854a56de0709..d1cd037a130b 100644
--- a/pkgs/by-name/do/doctave/package.nix
+++ b/pkgs/by-name/do/doctave/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -28,10 +26,6 @@ rustPlatform.buildRustPackage rec {
     };
   };
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.CoreServices
-  ];
-
   meta = {
     description = "Batteries-included developer documentation site generator";
     homepage = "https://github.com/doctave/doctave";
diff --git a/pkgs/by-name/do/docuum/package.nix b/pkgs/by-name/do/docuum/package.nix
index 1ce408dfdabc..90cb06b6babb 100644
--- a/pkgs/by-name/do/docuum/package.nix
+++ b/pkgs/by-name/do/docuum/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -25,10 +23,6 @@ rustPlatform.buildRustPackage rec {
     "--skip=format::tests::code_str_display"
   ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.IOKit
-  ];
-
   meta = with lib; {
     description = "Least recently used (LRU) eviction of Docker images";
     homepage = "https://github.com/stepchowfun/docuum";
diff --git a/pkgs/by-name/do/dogedns/package.nix b/pkgs/by-name/do/dogedns/package.nix
index 0a6a950e93f1..23f798d7061a 100644
--- a/pkgs/by-name/do/dogedns/package.nix
+++ b/pkgs/by-name/do/dogedns/package.nix
@@ -7,7 +7,6 @@
   pkg-config,
   openssl,
   pandoc,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -45,9 +44,7 @@ rustPlatform.buildRustPackage rec {
     installShellFiles
     pandoc
   ] ++ lib.optionals stdenv.hostPlatform.isLinux [ pkg-config ];
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.Security ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ openssl ];
 
   postInstall = ''
     installShellCompletion completions/doge.{bash,fish,zsh}
diff --git a/pkgs/by-name/do/done/package.nix b/pkgs/by-name/do/done/package.nix
index 7b4398e1e2bb..e7c1e70b8d6e 100644
--- a/pkgs/by-name/do/done/package.nix
+++ b/pkgs/by-name/do/done/package.nix
@@ -16,7 +16,6 @@
   libsecret,
   openssl,
   sqlite,
-  darwin,
   gettext,
 }:
 
@@ -48,18 +47,14 @@ stdenv.mkDerivation rec {
     wrapGAppsHook4
   ];
 
-  buildInputs =
-    [
-      gdk-pixbuf
-      gtk4
-      libadwaita
-      libsecret
-      openssl
-      sqlite
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.AppKit
-    ];
+  buildInputs = [
+    gdk-pixbuf
+    gtk4
+    libadwaita
+    libsecret
+    openssl
+    sqlite
+  ];
 
   env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
     GETTEXT_DIR = gettext;
diff --git a/pkgs/by-name/do/doomretro/package.nix b/pkgs/by-name/do/doomretro/package.nix
index 2eb11cd61ea4..b332fafe1aa5 100644
--- a/pkgs/by-name/do/doomretro/package.nix
+++ b/pkgs/by-name/do/doomretro/package.nix
@@ -4,15 +4,11 @@
   SDL2_image,
   SDL2_mixer,
   cmake,
-  darwin,
   fetchFromGitHub,
   pkg-config,
   stdenv,
 }:
 
-let
-  inherit (darwin.apple_sdk.frameworks) Cocoa;
-in
 stdenv.mkDerivation (finalAttrs: {
   pname = "doomretro";
   version = "5.6.2";
@@ -33,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
     SDL2
     SDL2_image
     SDL2_mixer
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Cocoa ];
+  ];
 
   strictDeps = true;
 
diff --git a/pkgs/by-name/do/dotter/package.nix b/pkgs/by-name/do/dotter/package.nix
index 87339d21f6f9..789fa76979b9 100644
--- a/pkgs/by-name/do/dotter/package.nix
+++ b/pkgs/by-name/do/dotter/package.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   nix-update-script,
   rustPlatform,
-  darwin,
   which,
   installShellFiles,
 }:
@@ -23,10 +22,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-UBZZu8D1fbNOn2obviP+/Qw+E/OoNKRA4NXzqCqghGs=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.CoreServices
-  ];
-
   nativeCheckInputs = [
     which
     installShellFiles
diff --git a/pkgs/by-name/dp/dpkg/package.nix b/pkgs/by-name/dp/dpkg/package.nix
index ba98905413e8..b85ad1a50ba5 100644
--- a/pkgs/by-name/dp/dpkg/package.nix
+++ b/pkgs/by-name/dp/dpkg/package.nix
@@ -15,7 +15,6 @@
   pkg-config,
   diffutils,
   glibc ? !stdenv.hostPlatform.isDarwin,
-  darwin,
 }:
 
 stdenv.mkDerivation rec {
@@ -86,7 +85,7 @@ stdenv.mkDerivation rec {
     xz
     zstd
     libmd
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.CoreServices ];
+  ];
   nativeBuildInputs = [
     makeWrapper
     perl
diff --git a/pkgs/by-name/dt/dtool/package.nix b/pkgs/by-name/dt/dtool/package.nix
index 3d154e94567f..3420b9e8db97 100644
--- a/pkgs/by-name/dt/dtool/package.nix
+++ b/pkgs/by-name/dt/dtool/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -19,10 +17,6 @@ rustPlatform.buildRustPackage rec {
 
   useFetchCargoVendor = true;
   cargoHash = "sha256-C0H5cIMMfUPJ2iJCUs1jEu3Ln8CdDgbgstMnH/f9FRY=";
-
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-  ];
   # FIXME: remove patch when upstream version of rustc-serialize is updated
   cargoPatches = [ ./rustc-serialize-fix.patch ];
 
diff --git a/pkgs/by-name/du/dufs/package.nix b/pkgs/by-name/du/dufs/package.nix
index b62086b95b52..f7e22cd77abc 100644
--- a/pkgs/by-name/du/dufs/package.nix
+++ b/pkgs/by-name/du/dufs/package.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   installShellFiles,
   stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -23,10 +22,6 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-  ];
-
   # FIXME: checkPhase on darwin will leave some zombie spawn processes
   # see https://github.com/NixOS/nixpkgs/issues/205620
   doCheck = !stdenv.hostPlatform.isDarwin;
diff --git a/pkgs/by-name/du/dumbpipe/package.nix b/pkgs/by-name/du/dumbpipe/package.nix
index 368017e0fa45..7a9d0631c6d8 100644
--- a/pkgs/by-name/du/dumbpipe/package.nix
+++ b/pkgs/by-name/du/dumbpipe/package.nix
@@ -1,6 +1,5 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
 }:
diff --git a/pkgs/by-name/du/dummyhttp/package.nix b/pkgs/by-name/du/dummyhttp/package.nix
index ea3406aa4c01..d212809cf1de 100644
--- a/pkgs/by-name/du/dummyhttp/package.nix
+++ b/pkgs/by-name/du/dummyhttp/package.nix
@@ -2,8 +2,6 @@
   lib,
   fetchFromGitHub,
   rustPlatform,
-  darwin,
-  stdenv,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,10 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-bjNB0aoG9Mrz1JzD80j2Czfg0pfU2uGlFFsi5WO4pdU=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-  ];
-
   meta = with lib; {
     description = "Super simple HTTP server that replies a fixed body with a fixed response code";
     homepage = "https://github.com/svenstaro/dummyhttp";
diff --git a/pkgs/by-name/dv/dvdplusrwtools/package.nix b/pkgs/by-name/dv/dvdplusrwtools/package.nix
index e16f95fe7412..49bb2b6e1948 100644
--- a/pkgs/by-name/dv/dvdplusrwtools/package.nix
+++ b/pkgs/by-name/dv/dvdplusrwtools/package.nix
@@ -5,12 +5,8 @@
   fetchpatch,
   cdrtools,
   m4,
-  darwin,
 }:
 
-let
-  inherit (darwin.apple_sdk.frameworks) IOKit;
-in
 stdenv.mkDerivation rec {
   pname = "dvd+rw-tools";
   version = "7.1";
@@ -76,7 +72,7 @@ stdenv.mkDerivation rec {
         ];
 
   nativeBuildInputs = [ m4 ];
-  buildInputs = [ cdrtools ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ IOKit ];
+  buildInputs = [ cdrtools ];
 
   makeFlags = [
     "prefix=${placeholder "out"}"
diff --git a/pkgs/by-name/e1/e1s/package.nix b/pkgs/by-name/e1/e1s/package.nix
index c921f86e0cbf..cc5fe66c21a0 100644
--- a/pkgs/by-name/e1/e1s/package.nix
+++ b/pkgs/by-name/e1/e1s/package.nix
@@ -25,6 +25,9 @@ buildGoModule {
     changelog = "https://github.com/keidarcy/e1s/releases/tag/v${version}";
     license = licenses.mit;
     mainProgram = "e1s";
-    maintainers = with maintainers; [ zelkourban ];
+    maintainers = with maintainers; [
+      zelkourban
+      carlossless
+    ];
   };
 }
diff --git a/pkgs/by-name/ea/easytier/package.nix b/pkgs/by-name/ea/easytier/package.nix
index 305dbbd60330..39871a0e8bea 100644
--- a/pkgs/by-name/ea/easytier/package.nix
+++ b/pkgs/by-name/ea/easytier/package.nix
@@ -5,7 +5,6 @@
   rustPlatform,
   protobuf,
   nix-update-script,
-  darwin,
   withQuic ? false, # with QUIC protocol support
 }:
 
@@ -29,10 +28,6 @@ rustPlatform.buildRustPackage rec {
     rustPlatform.bindgenHook
   ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-  ];
-
   buildNoDefaultFeatures = stdenv.hostPlatform.isMips;
   buildFeatures = lib.optional stdenv.hostPlatform.isMips "mips" ++ lib.optional withQuic "quic";
 
diff --git a/pkgs/by-name/ed/ed/package.nix b/pkgs/by-name/ed/ed/package.nix
index 8f225e715437..334b5ddc35a1 100644
--- a/pkgs/by-name/ed/ed/package.nix
+++ b/pkgs/by-name/ed/ed/package.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ed";
-  version = "1.21";
+  version = "1.21.1";
 
   src = fetchurl {
     url = "mirror://gnu/ed/ed-${finalAttrs.version}.tar.lz";
-    hash = "sha256-YOJJmHJ9RTpc8CxUZkuXU23kais0zR9PZ8HBphu7rXU=";
+    hash = "sha256-1tDHGSsCsFGckCqTcZBT6GWt5aeEo7Mn2T2IhFeyPEs=";
   };
 
   nativeBuildInputs = [ lzip ];
diff --git a/pkgs/by-name/ed/edencommon/package.nix b/pkgs/by-name/ed/edencommon/package.nix
index 95e31de10e53..eb0a3e823440 100644
--- a/pkgs/by-name/ed/edencommon/package.nix
+++ b/pkgs/by-name/ed/edencommon/package.nix
@@ -21,7 +21,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "edencommon";
-  version = "2025.02.10.00";
+  version = "2025.04.21.00";
 
   outputs = [
     "out"
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "facebookexperimental";
     repo = "edencommon";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wY6HEIQZdyyglXADxq9zaCrRCneqQEBs+EqoY3mNY3E=";
+    hash = "sha256-WlLQb4O4rGhXp+bQrJA12CvrwcIS6vzO4W6bX04vKMM=";
   };
 
   patches =
diff --git a/pkgs/by-name/ed/edge-runtime/package.nix b/pkgs/by-name/ed/edge-runtime/package.nix
index e6133bf1389e..19607f2c995c 100644
--- a/pkgs/by-name/ed/edge-runtime/package.nix
+++ b/pkgs/by-name/ed/edge-runtime/package.nix
@@ -5,7 +5,6 @@
   fetchFromGitHub,
   rustPlatform,
   nix-update-script,
-  darwin,
   openssl,
   pkg-config,
 }:
@@ -39,16 +38,7 @@ rustPlatform.buildRustPackage {
     rustPlatform.bindgenHook
   ];
 
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        Security
-        CoreFoundation
-        SystemConfiguration
-      ]
-    );
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ openssl ];
 
   # The v8 package will try to download a `librusty_v8.a` release at build time to our read-only filesystem
   # To avoid this we pre-download the file and export it via RUSTY_V8_ARCHIVE
diff --git a/pkgs/by-name/ed/eduke32/package.nix b/pkgs/by-name/ed/eduke32/package.nix
index 3c1cc3607a6f..bcafef63bade 100644
--- a/pkgs/by-name/ed/eduke32/package.nix
+++ b/pkgs/by-name/ed/eduke32/package.nix
@@ -15,17 +15,10 @@
   libGL,
   SDL2,
   SDL2_mixer,
-  darwin,
   graphicsmagick,
 }:
 
 let
-  inherit (darwin.apple_sdk.frameworks)
-    AGL
-    Cocoa
-    GLUT
-    OpenGL
-    ;
   wrapper = "eduke32-wrapper";
   swWrapper = "voidsw-wrapper";
   furyWrapper = "fury-wrapper";
@@ -61,12 +54,6 @@ stdenv.mkDerivation (finalAttrs: {
       alsa-lib
       gtk2
       libGL
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AGL
-      Cocoa
-      GLUT
-      OpenGL
     ];
 
   nativeBuildInputs =
diff --git a/pkgs/by-name/el/ell/package.nix b/pkgs/by-name/el/ell/package.nix
index c5a1475eaaae..ecfb50a5d1b0 100644
--- a/pkgs/by-name/el/ell/package.nix
+++ b/pkgs/by-name/el/ell/package.nix
@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation rec {
   pname = "ell";
-  version = "0.71";
+  version = "0.73";
 
   outputs = [
     "out"
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/libs/ell/ell.git";
     rev = version;
-    hash = "sha256-nbfWjV0zPPx2kcnD/aRaWSXUGIqrUX7Z4U45ASk5Ric=";
+    hash = "sha256-pwAlRh+rkfPA6dXOGZcIidyCD2ioxVPSJjnyvrWuwow=";
   };
 
   nativeBuildInputs = [
@@ -41,6 +41,11 @@ stdenv.mkDerivation rec {
   # Runs multiple dbus instances on the same port failing the bind.
   enableParallelChecking = false;
 
+  # 'unit/test-hwdb' fails in the sandbox as it relies on
+  # '/etc/udev/hwdb.bin' file presence in the sandbox. `nixpkgs` does
+  # not provide it today in any form. Let's skip the test.
+  env.XFAIL_TESTS = "unit/test-hwdb";
+
   # tests sporadically fail on musl
   doCheck = !stdenv.hostPlatform.isMusl;
 
diff --git a/pkgs/by-name/el/elpa/package.nix b/pkgs/by-name/el/elpa/package.nix
index d629171220ce..a2901aacea0f 100644
--- a/pkgs/by-name/el/elpa/package.nix
+++ b/pkgs/by-name/el/elpa/package.nix
@@ -28,13 +28,13 @@ assert blas.isILP64 == scalapack.isILP64;
 
 stdenv.mkDerivation rec {
   pname = "elpa";
-  version = "2025.01.001";
+  version = "2025.01.002";
 
   passthru = { inherit (blas) isILP64; };
 
   src = fetchurl {
     url = "https://elpa.mpcdf.mpg.de/software/tarball-archive/Releases/${version}/elpa-${version}.tar.gz";
-    sha256 = "sha256-PvDGrtmj4F2276/m4U1m64iyoTVNYedlt83g09XzlR4=";
+    sha256 = "sha256-j+vkCMWQuptEvYvOBGBf0bfalkr82P1fHOnt7LPQtl0=";
   };
 
   patches = [
diff --git a/pkgs/by-name/em/emblem/package.nix b/pkgs/by-name/em/emblem/package.nix
index fb9eba883f69..cd341ac4296b 100644
--- a/pkgs/by-name/em/emblem/package.nix
+++ b/pkgs/by-name/em/emblem/package.nix
@@ -13,7 +13,6 @@
   wrapGAppsHook4,
   libadwaita,
   libxml2,
-  darwin,
   nix-update-script,
 }:
 
@@ -48,14 +47,10 @@ stdenv.mkDerivation rec {
     rustc
   ];
 
-  buildInputs =
-    [
-      libadwaita
-      libxml2
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Foundation
-    ];
+  buildInputs = [
+    libadwaita
+    libxml2
+  ];
 
   env.NIX_CFLAGS_COMPILE = toString (
     lib.optionals stdenv.hostPlatform.isDarwin [
diff --git a/pkgs/by-name/en/envio/package.nix b/pkgs/by-name/en/envio/package.nix
index d54fb62c911c..8578b8307378 100644
--- a/pkgs/by-name/en/envio/package.nix
+++ b/pkgs/by-name/en/envio/package.nix
@@ -1,18 +1,13 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   installShellFiles,
-  darwin,
   gpgme,
   libgpg-error,
   pkg-config,
   rustPlatform,
 }:
 
-let
-  inherit (darwin.apple_sdk.frameworks) Security;
-in
 rustPlatform.buildRustPackage rec {
   pname = "envio";
   version = "0.6.1";
@@ -35,7 +30,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [
     libgpg-error
     gpgme
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
+  ];
 
   postInstall = ''
     installManPage man/*.1
diff --git a/pkgs/by-name/es/eslint/package.nix b/pkgs/by-name/es/eslint/package.nix
index 14267e6c1aaa..91e0a7cd3f3c 100644
--- a/pkgs/by-name/es/eslint/package.nix
+++ b/pkgs/by-name/es/eslint/package.nix
@@ -3,14 +3,8 @@
   buildNpmPackage,
   fetchFromGitHub,
   stdenv,
-  overrideSDK,
 }:
-let
-  buildNpmPackage' = buildNpmPackage.override {
-    stdenv = if stdenv.hostPlatform.isDarwin then overrideSDK stdenv "11.0" else stdenv;
-  };
-in
-buildNpmPackage' rec {
+buildNpmPackage rec {
   pname = "eslint";
   version = "9.20.0";
 
diff --git a/pkgs/by-name/es/espflash/package.nix b/pkgs/by-name/es/espflash/package.nix
index f365a2c54794..266144cd4808 100644
--- a/pkgs/by-name/es/espflash/package.nix
+++ b/pkgs/by-name/es/espflash/package.nix
@@ -6,11 +6,8 @@
   installShellFiles,
   udev,
   stdenv,
-  CoreServices,
-  Security,
   nix-update-script,
   openssl,
-  SystemConfiguration,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -36,11 +33,6 @@ rustPlatform.buildRustPackage rec {
     [ openssl ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       udev
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CoreServices
-      Security
-      SystemConfiguration
     ];
 
   useFetchCargoVendor = true;
diff --git a/pkgs/by-name/es/espup/package.nix b/pkgs/by-name/es/espup/package.nix
index 8e60ada716f5..7b21b7297b7c 100644
--- a/pkgs/by-name/es/espup/package.nix
+++ b/pkgs/by-name/es/espup/package.nix
@@ -9,7 +9,6 @@
   xz,
   zstd,
   stdenv,
-  darwin,
   testers,
   writableTmpDirAsHomeHook,
   nix-update-script,
@@ -34,18 +33,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     installShellFiles
   ];
 
-  buildInputs =
-    [
-      bzip2
-      openssl
-      xz
-      zstd
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.CoreFoundation
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    bzip2
+    openssl
+    xz
+    zstd
+  ];
 
   env = {
     OPENSSL_NO_VENDOR = true;
diff --git a/pkgs/by-name/et/eternal-terminal/package.nix b/pkgs/by-name/et/eternal-terminal/package.nix
index 634ecfbbf4d0..d60842ae2133 100644
--- a/pkgs/by-name/et/eternal-terminal/package.nix
+++ b/pkgs/by-name/et/eternal-terminal/package.nix
@@ -9,7 +9,6 @@
   protobuf,
   zlib,
   catch2,
-  darwin,
 }:
 
 stdenv.mkDerivation rec {
diff --git a/pkgs/by-name/et/ethtool/package.nix b/pkgs/by-name/et/ethtool/package.nix
index 9362d2d4007e..13b15abe5f2a 100644
--- a/pkgs/by-name/et/ethtool/package.nix
+++ b/pkgs/by-name/et/ethtool/package.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ethtool";
-  version = "6.11";
+  version = "6.14";
 
   src = fetchurl {
     url = "mirror://kernel/software/network/ethtool/ethtool-${version}.tar.xz";
-    sha256 = "sha256-jZH1xyrj8lt+iNR4EnncsyD3HjAFiRQ3CxxXTJazEgI=";
+    hash = "sha256-kzi7AOSSh407vjzSiU5g2zWBNjTCCNsLIPXH7oTaabE=";
   };
 
   nativeBuildInputs = [
@@ -24,6 +24,8 @@ stdenv.mkDerivation rec {
     libmnl
   ];
 
+  enableParallelBuilding = true;
+
   passthru = {
     updateScript = writeScript "update-ethtool" ''
       #!/usr/bin/env nix-shell
diff --git a/pkgs/by-name/ex/exempi/package.nix b/pkgs/by-name/ex/exempi/package.nix
index 26b57d89e758..e8131c0d8b57 100644
--- a/pkgs/by-name/ex/exempi/package.nix
+++ b/pkgs/by-name/ex/exempi/package.nix
@@ -6,7 +6,6 @@
   zlib,
   boost,
   libiconv,
-  darwin,
 }:
 
 stdenv.mkDerivation rec {
@@ -34,7 +33,6 @@ stdenv.mkDerivation rec {
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       libiconv
-      darwin.apple_sdk.frameworks.CoreServices
     ];
 
   doCheck = stdenv.hostPlatform.isLinux && stdenv.hostPlatform.is64bit;
diff --git a/pkgs/by-name/ez/ezno/package.nix b/pkgs/by-name/ez/ezno/package.nix
index 9c04adecdb0a..7cf45f25c4b1 100644
--- a/pkgs/by-name/ez/ezno/package.nix
+++ b/pkgs/by-name/ez/ezno/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,10 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-v4lgHx+sR58CshZJCUYrtaW4EDFBUKFPJJ6V+eyf5Bc=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.CoreServices
-  ];
-
   cargoBuildFlags = [
     "--bin"
     "ezno"
diff --git a/pkgs/by-name/fa/faircamp/package.nix b/pkgs/by-name/fa/faircamp/package.nix
index ecf889379009..6508f3fe4c77 100644
--- a/pkgs/by-name/fa/faircamp/package.nix
+++ b/pkgs/by-name/fa/faircamp/package.nix
@@ -1,6 +1,5 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitea,
   makeWrapper,
@@ -10,7 +9,6 @@
   vips,
   ffmpeg,
   callPackage,
-  darwin,
   testers,
   faircamp,
 }:
@@ -38,15 +36,11 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      glib
-      libopus
-      vips
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.CoreServices
-    ];
+  buildInputs = [
+    glib
+    libopus
+    vips
+  ];
 
   postInstall = ''
     wrapProgram $out/bin/faircamp \
diff --git a/pkgs/by-name/fa/fast-float/package.nix b/pkgs/by-name/fa/fast-float/package.nix
index 9ecdb4239114..c4b7ca10efaf 100644
--- a/pkgs/by-name/fa/fast-float/package.nix
+++ b/pkgs/by-name/fa/fast-float/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fast-float";
-  version = "8.0.1";
+  version = "8.0.2";
 
   src = fetchFromGitHub {
     owner = "fastfloat";
     repo = "fast_float";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Y13JdBk8pZyg748fEOj+O/6gMAaqNXIE2fLY5tsMGB0=";
+    hash = "sha256-lKEzRYKdpjsqixC9WBoILccqB2ZkUtPUzT4Q4+j0oac=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/fb/fb303/package.nix b/pkgs/by-name/fb/fb303/package.nix
index 82ece3cd5621..834f700df656 100644
--- a/pkgs/by-name/fb/fb303/package.nix
+++ b/pkgs/by-name/fb/fb303/package.nix
@@ -19,7 +19,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fb303";
-  version = "2025.02.10.00";
+  version = "2025.04.21.00";
 
   outputs = [
     "out"
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "facebook";
     repo = "fb303";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ofQshSBWjL02Z9iQVJu86eet1ULANYzUUcOLBfKJip0=";
+    hash = "sha256-Cgr+uuUl+tlyWdAvBCVMK/mInYu+M5N9QLMTvvJ3oEk=";
   };
 
   patches = [
diff --git a/pkgs/by-name/fb/fbthrift/package.nix b/pkgs/by-name/fb/fbthrift/package.nix
index c69aeb48bd97..1987f574e7f4 100644
--- a/pkgs/by-name/fb/fbthrift/package.nix
+++ b/pkgs/by-name/fb/fbthrift/package.nix
@@ -3,6 +3,7 @@
   stdenv,
 
   fetchFromGitHub,
+  fetchpatch,
 
   cmake,
   ninja,
@@ -25,7 +26,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fbthrift";
-  version = "2025.02.10.00";
+  version = "2025.04.21.00";
 
   outputs = [
     # Trying to split this up further into `bin`, `out`, and `dev`
@@ -39,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "facebook";
     repo = "fbthrift";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-130BHYUFDo11T9bI7cQ7Y+lTnFSr3WNgJ7IA+3BE9+g=";
+    hash = "sha256-W86jBqq0wC8ZYcE7MQ76rV3axPf7efXieEot6ahonUI=";
   };
 
   patches = [
@@ -48,6 +49,16 @@ stdenv.mkDerivation (finalAttrs: {
     ./remove-cmake-install-rpath.patch
 
     ./glog-0.7.patch
+
+    # Backport upstream build system fixes. Remove on next update.
+    (fetchpatch {
+      url = "https://github.com/facebook/fbthrift/commit/638384afb83e5fae29a6483d20f9443b2342ca0b.patch";
+      hash = "sha256-q0VgaQtwAEgDHZ6btOLSnKfkP2cXstFPxPNdX1wcdCg=";
+    })
+    (fetchpatch {
+      url = "https://github.com/facebook/fbthrift/commit/350955beef40abec1e9d13112c9d2b7f95c29022.patch";
+      hash = "sha256-SaCZ0iczj8He2wujWN08QpizsTsK6OhreroOHY9f0BA=";
+    })
   ];
 
   nativeBuildInputs = [
@@ -65,11 +76,11 @@ stdenv.mkDerivation (finalAttrs: {
     wangle
     zlib
     zstd
-    xxHash
   ];
 
   propagatedBuildInputs = [
     mvfst
+    xxHash
   ];
 
   cmakeFlags =
diff --git a/pkgs/by-name/fh/fh/package.nix b/pkgs/by-name/fh/fh/package.nix
index 282565012423..1d0e0ae613b0 100644
--- a/pkgs/by-name/fh/fh/package.nix
+++ b/pkgs/by-name/fh/fh/package.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   installShellFiles,
   stdenv,
-  darwin,
   gcc,
   cacert,
 }:
@@ -31,8 +30,6 @@ rustPlatform.buildRustPackage rec {
   checkInputs = [ cacert ];
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-    darwin.apple_sdk.frameworks.SystemConfiguration
     gcc.cc.lib
   ];
 
diff --git a/pkgs/by-name/fi/fido2-manage/package.nix b/pkgs/by-name/fi/fido2-manage/package.nix
index 633a148451e4..b6440098e92f 100644
--- a/pkgs/by-name/fi/fido2-manage/package.nix
+++ b/pkgs/by-name/fi/fido2-manage/package.nix
@@ -23,7 +23,6 @@
   libuv,
   libsolv,
   libcouchbase,
-  darwin,
 }:
 let
   pythonEnv = python3.withPackages (ps: [ ps.tkinter ]);
@@ -69,8 +68,6 @@ stdenv.mkDerivation rec {
       libuv
       libsolv
       libcouchbase
-      darwin.apple_sdk.frameworks.IOKit
-      darwin.apple_sdk.frameworks.PCSC
     ];
 
   cmakeFlags = [ "-USE_PCSC=ON" ];
diff --git a/pkgs/by-name/fi/filen-cli/package.nix b/pkgs/by-name/fi/filen-cli/package.nix
index 55a66bb2449d..5a2cbe596878 100644
--- a/pkgs/by-name/fi/filen-cli/package.nix
+++ b/pkgs/by-name/fi/filen-cli/package.nix
@@ -6,7 +6,6 @@
   makeWrapper,
   nix-update-script,
   versionCheckHook,
-  darwin,
   libsecret,
   nodejs,
   perl,
@@ -42,12 +41,7 @@ buildNpmPackage (finalAttrs: {
     ];
 
   # for keytar
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [ libsecret ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.AppKit
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ libsecret ];
 
   postPatch = ''
     # The version string is substituted during publishing:
diff --git a/pkgs/by-name/fi/fim-rs/package.nix b/pkgs/by-name/fi/fim-rs/package.nix
index 2ecb4b4142d1..1c43375c7f37 100644
--- a/pkgs/by-name/fi/fim-rs/package.nix
+++ b/pkgs/by-name/fi/fim-rs/package.nix
@@ -1,11 +1,9 @@
 {
   lib,
   bzip2,
-  darwin,
   fetchFromGitHub,
   pkg-config,
   rustPlatform,
-  stdenv,
   zstd,
 }:
 
@@ -32,17 +30,10 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      bzip2
-      zstd
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.CoreFoundation
-      darwin.apple_sdk.frameworks.CoreServices
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    bzip2
+    zstd
+  ];
 
   env = {
     ZSTD_SYS_USE_PKG_CONFIG = true;
diff --git a/pkgs/by-name/fi/findomain/package.nix b/pkgs/by-name/fi/findomain/package.nix
index 344844b98588..7df036a80722 100644
--- a/pkgs/by-name/fi/findomain/package.nix
+++ b/pkgs/by-name/fi/findomain/package.nix
@@ -5,8 +5,6 @@
   installShellFiles,
   pkg-config,
   openssl,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -28,13 +26,9 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    openssl
+  ];
 
   env = {
     OPENSSL_NO_VENDOR = true;
diff --git a/pkgs/by-name/fi/fizz/package.nix b/pkgs/by-name/fi/fizz/package.nix
index 44edf61ea221..e451ee6fd812 100644
--- a/pkgs/by-name/fi/fizz/package.nix
+++ b/pkgs/by-name/fi/fizz/package.nix
@@ -26,7 +26,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fizz";
-  version = "2025.02.10.00";
+  version = "2025.04.21.00";
 
   outputs = [
     "bin"
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "facebookincubator";
     repo = "fizz";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-czGCQNigLveQu0lvu1Dbamk6Upngr2i3njvLSNKSNj0=";
+    hash = "sha256-khaUbxcD8+9zznH0DE/BpweZeDKafTnr4EqPbmOpckU=";
   };
 
   patches = [
diff --git a/pkgs/by-name/fl/flac/package.nix b/pkgs/by-name/fl/flac/package.nix
index 7c5bd5c6fc44..afc1ac74c150 100644
--- a/pkgs/by-name/fl/flac/package.nix
+++ b/pkgs/by-name/fl/flac/package.nix
@@ -23,6 +23,8 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-B6XRai5UOAtY/7JXNbI3YuBgazi1Xd2ZOs6vvLq9LIs=";
   };
 
+  hardeningDisable = [ "trivialautovarinit" ];
+
   nativeBuildInputs = [
     cmake
     doxygen
diff --git a/pkgs/by-name/fl/flake-checker/package.nix b/pkgs/by-name/fl/flake-checker/package.nix
index 0155d14ea793..1bfbe8d0c2a5 100644
--- a/pkgs/by-name/fl/flake-checker/package.nix
+++ b/pkgs/by-name/fl/flake-checker/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,14 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-FDfsA87VATJ4CpXoJ0eFoFl5z9Jtv6tPjkCf7kz6g00=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin (
-    with darwin.apple_sdk.frameworks;
-    [
-      Security
-      SystemConfiguration
-    ]
-  );
-
   meta = with lib; {
     description = "Health checks for your Nix flakes";
     homepage = "https://github.com/${src.owner}/${src.repo}";
diff --git a/pkgs/by-name/fl/flake-edit/package.nix b/pkgs/by-name/fl/flake-edit/package.nix
index b54936e1a895..8b01aaab4055 100644
--- a/pkgs/by-name/fl/flake-edit/package.nix
+++ b/pkgs/by-name/fl/flake-edit/package.nix
@@ -4,10 +4,8 @@
   fetchFromGitHub,
   pkg-config,
   openssl,
-  stdenv,
   installShellFiles,
   nix-update-script,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -29,12 +27,7 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [ openssl ];
 
   env.ASSET_DIR = "target/assets";
 
diff --git a/pkgs/by-name/fl/flameshot/package.nix b/pkgs/by-name/fl/flameshot/package.nix
index 1bd78a3dee6e..05e30e487e8d 100644
--- a/pkgs/by-name/fl/flameshot/package.nix
+++ b/pkgs/by-name/fl/flameshot/package.nix
@@ -1,8 +1,6 @@
 {
   stdenv,
   lib,
-  overrideSDK,
-  darwin,
   fetchFromGitHub,
   fetchpatch,
   cmake,
@@ -18,11 +16,7 @@
 
 assert stdenv.hostPlatform.isDarwin -> (!enableWlrSupport);
 
-let
-  stdenv' = if stdenv.hostPlatform.isDarwin then overrideSDK stdenv "11.0" else stdenv;
-in
-
-stdenv'.mkDerivation {
+stdenv.mkDerivation {
   pname = "flameshot";
   # wlr screenshotting is currently only available on unstable version (>12.1.0)
   version = "12.1.0-unstable-2025-04-07";
diff --git a/pkgs/by-name/fl/fluidsynth/package.nix b/pkgs/by-name/fl/fluidsynth/package.nix
index 789f290cd987..653da761f4d6 100644
--- a/pkgs/by-name/fl/fluidsynth/package.nix
+++ b/pkgs/by-name/fl/fluidsynth/package.nix
@@ -1,6 +1,5 @@
 {
   stdenv,
-  darwin,
   lib,
   fetchFromGitHub,
   buildPackages,
@@ -45,17 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       alsa-lib
       libpulseaudio
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        AppKit
-        AudioUnit
-        CoreAudio
-        CoreMIDI
-        CoreServices
-      ]
-    );
+    ];
 
   cmakeFlags = [
     "-Denable-framework=off"
diff --git a/pkgs/by-name/fo/folly/package.nix b/pkgs/by-name/fo/folly/package.nix
index 6d9313acbe0a..9f029393134f 100644
--- a/pkgs/by-name/fo/folly/package.nix
+++ b/pkgs/by-name/fo/folly/package.nix
@@ -40,7 +40,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "folly";
-  version = "2025.02.10.00";
+  version = "2025.04.21.00";
 
   # split outputs to reduce downstream closure sizes
   outputs = [
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "facebook";
     repo = "folly";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-OuMbxZ9sl9KPDHFae503R0AqzDYFdyuaGK1BospRtfs=";
+    hash = "sha256-P2saSFVRBWt5xjAWlKmcPJT9MFV9CXFmA18dIDCO84o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/fo/font-alias/package.nix b/pkgs/by-name/fo/font-alias/package.nix
new file mode 100644
index 000000000000..4a441d944c8f
--- /dev/null
+++ b/pkgs/by-name/fo/font-alias/package.nix
@@ -0,0 +1,40 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  writeScript,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-alias";
+  version = "1.0.5";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-alias-${finalAttrs.version}.tar.xz";
+    hash = "sha256-n4niF7tz4ONjagpJP7+LfJlRVuDFPZoEdtIBtnwta24=";
+  };
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Common aliases for Xorg fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/alias";
+    license = with lib.licenses; [
+      cronyx
+      mit
+    ];
+    maintainers = [ ];
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/by-name/fo/font-util/package.nix b/pkgs/by-name/fo/font-util/package.nix
new file mode 100644
index 000000000000..b443788a941a
--- /dev/null
+++ b/pkgs/by-name/fo/font-util/package.nix
@@ -0,0 +1,49 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  testers,
+  writeScript,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-util";
+  version = "1.4.1";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-util-${finalAttrs.version}.tar.xz";
+    hash = "sha256-XJ9kEjwZSxUP7okEmZFoc4bm/zbvKve4C6U++vNozJU=";
+  };
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "X.Org font package creation/installation utilities";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/util";
+    license = with lib.licenses; [
+      mit
+      bsd2
+      bsdSourceCode
+      mitOpenGroup
+      # there is a bit of a diff, but i think its close enough
+      # it was probably just adapted a bit to fit to the repository structure
+      # or its an older version that the one on spdx
+      unicodeTOU
+    ];
+    maintainers = [ ];
+    pkgConfigModules = [ "fontutil" ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/fo/formatjson5/package.nix b/pkgs/by-name/fo/formatjson5/package.nix
index 000dae2e8e34..e77a03029509 100644
--- a/pkgs/by-name/fo/formatjson5/package.nix
+++ b/pkgs/by-name/fo/formatjson5/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  darwin,
   nix-update-script,
   fetchpatch,
 }:
@@ -30,8 +28,6 @@ rustPlatform.buildRustPackage {
   useFetchCargoVendor = true;
   cargoHash = "sha256-1CSt9dPVHdOqfQXio7/eXiDLWt+iOe6Qj+VtWblwSDE=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.Security ];
-
   cargoBuildFlags = [ "--example formatjson5" ];
 
   postInstall =
diff --git a/pkgs/by-name/fo/fortune-kind/package.nix b/pkgs/by-name/fo/fortune-kind/package.nix
index 1469d6233642..94e20e3eee59 100644
--- a/pkgs/by-name/fo/fortune-kind/package.nix
+++ b/pkgs/by-name/fo/fortune-kind/package.nix
@@ -3,7 +3,6 @@
   stdenv,
   fetchFromGitHub,
   rustPlatform,
-  darwin,
   libiconv,
   makeBinaryWrapper,
   installShellFiles,
@@ -30,7 +29,6 @@ rustPlatform.buildRustPackage rec {
   ];
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     libiconv
-    darwin.apple_sdk.frameworks.Security
   ];
 
   buildNoDefaultFeatures = true;
diff --git a/pkgs/by-name/fr/freealut/package.nix b/pkgs/by-name/fr/freealut/package.nix
index ac833b59882f..6ca129b98a5a 100644
--- a/pkgs/by-name/fr/freealut/package.nix
+++ b/pkgs/by-name/fr/freealut/package.nix
@@ -1,7 +1,6 @@
 {
   lib,
   stdenv,
-  darwin,
   fetchurl,
   openal,
   testers,
@@ -18,7 +17,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     openal
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.frameworks.OpenAL;
+  ];
 
   passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
 
diff --git a/pkgs/by-name/fr/freeglut/package.nix b/pkgs/by-name/fr/freeglut/package.nix
index ca0f1923098f..5a1ef392ff06 100644
--- a/pkgs/by-name/fr/freeglut/package.nix
+++ b/pkgs/by-name/fr/freeglut/package.nix
@@ -38,11 +38,9 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   cmakeFlags = lib.optionals stdenv.hostPlatform.isDarwin [
-    "-DOPENGL_INCLUDE_DIR=${libGLX.dev}/include"
-    "-DOPENGL_gl_LIBRARY:FILEPATH=${libGLX}/lib/libGL.dylib"
-    "-DOPENGL_glu_LIBRARY:FILEPATH=${libGLU}/lib/libGLU.dylib"
+    "-DOPENGL_INCLUDE_DIR=${lib.getInclude libGLX}/include"
+    "-DOPENGL_gl_LIBRARY:FILEPATH=${lib.getLib libGLX}/lib/libGL.dylib"
     "-DFREEGLUT_BUILD_DEMOS:BOOL=OFF"
-    "-DFREEGLUT_BUILD_STATIC:BOOL=OFF"
   ];
 
   passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
diff --git a/pkgs/by-name/fr/fretboard/package.nix b/pkgs/by-name/fr/fretboard/package.nix
index 25e405b6b9b3..72ee6927f02e 100644
--- a/pkgs/by-name/fr/fretboard/package.nix
+++ b/pkgs/by-name/fr/fretboard/package.nix
@@ -2,7 +2,6 @@
   lib,
   blueprint-compiler,
   cargo,
-  darwin,
   desktop-file-utils,
   fetchFromGitHub,
   glib,
@@ -47,15 +46,11 @@ stdenv.mkDerivation (finalAttrs: {
     wrapGAppsHook4
   ];
 
-  buildInputs =
-    [
-      glib
-      gtk4
-      libadwaita
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Foundation
-    ];
+  buildInputs = [
+    glib
+    gtk4
+    libadwaita
+  ];
 
   env.NIX_CFLAGS_COMPILE = toString (
     lib.optionals stdenv.cc.isClang [
diff --git a/pkgs/by-name/fu/functiontrace-server/package.nix b/pkgs/by-name/fu/functiontrace-server/package.nix
index 22bbfbf05428..d371515e3742 100644
--- a/pkgs/by-name/fu/functiontrace-server/package.nix
+++ b/pkgs/by-name/fu/functiontrace-server/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchCrate,
-  stdenv,
-  darwin,
   nix-update-script,
 }:
 
@@ -19,10 +17,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-61+hEq0cdJZ+DTgN/ZtK6IKuwLCq3oxk0SrzqWewQXs=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.CoreFoundation
-  ];
-
   passthru.updateScript = nix-update-script { };
 
   meta = with lib; {
diff --git a/pkgs/by-name/fu/funzzy/package.nix b/pkgs/by-name/fu/funzzy/package.nix
index 64b5ae43073b..f3f659bcc5bd 100644
--- a/pkgs/by-name/fu/funzzy/package.nix
+++ b/pkgs/by-name/fu/funzzy/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,10 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-n9UHyr7W4hrN0+2dsYAYqkP/uzBv74p5XHU0g2MReJY=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.CoreServices
-  ];
-
   meta = with lib; {
     description = "Lightweight watcher";
     homepage = "https://github.com/cristianoliveira/funzzy";
diff --git a/pkgs/by-name/fu/furnace/package.nix b/pkgs/by-name/fu/furnace/package.nix
index 1ca6761b33c2..f6364c9db281 100644
--- a/pkgs/by-name/fu/furnace/package.nix
+++ b/pkgs/by-name/fu/furnace/package.nix
@@ -19,7 +19,6 @@
   withJACK ? stdenv.hostPlatform.isUnix,
   libjack2,
   withGUI ? true,
-  darwin,
   portaudio,
   alsa-lib,
   # Enable GL/GLES rendering
@@ -77,13 +76,7 @@ stdenv.mkDerivation (finalAttrs: {
       # portaudio pkg-config is pulling this in as a link dependency, not set in propagatedBuildInputs
       alsa-lib
       libX11
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        Cocoa
-      ]
-    );
+    ];
 
   cmakeFlags = [
     (lib.cmakeBool "BUILD_GUI" withGUI)
diff --git a/pkgs/by-name/fw/fw/package.nix b/pkgs/by-name/fw/fw/package.nix
index 5bc5eb315ebd..1c362653909f 100644
--- a/pkgs/by-name/fw/fw/package.nix
+++ b/pkgs/by-name/fw/fw/package.nix
@@ -6,8 +6,6 @@
   libgit2,
   openssl,
   zlib,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -28,15 +26,11 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      libgit2
-      openssl
-      zlib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    libgit2
+    openssl
+    zlib
+  ];
 
   env = {
     OPENSSL_NO_VENDOR = true;
diff --git a/pkgs/by-name/fy/fyne/package.nix b/pkgs/by-name/fy/fyne/package.nix
index 6d2ffabdb9a7..43fd2d976b75 100644
--- a/pkgs/by-name/fy/fyne/package.nix
+++ b/pkgs/by-name/fy/fyne/package.nix
@@ -11,8 +11,6 @@
   libXrandr,
   libXxf86vm,
   pkg-config,
-  stdenv,
-  darwin,
 }:
 
 buildGoModule rec {
@@ -30,25 +28,15 @@ buildGoModule rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    [
-      libGL
-      libX11
-      libXcursor
-      libXinerama
-      libXi
-      libXrandr
-      libXxf86vm
-    ]
-    ++ (lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk_11_0.frameworks;
-      [
-        Carbon
-        Cocoa
-        Kernel
-        UserNotifications
-      ]
-    ));
+  buildInputs = [
+    libGL
+    libX11
+    libXcursor
+    libXinerama
+    libXi
+    libXrandr
+    libXxf86vm
+  ];
 
   doCheck = false;
 
diff --git a/pkgs/by-name/g3/g3proxy/package.nix b/pkgs/by-name/g3/g3proxy/package.nix
index f32e62aae86a..b9dcdad4c4e5 100644
--- a/pkgs/by-name/g3/g3proxy/package.nix
+++ b/pkgs/by-name/g3/g3proxy/package.nix
@@ -3,8 +3,6 @@
   rustPlatform,
   fetchFromGitHub,
   pkg-config,
-  stdenv,
-  darwin,
   c-ares,
   python3,
   lua5_4,
@@ -43,14 +41,10 @@ rustPlatform.buildRustPackage rec {
     cmake
   ];
 
-  buildInputs =
-    [
-      c-ares
-      lua5_4
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = [
+    c-ares
+    lua5_4
+  ];
 
   meta = {
     description = "Enterprise-oriented Generic Proxy Solutions";
diff --git a/pkgs/by-name/ga/gambit-project/package.nix b/pkgs/by-name/ga/gambit-project/package.nix
index 7dedb213faa4..cb3d63379136 100644
--- a/pkgs/by-name/ga/gambit-project/package.nix
+++ b/pkgs/by-name/ga/gambit-project/package.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   stdenv,
   wxGTK31,
-  darwin,
   withGui ? true,
 }:
 
@@ -21,9 +20,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ autoreconfHook ] ++ lib.optional withGui wxGTK31;
 
-  buildInputs =
-    lib.optional withGui wxGTK31
-    ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.frameworks.Cocoa;
+  buildInputs = lib.optional withGui wxGTK31;
 
   strictDeps = true;
 
diff --git a/pkgs/by-name/gc/gccmakedep/package.nix b/pkgs/by-name/gc/gccmakedep/package.nix
new file mode 100644
index 000000000000..daa63e40bfd2
--- /dev/null
+++ b/pkgs/by-name/gc/gccmakedep/package.nix
@@ -0,0 +1,59 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  writeScript,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "gccmakedep";
+  version = "1.0.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/util/gccmakedep-${finalAttrs.version}.tar.xz";
+    hash = "sha256-UIj5h2n7Y8Mm6bnSy3yfSmMKKAHdHaBpcdCCkXbPJbY=";
+  };
+
+  passthru.updateScript = writeScript "update-${finalAttrs.pname}" ''
+    #!/usr/bin/env nix-shell
+    #!nix-shell -i bash -p common-updater-scripts
+
+    version="$(list-directory-versions --pname ${finalAttrs.pname} \
+      --url https://xorg.freedesktop.org/releases/individual/util/ \
+      | sort -V | tail -n1)"
+
+    update-source-version ${finalAttrs.pname} "$version"
+  '';
+
+  meta = {
+    description = "Creates dependencies in makefiles using 'gcc -M'";
+    homepage = "https://gitlab.freedesktop.org/xorg/util/gccmakedep";
+    license = with lib.licenses; [
+      # COPYING file suggests looking at the Copyright headers of every file:
+      # upstream issue: https://gitlab.freedesktop.org/xorg/util/gccmakedep/-/issues/1
+
+      # 1. build system files Copyright Red Hat
+      hpndSellVariant
+
+      # 2. gccmakedep.man was written by Colin Watson for Debian somewhen
+      # earlier than November 2003. While I wasn't able to trace the exact
+      # source, between 1997 and 2004 the "Debian Social Contract, Version
+      # 1.0" was in effect, which requires all components of the Debian
+      # Operating System to be free software, which includes this man page.
+      # https://www.debian.org/social_contract.1.0
+      free
+
+      # 3. gccmakedep.in, originally named gccmdep.cpp was copied from the
+      # XFree86 project around 2000. While it states to be "Based on
+      # mdepend.cpp and code supplied by Hongjiu Lu", that doesn't matter
+      # because it was supposedly completely rewritten by XFree86.
+      # XFree86 code without any explicit Copyright Statement is under X11.
+      x11
+
+      # 4. some files don't have any license info, but they are all trivial
+    ];
+    mainProgram = "gccmakedep";
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/gd/gdbm/package.nix b/pkgs/by-name/gd/gdbm/package.nix
index 9a46d37d698d..45707a5a4d4b 100644
--- a/pkgs/by-name/gd/gdbm/package.nix
+++ b/pkgs/by-name/gd/gdbm/package.nix
@@ -8,13 +8,20 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gdbm";
-  version = "1.24";
+  version = "1.25";
 
   src = fetchurl {
     url = "mirror://gnu/gdbm/gdbm-${finalAttrs.version}.tar.gz";
-    hash = "sha256-aV6YJ/33Y1E/EzkQvH5s/bkYeUOk/slD5XRJcj0rjb8=";
+    hash = "sha256-0C2zxZJu2Hf4gXuBzR+S9T73TKjG21Q/u6AnGzTzk+w=";
   };
 
+  patches = [
+    # Remove on next release.
+    ./upstream-darwin-clock-nanosleep-fix.patch
+    ./upstream-lockwait-test-fixes.patch
+    ./upstream-musl-ssize_t-fix.patch
+  ];
+
   nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ];
 
   configureFlags = [ (lib.enableFeature true "libgdbm-compat") ];
diff --git a/pkgs/by-name/gd/gdbm/upstream-darwin-clock-nanosleep-fix.patch b/pkgs/by-name/gd/gdbm/upstream-darwin-clock-nanosleep-fix.patch
new file mode 100644
index 000000000000..cbc1045305b7
--- /dev/null
+++ b/pkgs/by-name/gd/gdbm/upstream-darwin-clock-nanosleep-fix.patch
@@ -0,0 +1,26 @@
+From ed0a865345681982ea02c6159c0f3d7702c928a1 Mon Sep 17 00:00:00 2001
+From: Sergey Poznyakoff <gray@gnu.org>
+Date: Thu, 27 Mar 2025 20:29:10 +0200
+Subject: Use nanosleep instead of clock_nanosleep
+
+The latter is not available on macOS
+---
+ src/lock.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/lock.c b/src/lock.c
+index a43d9c3..cf28478 100644
+--- a/src/lock.c
++++ b/src/lock.c
+@@ -291,7 +291,7 @@ _gdbm_lockwait_retry (GDBM_FILE dbf, struct timespec const *ts,
+       if (timespec_cmp (&ttw, iv) < 0)
+ 	break;
+       timespec_sub (&ttw, iv);
+-      if (clock_nanosleep (CLOCK_REALTIME, 0, iv, &r))
++      if (nanosleep (iv, &r))
+ 	{
+ 	  if (errno == EINTR)
+ 	    timespec_add (&ttw, &r);
+-- 
+cgit v1.2.3
+
diff --git a/pkgs/by-name/gd/gdbm/upstream-lockwait-test-fixes.patch b/pkgs/by-name/gd/gdbm/upstream-lockwait-test-fixes.patch
new file mode 100644
index 000000000000..1bf42fde28fb
--- /dev/null
+++ b/pkgs/by-name/gd/gdbm/upstream-lockwait-test-fixes.patch
@@ -0,0 +1,192 @@
+From 5be83b4c5da7c6a68817908b19f8925af09e9b2c Mon Sep 17 00:00:00 2001
+From: Sergey Poznyakoff <gray@gnu.org>
+Date: Thu, 10 Apr 2025 17:31:56 +0300
+Subject: Fix timeout calculation in lockwait signal test.
+
+* tests/t_lockwait.c (runtest_signal): mark start time right
+after setting alarm, not before it.
+---
+ tests/t_lockwait.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/tests/t_lockwait.c b/tests/t_lockwait.c
+index a5e74c8..3547af7 100644
+--- a/tests/t_lockwait.c
++++ b/tests/t_lockwait.c
+@@ -323,9 +323,6 @@ runtest_signal (struct timespec *ts)
+       struct sigaction act;
+       struct timeval now;
+ 
+-      gettimeofday (&now, NULL);
+-      start = tv_to_ms (&now);
+-
+       if (pipe (sig_fd))
+ 	{
+ 	  perror ("pipe");
+@@ -341,6 +338,8 @@ runtest_signal (struct timespec *ts)
+ 	  return -1;
+ 	}
+       alarm (ts_to_ms (&ts[1]) / MILLI);
++      gettimeofday (&now, NULL);
++      start = tv_to_ms (&now);
+     }
+ 
+   op.lock_wait = GDBM_LOCKWAIT_SIGNAL;
+-- 
+cgit v1.2.3
+
+From 6f165a8e1745dbd9b88f6fb6882dff7997cfdf74 Mon Sep 17 00:00:00 2001
+From: Sergey Poznyakoff <gray@gnu.org>
+Date: Thu, 10 Apr 2025 21:07:41 +0300
+Subject: More fixes to lockwait test
+
+* tests/t_lockwait.c (sighan): Close fd.
+(runtest_signal): compensate for alarm(2) second precision
+---
+ tests/t_lockwait.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/tests/t_lockwait.c b/tests/t_lockwait.c
+index 3547af7..b378819 100644
+--- a/tests/t_lockwait.c
++++ b/tests/t_lockwait.c
+@@ -170,6 +170,7 @@ static void
+ sighan (int sig)
+ {
+   write (sig_fd[1], &sig, sizeof (sig));
++  close (sig_fd[1]);
+ }
+ 
+ static int runtest_retry (struct timespec *ts);
+@@ -364,7 +365,8 @@ runtest_signal (struct timespec *ts)
+ 
+       pfd.fd = sig_fd[0];
+       pfd.events = POLLIN;
+-      switch (poll (&pfd, 1, ts_to_ms (&ts[1]) - tv_to_ms (&now) + start)) {
++      switch (poll (&pfd, 1,
++		    ts_to_ms (&ts[1]) - tv_to_ms (&now) + start + MILLI)) {
+       case 1:
+ 	break;
+ 
+-- 
+cgit v1.2.3
+
+From aa9baca52ad155ae501ba586ff7b08f4b08e5434 Mon Sep 17 00:00:00 2001
+From: Sergey Poznyakoff <gray@gnu.org>
+Date: Fri, 11 Apr 2025 07:53:58 +0300
+Subject: Adjust timeouts for setitimer interface in lockwait test.
+
+* tests/t_lockwait.c: Setitimer (at least on some systems) restarts
+the timer set by alarm(2). To calculate the ETA of SIGALRM, call
+alarm after gdbm_open_ext returns.
+---
+ tests/t_lockwait.c | 66 ++++++++++++++++++++++++++++++++----------------------
+ 1 file changed, 39 insertions(+), 27 deletions(-)
+
+diff --git a/tests/t_lockwait.c b/tests/t_lockwait.c
+index b378819..dfae838 100644
+--- a/tests/t_lockwait.c
++++ b/tests/t_lockwait.c
+@@ -322,7 +322,6 @@ runtest_signal (struct timespec *ts)
+   if (!(ts[1].tv_sec == 0 && ts[1].tv_nsec == 0))
+     {
+       struct sigaction act;
+-      struct timeval now;
+ 
+       if (pipe (sig_fd))
+ 	{
+@@ -338,9 +337,6 @@ runtest_signal (struct timespec *ts)
+ 	  fprintf (stderr, "%s: sigaction: %s", progname, strerror (errno));
+ 	  return -1;
+ 	}
+-      alarm (ts_to_ms (&ts[1]) / MILLI);
+-      gettimeofday (&now, NULL);
+-      start = tv_to_ms (&now);
+     }
+ 
+   op.lock_wait = GDBM_LOCKWAIT_SIGNAL;
+@@ -354,42 +350,58 @@ runtest_signal (struct timespec *ts)
+     }
+   gdbm_close (dbf);
+ 
+-  if (start > 0)
++  if (!(ts[1].tv_sec == 0 && ts[1].tv_nsec == 0))
+     {
+       struct pollfd pfd;
+       struct timeval now;
+-      int sig;
++      int n, t, sig;
+ 
+-    restart:
++      alarm (ts_to_ms (&ts[1]) / MILLI);
+       gettimeofday (&now, NULL);
++      start = tv_to_ms (&now);
+ 
+       pfd.fd = sig_fd[0];
+       pfd.events = POLLIN;
+-      switch (poll (&pfd, 1,
+-		    ts_to_ms (&ts[1]) - tv_to_ms (&now) + start + MILLI)) {
+-      case 1:
+-	break;
+ 
+-      case 0:
+-	fprintf (stderr, "%s: failed waiting for alarm\n", progname);
+-	return 1;
+-
+-      default:
+-	if (errno == EINTR) goto restart;
+-	fprintf (stderr, "%s: poll: %s\n", progname, strerror (errno));
+-	return 1;
+-      }
+-
+-      if (read (sig_fd[0], &sig, sizeof (sig)) != sizeof (sig))
++      do
+ 	{
+-	  fprintf (stderr, "%s: read: %s\n", progname, strerror (errno));
+-	  return 1;
++	  gettimeofday (&now, NULL);
++	  t = ts_to_ms (&ts[1]) - tv_to_ms (&now) + start + MILLI;
++	  if (t < 0)
++	    {
++	      n = 0;
++	      break;
++	    }
+ 	}
+-      close (sig_fd[0]);
+-      if (sig != SIGALRM)
++      while ((n = poll (&pfd, 1, t)) == -1 && errno == EINTR);
++
++      switch (n)
+ 	{
+-	  fprintf (stderr, "%s: unexpected data read\n", progname);
++	case 1:
++	  if (read (sig_fd[0], &sig, sizeof (sig)) != sizeof (sig))
++	    {
++	      fprintf (stderr, "%s: read: %s\n", progname, strerror (errno));
++	      return 1;
++	    }
++	  close (sig_fd[0]);
++	  if (sig != SIGALRM)
++	    {
++	      fprintf (stderr, "%s: unexpected data read\n", progname);
++	      return 1;
++	    }
++	  break;
++
++	case 0:
++	  fprintf (stderr, "%s: failed waiting for alarm\n", progname);
+ 	  return 1;
++
++	default:
++	  if (errno != EINTR)
++	    {
++	      fprintf (stderr, "%s: poll: %s\n",
++		       progname, strerror (errno));
++	      return 1;
++	    }
+ 	}
+     }
+ 
+-- 
+cgit v1.2.3
+
diff --git a/pkgs/by-name/gd/gdbm/upstream-musl-ssize_t-fix.patch b/pkgs/by-name/gd/gdbm/upstream-musl-ssize_t-fix.patch
new file mode 100644
index 000000000000..79f5b3b16eef
--- /dev/null
+++ b/pkgs/by-name/gd/gdbm/upstream-musl-ssize_t-fix.patch
@@ -0,0 +1,25 @@
+From 39ef0347f78ef691c9ad815360198f577043ce4c Mon Sep 17 00:00:00 2001
+From: Sergey Poznyakoff <gray@gnu.org>
+Date: Mon, 24 Mar 2025 07:56:00 +0200
+Subject: Add missing include
+
+* tools/gdbmapp.h: Include sys/types.h
+---
+ tools/gdbmapp.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/gdbmapp.h b/tools/gdbmapp.h
+index 3ea826b..e20253a 100644
+--- a/tools/gdbmapp.h
++++ b/tools/gdbmapp.h
+@@ -16,6 +16,7 @@
+ 
+ #include <stdlib.h>
+ #include <stdarg.h>
++#include <sys/types.h>
+ #include "gettext.h"
+ #ifdef HAVE_LOCALE_H
+ # include <locale.h>
+-- 
+cgit v1.1
+
diff --git a/pkgs/by-name/gd/gdlv/package.nix b/pkgs/by-name/gd/gdlv/package.nix
index 87858f7a6752..2aeace32b8fe 100644
--- a/pkgs/by-name/gd/gdlv/package.nix
+++ b/pkgs/by-name/gd/gdlv/package.nix
@@ -1,12 +1,7 @@
 {
   lib,
-  stdenv,
   buildGoModule,
   fetchFromGitHub,
-  AppKit,
-  CoreGraphics,
-  Foundation,
-  Metal,
 }:
 buildGoModule rec {
   pname = "gdlv";
@@ -22,13 +17,6 @@ buildGoModule rec {
   vendorHash = null;
   subPackages = ".";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    AppKit
-    CoreGraphics
-    Foundation
-    Metal
-  ];
-
   meta = with lib; {
     description = "GUI frontend for Delve";
     mainProgram = "gdlv";
diff --git a/pkgs/by-name/gd/gdrive3/package.nix b/pkgs/by-name/gd/gdrive3/package.nix
index 07dd3f449d13..dee540bec883 100644
--- a/pkgs/by-name/gd/gdrive3/package.nix
+++ b/pkgs/by-name/gd/gdrive3/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,10 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-ZIswHJBV1uwrnSm5BmQgb8tVD1XQMTQXQ5DWvBj1WDk=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-  ];
-
   meta = with lib; {
     description = "Google Drive CLI Client";
     homepage = "https://github.com/glotlabs/gdrive";
diff --git a/pkgs/by-name/ge/gen-license/package.nix b/pkgs/by-name/ge/gen-license/package.nix
index d55dda6ebc21..2a2d292e17fc 100644
--- a/pkgs/by-name/ge/gen-license/package.nix
+++ b/pkgs/by-name/ge/gen-license/package.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitHub,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,10 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-xXzUobB8RMyJOC4lKayE+6SKC7NW1dNWGUUH3i1TaW0=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-  ];
-
   meta = with lib; {
     description = "Create licenses for your projects right from your terminal";
     mainProgram = "gen-license";
diff --git a/pkgs/by-name/ge/gex/package.nix b/pkgs/by-name/ge/gex/package.nix
index 53a20c7308a3..0ecba4acd1e0 100644
--- a/pkgs/by-name/ge/gex/package.nix
+++ b/pkgs/by-name/ge/gex/package.nix
@@ -1,11 +1,9 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitHub,
   pkg-config,
   libgit2,
-  darwin,
   nix-update-script,
 }:
 
@@ -24,13 +22,9 @@ rustPlatform.buildRustPackage rec {
 
   passthru.updateScript = nix-update-script { };
 
-  buildInputs =
-    [
-      libgit2
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = [
+    libgit2
+  ];
 
   env = {
     LIBGIT2_NO_VENDOR = 1;
diff --git a/pkgs/by-name/gf/gfxstream/package.nix b/pkgs/by-name/gf/gfxstream/package.nix
index ccae47da4d48..48de695bb91f 100644
--- a/pkgs/by-name/gf/gfxstream/package.nix
+++ b/pkgs/by-name/gf/gfxstream/package.nix
@@ -8,7 +8,6 @@
   pkg-config,
   python3,
   aemu,
-  darwin,
   libdrm,
   libglvnd,
   vulkan-headers,
@@ -47,23 +46,13 @@ stdenv.mkDerivation {
     pkg-config
     python3
   ];
-  buildInputs =
-    [
-      aemu
-      libglvnd
-      vulkan-headers
-      vulkan-loader
-      xorg.libX11
-    ]
-    ++ lib.optionals (lib.meta.availableOn stdenv.hostPlatform libdrm) [ libdrm ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Cocoa
-      darwin.apple_sdk.frameworks.CoreGraphics
-      darwin.apple_sdk.frameworks.IOKit
-      darwin.apple_sdk.frameworks.IOSurface
-      darwin.apple_sdk.frameworks.OpenGL
-      darwin.apple_sdk.frameworks.QuartzCore
-    ];
+  buildInputs = [
+    aemu
+    libglvnd
+    vulkan-headers
+    vulkan-loader
+    xorg.libX11
+  ] ++ lib.optionals (lib.meta.availableOn stdenv.hostPlatform libdrm) [ libdrm ];
 
   env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
     NIX_LDFLAGS = toString [
diff --git a/pkgs/by-name/gh/ghciwatch/package.nix b/pkgs/by-name/gh/ghciwatch/package.nix
index 0da0ca63a6d9..69694f1670ad 100644
--- a/pkgs/by-name/gh/ghciwatch/package.nix
+++ b/pkgs/by-name/gh/ghciwatch/package.nix
@@ -3,8 +3,6 @@
   rustPlatform,
   fetchFromGitHub,
   nix-update-script,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -21,11 +19,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-kH5YTadpaUXDma+7SfBJxrOIsd9Gm0EU3MfhFmQ3U80=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.CoreFoundation
-    darwin.apple_sdk.frameworks.CoreServices
-  ];
-
   # integration tests are not run but the macros need this variable to be set
   GHC_VERSIONS = "";
   checkFlags = "--test \"unit\"";
diff --git a/pkgs/by-name/gh/ghostie/package.nix b/pkgs/by-name/gh/ghostie/package.nix
index 1737072421f6..8c80579becf7 100644
--- a/pkgs/by-name/gh/ghostie/package.nix
+++ b/pkgs/by-name/gh/ghostie/package.nix
@@ -6,7 +6,6 @@
   openssl,
   sqlite,
   stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -27,14 +26,10 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      openssl
-      sqlite
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Cocoa
-    ];
+  buildInputs = [
+    openssl
+    sqlite
+  ];
 
   # 4 out of 5 tests are notification tests which do not work in nix builds
   doCheck = false;
diff --git a/pkgs/by-name/gi/gildas/package.nix b/pkgs/by-name/gi/gildas/package.nix
index 4d7431b4fe80..1c0399a995b9 100644
--- a/pkgs/by-name/gi/gildas/package.nix
+++ b/pkgs/by-name/gi/gildas/package.nix
@@ -11,7 +11,6 @@
   perl,
   groff,
   which,
-  darwin,
   ncurses,
 }:
 
@@ -48,33 +47,25 @@ stdenv.mkDerivation rec {
     which
   ];
 
-  buildInputs =
-    [
-      gtk2-x11
-      cfitsio
-      python3Env
-      ncurses
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks; [ CoreFoundation ]
-    );
+  buildInputs = [
+    gtk2-x11
+    cfitsio
+    python3Env
+    ncurses
+  ];
 
   patches =
     [ ./wrapper.patch ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin ([
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
       ./clang.patch
       ./cpp-darwin.patch
-    ]);
+    ];
 
   env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-unused-command-line-argument";
 
   # Workaround for https://github.com/NixOS/nixpkgs/issues/304528
   env.GAG_CPP = lib.optionalString stdenv.hostPlatform.isDarwin "${gfortran.outPath}/bin/cpp";
 
-  NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin (
-    with darwin.apple_sdk.frameworks; "-F${CoreFoundation}/Library/Frameworks"
-  );
-
   configurePhase = ''
     substituteInPlace admin/wrapper.sh --replace '%%OUT%%' $out
     substituteInPlace admin/wrapper.sh --replace '%%PYTHONHOME%%' ${python3Env}
diff --git a/pkgs/by-name/gi/gimoji/package.nix b/pkgs/by-name/gi/gimoji/package.nix
index ea4c142d369e..d6837ec1452b 100644
--- a/pkgs/by-name/gi/gimoji/package.nix
+++ b/pkgs/by-name/gi/gimoji/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,10 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-vAhHCNsViYyNSKeSGUL2oIp8bp5UCm8HReyDuoFvfqs=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.AppKit
-  ];
-
   meta = with lib; {
     description = "Easily add emojis to your git commit messages";
     homepage = "https://github.com/zeenix/gimoji";
diff --git a/pkgs/by-name/gi/girouette/package.nix b/pkgs/by-name/gi/girouette/package.nix
index 36092e7bb808..11ef95495dd4 100644
--- a/pkgs/by-name/gi/girouette/package.nix
+++ b/pkgs/by-name/gi/girouette/package.nix
@@ -5,8 +5,6 @@
   pkg-config,
   dbus,
   openssl,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -27,14 +25,10 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      dbus
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = [
+    dbus
+    openssl
+  ];
 
   meta = with lib; {
     description = "Show the weather in the terminal, in style";
diff --git a/pkgs/by-name/gi/git-agecrypt/package.nix b/pkgs/by-name/gi/git-agecrypt/package.nix
index 5136e112ffee..95e48e29d5e6 100644
--- a/pkgs/by-name/gi/git-agecrypt/package.nix
+++ b/pkgs/by-name/gi/git-agecrypt/package.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
-  darwin,
   libgit2,
   git,
   pkg-config,
@@ -32,7 +30,7 @@ rustPlatform.buildRustPackage {
   buildInputs = [
     libgit2
     zlib
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.frameworks.Security;
+  ];
 
   meta = with lib; {
     description = "Alternative to git-crypt using age instead of GPG";
diff --git a/pkgs/by-name/gi/git-chain/package.nix b/pkgs/by-name/gi/git-chain/package.nix
index 32bdb30fc5f5..54957d139fbb 100644
--- a/pkgs/by-name/gi/git-chain/package.nix
+++ b/pkgs/by-name/gi/git-chain/package.nix
@@ -6,8 +6,6 @@
   openssl,
   git,
   nix-update-script,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage {
@@ -26,14 +24,7 @@ rustPlatform.buildRustPackage {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        Security
-      ]
-    );
+  buildInputs = [ openssl ];
 
   nativeCheckInputs = [ git ];
 
diff --git a/pkgs/by-name/gi/git-dive/package.nix b/pkgs/by-name/gi/git-dive/package.nix
index f98afaf57f86..c3190b1517b3 100644
--- a/pkgs/by-name/gi/git-dive/package.nix
+++ b/pkgs/by-name/gi/git-dive/package.nix
@@ -6,8 +6,6 @@
   libgit2,
   oniguruma,
   zlib,
-  stdenv,
-  darwin,
   gitMinimal,
 }:
 
@@ -29,15 +27,11 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      libgit2
-      oniguruma
-      zlib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = [
+    libgit2
+    oniguruma
+    zlib
+  ];
 
   nativeCheckInputs = [
     gitMinimal
diff --git a/pkgs/by-name/gi/git-gr/package.nix b/pkgs/by-name/gi/git-gr/package.nix
index c778dd82857b..2996a06c9853 100644
--- a/pkgs/by-name/gi/git-gr/package.nix
+++ b/pkgs/by-name/gi/git-gr/package.nix
@@ -6,7 +6,6 @@
   rustPlatform,
   installShellFiles,
   libiconv,
-  darwin,
   nix-update-script,
   pkg-config,
   openssl,
@@ -40,8 +39,6 @@ rustPlatform.buildRustPackage {
     lib.optional stdenv.hostPlatform.isLinux openssl
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       libiconv
-      darwin.apple_sdk.frameworks.CoreServices
-      darwin.apple_sdk.frameworks.SystemConfiguration
     ];
 
   postInstall = lib.optionalString canRunGitGr ''
diff --git a/pkgs/by-name/gi/git-igitt/package.nix b/pkgs/by-name/gi/git-igitt/package.nix
index e8937ae98db9..843b1bc8e51c 100644
--- a/pkgs/by-name/gi/git-igitt/package.nix
+++ b/pkgs/by-name/gi/git-igitt/package.nix
@@ -6,8 +6,6 @@
   libgit2,
   oniguruma,
   zlib,
-  stdenv,
-  darwin,
   nix-update-script,
 }:
 
@@ -34,7 +32,7 @@ rustPlatform.buildRustPackage {
     libgit2
     oniguruma
     zlib
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.Security ];
+  ];
 
   env = {
     RUSTONIG_SYSTEM_LIBONIG = true;
diff --git a/pkgs/by-name/gi/git-ignore/package.nix b/pkgs/by-name/gi/git-ignore/package.nix
index 992c25b89a3c..a125753eec39 100644
--- a/pkgs/by-name/gi/git-ignore/package.nix
+++ b/pkgs/by-name/gi/git-ignore/package.nix
@@ -3,8 +3,6 @@
   rustPlatform,
   fetchFromGitHub,
   installShellFiles,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -25,10 +23,6 @@ rustPlatform.buildRustPackage rec {
     installShellFiles
   ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-  ];
-
   postInstall = ''
     assets=$releaseDir/../assets
     installManPage $assets/git-ignore.1
diff --git a/pkgs/by-name/gi/git-mit/package.nix b/pkgs/by-name/gi/git-mit/package.nix
index 608adfa25c0f..67243bc79901 100644
--- a/pkgs/by-name/gi/git-mit/package.nix
+++ b/pkgs/by-name/gi/git-mit/package.nix
@@ -7,8 +7,6 @@
   libgit2,
   openssl,
   zlib,
-  stdenv,
-  darwin,
 }:
 
 let
@@ -36,15 +34,11 @@ rustPlatform.buildRustPackage {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    [
-      libgit2
-      openssl
-      zlib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.AppKit
-    ];
+  buildInputs = [
+    libgit2
+    openssl
+    zlib
+  ];
 
   env = {
     LIBGIT2_NO_VENDOR = 1;
diff --git a/pkgs/by-name/gi/git-together/package.nix b/pkgs/by-name/gi/git-together/package.nix
index 8b56b68280a0..e2a04faa8292 100644
--- a/pkgs/by-name/gi/git-together/package.nix
+++ b/pkgs/by-name/gi/git-together/package.nix
@@ -1,11 +1,9 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
   openssl,
   pkg-config,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,7 +18,7 @@ rustPlatform.buildRustPackage rec {
   };
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ openssl ] ++ lib.optional stdenv.hostPlatform.isDarwin darwin.Security;
+  buildInputs = [ openssl ];
 
   OPENSSL_NO_VENDOR = true;
 
diff --git a/pkgs/by-name/gi/git-wait/package.nix b/pkgs/by-name/gi/git-wait/package.nix
index 8288a70d3c06..f5417c49b36c 100644
--- a/pkgs/by-name/gi/git-wait/package.nix
+++ b/pkgs/by-name/gi/git-wait/package.nix
@@ -3,7 +3,6 @@
   rustPlatform,
   fetchFromGitHub,
   stdenv,
-  darwin,
   git,
 }:
 
@@ -22,11 +21,6 @@ rustPlatform.buildRustPackage {
   useFetchCargoVendor = true;
   cargoHash = "sha256-tA0WjghBB2K71IlZ1u9K67tZWGe9VNFOfI2YdrqCUw0=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.CoreFoundation
-    darwin.apple_sdk.frameworks.CoreServices
-  ];
-
   checkFlags = lib.optionals stdenv.hostPlatform.isDarwin [
     "--skip=tests::wait_if_index_lock_is_present"
   ];
diff --git a/pkgs/by-name/gi/gitlab-ci-ls/package.nix b/pkgs/by-name/gi/gitlab-ci-ls/package.nix
index 3441413c7135..c38041e4f577 100644
--- a/pkgs/by-name/gi/gitlab-ci-ls/package.nix
+++ b/pkgs/by-name/gi/gitlab-ci-ls/package.nix
@@ -2,10 +2,8 @@
   rustPlatform,
   lib,
   fetchFromGitHub,
-  darwin,
   openssl,
   pkg-config,
-  stdenv,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -22,11 +20,7 @@ rustPlatform.buildRustPackage rec {
   cargoHash = "sha256-WjTfIKWu5fivPXmlGXduHWA5dKmKz2620tprtuoJbD4=";
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs =
-    [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [ openssl ];
 
   meta = with lib; {
     homepage = "https://github.com/alesbrelih/gitlab-ci-ls";
diff --git a/pkgs/by-name/gi/gitlab-timelogs/package.nix b/pkgs/by-name/gi/gitlab-timelogs/package.nix
index 925b13b71b61..eb00dfbd7918 100644
--- a/pkgs/by-name/gi/gitlab-timelogs/package.nix
+++ b/pkgs/by-name/gi/gitlab-timelogs/package.nix
@@ -1,5 +1,4 @@
 {
-  darwin,
   fetchCrate,
   iconv,
   lib,
@@ -23,7 +22,6 @@ rustPlatform.buildRustPackage rec {
   buildInputs =
     [ openssl ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.SystemConfiguration
       iconv
     ];
 
diff --git a/pkgs/by-name/gi/gitnr/package.nix b/pkgs/by-name/gi/gitnr/package.nix
index 867bc19a9bd8..404aaaaf90fc 100644
--- a/pkgs/by-name/gi/gitnr/package.nix
+++ b/pkgs/by-name/gi/gitnr/package.nix
@@ -6,7 +6,6 @@
   libxkbcommon,
   openssl,
   stdenv,
-  darwin,
   wayland,
 }:
 
@@ -32,9 +31,6 @@ rustPlatform.buildRustPackage rec {
     [
       openssl
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.AppKit
-    ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       libxkbcommon
       wayland
diff --git a/pkgs/by-name/gi/gitrs/package.nix b/pkgs/by-name/gi/gitrs/package.nix
index d6a3942e7320..9e3de5731e9f 100644
--- a/pkgs/by-name/gi/gitrs/package.nix
+++ b/pkgs/by-name/gi/gitrs/package.nix
@@ -5,7 +5,6 @@
   openssl,
   pkg-config,
   libiconv,
-  darwin,
   rustPlatform,
 }:
 
@@ -31,8 +30,6 @@ rustPlatform.buildRustPackage rec {
     [ openssl.dev ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       libiconv
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
     ];
 
   meta = with lib; {
diff --git a/pkgs/by-name/gi/gitu/package.nix b/pkgs/by-name/gi/gitu/package.nix
index f3aea88b96d0..51e87ffddcd5 100644
--- a/pkgs/by-name/gi/gitu/package.nix
+++ b/pkgs/by-name/gi/gitu/package.nix
@@ -6,8 +6,6 @@
   libgit2,
   openssl,
   zlib,
-  stdenv,
-  darwin,
   git,
 }:
 
@@ -29,16 +27,11 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      libgit2
-      openssl
-      zlib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.AppKit
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = [
+    libgit2
+    openssl
+    zlib
+  ];
 
   nativeCheckInputs = [
     git
diff --git a/pkgs/by-name/gi/gitui/package.nix b/pkgs/by-name/gi/gitui/package.nix
index f1db72724190..2f24dbef6752 100644
--- a/pkgs/by-name/gi/gitui/package.nix
+++ b/pkgs/by-name/gi/gitui/package.nix
@@ -8,7 +8,6 @@
   pkg-config,
   cmake,
   xclip,
-  darwin,
   nix-update-script,
 }:
 let
@@ -38,8 +37,6 @@ rustPlatform.buildRustPackage {
     ++ lib.optional stdenv.hostPlatform.isLinux xclip
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       libiconv
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.AppKit
     ];
 
   postPatch = ''
diff --git a/pkgs/by-name/gl/gl2ps/package.nix b/pkgs/by-name/gl/gl2ps/package.nix
index 6838bccacc0a..f1a5a9746f4f 100644
--- a/pkgs/by-name/gl/gl2ps/package.nix
+++ b/pkgs/by-name/gl/gl2ps/package.nix
@@ -8,7 +8,6 @@
   libGL,
   libGLU,
   libglut,
-  darwin,
 }:
 
 stdenv.mkDerivation rec {
@@ -33,9 +32,6 @@ stdenv.mkDerivation rec {
       libGL
       libGLU
       libglut
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.OpenGL
     ];
 
   meta = with lib; {
diff --git a/pkgs/by-name/gl/glib/package.nix b/pkgs/by-name/gl/glib/package.nix
index b473ed55a9a3..14fe665be7ff 100644
--- a/pkgs/by-name/gl/glib/package.nix
+++ b/pkgs/by-name/gl/glib/package.nix
@@ -31,7 +31,6 @@
   tzdata,
   desktop-file-utils,
   shared-mime-info,
-  darwin,
   makeHardcodeGsettingsPatch,
   testers,
   gobject-introspection,
@@ -178,18 +177,7 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       libselinux
       util-linuxMinimal # for libmount
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        AppKit
-        Carbon
-        Cocoa
-        CoreFoundation
-        CoreServices
-        Foundation
-      ]
-    );
+    ];
 
   depsBuildBuild = [
     pkg-config # required to find native gi-docgen
diff --git a/pkgs/by-name/gl/glicol-cli/package.nix b/pkgs/by-name/gl/glicol-cli/package.nix
index 3bb374b47600..e432df1a798d 100644
--- a/pkgs/by-name/gl/glicol-cli/package.nix
+++ b/pkgs/by-name/gl/glicol-cli/package.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   pkg-config,
   stdenv,
-  darwin,
   alsa-lib,
 }:
 
@@ -27,13 +26,9 @@ rustPlatform.buildRustPackage rec {
     rustPlatform.bindgenHook
   ];
 
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.AudioUnit
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [
-      alsa-lib
-    ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    alsa-lib
+  ];
 
   meta = with lib; {
     description = "Cross-platform music live coding in terminal";
diff --git a/pkgs/by-name/gl/globalplatform/package.nix b/pkgs/by-name/gl/globalplatform/package.nix
index 6da23ccfb95d..ed6469b940b0 100644
--- a/pkgs/by-name/gl/globalplatform/package.nix
+++ b/pkgs/by-name/gl/globalplatform/package.nix
@@ -3,7 +3,6 @@
   stdenv,
   fetchFromGitHub,
   pcsclite,
-  PCSC,
   pkg-config,
   cmake,
   zlib,
@@ -40,9 +39,6 @@ stdenv.mkDerivation (finalAttrs: {
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       pcsclite
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      PCSC
     ];
 
   cmakeFlags = [
diff --git a/pkgs/by-name/gl/glrnvim/package.nix b/pkgs/by-name/gl/glrnvim/package.nix
index fc2de8e52d78..b504b09afefd 100644
--- a/pkgs/by-name/gl/glrnvim/package.nix
+++ b/pkgs/by-name/gl/glrnvim/package.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,14 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-oE1HXmJbKHegubqhsovat1ce/4rjdKGGTnmDdbRBo/k=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin (
-    with darwin.apple_sdk.frameworks;
-    [
-      DiskArbitration
-      Foundation
-    ]
-  );
-
   postInstall = ''
     install -Dm644 glrnvim.desktop -t $out/share/applications
     install -Dm644 glrnvim.svg $out/share/icons/hicolor/scalable/apps/glrnvim.svg
diff --git a/pkgs/by-name/gm/gmt/package.nix b/pkgs/by-name/gm/gmt/package.nix
index b4d4f268fe15..4f688d9b8041 100644
--- a/pkgs/by-name/gm/gmt/package.nix
+++ b/pkgs/by-name/gm/gmt/package.nix
@@ -4,7 +4,7 @@
   fetchFromGitHub,
   cmake,
   curl,
-  darwin,
+  apple-sdk,
   fftwSinglePrec,
   netcdf,
   pcre,
@@ -34,8 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
     NIX_CFLAGS_COMPILE =
       lib.optionalString stdenv.cc.isClang "-Wno-implicit-function-declaration "
       + lib.optionalString (
-        stdenv.hostPlatform.isDarwin
-        && lib.versionOlder (darwin.apple_sdk.MacOSX-SDK.version or darwin.apple_sdk.sdk.version) "13.3"
+        stdenv.hostPlatform.isDarwin && lib.versionOlder apple-sdk.version "13.3"
       ) "-D__LAPACK_int=int";
   };
 
@@ -48,21 +47,11 @@ stdenv.mkDerivation (finalAttrs: {
       dcw-gmt
       gshhg-gmt
     ]
-    ++ (
-      if stdenv.hostPlatform.isDarwin then
-        with darwin.apple_sdk.frameworks;
-        [
-          Accelerate
-          CoreGraphics
-          CoreVideo
-        ]
-      else
-        [
-          fftwSinglePrec
-          blas
-          lapack
-        ]
-    );
+    ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
+      fftwSinglePrec
+      blas
+      lapack
+    ];
 
   propagatedBuildInputs = [ ghostscript ];
 
diff --git a/pkgs/by-name/gn/gn/generic.nix b/pkgs/by-name/gn/gn/generic.nix
index 218a46d3fb98..ca28240fa705 100644
--- a/pkgs/by-name/gn/gn/generic.nix
+++ b/pkgs/by-name/gn/gn/generic.nix
@@ -4,7 +4,6 @@
   fetchgit,
   fetchpatch,
   cctools,
-  darwin,
   writeText,
   ninja,
   python3,
@@ -54,19 +53,9 @@ stdenv.mkDerivation {
     ninja
     python3
   ];
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin (
-    with darwin;
-    with apple_sdk.frameworks;
-    [
-      libobjc
-      cctools
-
-      # frameworks
-      ApplicationServices
-      Foundation
-      AppKit
-    ]
-  );
+  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
+    cctools
+  ];
 
   env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
diff --git a/pkgs/by-name/go/go-ethereum/package.nix b/pkgs/by-name/go/go-ethereum/package.nix
index c65b636eb1a3..e409dd140fac 100644
--- a/pkgs/by-name/go/go-ethereum/package.nix
+++ b/pkgs/by-name/go/go-ethereum/package.nix
@@ -1,10 +1,7 @@
 {
   lib,
-  stdenv,
   buildGoModule,
   fetchFromGitHub,
-  libobjc,
-  IOKit,
   nixosTests,
 }:
 
@@ -59,12 +56,6 @@ buildGoModule rec {
   # Following upstream: https://github.com/ethereum/go-ethereum/blob/v1.11.6/build/ci.go#L218
   tags = [ "urfave_cli_no_docs" ];
 
-  # Fix for usb-related segmentation faults on darwin
-  propagatedBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    libobjc
-    IOKit
-  ];
-
   passthru.tests = { inherit (nixosTests) geth; };
 
   meta = with lib; {
diff --git a/pkgs/by-name/go/gobang/package.nix b/pkgs/by-name/go/gobang/package.nix
index 12f6e8f38c7e..69bf2531e07e 100644
--- a/pkgs/by-name/go/gobang/package.nix
+++ b/pkgs/by-name/go/gobang/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  darwin,
 }:
 let
   version = "0.1.0-alpha.5";
@@ -24,14 +22,6 @@ rustPlatform.buildRustPackage {
   useFetchCargoVendor = true;
   cargoHash = "sha256-K9oo0QrqcPNdV7WMlgSCVc+7AVfoyDkovvJLqKJPvTQ=";
 
-  buildInputs =
-    with darwin.apple_sdk.frameworks;
-    lib.optionals stdenv.hostPlatform.isDarwin [
-      CoreFoundation
-      Security
-      SystemConfiguration
-    ];
-
   meta = {
     description = "Cross-platform TUI database management tool written in Rust";
     homepage = "https://github.com/tako8ki/gobang";
diff --git a/pkgs/by-name/go/google-cloud-cpp/package.nix b/pkgs/by-name/go/google-cloud-cpp/package.nix
index 3b8a0fe9f0f4..1f6c115e09ae 100644
--- a/pkgs/by-name/go/google-cloud-cpp/package.nix
+++ b/pkgs/by-name/go/google-cloud-cpp/package.nix
@@ -14,7 +14,8 @@
   nlohmann_json,
   openssl,
   pkg-config,
-  protobuf,
+  # upstream PR to update: https://github.com/googleapis/google-cloud-cpp/pull/14974
+  protobuf_29,
   pkgsBuildHost,
   # default list of APIs: https://github.com/googleapis/google-cloud-cpp/blob/v1.32.1/CMakeLists.txt#L173
   apis ? [ "*" ],
@@ -48,20 +49,11 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  nativeBuildInputs =
-    [
-      cmake
-      ninja
-      pkg-config
-    ]
-    ++ lib.optionals (!doInstallCheck) [
-      # enable these dependencies when doInstallCheck is false because we're
-      # unconditionally building tests and benchmarks
-      #
-      # when doInstallCheck is true, these deps are added to nativeInstallCheckInputs
-      gbenchmark
-      gtest
-    ];
+  nativeBuildInputs = [
+    cmake
+    ninja
+    pkg-config
+  ];
 
   buildInputs = [
     c-ares
@@ -70,7 +62,9 @@ stdenv.mkDerivation rec {
     grpc
     nlohmann_json
     openssl
-    protobuf
+    protobuf_29
+    gbenchmark
+    gtest
   ];
 
   doInstallCheck = true;
diff --git a/pkgs/by-name/go/gossip/package.nix b/pkgs/by-name/go/gossip/package.nix
index f666cb2f7e5f..33eec234f389 100644
--- a/pkgs/by-name/go/gossip/package.nix
+++ b/pkgs/by-name/go/gossip/package.nix
@@ -1,6 +1,5 @@
 {
   cmake,
-  darwin,
   fetchFromGitHub,
   SDL2,
   ffmpeg_6,
@@ -66,14 +65,6 @@ rustPlatform.buildRustPackage rec {
       libxkbcommon
       openssl
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.AppKit
-      darwin.apple_sdk.frameworks.Cocoa
-      darwin.apple_sdk.frameworks.CoreGraphics
-      darwin.apple_sdk.frameworks.Foundation
-      darwin.apple_sdk.frameworks.ForceFeedback
-      darwin.apple_sdk.frameworks.AVFoundation
-    ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       wayland
       libX11
diff --git a/pkgs/by-name/gp/gptscript/package.nix b/pkgs/by-name/gp/gptscript/package.nix
index 2f128bb06305..a5a56b609a87 100644
--- a/pkgs/by-name/gp/gptscript/package.nix
+++ b/pkgs/by-name/gp/gptscript/package.nix
@@ -2,8 +2,6 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
-  darwin,
-  stdenv,
 }:
 buildGoModule rec {
   pname = "gptscript";
@@ -18,8 +16,6 @@ buildGoModule rec {
 
   vendorHash = "sha256-ajglXWGJhSJtcrbSBmxmriXFTT+Vb4xYq0Ec9SYRlQk=";
 
-  propagatedBuildInputs = with darwin; lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
-
   ldflags = [
     "-s"
     "-w"
diff --git a/pkgs/by-name/gr/gridlock/package.nix b/pkgs/by-name/gr/gridlock/package.nix
index fc65506c631e..5f609d110b22 100644
--- a/pkgs/by-name/gr/gridlock/package.nix
+++ b/pkgs/by-name/gr/gridlock/package.nix
@@ -4,8 +4,6 @@
   fetchFromGitHub,
   pkg-config,
   openssl,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage {
@@ -31,13 +29,9 @@ rustPlatform.buildRustPackage {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = [
+    openssl
+  ];
 
   postInstall = ''
     moveToOutput bin/nyarr $nyarr
diff --git a/pkgs/by-name/gs/gsl-lite/package.nix b/pkgs/by-name/gs/gsl-lite/package.nix
index ba49c51a410b..250263fa1751 100644
--- a/pkgs/by-name/gs/gsl-lite/package.nix
+++ b/pkgs/by-name/gs/gsl-lite/package.nix
@@ -9,13 +9,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "gsl-lite";
-  version = "0.42.0";
+  version = "0.43.0";
 
   src = fetchFromGitHub {
     owner = "gsl-lite";
     repo = "gsl-lite";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4CQG+sX/UTQ4zICmDR6YBfapuh0hSqkWk5skZAVAy2o=";
+    hash = "sha256-9mvbD7zVTtfFRy2qIYJpU9XAlAW4ZLh5DE3WPEQpf38=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gu/gurk-rs/package.nix b/pkgs/by-name/gu/gurk-rs/package.nix
index 5d15310837aa..c58d34f1765c 100644
--- a/pkgs/by-name/gu/gurk-rs/package.nix
+++ b/pkgs/by-name/gu/gurk-rs/package.nix
@@ -4,7 +4,6 @@
   protobuf,
   rustPlatform,
   fetchFromGitHub,
-  darwin,
   pkgsBuildHost,
   openssl,
   pkg-config,
@@ -14,9 +13,6 @@
   gurk-rs,
 }:
 
-let
-  inherit (darwin.apple_sdk.frameworks) Cocoa;
-in
 rustPlatform.buildRustPackage rec {
   pname = "gurk-rs";
   version = "0.6.4";
@@ -41,7 +37,7 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs = [ openssl ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Cocoa ];
+  buildInputs = [ openssl ];
 
   NIX_LDFLAGS = lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
     "-framework"
diff --git a/pkgs/by-name/gz/gz-utils/package.nix b/pkgs/by-name/gz/gz-utils/package.nix
index 1a4bf09d40a1..c41ec4ef71d7 100644
--- a/pkgs/by-name/gz/gz-utils/package.nix
+++ b/pkgs/by-name/gz/gz-utils/package.nix
@@ -2,11 +2,23 @@
   lib,
   stdenv,
   fetchFromGitHub,
+
+  # nativeBuildInputs
   cmake,
   gz-cmake,
-  spdlog,
-}:
+  doxygen,
+  graphviz,
 
+  # buildInputs
+  cli11,
+  spdlog,
+
+  # nativeCheckInputs
+  python3,
+
+  # checkInputs
+  gtest,
+}:
 stdenv.mkDerivation (finalAttrs: {
   pname = "gz-utils";
   version = "3.1.1";
@@ -18,12 +30,49 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-fYzysdB608jfMb/EbqiGD4hXmPxcaVTUrt9Wx0dBlto=";
   };
 
+  outputs = [
+    "doc"
+    "out"
+  ];
+
+  # Remove vendored gtest, use nixpkgs' version instead.
+  postPatch = ''
+    rm -r test/gtest_vendor
+
+    substituteInPlace test/CMakeLists.txt --replace-fail \
+      "add_subdirectory(gtest_vendor)" "# add_subdirectory(gtest_vendor)"
+  '';
+
   nativeBuildInputs = [
     cmake
     gz-cmake
+    doxygen
+    graphviz
+  ];
+
+  buildInputs = [
+    cli11
     spdlog
   ];
 
+  # Indicate to CMake that we are not using the vendored CLI11 library.
+  # The integration tests make (unintentional?) unconditional usage of the vendored
+  # CLI11 library, so we can't remove that.
+  cmakeFlags = [
+    (lib.cmakeBool "GZ_UTILS_VENDOR_CLI11" false)
+  ];
+
+  postBuild = ''
+    make doc
+    cp -r doxygen/html $doc
+  '';
+
+  nativeCheckInputs = [ python3 ];
+
+  checkInputs = [ gtest ];
+
+  doCheck = true;
+
   meta = {
     description = "General purpose utility classes and functions for the Gazebo libraries";
     homepage = "https://gazebosim.org/home";
diff --git a/pkgs/by-name/gz/gzdoom/package.nix b/pkgs/by-name/gz/gzdoom/package.nix
index f4fd2bc7d95a..641b82cd1647 100644
--- a/pkgs/by-name/gz/gzdoom/package.nix
+++ b/pkgs/by-name/gz/gzdoom/package.nix
@@ -25,14 +25,14 @@
 
 stdenv.mkDerivation rec {
   pname = "gzdoom";
-  version = "4.14.1";
+  version = "4.14.2";
 
   src = fetchFromGitHub {
     owner = "ZDoom";
     repo = "gzdoom";
     rev = "g${version}";
     fetchSubmodules = true;
-    hash = "sha256-Hrqi2xpyMGcTJ2rI59EpcEtoJ+gCGmwEy+F396M3f/4=";
+    hash = "sha256-kYw+r08v/Q/hphJuvjn38Dj5mZRijE6pWKoEZBlN5P4=";
   };
 
   outputs = [ "out" ] ++ lib.optionals stdenv.hostPlatform.isLinux [ "doc" ];
diff --git a/pkgs/by-name/ha/handbrake/package.nix b/pkgs/by-name/ha/handbrake/package.nix
index 46153f48d145..679c110e9044 100644
--- a/pkgs/by-name/ha/handbrake/package.nix
+++ b/pkgs/by-name/ha/handbrake/package.nix
@@ -58,8 +58,6 @@
   libdvdnav,
   libdvdcss,
   libbluray,
-  # Darwin-specific
-  darwin,
   # GTK
   # NOTE: 2019-07-19: The gtk3 package has a transitive dependency on dbus,
   # which in turn depends on systemd. systemd is not supported on Darwin, so
@@ -87,12 +85,6 @@
 }:
 
 let
-  inherit (darwin.apple_sdk.frameworks)
-    AudioToolbox
-    Foundation
-    VideoToolbox
-    ;
-  inherit (darwin) libobjc;
   version = "1.9.2";
 
   src = fetchFromGitHub {
@@ -295,12 +287,6 @@ let
         udev
       ]
       ++ optional useFdk fdk_aac
-      ++ optionals stdenv.hostPlatform.isDarwin [
-        AudioToolbox
-        Foundation
-        libobjc
-        VideoToolbox
-      ]
       # NOTE: 2018-12-27: Handbrake supports nv-codec-headers for Linux only,
       # look at ./make/configure.py search "enable_nvenc"
       ++ optional stdenv.hostPlatform.isLinux nv-codec-headers;
diff --git a/pkgs/by-name/ha/haylxon/package.nix b/pkgs/by-name/ha/haylxon/package.nix
index 3d965efa3743..36ee26365a18 100644
--- a/pkgs/by-name/ha/haylxon/package.nix
+++ b/pkgs/by-name/ha/haylxon/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchCrate,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -19,8 +17,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-cKYHC8qz81P4xtehGQIvNH/g/pa90IJQbKz0RM9tjws=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.Security ];
-
   meta = {
     description = "Save screenshots of urls and webpages from terminal";
     homepage = "https://github.com/pwnwriter/haylxon";
diff --git a/pkgs/by-name/he/health/package.nix b/pkgs/by-name/he/health/package.nix
index 1ccf40443fee..d059ed8fd02f 100644
--- a/pkgs/by-name/he/health/package.nix
+++ b/pkgs/by-name/he/health/package.nix
@@ -13,7 +13,6 @@
   libadwaita,
   libsecret,
   tinysparql,
-  darwin,
   nix-update-script,
 }:
 
@@ -46,16 +45,11 @@ stdenv.mkDerivation rec {
     blueprint-compiler
   ];
 
-  buildInputs =
-    [
-      libadwaita
-      libsecret
-      tinysparql
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.Foundation
-    ];
+  buildInputs = [
+    libadwaita
+    libsecret
+    tinysparql
+  ];
 
   env.NIX_CFLAGS_COMPILE = toString (
     lib.optionals stdenv.cc.isClang [
diff --git a/pkgs/by-name/he/hebbot/package.nix b/pkgs/by-name/he/hebbot/package.nix
index f93de6fc5dd9..2a37463e1bc2 100644
--- a/pkgs/by-name/he/hebbot/package.nix
+++ b/pkgs/by-name/he/hebbot/package.nix
@@ -8,7 +8,6 @@
   openssl,
   autoconf,
   automake,
-  darwin,
   unstableGitUpdater,
   sqlite,
 }:
@@ -37,14 +36,9 @@ rustPlatform.buildRustPackage rec {
       automake
     ];
 
-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optional stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    openssl
+  ];
 
   env = {
     OPENSSL_NO_VENDOR = 1;
diff --git a/pkgs/by-name/ho/hoard/package.nix b/pkgs/by-name/ho/hoard/package.nix
index 52d8badc95fb..11b888c4c59b 100644
--- a/pkgs/by-name/ho/hoard/package.nix
+++ b/pkgs/by-name/ho/hoard/package.nix
@@ -4,8 +4,6 @@
   fetchFromGitHub,
   pkg-config,
   openssl,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -24,13 +22,9 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = [
+    openssl
+  ];
 
   meta = with lib; {
     description = "CLI command organizer written in rust";
diff --git a/pkgs/by-name/ho/homepage-dashboard/package.nix b/pkgs/by-name/ho/homepage-dashboard/package.nix
index 89643bad6a1b..a3271d8ee315 100644
--- a/pkgs/by-name/ho/homepage-dashboard/package.nix
+++ b/pkgs/by-name/ho/homepage-dashboard/package.nix
@@ -7,7 +7,6 @@
   python3,
   stdenv,
   cctools,
-  darwin,
   lib,
   nixosTests,
   enableLocalIcons ? false,
@@ -62,7 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     nodePackages.node-gyp-build
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.IOKit ];
+  ];
 
   env.PYTHON = "${python3}/bin/python";
 
diff --git a/pkgs/by-name/ht/htb-toolkit/package.nix b/pkgs/by-name/ht/htb-toolkit/package.nix
index 9e4cc9f9eec2..bc3ec4f995cc 100644
--- a/pkgs/by-name/ht/htb-toolkit/package.nix
+++ b/pkgs/by-name/ht/htb-toolkit/package.nix
@@ -5,7 +5,6 @@
   pkg-config,
   openssl,
   stdenv,
-  darwin,
   coreutils,
   gnome-keyring,
   libsecret,
@@ -44,10 +43,6 @@ rustPlatform.buildRustPackage {
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       gnome-keyring
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
     ];
 
   postPatch = ''
diff --git a/pkgs/by-name/ht/htop-vim/package.nix b/pkgs/by-name/ht/htop-vim/package.nix
index 937d212c37eb..b10a23cc8c62 100644
--- a/pkgs/by-name/ht/htop-vim/package.nix
+++ b/pkgs/by-name/ht/htop-vim/package.nix
@@ -6,7 +6,6 @@
   autoreconfHook,
   pkg-config,
   ncurses,
-  darwin,
   libcap,
   libnl,
   sensorsSupport ? stdenv.hostPlatform.isLinux,
@@ -53,7 +52,6 @@ stdenv.mkDerivation rec {
 
   buildInputs =
     [ ncurses ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.IOKit ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       libcap
       libnl
diff --git a/pkgs/by-name/ht/httplz/package.nix b/pkgs/by-name/ht/httplz/package.nix
index 391b4f400bc9..695d17726b38 100644
--- a/pkgs/by-name/ht/httplz/package.nix
+++ b/pkgs/by-name/ht/httplz/package.nix
@@ -7,8 +7,6 @@
   pkg-config,
   ronn,
   openssl,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -31,11 +29,7 @@ rustPlatform.buildRustPackage rec {
     ronn
   ];
 
-  buildInputs =
-    [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = [ openssl ];
 
   cargoBuildFlags = [
     "--bin"
diff --git a/pkgs/by-name/hy/hydra-cli/package.nix b/pkgs/by-name/hy/hydra-cli/package.nix
index 0f171a6b81e6..e7467882d85d 100644
--- a/pkgs/by-name/hy/hydra-cli/package.nix
+++ b/pkgs/by-name/hy/hydra-cli/package.nix
@@ -4,8 +4,6 @@
   fetchFromGitHub,
   pkg-config,
   openssl,
-  stdenv,
-  darwin,
   testers,
   hydra-cli,
 }:
@@ -30,7 +28,7 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = [
     openssl
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.Security ];
+  ];
 
   __darwinAllowLocalNetworking = true;
 
diff --git a/pkgs/by-name/hy/hyprpicker/package.nix b/pkgs/by-name/hy/hyprpicker/package.nix
index 8a191389f9b1..d7f5c6dc9416 100644
--- a/pkgs/by-name/hy/hyprpicker/package.nix
+++ b/pkgs/by-name/hy/hyprpicker/package.nix
@@ -20,13 +20,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "hyprpicker" + lib.optionalString debug "-debug";
-  version = "0.4.4";
+  version = "0.4.5";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "hyprpicker";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-hgY0rI/4MsxWMVXTd5pEE904V1apSrhzJblKjqQ8c0s=";
+    hash = "sha256-ta3eCdXyKTVKhCU2/zC+XljU1Tq5huIyuFBtzOcUU4c=";
   };
 
   cmakeBuildType = if debug then "Debug" else "Release";
diff --git a/pkgs/by-name/ic/icon-library/package.nix b/pkgs/by-name/ic/icon-library/package.nix
index 7c3185aedc87..bee499147760 100644
--- a/pkgs/by-name/ic/icon-library/package.nix
+++ b/pkgs/by-name/ic/icon-library/package.nix
@@ -16,7 +16,6 @@
   gtk4,
   gtksourceview5,
   libadwaita,
-  darwin,
 }:
 
 stdenv.mkDerivation rec {
@@ -45,17 +44,13 @@ stdenv.mkDerivation rec {
     rustc
     wrapGAppsHook4
   ];
-  buildInputs =
-    [
-      gdk-pixbuf
-      glib
-      gtk4
-      gtksourceview5
-      libadwaita
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Foundation
-    ];
+  buildInputs = [
+    gdk-pixbuf
+    glib
+    gtk4
+    gtksourceview5
+    libadwaita
+  ];
 
   meta = with lib; {
     homepage = "https://gitlab.gnome.org/World/design/icon-library";
diff --git a/pkgs/by-name/id/idutils/package.nix b/pkgs/by-name/id/idutils/package.nix
index f7640baffc8d..fd6e2b8fdc84 100644
--- a/pkgs/by-name/id/idutils/package.nix
+++ b/pkgs/by-name/id/idutils/package.nix
@@ -12,7 +12,6 @@
   texinfo,
   perl,
   rsync,
-  darwin,
 }:
 
 stdenv.mkDerivation rec {
@@ -31,13 +30,9 @@ stdenv.mkDerivation rec {
     ./bootstrap --force --gnulib-srcdir=${gnulib} --skip-po --bootstrap-sync --no-git
   '';
 
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [
-      emacs
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.CoreServices
-    ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    emacs
+  ];
 
   nativeBuildInputs = [
     gnulib
diff --git a/pkgs/by-name/im/immich-go/package.nix b/pkgs/by-name/im/immich-go/package.nix
index ea2729d7123b..b69bcb15b1e6 100644
--- a/pkgs/by-name/im/immich-go/package.nix
+++ b/pkgs/by-name/im/immich-go/package.nix
@@ -9,13 +9,13 @@
 }:
 buildGoModule rec {
   pname = "immich-go";
-  version = "0.25.3";
+  version = "0.26.0";
 
   src = fetchFromGitHub {
     owner = "simulot";
     repo = "immich-go";
     tag = "v${version}";
-    hash = "sha256-l4D0tE0yB2eLy9QlB9kraOtCUfqVRhYyaMUb/Xvv82c=";
+    hash = "sha256-ya2KCUGHLdKcoxR83YqNG/4GiSgPABUeVaf1jqHtdzE=";
 
     # Inspired by: https://github.com/NixOS/nixpkgs/blob/f2d7a289c5a5ece8521dd082b81ac7e4a57c2c5c/pkgs/applications/graphics/pdfcpu/default.nix#L20-L32
     # The intention here is to write the information into files in the `src`'s
diff --git a/pkgs/by-name/im/implot/demos/default.nix b/pkgs/by-name/im/implot/demos/default.nix
index 00bd02f69ed4..45d5d54ac83a 100644
--- a/pkgs/by-name/im/implot/demos/default.nix
+++ b/pkgs/by-name/im/implot/demos/default.nix
@@ -5,7 +5,6 @@
   fetchpatch,
   cmake,
   pkg-config,
-  darwin,
   fmt,
   gtk3,
   iir1,
@@ -54,18 +53,15 @@ stdenv.mkDerivation {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      curl
-      fmt
-      iir1
-      imgui
-      imnodes
-      implot
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [ gtk3 ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.AppKit ];
+  buildInputs = [
+    curl
+    fmt
+    iir1
+    imgui
+    imnodes
+    implot
+    openssl
+  ] ++ lib.optionals stdenv.hostPlatform.isLinux [ gtk3 ];
 
   meta = {
     description = "Standalone ImPlot Demos";
diff --git a/pkgs/by-name/im/imtui/package.nix b/pkgs/by-name/im/imtui/package.nix
index 4bb5187ab518..a587f8bce7ab 100644
--- a/pkgs/by-name/im/imtui/package.nix
+++ b/pkgs/by-name/im/imtui/package.nix
@@ -12,7 +12,6 @@
   withNcurses ? (!withEmscripten),
   ncurses,
   static ? withEmscripten,
-  darwin,
 }:
 
 stdenv.mkDerivation rec {
@@ -34,8 +33,7 @@ stdenv.mkDerivation rec {
   buildInputs =
     lib.optional withEmscripten emscripten
     ++ lib.optional withCurl curl
-    ++ lib.optional withNcurses ncurses
-    ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.frameworks.Cocoa;
+    ++ lib.optional withNcurses ncurses;
 
   postPatch =
     ''
diff --git a/pkgs/by-name/in/intelli-shell/package.nix b/pkgs/by-name/in/intelli-shell/package.nix
index e2fec783cb76..79cf30615328 100644
--- a/pkgs/by-name/in/intelli-shell/package.nix
+++ b/pkgs/by-name/in/intelli-shell/package.nix
@@ -7,8 +7,6 @@
   openssl,
   sqlite,
   zlib,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -29,16 +27,12 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      libgit2
-      openssl
-      sqlite
-      zlib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = [
+    libgit2
+    openssl
+    sqlite
+    zlib
+  ];
 
   env = {
     OPENSSL_NO_VENDOR = true;
diff --git a/pkgs/by-name/io/ioquake3/package.nix b/pkgs/by-name/io/ioquake3/package.nix
index 80afd46bc92b..466cb477fe5e 100644
--- a/pkgs/by-name/io/ioquake3/package.nix
+++ b/pkgs/by-name/io/ioquake3/package.nix
@@ -18,17 +18,18 @@
   makeDesktopItem,
   freetype,
   mumble,
+  unstableGitUpdater,
 }:
 
 stdenv.mkDerivation {
   pname = "ioquake3";
-  version = "unstable-2023-08-13";
+  version = "0-unstable-2025-04-25";
 
   src = fetchFromGitHub {
     owner = "ioquake";
     repo = "ioq3";
-    rev = "ee950eb7b0e41437cc23a9943254c958da8a61ab";
-    sha256 = "sha256-NfhInwrtw85i2mnv7EtBrrpNaslaQaVhLNlK0I9aYto=";
+    rev = "10afd421f23876e03535bb1958eae8b76371565d";
+    hash = "sha256-5ByaIjmyndiliU5qnt62mj2CFByVv4M4+d3KBAgysck=";
   };
 
   nativeBuildInputs = [
@@ -83,6 +84,8 @@ stdenv.mkDerivation {
     })
   ];
 
+  passthru.updateScript = unstableGitUpdater { };
+
   meta = {
     homepage = "https://ioquake3.org/";
     description = "Fast-paced 3D first-person shooter, a community effort to continue supporting/developing id's Quake III Arena";
diff --git a/pkgs/by-name/ir/iroh/package.nix b/pkgs/by-name/ir/iroh/package.nix
index 01138c9e3517..8906373f993c 100644
--- a/pkgs/by-name/ir/iroh/package.nix
+++ b/pkgs/by-name/ir/iroh/package.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,14 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-O/j+/sRyMtqd4GaER2trn9SEFpZuSlc5q1MTXU+rwLg=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin (
-    with darwin.apple_sdk.frameworks;
-    [
-      Security
-      SystemConfiguration
-    ]
-  );
-
   # Some tests require network access which is not available in nix build sandbox.
   doCheck = false;
 
diff --git a/pkgs/by-name/iw/iwd/package.nix b/pkgs/by-name/iw/iwd/package.nix
index 86b4dd7f86de..9e67a9d4ed7b 100644
--- a/pkgs/by-name/iw/iwd/package.nix
+++ b/pkgs/by-name/iw/iwd/package.nix
@@ -15,12 +15,12 @@
 
 stdenv.mkDerivation rec {
   pname = "iwd";
-  version = "3.3";
+  version = "3.6";
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/network/wireless/iwd.git";
     rev = version;
-    hash = "sha256-+CoXoTlQu7ofXPueia1t1vpeH092fYBxLYB+xV4WNEs=";
+    hash = "sha256-JQfYZtdpJfIZWTbYYj07YWx4auAGQMiedIMpP5DyxSo=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/ja/jasper/package.nix b/pkgs/by-name/ja/jasper/package.nix
index 13f0949c976c..99326fed642d 100644
--- a/pkgs/by-name/ja/jasper/package.nix
+++ b/pkgs/by-name/ja/jasper/package.nix
@@ -6,7 +6,6 @@
   libGL,
   libheif,
   libjpeg,
-  darwin,
   pkg-config,
   stdenv,
   enableHEIFCodec ? true,
@@ -50,9 +49,6 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optionals enableOpenGL [
       libglut
       libGL
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Cocoa
     ];
 
   # Since "build" already exists and is populated, cmake tries to use it,
diff --git a/pkgs/by-name/je/jen/package.nix b/pkgs/by-name/je/jen/package.nix
index 818724a409bb..aac9207c2697 100644
--- a/pkgs/by-name/je/jen/package.nix
+++ b/pkgs/by-name/je/jen/package.nix
@@ -3,8 +3,6 @@
   rustPlatform,
   fetchCrate,
   fetchpatch,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -27,10 +25,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-qYEnKFC1Y24TEY0dXa9N7QNvxhHULq+vd4Wej/RK8HQ=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-  ];
-
   meta = with lib; {
     description = "Simple CLI generation tool for creating large datasets";
     mainProgram = "jen";
diff --git a/pkgs/by-name/ji/jitsi-meet-electron/package.nix b/pkgs/by-name/ji/jitsi-meet-electron/package.nix
index 4d8849bed82c..fb49e4e51023 100644
--- a/pkgs/by-name/ji/jitsi-meet-electron/package.nix
+++ b/pkgs/by-name/ji/jitsi-meet-electron/package.nix
@@ -11,18 +11,9 @@
   libXi,
   libXtst,
   zlib,
-  darwin,
   electron,
 }:
 
-let
-  inherit (darwin.apple_sdk.frameworks)
-    Carbon
-    CoreFoundation
-    ApplicationServices
-    OpenGL
-    ;
-in
 buildNpmPackage rec {
   pname = "jitsi-meet-electron";
   version = "2025.2.0";
@@ -43,20 +34,13 @@ buildNpmPackage rec {
     ];
 
   # robotjs node-gyp dependencies
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [
-      libpng
-      libX11
-      libXi
-      libXtst
-      zlib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Carbon
-      CoreFoundation
-      ApplicationServices
-      OpenGL
-    ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    libpng
+    libX11
+    libXi
+    libXtst
+    zlib
+  ];
 
   npmDepsHash = "sha256-TckV91RJo06OKb8nIvxBCxu28qyHtA/ACDshOlaCQxA=";
 
diff --git a/pkgs/by-name/jo/josh/package.nix b/pkgs/by-name/jo/josh/package.nix
index cfb33fa796bb..a2544073b83c 100644
--- a/pkgs/by-name/jo/josh/package.nix
+++ b/pkgs/by-name/jo/josh/package.nix
@@ -1,6 +1,5 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
   libgit2,
@@ -8,7 +7,6 @@
   pkg-config,
   makeWrapper,
   git,
-  darwin,
 }:
 
 let
@@ -40,14 +38,10 @@ rustPlatform.buildRustPackage {
     makeWrapper
   ];
 
-  buildInputs =
-    [
-      libgit2
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.Security
-    ];
+  buildInputs = [
+    libgit2
+    openssl
+  ];
 
   cargoBuildFlags = cargoFlags;
   cargoTestFlags = cargoFlags;
diff --git a/pkgs/by-name/jo/joshuto/package.nix b/pkgs/by-name/jo/joshuto/package.nix
index fb923caea595..72e1c48a3d94 100644
--- a/pkgs/by-name/jo/joshuto/package.nix
+++ b/pkgs/by-name/jo/joshuto/package.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   installShellFiles,
   stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -23,10 +22,6 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Foundation
-  ];
-
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd joshuto \
       --bash <($out/bin/joshuto completions bash) \
diff --git a/pkgs/by-name/ju/juce/package.nix b/pkgs/by-name/ju/juce/package.nix
index 308103c09bb7..16956d078fc9 100644
--- a/pkgs/by-name/ju/juce/package.nix
+++ b/pkgs/by-name/ju/juce/package.nix
@@ -1,7 +1,6 @@
 {
   lib,
   stdenv,
-  overrideSDK,
   fetchFromGitHub,
 
   # Native build inputs
@@ -33,14 +32,6 @@
   nix-update-script,
 }:
 
-let
-  # Rebind this in a separate let-binding so that we can then rebind stdenv without infrec below
-  stdenv' = stdenv;
-in
-let
-  stdenv = if stdenv'.hostPlatform.isDarwin then overrideSDK stdenv' "11.0" else stdenv';
-in
-
 stdenv.mkDerivation (finalAttrs: {
   pname = "juce";
   version = "8.0.7";
diff --git a/pkgs/by-name/ju/jumpy/package.nix b/pkgs/by-name/ju/jumpy/package.nix
index a3839536694b..5c2ac20a8e82 100644
--- a/pkgs/by-name/ju/jumpy/package.nix
+++ b/pkgs/by-name/ju/jumpy/package.nix
@@ -12,7 +12,6 @@
   vulkan-loader,
   wayland,
   xorg,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -50,7 +49,6 @@ rustPlatform.buildRustPackage rec {
       xorg.libXrandr
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk_11_0.frameworks.Cocoa
       rustPlatform.bindgenHook
     ];
 
diff --git a/pkgs/by-name/ka/kakoune-lsp/package.nix b/pkgs/by-name/ka/kakoune-lsp/package.nix
index 80e0c4b31c74..bbbe29f0fd80 100644
--- a/pkgs/by-name/ka/kakoune-lsp/package.nix
+++ b/pkgs/by-name/ka/kakoune-lsp/package.nix
@@ -4,10 +4,6 @@
   fetchFromGitHub,
   replaceVars,
   perl,
-  stdenv,
-  CoreServices,
-  Security,
-  SystemConfiguration,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -26,12 +22,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-fb6RDcOLtkrUqw+BX2oa43d84BGF8IA2HxhdGgB94iU=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    CoreServices
-    Security
-    SystemConfiguration
-  ];
-
   meta = {
     description = "Kakoune Language Server Protocol Client";
     homepage = "https://github.com/kakoune-lsp/kakoune-lsp";
diff --git a/pkgs/by-name/ka/kana/package.nix b/pkgs/by-name/ka/kana/package.nix
index ba8cf79ef86a..fc4d2aa1b860 100644
--- a/pkgs/by-name/ka/kana/package.nix
+++ b/pkgs/by-name/ka/kana/package.nix
@@ -12,7 +12,6 @@
   desktop-file-utils,
   libadwaita,
   gst_all_1,
-  darwin,
 }:
 
 stdenv.mkDerivation rec {
@@ -53,10 +52,7 @@ stdenv.mkDerivation rec {
       gst-plugins-base
       gst-plugins-bad
       gst-plugins-good
-    ])
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Foundation
-    ];
+    ]);
 
   # Workaround for the gettext-sys issue
   # https://github.com/Koka/gettext-rs/issues/114
diff --git a/pkgs/by-name/ka/kanha/package.nix b/pkgs/by-name/ka/kanha/package.nix
index 1e42a8430dd8..1395e113ac21 100644
--- a/pkgs/by-name/ka/kanha/package.nix
+++ b/pkgs/by-name/ka/kanha/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchCrate,
-  stdenv,
-  darwin,
   openssl,
 }:
 
@@ -20,16 +18,7 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-bO37UYApe1CbwcfG8j/1UPu6DlYqlGPLsh0epxh8x3M=";
 
-  buildInputs =
-    [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        Security
-        CoreFoundation
-        SystemConfiguration
-      ]
-    );
+  buildInputs = [ openssl ];
 
   meta = {
     description = "Web-app pentesting suite written in rust";
diff --git a/pkgs/by-name/kb/kbt/package.nix b/pkgs/by-name/kb/kbt/package.nix
index d100621bff69..08b1503ea263 100644
--- a/pkgs/by-name/kb/kbt/package.nix
+++ b/pkgs/by-name/kb/kbt/package.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   stdenv,
   pkg-config,
-  darwin,
   xorg,
 }:
 
@@ -26,13 +25,9 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.AppKit
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [
-      xorg.libX11
-    ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    xorg.libX11
+  ];
 
   meta = with lib; {
     description = "Keyboard tester in terminal";
diff --git a/pkgs/by-name/kc/kcl/package.nix b/pkgs/by-name/kc/kcl/package.nix
index 2a4abe1194ce..7df5288488e1 100644
--- a/pkgs/by-name/kc/kcl/package.nix
+++ b/pkgs/by-name/kc/kcl/package.nix
@@ -1,6 +1,5 @@
 {
   buildGoModule,
-  darwin,
   fetchFromGitHub,
   installShellFiles,
   kclvm_cli,
@@ -34,16 +33,10 @@ buildGoModule rec {
     installShellFiles
   ];
 
-  buildInputs =
-    [
-      kclvm
-      kclvm_cli
-    ]
-    ++ (lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.CoreServices
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ]);
+  buildInputs = [
+    kclvm
+    kclvm_cli
+  ];
 
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     export HOME=$(mktemp -d)
diff --git a/pkgs/by-name/kc/kclvm/package.nix b/pkgs/by-name/kc/kclvm/package.nix
index 7c33e7e0b9eb..94eb2b4bf18d 100644
--- a/pkgs/by-name/kc/kclvm/package.nix
+++ b/pkgs/by-name/kc/kclvm/package.nix
@@ -5,7 +5,6 @@
   fetchFromGitHub,
   protobuf,
   pkg-config,
-  darwin,
   rustc,
 }:
 rustPlatform.buildRustPackage rec {
@@ -24,13 +23,7 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-o7YFyqRWAMjq23mcAqDrcN4infdBgp1KNvviYOLR35s=";
 
-  buildInputs =
-    [ rustc ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.CoreServices
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [ rustc ];
 
   postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
     install_name_tool -id $out/lib/libkclvm_cli_cdylib.dylib $out/lib/libkclvm_cli_cdylib.dylib
diff --git a/pkgs/by-name/kc/kclvm_cli/package.nix b/pkgs/by-name/kc/kclvm_cli/package.nix
index 4d350cebdf48..b205e1484df0 100644
--- a/pkgs/by-name/kc/kclvm_cli/package.nix
+++ b/pkgs/by-name/kc/kclvm_cli/package.nix
@@ -1,10 +1,8 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitHub,
   kclvm,
-  darwin,
   rustc,
 }:
 rustPlatform.buildRustPackage rec {
@@ -23,16 +21,10 @@ rustPlatform.buildRustPackage rec {
   cargoHash = "sha256-ZhrjxHqwWwcVkCVkJJnVm2CZLfRlrI2383ejgI+B2KQ=";
   cargoPatches = [ ./cargo_lock.patch ];
 
-  buildInputs =
-    [
-      kclvm
-      rustc
-    ]
-    ++ (lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.CoreServices
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ]);
+  buildInputs = [
+    kclvm
+    rustc
+  ];
 
   meta = with lib; {
     description = "A high-performance implementation of KCL written in Rust that uses LLVM as the compiler backend";
diff --git a/pkgs/by-name/ke/kepler/package.nix b/pkgs/by-name/ke/kepler/package.nix
index 845e6fff4ce3..ebdadf611ed2 100644
--- a/pkgs/by-name/ke/kepler/package.nix
+++ b/pkgs/by-name/ke/kepler/package.nix
@@ -1,7 +1,5 @@
 {
   lib,
-  stdenv,
-  darwin,
   fetchFromGitHub,
   libpq,
   openssl,
@@ -28,15 +26,11 @@ rustPlatform.buildRustPackage {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      libpq
-      openssl
-      zstd
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = [
+    libpq
+    openssl
+    zstd
+  ];
 
   env = {
     ZSTD_SYS_USE_PKG_CONFIG = true;
diff --git a/pkgs/by-name/ki/kitty/package.nix b/pkgs/by-name/ki/kitty/package.nix
index 9546a34ab7b0..89acf9a051eb 100644
--- a/pkgs/by-name/ki/kitty/package.nix
+++ b/pkgs/by-name/ki/kitty/package.nix
@@ -28,11 +28,6 @@
   installShellFiles,
   dbus,
   sudo,
-  Libsystem,
-  Cocoa,
-  Kernel,
-  UniformTypeIdentifiers,
-  UserNotifications,
   libcanberra,
   libicns,
   wayland-scanner,
@@ -85,17 +80,10 @@ buildPythonApplication rec {
       xxHash
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Cocoa
-      Kernel
-      UniformTypeIdentifiers
-      UserNotifications
       libpng
       python3
       zlib
     ]
-    ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
-      Libsystem
-    ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       fontconfig
       libunistring
diff --git a/pkgs/by-name/ko/komac/package.nix b/pkgs/by-name/ko/komac/package.nix
index 84abcc2a04bd..70824ce6352c 100644
--- a/pkgs/by-name/ko/komac/package.nix
+++ b/pkgs/by-name/ko/komac/package.nix
@@ -5,7 +5,6 @@
   pkg-config,
   openssl,
   rustPlatform,
-  darwin,
   testers,
   komac,
   dbus,
@@ -37,17 +36,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
       installShellFiles
     ];
 
-  buildInputs =
-    [
-      dbus
-      openssl
-      zstd
-      bzip2
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    dbus
+    openssl
+    zstd
+    bzip2
+  ];
 
   env = {
     OPENSSL_NO_VENDOR = true;
diff --git a/pkgs/by-name/ko/kord/package.nix b/pkgs/by-name/ko/kord/package.nix
index d1b830abf4aa..b25304679cbf 100644
--- a/pkgs/by-name/ko/kord/package.nix
+++ b/pkgs/by-name/ko/kord/package.nix
@@ -1,7 +1,6 @@
 {
   lib,
   stdenv,
-  darwin,
   fetchFromGitHub,
   fetchpatch,
   rustPlatform,
@@ -41,9 +40,7 @@ rustPlatform.buildRustPackage rec {
     lib.optionals stdenv.hostPlatform.isLinux [ pkg-config ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [ rustPlatform.bindgenHook ];
 
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [ alsa-lib ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.AudioUnit ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ alsa-lib ];
 
   meta = with lib; {
     description = "Music theory binary and library for Rust";
diff --git a/pkgs/by-name/ko/kore/package.nix b/pkgs/by-name/ko/kore/package.nix
index 34b5612d9b1f..4f95c0d3382c 100644
--- a/pkgs/by-name/ko/kore/package.nix
+++ b/pkgs/by-name/ko/kore/package.nix
@@ -2,15 +2,15 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   openssl,
   curl,
-  postgresql_16,
+  libpq,
   yajl,
 }:
 
 stdenv.mkDerivation rec {
   pname = "kore";
-  # TODO: Check on next update whether postgresql 17 is supported.
   version = "4.2.3";
 
   src = fetchFromGitHub {
@@ -20,13 +20,28 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-p0M2P02xwww5EnT28VnEtj5b+/jkPW3YkJMuK79vp4k=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/jorisvink/kore/commit/978cb0ab79c9c939c35996f34f7d835f9c671831.patch";
+      hash = "sha256-uHTWiliM4m2i9/6GQQfnAo31XBXd/2+fzysPeNo2dQ0=";
+    })
+    (fetchpatch {
+      url = "https://github.com/jorisvink/kore/commit/6122affe22bf676eed0f544e421c53699aa7a2e2.patch";
+      hash = "sha256-xaiUOjBJPEgEwwuseXe6VbOTkOCKdQ5tuwDdL7DojHM=";
+    })
+  ];
+
   buildInputs = [
     openssl
     curl
-    postgresql_16
+    libpq
     yajl
   ];
 
+  nativeBuildInputs = [
+    libpq.pg_config
+  ];
+
   makeFlags = [
     "PREFIX=${placeholder "out"}"
     "ACME=1"
diff --git a/pkgs/by-name/kt/kty/package.nix b/pkgs/by-name/kt/kty/package.nix
index cd197e43bec0..0c1516e33c71 100644
--- a/pkgs/by-name/kt/kty/package.nix
+++ b/pkgs/by-name/kt/kty/package.nix
@@ -4,8 +4,6 @@
   fetchFromGitHub,
   pkg-config,
   openssl,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -27,16 +25,9 @@ rustPlatform.buildRustPackage rec {
     OPENSSL_NO_VENDOR = 1;
   };
 
-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk;
-      [
-        frameworks.SystemConfiguration
-      ]
-    );
+  buildInputs = [
+    openssl
+  ];
 
   useFetchCargoVendor = true;
   cargoHash = "sha256-nJ+nof2YhyLrNuLVy69kYj5tw+aG4IJm6nVxHkczbko=";
diff --git a/pkgs/by-name/ku/kubetui/package.nix b/pkgs/by-name/ku/kubetui/package.nix
index 16d3029eccd8..d271b1c88329 100644
--- a/pkgs/by-name/ku/kubetui/package.nix
+++ b/pkgs/by-name/ku/kubetui/package.nix
@@ -2,8 +2,6 @@
   rustPlatform,
   lib,
   fetchFromGitHub,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -21,13 +19,6 @@ rustPlatform.buildRustPackage rec {
     "--skip=workers::kube::store::tests::kubeconfigからstateを生成"
   ];
 
-  buildInputs = lib.optionals (stdenv.hostPlatform.isDarwin) (
-    with darwin.apple_sdk;
-    [
-      frameworks.CoreGraphics
-      frameworks.AppKit
-    ]
-  );
   useFetchCargoVendor = true;
   cargoHash = "sha256-fMrlZMe2uD+ImM6zPXzo/+/Eto2MeIyscYfU8msLJFw=";
 
diff --git a/pkgs/by-name/la/lazymc/package.nix b/pkgs/by-name/la/lazymc/package.nix
index d598a4ca7c07..85ef9ddf9806 100644
--- a/pkgs/by-name/la/lazymc/package.nix
+++ b/pkgs/by-name/la/lazymc/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  darwin,
   nix-update-script,
 }:
 
@@ -21,10 +19,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-jqqqWZKO1HgwxLBGMz9rlFQ5xmZTycfUZjqHf+uVTBQ=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.CoreServices
-  ];
-
   passthru.updateScript = nix-update-script { };
 
   meta = with lib; {
diff --git a/pkgs/by-name/la/lazysql/package.nix b/pkgs/by-name/la/lazysql/package.nix
index 9ca3eb727e77..82dabbcd3fff 100644
--- a/pkgs/by-name/la/lazysql/package.nix
+++ b/pkgs/by-name/la/lazysql/package.nix
@@ -26,9 +26,7 @@ buildGoModule rec {
     "-X main.version=${version}"
   ];
 
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [ xorg.libX11 ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.Cocoa ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ xorg.libX11 ];
 
   passthru.tests.version = testers.testVersion {
     package = lazysql;
diff --git a/pkgs/by-name/ld/ldc/package.nix b/pkgs/by-name/ld/ldc/package.nix
index 95b6ffa898a0..03f87a50d91c 100644
--- a/pkgs/by-name/ld/ldc/package.nix
+++ b/pkgs/by-name/ld/ldc/package.nix
@@ -16,7 +16,6 @@
   lit,
   gdb,
   unzip,
-  darwin,
 
   ldcBootstrap ? callPackage ./bootstrap.nix { },
 }:
@@ -77,9 +76,6 @@ stdenv.mkDerivation (finalAttrs: {
       ninja
       unzip
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Foundation
-    ]
     ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
       # https://github.com/NixOS/nixpkgs/pull/36378#issuecomment-385034818
       gdb
diff --git a/pkgs/by-name/le/leaf/package.nix b/pkgs/by-name/le/leaf/package.nix
index 31cac3531b68..12181d2036ac 100644
--- a/pkgs/by-name/le/leaf/package.nix
+++ b/pkgs/by-name/le/leaf/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,11 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-RQ9fQfYfpsFAA5CzR3ICLIEYb00qzUsWAQKSrK/488g=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.CoreFoundation
-    darwin.apple_sdk.frameworks.SystemConfiguration
-  ];
-
   meta = with lib; {
     description = "Simple system fetch written in rust";
     homepage = "https://github.com/IogaMaster/leaf";
diff --git a/pkgs/by-name/le/leetcode-cli/package.nix b/pkgs/by-name/le/leetcode-cli/package.nix
index 25f05d80fb52..df6619838059 100644
--- a/pkgs/by-name/le/leetcode-cli/package.nix
+++ b/pkgs/by-name/le/leetcode-cli/package.nix
@@ -8,7 +8,6 @@
   dbus,
   sqlite,
   stdenv,
-  darwin,
   testers,
   leetcode-cli,
 }:
@@ -30,16 +29,11 @@ rustPlatform.buildRustPackage rec {
     installShellFiles
   ];
 
-  buildInputs =
-    [
-      openssl
-      dbus
-      sqlite
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    openssl
+    dbus
+    sqlite
+  ];
 
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd leetcode \
diff --git a/pkgs/by-name/le/legba/package.nix b/pkgs/by-name/le/legba/package.nix
index 99e1862dd5f9..f6802c334951 100644
--- a/pkgs/by-name/le/legba/package.nix
+++ b/pkgs/by-name/le/legba/package.nix
@@ -6,8 +6,6 @@
   pkg-config,
   openssl,
   samba,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -28,14 +26,10 @@ rustPlatform.buildRustPackage rec {
     cmake
     pkg-config
   ];
-  buildInputs =
-    [
-      openssl.dev
-      samba
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    openssl.dev
+    samba
+  ];
 
   # Paho C test fails due to permission issue
   doCheck = false;
diff --git a/pkgs/by-name/le/lenmus/package.nix b/pkgs/by-name/le/lenmus/package.nix
index 4a7fbb5409db..5b01f4f6aef6 100644
--- a/pkgs/by-name/le/lenmus/package.nix
+++ b/pkgs/by-name/le/lenmus/package.nix
@@ -16,14 +16,10 @@
   wxsqlite3,
   fluidsynth,
   fontconfig,
-  darwin,
   soundfont-fluid,
   openlilylib-fonts,
 }:
 
-let
-  inherit (darwin.apple_sdk.frameworks) Cocoa;
-in
 stdenv.mkDerivation (finalAttrs: {
   pname = "lenmus";
   version = "6.0.1";
@@ -54,23 +50,19 @@ stdenv.mkDerivation (finalAttrs: {
       makeWrapper
     ];
 
-  buildInputs =
-    [
-      boost
-      portmidi
-      sqlite
-      freetype
-      libpng
-      pngpp
-      zlib
-      wxGTK32
-      wxsqlite3
-      fluidsynth
-      fontconfig
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Cocoa
-    ];
+  buildInputs = [
+    boost
+    portmidi
+    sqlite
+    freetype
+    libpng
+    pngpp
+    zlib
+    wxGTK32
+    wxsqlite3
+    fluidsynth
+    fontconfig
+  ];
 
   preConfigure = ''
     mkdir res/fonts
diff --git a/pkgs/by-name/li/libapparmor/apparmorRulesFromClosure.nix b/pkgs/by-name/li/libapparmor/apparmorRulesFromClosure.nix
new file mode 100644
index 000000000000..a12b8f0459be
--- /dev/null
+++ b/pkgs/by-name/li/libapparmor/apparmorRulesFromClosure.nix
@@ -0,0 +1,35 @@
+{
+  runCommand,
+  closureInfo,
+  lib,
+}:
+{
+  # The store path of the derivation is given in $path
+  additionalRules ? [ ],
+  # TODO: factorize here some other common paths
+  # that may emerge from use cases.
+  baseRules ? [
+    "r $path"
+    "r $path/etc/**"
+    "mr $path/share/**"
+    # Note that not all libraries are prefixed with "lib",
+    # eg. glibc-2.30/lib/ld-2.30.so
+    "mr $path/lib/**.so*"
+    "mr $path/lib64/**.so*"
+    # eg. glibc-2.30/lib/gconv/gconv-modules
+    "r $path/lib/**"
+    "r $path/lib64/**"
+    # Internal executables
+    "ixr $path/libexec/**"
+  ],
+  name ? "",
+}:
+rootPaths:
+runCommand ("apparmor-closure-rules" + lib.optionalString (name != "") "-${name}") { } ''
+  touch $out
+  while read -r path
+  do printf >>$out "%s,\n" ${
+    lib.concatMapStringsSep " " (x: "\"${x}\"") (baseRules ++ additionalRules)
+  }
+  done <${closureInfo { inherit rootPaths; }}/store-paths
+''
diff --git a/pkgs/by-name/li/libapparmor/package.nix b/pkgs/by-name/li/libapparmor/package.nix
new file mode 100644
index 000000000000..99aa886a8eaa
--- /dev/null
+++ b/pkgs/by-name/li/libapparmor/package.nix
@@ -0,0 +1,115 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitLab,
+  autoreconfHook,
+  autoconf-archive,
+  pkg-config,
+  which,
+  flex,
+  bison,
+  withPerl ?
+    stdenv.hostPlatform == stdenv.buildPlatform && lib.meta.availableOn stdenv.hostPlatform perl,
+  perl,
+  withPython ?
+    !stdenv.hostPlatform.isStatic && lib.meta.availableOn stdenv.hostPlatform python3Packages.python,
+  python3Packages,
+  swig,
+  ncurses,
+  libxcrypt,
+
+  # test
+  dejagnu,
+
+  # passthru
+  nix-update-script,
+  nixosTests,
+  callPackage,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libapparmor";
+  version = "4.1.0";
+
+  src = fetchFromGitLab {
+    owner = "apparmor";
+    repo = "apparmor";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-oj6mGw/gvoRGpJqw72Lk6LJuurg8efjiV1pvZYbXz6A=";
+  };
+  sourceRoot = "${finalAttrs.src.name}/libraries/libapparmor";
+
+  postPatch = ''
+    substituteInPlace swig/perl/Makefile.am \
+      --replace-fail install_vendor install_site
+  '';
+
+  strictDeps = true;
+
+  nativeBuildInputs =
+    [
+      autoconf-archive
+      autoreconfHook
+      bison
+      flex
+      pkg-config
+      swig
+      ncurses
+      which
+      dejagnu
+    ]
+    ++ lib.optionals withPython [
+      python3Packages.setuptools
+    ]
+    ++ lib.optionals (!finalAttrs.finalPackage.doCheck) [
+      # TODO FIXME This is a super ugly HACK.
+      # perl is required for podchecker.
+      # It is a native build input on native platform because checks are enabled there.
+      # Checks can't be enabled on cross, but moving perl to
+      # nativeCheckInputs causes rebuilds on native compile.
+      # Thus, hacks!
+      # This should just be made unconditional and removed from nativeCheckInputs.
+      perl
+    ];
+
+  nativeCheckInputs = [
+    python3Packages.pythonImportsCheckHook
+    perl
+  ];
+
+  buildInputs =
+    [ libxcrypt ] ++ (lib.optional withPerl perl) ++ (lib.optional withPython python3Packages.python);
+
+  # required to build apparmor-parser
+  dontDisableStatic = true;
+
+  # https://gitlab.com/apparmor/apparmor/issues/1
+  configureFlags = [
+    (lib.withFeature withPerl "perl")
+    (lib.withFeature withPython "python")
+  ];
+
+  doCheck = withPerl && withPython;
+
+  checkInputs = [ dejagnu ];
+
+  pythonImportsCheck = [
+    "LibAppArmor"
+  ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+    tests.nixos = nixosTests.apparmor;
+    apparmorRulesFromClosure = callPackage ./apparmorRulesFromClosure.nix { };
+  };
+
+  meta = {
+    homepage = "https://apparmor.net/";
+    description = "Mandatory access control system - core library";
+    license = with lib.licenses; [
+      gpl2Only
+      lgpl21Only
+    ];
+    maintainers = lib.teams.apparmor.members;
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/li/libaribcaption/package.nix b/pkgs/by-name/li/libaribcaption/package.nix
index 353f31c0e128..51d1da2f66be 100644
--- a/pkgs/by-name/li/libaribcaption/package.nix
+++ b/pkgs/by-name/li/libaribcaption/package.nix
@@ -7,10 +7,6 @@
   fontconfig,
   freetype,
 
-  ApplicationServices,
-  CoreFoundation,
-  CoreGraphics,
-  CoreText,
 }:
 
 stdenv.mkDerivation rec {
@@ -28,17 +24,10 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [ "-DBUILD_SHARED_LIBS=ON" ];
 
-  buildInputs =
-    lib.optionals (!stdenv.hostPlatform.isDarwin) [
-      fontconfig
-      freetype
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      ApplicationServices
-      CoreFoundation
-      CoreGraphics
-      CoreText
-    ];
+  buildInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) [
+    fontconfig
+    freetype
+  ];
 
   meta = with lib; {
     description = "Portable ARIB STD-B24 Caption Decoder/Renderer";
diff --git a/pkgs/by-name/li/libass/package.nix b/pkgs/by-name/li/libass/package.nix
index ba3fa9a74633..68a443b16e66 100644
--- a/pkgs/by-name/li/libass/package.nix
+++ b/pkgs/by-name/li/libass/package.nix
@@ -11,7 +11,6 @@
   fontconfig ? null, # fontconfig support
   largeTilesSupport ? false, # Use larger tiles in the rasterizer
   libiconv,
-  darwin,
 }:
 
 assert fontconfigSupport -> fontconfig != null;
@@ -49,9 +48,6 @@ stdenv.mkDerivation rec {
     ++ lib.optional fontconfigSupport fontconfig
     ++ lib.optional stdenv.hostPlatform.isDarwin [
       libiconv
-      darwin.apple_sdk.frameworks.ApplicationServices
-      darwin.apple_sdk.frameworks.CoreFoundation
-      darwin.apple_sdk.frameworks.CoreText
     ];
 
   meta = with lib; {
diff --git a/pkgs/by-name/li/libcdio/package.nix b/pkgs/by-name/li/libcdio/package.nix
new file mode 100644
index 000000000000..73f1f6de7667
--- /dev/null
+++ b/pkgs/by-name/li/libcdio/package.nix
@@ -0,0 +1,94 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  nix-update-script,
+  autoreconfHook,
+  testers,
+  texinfo,
+  libcddb,
+  pkg-config,
+  ncurses,
+  help2man,
+  libiconv,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libcdio";
+  version = "2.2.0";
+
+  src = fetchFromGitHub {
+    owner = "libcdio";
+    repo = "libcdio";
+    tag = finalAttrs.version;
+    hash = "sha256-izjZk2kz9PkLm9+INUdl1e7jMz3nUsQKdplKI9Io+CM=";
+  };
+
+  env = lib.optionalAttrs stdenv.is32bit {
+    NIX_CFLAGS_COMPILE = "-D_LARGEFILE64_SOURCE";
+  };
+
+  postPatch = ''
+    patchShebangs .
+    echo "
+    @set UPDATED 1 January 1970
+    @set UPDATED-MONTH January 1970
+    @set EDITION ${finalAttrs.version}
+    @set VERSION ${finalAttrs.version}
+    " > doc/version.texi
+  '';
+
+  configureFlags = [
+    (lib.enableFeature true "maintainer-mode")
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+    help2man
+    autoreconfHook
+    texinfo
+  ];
+
+  buildInputs = [
+    libcddb
+    libiconv
+    ncurses
+  ];
+
+  enableParallelBuilding = true;
+
+  doCheck = !stdenv.hostPlatform.isDarwin;
+
+  outputs = [
+    "out"
+    "lib"
+    "dev"
+    "info"
+    "man"
+  ];
+
+  passthru = {
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Library for OS-independent CD-ROM and CD image access";
+    longDescription = ''
+      GNU libcdio is a library for OS-independent CD-ROM and
+      CD image access.  It includes a library for working with
+      ISO-9660 filesystems (libiso9660), as well as utility
+      programs such as an audio CD player and an extractor.
+    '';
+    homepage = "https://www.gnu.org/software/libcdio/";
+    license = lib.licenses.gpl2Plus;
+    pkgConfigModules = [
+      "libcdio"
+      "libcdio++"
+      "libiso9660"
+      "libiso9660++"
+      "libudf"
+    ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/li/libclipboard/package.nix b/pkgs/by-name/li/libclipboard/package.nix
index e0eb69704199..122cbb651ab9 100644
--- a/pkgs/by-name/li/libclipboard/package.nix
+++ b/pkgs/by-name/li/libclipboard/package.nix
@@ -6,7 +6,6 @@
   libxcb,
   libXau,
   libXdmcp,
-  darwin,
   lib,
 }:
 
@@ -25,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
     libxcb
     libXau
     libXdmcp
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.Cocoa ];
+  ];
   nativeBuildInputs = [
     cmake
     pkg-config
diff --git a/pkgs/by-name/li/libdeltachat/package.nix b/pkgs/by-name/li/libdeltachat/package.nix
index f2f86625c423..5420475ae5af 100644
--- a/pkgs/by-name/li/libdeltachat/package.nix
+++ b/pkgs/by-name/li/libdeltachat/package.nix
@@ -15,7 +15,6 @@
   sqlcipher,
   sqlite,
   fixDarwinDylibNames,
-  darwin,
   libiconv,
 }:
 
@@ -59,9 +58,6 @@ stdenv.mkDerivation rec {
       sqlite
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.CoreFoundation
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
       libiconv
     ];
 
diff --git a/pkgs/by-name/li/libdiscid/package.nix b/pkgs/by-name/li/libdiscid/package.nix
index e863863fe6f1..3be92789614b 100644
--- a/pkgs/by-name/li/libdiscid/package.nix
+++ b/pkgs/by-name/li/libdiscid/package.nix
@@ -4,7 +4,6 @@
   fetchurl,
   cmake,
   pkg-config,
-  darwin,
 }:
 
 stdenv.mkDerivation rec {
@@ -16,8 +15,6 @@ stdenv.mkDerivation rec {
     pkg-config
   ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.IOKit ];
-
   src = fetchurl {
     url = "http://ftp.musicbrainz.org/pub/musicbrainz/${pname}/${pname}-${version}.tar.gz";
     sha256 = "sha256-3V6PHJrq1ELiO3SanMkzY3LmLoitcHmitiiVsDkMsoI=";
diff --git a/pkgs/by-name/li/libfreefare/package.nix b/pkgs/by-name/li/libfreefare/package.nix
index 8aa06f577a95..247fa1607940 100644
--- a/pkgs/by-name/li/libfreefare/package.nix
+++ b/pkgs/by-name/li/libfreefare/package.nix
@@ -6,7 +6,6 @@
   pkg-config,
   libnfc,
   openssl,
-  darwin,
 }:
 
 stdenv.mkDerivation {
@@ -22,15 +21,10 @@ stdenv.mkDerivation {
     autoreconfHook
     pkg-config
   ];
-  buildInputs =
-    [
-      libnfc
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.libobjc
-      darwin.apple_sdk
-    ];
+  buildInputs = [
+    libnfc
+    openssl
+  ];
 
   env = {
     NIX_CFLAGS_COMPILE = toString [
diff --git a/pkgs/by-name/li/libhv/package.nix b/pkgs/by-name/li/libhv/package.nix
index 4eb104dbce54..c7fabd5eb5c6 100644
--- a/pkgs/by-name/li/libhv/package.nix
+++ b/pkgs/by-name/li/libhv/package.nix
@@ -5,7 +5,6 @@
   cmake,
   curl,
   openssl,
-  darwin,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -24,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     curl
     openssl
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.frameworks.Security;
+  ];
 
   cmakeFlags = [
     "-DENABLE_UDS=ON"
diff --git a/pkgs/by-name/li/libpciaccess/package.nix b/pkgs/by-name/li/libpciaccess/package.nix
new file mode 100644
index 000000000000..e18595b1caf2
--- /dev/null
+++ b/pkgs/by-name/li/libpciaccess/package.nix
@@ -0,0 +1,81 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  testers,
+  writeScript,
+  pkg-config,
+  meson,
+  ninja,
+  zlib,
+  netbsd,
+  hwdata,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libpciaccess";
+  version = "0.18.1";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libpciaccess-${finalAttrs.version}.tar.xz";
+    hash = "sha256-SvQ0RLOK21VF0O0cLORtlgjMR7McI4f8UYFlZ2Wm+nY=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    meson
+    ninja
+  ];
+
+  buildInputs =
+    [ zlib ]
+    ++ lib.optionals stdenv.hostPlatform.isNetBSD [
+      netbsd.libarch
+      netbsd.libpci
+    ];
+
+  mesonFlags = [
+    (lib.mesonOption "pci-ids" "${hwdata}/share/hwdata")
+    (lib.mesonEnable "zlib" true)
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "Generic PCI access library";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libpciaccess";
+    license = with lib.licenses; [
+      mit
+      isc
+      x11
+    ];
+    pkgConfigModules = [ "pciaccess" ];
+    # https://gitlab.freedesktop.org/xorg/lib/libpciaccess/-/blob/6cd5a4afbb70868c7746de8d50dea59e02e9acf2/configure.ac#L108-114
+    platforms =
+      with lib.platforms;
+      cygwin
+      ++ freebsd
+      ++ illumos
+      ++ linux
+      ++ lib.platforms.netbsd # otherwise netbsd from the function arguments is used
+      ++ openbsd;
+    badPlatforms = [
+      # mandatory shared library
+      lib.systems.inspect.platformPatterns.isStatic
+    ];
+  };
+})
diff --git a/pkgs/by-name/li/libproxy/package.nix b/pkgs/by-name/li/libproxy/package.nix
index 67ccc456dc74..191a7d484d69 100644
--- a/pkgs/by-name/li/libproxy/package.nix
+++ b/pkgs/by-name/li/libproxy/package.nix
@@ -2,7 +2,6 @@
   lib,
   _experimental-update-script-combinators,
   curl,
-  darwin,
   duktape,
   fetchFromGitHub,
   gi-docgen,
@@ -88,17 +87,10 @@ stdenv.mkDerivation (finalAttrs: {
       curl
       duktape
     ]
-    ++ (
-      if stdenv.hostPlatform.isDarwin then
-        (with darwin.apple_sdk.frameworks; [
-          Foundation
-        ])
-      else
-        [
-          glib
-          gsettings-desktop-schemas
-        ]
-    );
+    ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
+      glib
+      gsettings-desktop-schemas
+    ];
 
   mesonFlags =
     [
diff --git a/pkgs/by-name/li/libpthread-stubs/package.nix b/pkgs/by-name/li/libpthread-stubs/package.nix
new file mode 100644
index 000000000000..8ad5577de7b6
--- /dev/null
+++ b/pkgs/by-name/li/libpthread-stubs/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  testers,
+  writeScript,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libpthread-stubs";
+  version = "0.5";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libpthread-stubs-${finalAttrs.version}.tar.xz";
+    hash = "sha256-WdpWbezOunwqeXCkoDtI2ZBfEmL/lEEKZJIk4z0kQrw=";
+  };
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "Provides a pkg-config file `pthread-stubs.pc` containing the Cflags/Libs flags applicable to programs/libraries that use only lightweight pthread API";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/pthread-stubs";
+    # gitlab says x11-distribute-modifications but it's not
+    # maybe due to https://github.com/spdx/spdx-online-tools/issues/540
+    license = lib.licenses.x11;
+    maintainers = [ ];
+    pkgConfigModules = [ "pthread-stubs" ];
+    # on these platforms according to the readme
+    platforms = with lib.platforms; linux ++ cygwin ++ darwin ++ [ "x86_64-solaris" ];
+  };
+})
diff --git a/pkgs/by-name/li/libqmi/build_doc_deps_by_default.patch b/pkgs/by-name/li/libqmi/build_doc_deps_by_default.patch
deleted file mode 100644
index f9ffbb589bf7..000000000000
--- a/pkgs/by-name/li/libqmi/build_doc_deps_by_default.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/docs/reference/libqmi-glib/meson.build b/docs/reference/libqmi-glib/meson.build
-index 2f5cfc3..14e1aea 100644
---- a/docs/reference/libqmi-glib/meson.build
-+++ b/docs/reference/libqmi-glib/meson.build
-@@ -57,6 +57,7 @@ sections_txt = custom_target(
-   capture: true,
-   command: [find_program('cat'), '@INPUT@'] + gen_sections,
-   depends: gen_sections_deps,
-+  build_by_default: true,
- )
- 
- version_xml = configure_file(
diff --git a/pkgs/by-name/li/libqmi/package.nix b/pkgs/by-name/li/libqmi/package.nix
index 2edf66d0b31d..9f1f8986ff4a 100644
--- a/pkgs/by-name/li/libqmi/package.nix
+++ b/pkgs/by-name/li/libqmi/package.nix
@@ -26,7 +26,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libqmi";
-  version = "1.34.0";
+  version = "1.36.0";
 
   outputs = [
     "out"
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     owner = "mobile-broadband";
     repo = "libqmi";
     rev = version;
-    hash = "sha256-l9ev9ZOWicVNZ/Wj//KNd3NHcefIrLVriqJhEpwWvtQ=";
+    hash = "sha256-cGNnw0vO/Hr9o/eIf6lLTsoGiEkTvZiArgO7tAc208U=";
   };
 
   nativeBuildInputs =
@@ -88,10 +88,6 @@ stdenv.mkDerivation rec {
   ];
 
   doCheck = true;
-  patches = [
-    # https://gitlab.freedesktop.org/mobile-broadband/libqmi/-/issues/124
-    ./build_doc_deps_by_default.patch
-  ];
 
   postPatch = ''
     patchShebangs \
diff --git a/pkgs/by-name/li/libremidi/package.nix b/pkgs/by-name/li/libremidi/package.nix
index a5a16f53e338..4490619f1f71 100644
--- a/pkgs/by-name/li/libremidi/package.nix
+++ b/pkgs/by-name/li/libremidi/package.nix
@@ -2,19 +2,10 @@
   lib,
   alsa-lib,
   cmake,
-  darwin,
   fetchFromGitHub,
   stdenv,
 }:
 
-let
-  inherit (darwin.apple_sdk.frameworks)
-    CoreAudio
-    CoreFoundation
-    CoreMIDI
-    CoreServices
-    ;
-in
 stdenv.mkDerivation (finalAttrs: {
   pname = "libremidi";
   version = "4.5.0";
@@ -30,16 +21,9 @@ stdenv.mkDerivation (finalAttrs: {
     cmake
   ];
 
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [
-      alsa-lib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CoreAudio
-      CoreFoundation
-      CoreMIDI
-      CoreServices
-    ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    alsa-lib
+  ];
 
   # Bug: set this as true breaks obs-studio-plugins.advanced-scene-switcher
   strictDeps = false;
diff --git a/pkgs/by-name/li/libselinux/fix-build-32bit-lfs.patch b/pkgs/by-name/li/libselinux/fix-build-32bit-lfs.patch
new file mode 100644
index 000000000000..2fed4f2cee8d
--- /dev/null
+++ b/pkgs/by-name/li/libselinux/fix-build-32bit-lfs.patch
@@ -0,0 +1,72 @@
+From 86211534862622124d26e8570034efc1f5d78823 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=D0=BD=D0=B0=D0=B1?= <nabijaczleweli@nabijaczleweli.xyz>
+Date: Sat, 22 Feb 2025 23:09:30 +0100
+Subject: [PATCH] Inject matchpathcon_filespec_add64() if
+ !defined(__INO_T_MATCHES_INO64_T) instead of using __BITS_PER_LONG < 64 as
+ proxy
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The __INO_T_MATCHES_INO64_T is defined
+if ino_t would be the same size as ino64_t
+if -D_FILE_OFFSET_BITS=64 were not defined.
+
+This is /exactly/ what
+  /* ABI backwards-compatible shim for non-LFS 32-bit systems */
+  #if defined(_FILE_OFFSET_BITS) && _FILE_OFFSET_BITS == 64 && __BITS_PER_LONG < 64
+is trying to get at, but currently fails because x32/RV32 are "LFS"
+with 32-bit longs and 64-bit time_ts natively.
+
+Thus, the
+  static_assert(sizeof(unsigned long) == sizeof(__ino_t), "inode size mismatch");
+assertion fails (__ino_t is the "kernel ino_t" type,
+which generally corresponds to the kernel's ulong, which is u64 on x32).
+
+glibc headers allow us to check the condition we care about directly.
+
+Fixes: commit 9395cc0322 ("Always build for LFS mode on 32-bit archs.")
+Closes: #463
+Closes: Debian#1098481
+Signed-off-by: наб <nabijaczleweli@nabijaczleweli.xyz>
+Cc: Alba Mendez <me@alba.sh>
+---
+ libselinux/include/selinux/selinux.h | 2 +-
+ libselinux/src/matchpathcon.c        | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git libselinux/include/selinux/selinux.h libselinux/include/selinux/selinux.h
+index f3cf5a209..f64896b7a 100644
+--- libselinux/include/selinux/selinux.h
++++ libselinux/include/selinux/selinux.h
+@@ -537,7 +537,7 @@ extern int matchpathcon_index(const char *path,
+    with the same inode (e.g. due to multiple hard links).  If so, then
+    use the latter of the two specifications based on their order in the 
+    file contexts configuration.  Return the used specification index. */
+-#if defined(_FILE_OFFSET_BITS) && _FILE_OFFSET_BITS == 64 && __BITS_PER_LONG < 64
++#if defined(_FILE_OFFSET_BITS) && _FILE_OFFSET_BITS == 64 && !defined(__INO_T_MATCHES_INO64_T)
+ #define matchpathcon_filespec_add matchpathcon_filespec_add64
+ #endif
+ extern int matchpathcon_filespec_add(ino_t ino, int specind, const char *file);
+diff --git libselinux/src/matchpathcon.c libselinux/src/matchpathcon.c
+index 51f0e4ff9..ab7c3090a 100644
+--- libselinux/src/matchpathcon.c
++++ libselinux/src/matchpathcon.c
+@@ -261,7 +261,7 @@ int matchpathcon_filespec_add(ino_t ino, int specind, const char *file)
+ 	return -1;
+ }
+ 
+-#if defined(_FILE_OFFSET_BITS) && _FILE_OFFSET_BITS == 64 && __BITS_PER_LONG < 64
++#if defined(_FILE_OFFSET_BITS) && _FILE_OFFSET_BITS == 64 && !defined(__INO_T_MATCHES_INO64_T)
+ /* alias defined in the public header but we undefine it here */
+ #undef matchpathcon_filespec_add
+ 
+@@ -282,7 +282,7 @@ int matchpathcon_filespec_add(unsigned long ino, int specind,
+ }
+ #else
+ 
+-static_assert(sizeof(unsigned long) == sizeof(ino_t), "inode size mismatch");
++static_assert(sizeof(uint64_t) == sizeof(ino_t), "inode size mismatch");
+ 
+ #endif
+ 
diff --git a/pkgs/by-name/li/libselinux/package.nix b/pkgs/by-name/li/libselinux/package.nix
index c4d5b7addae8..4aec113dc9fe 100644
--- a/pkgs/by-name/li/libselinux/package.nix
+++ b/pkgs/by-name/li/libselinux/package.nix
@@ -15,112 +15,122 @@
 
 assert enablePython -> swig != null && python3 != null;
 
-stdenv.mkDerivation (
-  rec {
-    pname = "libselinux";
-    version = "3.8";
-    inherit (libsepol) se_url;
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libselinux";
+  version = "3.8.1";
+  inherit (libsepol) se_url;
 
-    outputs = [
-      "bin"
-      "out"
-      "dev"
-      "man"
-    ] ++ lib.optional enablePython "py";
+  outputs = [
+    "bin"
+    "out"
+    "dev"
+    "man"
+  ] ++ lib.optional enablePython "py";
 
-    src = fetchurl {
-      url = "${se_url}/${version}/libselinux-${version}.tar.gz";
-      hash = "sha256-DDdWvKBHyScCgdfE3N7NAAty44oYPJMGYeupaQg5tUE=";
-    };
+  src = fetchurl {
+    url = "${finalAttrs.se_url}/${finalAttrs.version}/libselinux-${finalAttrs.version}.tar.gz";
+    hash = "sha256-7C0nifkxFS0hwdsetLwgLOTszt402b6eNg47RSQ87iw=";
+  };
 
-    patches = [
-      # Make it possible to disable shared builds (for pkgsStatic).
-      #
-      # We can't use fetchpatch because it processes includes/excludes
-      # /after/ stripping the prefix, which wouldn't work here because
-      # there would be no way to distinguish between
-      # e.g. libselinux/src/Makefile and libsepol/src/Makefile.
-      #
-      # This is a static email, so we shouldn't have to worry about
-      # normalizing the patch.
-      (fetchurl {
-        url = "https://lore.kernel.org/selinux/20250211211651.1297357-3-hi@alyssa.is/raw";
-        hash = "sha256-a0wTSItj5vs8GhIkfD1OPSjGmAJlK1orptSE7T3Hx20=";
-        postFetch = ''
-          mv "$out" $TMPDIR/patch
-          ${buildPackages.patchutils_0_3_3}/bin/filterdiff \
-              -i 'a/libselinux/*' --strip 1 <$TMPDIR/patch >"$out"
-        '';
-      })
+  patches = [
+    # Make it possible to disable shared builds (for pkgsStatic).
+    #
+    # We can't use fetchpatch because it processes includes/excludes
+    # /after/ stripping the prefix, which wouldn't work here because
+    # there would be no way to distinguish between
+    # e.g. libselinux/src/Makefile and libsepol/src/Makefile.
+    #
+    # This is a static email, so we shouldn't have to worry about
+    # normalizing the patch.
+    (fetchurl {
+      url = "https://lore.kernel.org/selinux/20250211211651.1297357-3-hi@alyssa.is/raw";
+      hash = "sha256-a0wTSItj5vs8GhIkfD1OPSjGmAJlK1orptSE7T3Hx20=";
+      postFetch = ''
+        mv "$out" $TMPDIR/patch
+        ${buildPackages.patchutils_0_3_3}/bin/filterdiff \
+            -i 'a/libselinux/*' --strip 1 <$TMPDIR/patch >"$out"
+      '';
+    })
 
-      (fetchurl {
-        url = "https://git.yoctoproject.org/meta-selinux/plain/recipes-security/selinux/libselinux/0003-libselinux-restore-drop-the-obsolete-LSF-transitiona.patch?id=62b9c816a5000dc01b28e78213bde26b58cbca9d";
-        hash = "sha256-RiEUibLVzfiRU6N/J187Cs1iPAih87gCZrlyRVI2abU=";
-      })
+    (fetchurl {
+      url = "https://git.yoctoproject.org/meta-selinux/plain/recipes-security/selinux/libselinux/0003-libselinux-restore-drop-the-obsolete-LSF-transitiona.patch?id=62b9c816a5000dc01b28e78213bde26b58cbca9d";
+      hash = "sha256-RiEUibLVzfiRU6N/J187Cs1iPAih87gCZrlyRVI2abU=";
+    })
+
+    # PR: https://github.com/SELinuxProject/selinux/pull/464
+    # Fix build on 32-bit LFS platforms
+    ./fix-build-32bit-lfs.patch
+  ];
+
+  nativeBuildInputs =
+    [
+      pkg-config
+      python3
+    ]
+    ++ lib.optionals enablePython [
+      python3Packages.pip
+      python3Packages.setuptools
+      python3Packages.wheel
+      swig
     ];
+  buildInputs = [
+    libsepol
+    pcre2
+    fts
+  ] ++ lib.optionals enablePython [ python3 ];
 
-    nativeBuildInputs =
-      [
-        pkg-config
-        python3
-      ]
-      ++ lib.optionals enablePython [
-        python3Packages.pip
-        python3Packages.setuptools
-        python3Packages.wheel
-        swig
-      ];
-    buildInputs = [
-      libsepol
-      pcre2
-      fts
-    ] ++ lib.optionals enablePython [ python3 ];
+  # drop fortify here since package uses it by default, leading to compile error:
+  # command-line>:0:0: error: "_FORTIFY_SOURCE" redefined [-Werror]
+  hardeningDisable = [ "fortify" ];
 
-    # drop fortify here since package uses it by default, leading to compile error:
-    # command-line>:0:0: error: "_FORTIFY_SOURCE" redefined [-Werror]
-    hardeningDisable = [ "fortify" ];
-
-    env.NIX_CFLAGS_COMPILE = "-Wno-error -D_FILE_OFFSET_BITS=64";
-
-    makeFlags =
-      [
-        "PREFIX=$(out)"
-        "INCDIR=$(dev)/include/selinux"
-        "INCLUDEDIR=$(dev)/include"
-        "MAN3DIR=$(man)/share/man/man3"
-        "MAN5DIR=$(man)/share/man/man5"
-        "MAN8DIR=$(man)/share/man/man8"
-        "SBINDIR=$(bin)/sbin"
-        "SHLIBDIR=$(out)/lib"
-
-        "LIBSEPOLA=${lib.getLib libsepol}/lib/libsepol.a"
-        "ARCH=${stdenv.hostPlatform.linuxArch}"
-      ]
-      ++ lib.optionals (fts != null) [
-        "FTS_LDLIBS=-lfts"
-      ]
-      ++ lib.optionals stdenv.hostPlatform.isStatic [
-        "DISABLE_SHARED=y"
-      ]
-      ++ lib.optionals enablePython [
-        "PYTHON=${python3.pythonOnBuildForHost.interpreter}"
-        "PYTHONLIBDIR=$(py)/${python3.sitePackages}"
-        "PYTHON_SETUP_ARGS=--no-build-isolation"
-      ];
-
-    preInstall = lib.optionalString enablePython ''
-      mkdir -p $py/${python3.sitePackages}/selinux
-    '';
-
-    installTargets = [ "install" ] ++ lib.optional enablePython "install-pywrap";
-
-    meta = removeAttrs libsepol.meta [ "outputsToInstall" ] // {
-      description = "SELinux core library";
-    };
-  }
-  //
-    lib.optionalAttrs (stdenv.cc.bintools.isLLVM && lib.versionAtLeast stdenv.cc.bintools.version "17")
+  env =
+    {
+      NIX_CFLAGS_COMPILE = "-Wno-error -D_FILE_OFFSET_BITS=64";
+    }
+    // lib.optionalAttrs
+      (stdenv.cc.bintools.isLLVM && lib.versionAtLeast stdenv.cc.bintools.version "17")
       {
         NIX_LDFLAGS = "--undefined-version";
-      }
-)
+      };
+
+  makeFlags =
+    [
+      "PREFIX=$(out)"
+      "INCDIR=$(dev)/include/selinux"
+      "INCLUDEDIR=$(dev)/include"
+      "MAN3DIR=$(man)/share/man/man3"
+      "MAN5DIR=$(man)/share/man/man5"
+      "MAN8DIR=$(man)/share/man/man8"
+      "SBINDIR=$(bin)/sbin"
+      "SHLIBDIR=$(out)/lib"
+
+      "LIBSEPOLA=${lib.getLib libsepol}/lib/libsepol.a"
+      "ARCH=${stdenv.hostPlatform.linuxArch}"
+    ]
+    ++ lib.optionals (fts != null) [
+      "FTS_LDLIBS=-lfts"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isStatic [
+      "DISABLE_SHARED=y"
+    ]
+    ++ lib.optionals enablePython [
+      "PYTHON=${python3.pythonOnBuildForHost.interpreter}"
+      "PYTHONLIBDIR=$(py)/${python3.sitePackages}"
+      "PYTHON_SETUP_ARGS=--no-build-isolation"
+    ];
+
+  preInstall = lib.optionalString enablePython ''
+    mkdir -p $py/${python3.sitePackages}/selinux
+  '';
+
+  installTargets = [ "install" ] ++ lib.optional enablePython "install-pywrap";
+
+  preFixup = lib.optionalString enablePython ''
+    mv $out/${python3.sitePackages}/selinux/* $py/${python3.sitePackages}/selinux/
+    rm -rf $out/lib/python*
+  '';
+
+  meta = removeAttrs libsepol.meta [ "outputsToInstall" ] // {
+    description = "SELinux core library";
+  };
+})
diff --git a/pkgs/os-specific/linux/libsemanage/default.nix b/pkgs/by-name/li/libsemanage/package.nix
similarity index 86%
rename from pkgs/os-specific/linux/libsemanage/default.nix
rename to pkgs/by-name/li/libsemanage/package.nix
index eae78b62785d..277d7d5238b3 100644
--- a/pkgs/os-specific/linux/libsemanage/default.nix
+++ b/pkgs/by-name/li/libsemanage/package.nix
@@ -11,7 +11,7 @@
   audit,
   enablePython ? true,
   swig ? null,
-  python ? null,
+  python3 ? null,
 }:
 
 stdenv.mkDerivation rec {
@@ -32,17 +32,23 @@ stdenv.mkDerivation rec {
 
   strictDeps = true;
 
-  nativeBuildInputs = [
-    bison
-    flex
-    pkg-config
-  ] ++ lib.optional enablePython swig;
+  nativeBuildInputs =
+    [
+      bison
+      flex
+      pkg-config
+    ]
+    ++ lib.optionals enablePython [
+      python3
+      swig
+    ];
+
   buildInputs = [
     libsepol
     libselinux
     bzip2
     audit
-  ] ++ lib.optional enablePython python;
+  ] ++ lib.optional enablePython python3;
 
   makeFlags = [
     "PREFIX=$(out)"
@@ -51,7 +57,7 @@ stdenv.mkDerivation rec {
     "MAN5DIR=$(man)/share/man/man5"
     "PYTHON=python"
     "PYPREFIX=python"
-    "PYTHONLIBDIR=$(py)/${python.sitePackages}"
+    "PYTHONLIBDIR=$(py)/${python3.sitePackages}"
     "DEFAULT_SEMANAGE_CONF_LOCATION=$(out)/etc/selinux/semanage.conf"
   ];
 
diff --git a/pkgs/by-name/li/libsepol/package.nix b/pkgs/by-name/li/libsepol/package.nix
index ea4a5e45838a..f04de97e9949 100644
--- a/pkgs/by-name/li/libsepol/package.nix
+++ b/pkgs/by-name/li/libsepol/package.nix
@@ -49,7 +49,10 @@ stdenv.mkDerivation rec {
     description = "SELinux binary policy manipulation library";
     homepage = "http://userspace.selinuxproject.org";
     platforms = platforms.linux;
-    maintainers = with maintainers; [ RossComputerGuy ];
+    maintainers = with maintainers; [
+      RossComputerGuy
+      numinit
+    ];
     license = lib.licenses.gpl2Plus;
     pkgConfigModules = [ "libselinux" ];
   };
diff --git a/pkgs/by-name/li/libserialport/package.nix b/pkgs/by-name/li/libserialport/package.nix
index 084b9c812648..db6bdd650e7c 100644
--- a/pkgs/by-name/li/libserialport/package.nix
+++ b/pkgs/by-name/li/libserialport/package.nix
@@ -4,7 +4,6 @@
   fetchurl,
   pkg-config,
   udev,
-  darwin,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -17,9 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs =
-    lib.optional stdenv.hostPlatform.isLinux udev
-    ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.frameworks.IOKit;
+  buildInputs = lib.optional stdenv.hostPlatform.isLinux udev;
 
   meta = {
     description = "Cross-platform shared library for serial port access";
diff --git a/pkgs/by-name/li/libsignal-ffi/package.nix b/pkgs/by-name/li/libsignal-ffi/package.nix
index b0d71460eaf0..3cf2722f216a 100644
--- a/pkgs/by-name/li/libsignal-ffi/package.nix
+++ b/pkgs/by-name/li/libsignal-ffi/package.nix
@@ -7,7 +7,6 @@
   xcodebuild,
   protobuf,
   boringssl,
-  darwin,
 }:
 let
   # boring-sys expects the static libraries in build/ instead of lib/
@@ -32,8 +31,6 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-6CBhLvD0UflLzJHAMB21wSH8MWTUNx0uPdqOUo/Eq44=";
   };
 
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.Security ];
-
   nativeBuildInputs = [
     protobuf
     rustPlatform.bindgenHook
diff --git a/pkgs/by-name/li/libtiger/package.nix b/pkgs/by-name/li/libtiger/package.nix
index 09211b89c89b..3a1d5b6d13fc 100644
--- a/pkgs/by-name/li/libtiger/package.nix
+++ b/pkgs/by-name/li/libtiger/package.nix
@@ -7,7 +7,6 @@
   libkate,
   pango,
   cairo,
-  darwin,
 }:
 
 stdenv.mkDerivation rec {
@@ -35,7 +34,7 @@ stdenv.mkDerivation rec {
     libkate
     pango
     cairo
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.frameworks.ApplicationServices;
+  ];
 
   meta = {
     homepage = "https://code.google.com/archive/p/libtiger/";
diff --git a/pkgs/by-name/li/libtorrent-rasterbar-1_2_x/package.nix b/pkgs/by-name/li/libtorrent-rasterbar-1_2_x/package.nix
index 9d3c64255893..3521249a6766 100644
--- a/pkgs/by-name/li/libtorrent-rasterbar-1_2_x/package.nix
+++ b/pkgs/by-name/li/libtorrent-rasterbar-1_2_x/package.nix
@@ -10,7 +10,6 @@
   python311,
   libiconv,
   ncurses,
-  darwin,
   boost-build,
 }:
 
@@ -63,7 +62,7 @@ stdenv.mkDerivation {
     python311
     libiconv
     ncurses
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.SystemConfiguration ];
+  ];
 
   preAutoreconf = ''
     mkdir -p build-aux
diff --git a/pkgs/by-name/li/libtorrent-rasterbar-2_0_x/package.nix b/pkgs/by-name/li/libtorrent-rasterbar-2_0_x/package.nix
index b544b1c6f77e..2c7c53c46353 100644
--- a/pkgs/by-name/li/libtorrent-rasterbar-2_0_x/package.nix
+++ b/pkgs/by-name/li/libtorrent-rasterbar-2_0_x/package.nix
@@ -8,7 +8,6 @@
   openssl,
   python3,
   ncurses,
-  darwin,
 }:
 
 let
@@ -41,7 +40,7 @@ stdenv.mkDerivation {
     zlib
     python3
     ncurses
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.SystemConfiguration ];
+  ];
 
   patches = [
     # provide distutils alternative for python 3.12
diff --git a/pkgs/by-name/li/libui-ng/package.nix b/pkgs/by-name/li/libui-ng/package.nix
index 94977b420556..54312f6918fd 100644
--- a/pkgs/by-name/li/libui-ng/package.nix
+++ b/pkgs/by-name/li/libui-ng/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   cmocka,
-  darwin,
   fetchFromGitHub,
   gtk3,
   meson,
@@ -33,19 +32,9 @@ stdenv.mkDerivation {
     pkg-config
   ];
 
-  buildInputs =
-    if stdenv.hostPlatform.isDarwin then
-      [
-        darwin.libobjc
-        darwin.apple_sdk_11_0.Libsystem
-        darwin.apple_sdk_11_0.frameworks.Cocoa
-        darwin.apple_sdk_11_0.frameworks.AppKit
-        darwin.apple_sdk_11_0.frameworks.CoreFoundation
-      ]
-    else
-      [
-        gtk3
-      ];
+  buildInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) [
+    gtk3
+  ];
 
   mesonFlags = [
     (lib.mesonBool "examples" (!stdenv.hostPlatform.isDarwin))
diff --git a/pkgs/by-name/li/liburcu/package.nix b/pkgs/by-name/li/liburcu/package.nix
index 155ff34d39cc..2308f77b58a6 100644
--- a/pkgs/by-name/li/liburcu/package.nix
+++ b/pkgs/by-name/li/liburcu/package.nix
@@ -6,12 +6,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "0.15.1";
+  version = "0.15.2";
   pname = "liburcu";
 
   src = fetchurl {
     url = "https://lttng.org/files/urcu/userspace-rcu-${version}.tar.bz2";
-    hash = "sha256-mNZswS8sWIGHm5dvDFXRDTEUAVE74lTjvSjPOBH7UMg=";
+    hash = "sha256-WfNvK4vaG3Ygp+ztJjTybFSURIGKgxMCWjuwnAdmph0=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/li/libusbsio/package.nix b/pkgs/by-name/li/libusbsio/package.nix
index 24a41781d447..d1b762b4e014 100644
--- a/pkgs/by-name/li/libusbsio/package.nix
+++ b/pkgs/by-name/li/libusbsio/package.nix
@@ -6,7 +6,6 @@
   fixDarwinDylibNames,
   libusb1,
   systemdMinimal,
-  darwin,
 }:
 
 stdenv.mkDerivation rec {
@@ -39,14 +38,7 @@ stdenv.mkDerivation rec {
     [
       libusb1
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        AppKit
-        CoreFoundation
-        IOKit
-      ]
-    )
+
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       systemdMinimal # libudev
     ];
diff --git a/pkgs/by-name/li/licensure/package.nix b/pkgs/by-name/li/licensure/package.nix
index a5a4ac228048..01d404151dbb 100644
--- a/pkgs/by-name/li/licensure/package.nix
+++ b/pkgs/by-name/li/licensure/package.nix
@@ -1,13 +1,11 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitHub,
   pkg-config,
   openssl,
   git,
   gitls,
-  darwin,
 }:
 rustPlatform.buildRustPackage rec {
   pname = "licensure";
@@ -23,15 +21,11 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-b3Vb8beULbLQuBORcE5nWuHkqDmalexJick9Ct5+iUM=";
   nativeBuildInputs = [ pkg-config ];
-  buildInputs =
-    [
-      openssl
-      git
-      gitls
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    openssl
+    git
+    gitls
+  ];
 
   checkFlags = [
     # Checking for files in the git repo (git ls-files),
diff --git a/pkgs/by-name/li/linien-gui/package.nix b/pkgs/by-name/li/linien-gui/package.nix
index a62f5b269f10..213c4174db1c 100644
--- a/pkgs/by-name/li/linien-gui/package.nix
+++ b/pkgs/by-name/li/linien-gui/package.nix
@@ -4,22 +4,28 @@
   qt5,
 }:
 
-python3.pkgs.buildPythonApplication rec {
+let
+  python = python3.override {
+    self = python;
+    packageOverrides = self: super: {
+      numpy = super.numpy_1;
+    };
+  };
+in
+python.pkgs.buildPythonApplication rec {
   pname = "linien-gui";
   pyproject = true;
 
-  inherit (python3.pkgs.linien-common) src version;
+  inherit (python.pkgs.linien-common) src version;
 
   sourceRoot = "${src.name}/linien-gui";
 
-  nativeBuildInputs =
-    with python3.pkgs;
-    [
-      setuptools
-    ]
-    ++ [
-      qt5.wrapQtAppsHook
-    ];
+  build-system = with python.pkgs; [
+    setuptools
+  ];
+  nativeBuildInputs = [
+    qt5.wrapQtAppsHook
+  ];
 
   # Makes qt-wayland appear in the qt paths injected by the wrapper - helps users
   # with `QT_QPA_PLATFORM=wayland` in their environment.
@@ -27,7 +33,7 @@ python3.pkgs.buildPythonApplication rec {
     qt5.qtwayland
   ];
 
-  propagatedBuildInputs = with python3.pkgs; [
+  dependencies = with python.pkgs; [
     appdirs
     click
     pyqtgraph
@@ -43,13 +49,19 @@ python3.pkgs.buildPythonApplication rec {
     makeWrapperArgs+=("''${qtWrapperArgs[@]}")
   '';
 
-  meta = with lib; {
+  passthru = {
+    # Useful for creating .withPackages environments, see NOTE near
+    # `python3Packages.linien-common.meta.broken`.
+    inherit python;
+  };
+
+  meta = {
     description = "Graphical user interface of the Linien spectroscopy lock application";
     mainProgram = "linien";
     homepage = "https://github.com/linien-org/linien/tree/develop/linien-gui";
     changelog = "https://github.com/linien-org/linien/blob/v${version}/CHANGELOG.md";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [
       fsagbuya
       doronbehar
     ];
diff --git a/pkgs/by-name/li/linux-pam/package.nix b/pkgs/by-name/li/linux-pam/package.nix
index a1a515097307..03bbf3299520 100644
--- a/pkgs/by-name/li/linux-pam/package.nix
+++ b/pkgs/by-name/li/linux-pam/package.nix
@@ -4,7 +4,6 @@
   buildPackages,
   fetchurl,
   flex,
-  cracklib,
   db4,
   gettext,
   audit,
@@ -51,7 +50,6 @@ stdenv.mkDerivation rec {
   ] ++ lib.optional stdenv.buildPlatform.isDarwin gettext;
 
   buildInputs = [
-    cracklib
     db4
     libxcrypt
   ] ++ lib.optional stdenv.buildPlatform.isLinux audit;
diff --git a/pkgs/by-name/li/live-server/package.nix b/pkgs/by-name/li/live-server/package.nix
index 66ede7d221c3..0257a426b04f 100644
--- a/pkgs/by-name/li/live-server/package.nix
+++ b/pkgs/by-name/li/live-server/package.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitHub,
-  darwin,
   openssl,
   pkg-config,
 }:
@@ -24,15 +22,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        CoreServices
-        SystemConfiguration
-      ]
-    );
+  buildInputs = [ openssl ];
 
   meta = with lib; {
     description = "Local network server with live reload feature for static pages";
diff --git a/pkgs/by-name/ll/llama-cpp/package.nix b/pkgs/by-name/ll/llama-cpp/package.nix
index d68d86c21809..8715e8383b3e 100644
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@@ -2,7 +2,6 @@
   lib,
   autoAddDriverRunpath,
   cmake,
-  darwin,
   fetchFromGitHub,
   nix-update-script,
   stdenv,
@@ -50,15 +49,6 @@ let
     optionalString
     ;
 
-  darwinBuildInputs =
-    with darwin.apple_sdk.frameworks;
-    [
-      Accelerate
-      CoreVideo
-      CoreGraphics
-    ]
-    ++ optionals metalSupport [ MetalKit ];
-
   cudaBuildInputs = with cudaPackages; [
     cuda_cccl # <nv/target>
 
@@ -126,8 +116,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
     ];
 
   buildInputs =
-    optionals effectiveStdenv.hostPlatform.isDarwin darwinBuildInputs
-    ++ optionals cudaSupport cudaBuildInputs
+    optionals cudaSupport cudaBuildInputs
     ++ optionals openclSupport [ clblast ]
     ++ optionals rocmSupport rocmBuildInputs
     ++ optionals blasSupport [ blas ]
diff --git a/pkgs/by-name/ll/llpp/package.nix b/pkgs/by-name/ll/llpp/package.nix
index 686831fd92dc..12d0e5d54c90 100644
--- a/pkgs/by-name/ll/llpp/package.nix
+++ b/pkgs/by-name/ll/llpp/package.nix
@@ -20,7 +20,6 @@
   xclip,
   inotify-tools,
   procps,
-  darwin,
 }:
 
 assert lib.versionAtLeast (lib.getVersion ocaml) "4.07";
@@ -63,10 +62,6 @@ stdenv.mkDerivation rec {
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       libGLU
       libGL
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.OpenGL
-      darwin.apple_sdk.frameworks.Cocoa
     ];
 
   dontStrip = true;
diff --git a/pkgs/by-name/lo/loudmouth/package.nix b/pkgs/by-name/lo/loudmouth/package.nix
index 600082edef21..6ce497ea5a59 100644
--- a/pkgs/by-name/lo/loudmouth/package.nix
+++ b/pkgs/by-name/lo/loudmouth/package.nix
@@ -7,7 +7,6 @@
   glib,
   pkg-config,
   zlib,
-  darwin,
 }:
 
 stdenv.mkDerivation rec {
@@ -30,14 +29,6 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    lib.optionals
-      (stdenv.hostPlatform.isDarwin && lib.versionOlder stdenv.hostPlatform.darwinMinVersion "11")
-      [
-        darwin.apple_sdk.frameworks.AppKit
-        darwin.apple_sdk.frameworks.Foundation
-      ];
-
   meta = with lib; {
     description = "Lightweight C library for the Jabber protocol";
     platforms = platforms.all;
diff --git a/pkgs/by-name/lo/lowfi/package.nix b/pkgs/by-name/lo/lowfi/package.nix
index 7a03cab4ab15..365f87477ab6 100644
--- a/pkgs/by-name/lo/lowfi/package.nix
+++ b/pkgs/by-name/lo/lowfi/package.nix
@@ -5,7 +5,6 @@
   pkg-config,
   openssl,
   stdenv,
-  darwin,
   alsa-lib,
 }:
 
diff --git a/pkgs/by-name/lr/lrcget/package.nix b/pkgs/by-name/lr/lrcget/package.nix
index 1bf3282df317..12c94f8cce5f 100644
--- a/pkgs/by-name/lr/lrcget/package.nix
+++ b/pkgs/by-name/lr/lrcget/package.nix
@@ -13,7 +13,6 @@
   copyDesktopItems,
   makeDesktopItem,
   alsa-lib,
-  darwin,
   nix-update-script,
 }:
 rustPlatform.buildRustPackage rec {
@@ -75,10 +74,6 @@ rustPlatform.buildRustPackage rec {
     ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
       webkitgtk_4_1
       alsa-lib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.CoreAudio
-      darwin.apple_sdk.frameworks.WebKit
     ];
 
   # Disable checkPhase, since the project doesn't contain tests
diff --git a/pkgs/by-name/ls/lsp-ai/package.nix b/pkgs/by-name/ls/lsp-ai/package.nix
index 5324d1e13240..9c19652d5323 100644
--- a/pkgs/by-name/ls/lsp-ai/package.nix
+++ b/pkgs/by-name/ls/lsp-ai/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  darwin,
   pkg-config,
   cmake,
   openssl,
@@ -58,15 +56,10 @@ rustPlatform.buildRustPackage rec {
     perl
   ];
 
-  buildInputs =
-    [
-      openssl
-      zlib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.SystemConfiguration
-      darwin.apple_sdk.frameworks.CoreServices
-    ];
+  buildInputs = [
+    openssl
+    zlib
+  ];
 
   passthru.updateScript = gitUpdater {
     rev-prefix = "v";
diff --git a/pkgs/by-name/lu/luanti/package.nix b/pkgs/by-name/lu/luanti/package.nix
index ee275ba8ad1b..ba6f24bbf5bf 100644
--- a/pkgs/by-name/lu/luanti/package.nix
+++ b/pkgs/by-name/lu/luanti/package.nix
@@ -31,7 +31,6 @@
   libiconv,
   ninja,
   prometheus-cpp,
-  darwin,
   buildClient ? true,
   buildServer ? true,
   SDL2,
@@ -109,11 +108,6 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optional (lib.meta.availableOn stdenv.hostPlatform luajit) luajit
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       libiconv
-      darwin.apple_sdk.frameworks.OpenGL
-      darwin.apple_sdk.frameworks.OpenAL
-      darwin.apple_sdk.frameworks.Carbon
-      darwin.apple_sdk.frameworks.Cocoa
-      darwin.apple_sdk.frameworks.Kernel
     ]
     ++ lib.optionals buildClient [
       libpng
diff --git a/pkgs/by-name/lu/luau/package.nix b/pkgs/by-name/lu/luau/package.nix
index b3ab380c17f4..f919b1960eef 100644
--- a/pkgs/by-name/lu/luau/package.nix
+++ b/pkgs/by-name/lu/luau/package.nix
@@ -3,19 +3,19 @@
   stdenv,
   fetchFromGitHub,
   cmake,
-  gitUpdater,
   llvmPackages,
+  nix-update-script,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "luau";
-  version = "0.671";
+  version = "0.672";
 
   src = fetchFromGitHub {
     owner = "luau-lang";
     repo = "luau";
-    rev = version;
-    hash = "sha256-iiIQKXByHuGCH5ypr7uSAcABaQagLw008Z0HRCsREIM=";
+    tag = finalAttrs.version;
+    hash = "sha256-FMFW7AikBnoT6FZhmCOHKqRVCi2qcO8kXxYCaAfCfNY=";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -43,15 +43,18 @@ stdenv.mkDerivation rec {
     runHook postCheck
   '';
 
-  passthru.updateScript = gitUpdater { };
+  passthru.updateScript = nix-update-script { };
 
-  meta = with lib; {
+  meta = {
     description = "Fast, small, safe, gradually typed embeddable scripting language derived from Lua";
     homepage = "https://luau-lang.org/";
-    changelog = "https://github.com/luau-lang/luau/releases/tag/${version}";
-    license = licenses.mit;
-    platforms = platforms.all;
-    maintainers = with maintainers; [ prince213 ];
+    changelog = "https://github.com/luau-lang/luau/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [
+      prince213
+      HeitorAugustoLN
+    ];
     mainProgram = "luau";
   };
-}
+})
diff --git a/pkgs/by-name/lu/lunatic/package.nix b/pkgs/by-name/lu/lunatic/package.nix
index 6127ecba9e7e..eace661ef36c 100644
--- a/pkgs/by-name/lu/lunatic/package.nix
+++ b/pkgs/by-name/lu/lunatic/package.nix
@@ -4,8 +4,6 @@
   fetchFromGitHub,
   pkg-config,
   openssl,
-  stdenv,
-  darwin,
   unstableGitUpdater,
 }:
 
@@ -27,13 +25,9 @@ rustPlatform.buildRustPackage {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = [
+    openssl
+  ];
 
   checkFlags = [
     # requires simd support which is not always available on hydra
diff --git a/pkgs/by-name/m1/m1ddc/package.nix b/pkgs/by-name/m1/m1ddc/package.nix
index cd69a7072e3b..51a2113fa17a 100644
--- a/pkgs/by-name/m1/m1ddc/package.nix
+++ b/pkgs/by-name/m1/m1ddc/package.nix
@@ -1,6 +1,5 @@
 {
   stdenv,
-  darwin,
   fetchFromGitHub,
   lib,
 }:
@@ -21,11 +20,6 @@ stdenv.mkDerivation (finalAttrs: {
         --replace-fail kIOMainPortDefault kIOMasterPortDefault
   '';
 
-  buildInputs = with darwin.apple_sdk_11_0.frameworks; [
-    CoreDisplay
-    Foundation
-  ];
-
   installPhase = ''
     runHook preInstall
     mkdir -p $out/bin
diff --git a/pkgs/by-name/ma/maa-assistant-arknights/package.nix b/pkgs/by-name/ma/maa-assistant-arknights/package.nix
index 32d43f3d05b1..947626dd46a9 100644
--- a/pkgs/by-name/ma/maa-assistant-arknights/package.nix
+++ b/pkgs/by-name/ma/maa-assistant-arknights/package.nix
@@ -3,7 +3,6 @@
   config,
   callPackage,
   stdenv,
-  overrideSDK,
   fetchFromGitHub,
   asio,
   cmake,
@@ -19,72 +18,70 @@ let
   fastdeploy = callPackage ./fastdeploy-ppocr.nix { };
   sources = lib.importJSON ./pin.json;
 in
-# https://github.com/NixOS/nixpkgs/issues/314160
-(if stdenv.hostPlatform.isDarwin then overrideSDK stdenv "11.0" else stdenv).mkDerivation
-  (finalAttr: {
-    pname = "maa-assistant-arknights" + lib.optionalString isBeta "-beta";
-    version = if isBeta then sources.beta.version else sources.stable.version;
+stdenv.mkDerivation (finalAttr: {
+  pname = "maa-assistant-arknights" + lib.optionalString isBeta "-beta";
+  version = if isBeta then sources.beta.version else sources.stable.version;
 
-    src = fetchFromGitHub {
-      owner = "MaaAssistantArknights";
-      repo = "MaaAssistantArknights";
-      rev = "v${finalAttr.version}";
-      hash = if isBeta then sources.beta.hash else sources.stable.hash;
-    };
+  src = fetchFromGitHub {
+    owner = "MaaAssistantArknights";
+    repo = "MaaAssistantArknights";
+    rev = "v${finalAttr.version}";
+    hash = if isBeta then sources.beta.hash else sources.stable.hash;
+  };
 
-    nativeBuildInputs = [
-      asio
-      cmake
-      fastdeploy.cmake
-    ] ++ lib.optionals cudaSupport [ cudaPackages.cuda_nvcc ];
+  nativeBuildInputs = [
+    asio
+    cmake
+    fastdeploy.cmake
+  ] ++ lib.optionals cudaSupport [ cudaPackages.cuda_nvcc ];
 
-    buildInputs =
+  buildInputs =
+    [
+      fastdeploy
+      libcpr
+      onnxruntime
+      opencv
+    ]
+    ++ lib.optionals cudaSupport (
+      with cudaPackages;
       [
-        fastdeploy
-        libcpr
-        onnxruntime
-        opencv
+        cuda_cccl # cub/cub.cuh
+        libcublas # cublas_v2.h
+        libcurand # curand.h
+        libcusparse # cusparse.h
+        libcufft # cufft.h
+        cudnn # cudnn.h
+        cuda_cudart
       ]
-      ++ lib.optionals cudaSupport (
-        with cudaPackages;
-        [
-          cuda_cccl # cub/cub.cuh
-          libcublas # cublas_v2.h
-          libcurand # curand.h
-          libcusparse # cusparse.h
-          libcufft # cufft.h
-          cudnn # cudnn.h
-          cuda_cudart
-        ]
-      );
+    );
 
-    cmakeBuildType = "None";
+  cmakeBuildType = "None";
 
-    cmakeFlags = [
-      (lib.cmakeBool "BUILD_SHARED_LIBS" true)
-      (lib.cmakeBool "INSTALL_FLATTEN" false)
-      (lib.cmakeBool "INSTALL_PYTHON" true)
-      (lib.cmakeBool "INSTALL_RESOURCE" true)
-      (lib.cmakeBool "USE_MAADEPS" false)
-      (lib.cmakeFeature "MAA_VERSION" "v${finalAttr.version}")
-    ];
+  cmakeFlags = [
+    (lib.cmakeBool "BUILD_SHARED_LIBS" true)
+    (lib.cmakeBool "INSTALL_FLATTEN" false)
+    (lib.cmakeBool "INSTALL_PYTHON" true)
+    (lib.cmakeBool "INSTALL_RESOURCE" true)
+    (lib.cmakeBool "USE_MAADEPS" false)
+    (lib.cmakeFeature "MAA_VERSION" "v${finalAttr.version}")
+  ];
 
-    passthru.updateScript = ./update.sh;
+  passthru.updateScript = ./update.sh;
 
-    postPatch = ''
-      cp -v ${fastdeploy.cmake}/Findonnxruntime.cmake cmake/
-    '';
+  postPatch = ''
+    cp -v ${fastdeploy.cmake}/Findonnxruntime.cmake cmake/
+  '';
 
-    postInstall = ''
-      mkdir -p $out/share/${finalAttr.pname}
-      mv $out/{Python,resource} $out/share/${finalAttr.pname}
-    '';
+  postInstall = ''
+    mkdir -p $out/share/${finalAttr.pname}
+    mv $out/{Python,resource} $out/share/${finalAttr.pname}
+  '';
 
-    meta = with lib; {
-      description = "Arknights assistant";
-      homepage = "https://github.com/MaaAssistantArknights/MaaAssistantArknights";
-      license = licenses.agpl3Only;
-      maintainers = with maintainers; [ Cryolitia ];
-      platforms = platforms.linux ++ platforms.darwin;
-    };
-  })
+  meta = with lib; {
+    description = "Arknights assistant";
+    homepage = "https://github.com/MaaAssistantArknights/MaaAssistantArknights";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ Cryolitia ];
+    platforms = platforms.linux ++ platforms.darwin;
+  };
+})
diff --git a/pkgs/by-name/ma/maa-cli/package.nix b/pkgs/by-name/ma/maa-cli/package.nix
index bf74f70ffd5a..f8e2a2c382a4 100644
--- a/pkgs/by-name/ma/maa-cli/package.nix
+++ b/pkgs/by-name/ma/maa-cli/package.nix
@@ -7,7 +7,6 @@
   makeWrapper,
   pkg-config,
   openssl,
-  darwin,
   maa-assistant-arknights,
   android-tools,
   git,
@@ -30,15 +29,7 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        Security
-        SystemConfiguration
-      ]
-    );
+  buildInputs = [ openssl ];
 
   # https://github.com/MaaAssistantArknights/maa-cli/pull/126
   buildNoDefaultFeatures = true;
diff --git a/pkgs/by-name/ma/macchina/package.nix b/pkgs/by-name/ma/macchina/package.nix
index bf3e0b657d72..03d34ca4257f 100644
--- a/pkgs/by-name/ma/macchina/package.nix
+++ b/pkgs/by-name/ma/macchina/package.nix
@@ -3,8 +3,6 @@
   rustPlatform,
   fetchFromGitHub,
   installShellFiles,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -25,11 +23,6 @@ rustPlatform.buildRustPackage rec {
     installShellFiles
   ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.AppKit
-    darwin.apple_sdk.frameworks.DisplayServices
-  ];
-
   postInstall = ''
     installManPage doc/macchina.{1,7}
   '';
diff --git a/pkgs/by-name/ma/man-db/package.nix b/pkgs/by-name/ma/man-db/package.nix
index d8d645113287..7481da85d1e9 100644
--- a/pkgs/by-name/ma/man-db/package.nix
+++ b/pkgs/by-name/ma/man-db/package.nix
@@ -1,6 +1,6 @@
 {
   buildPackages,
-  db,
+  gdbm,
   fetchurl,
   groff,
   gzip,
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
   ];
   buildInputs = [
     libpipeline
-    db
+    gdbm
     groff
     libiconv'
   ]; # (Yes, 'groff' is both native and build input)
diff --git a/pkgs/by-name/ma/markuplinkchecker/package.nix b/pkgs/by-name/ma/markuplinkchecker/package.nix
index baabb4624d87..5155985b1f98 100644
--- a/pkgs/by-name/ma/markuplinkchecker/package.nix
+++ b/pkgs/by-name/ma/markuplinkchecker/package.nix
@@ -4,8 +4,6 @@
   fetchFromGitHub,
   pkg-config,
   openssl,
-  stdenv,
-  darwin,
 }:
 let
   version = "0.21.0";
@@ -26,15 +24,7 @@ rustPlatform.buildRustPackage {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        Security
-        SystemConfiguration
-      ]
-    );
+  buildInputs = [ openssl ];
 
   env = {
     OPENSSL_NO_VENDOR = true;
diff --git a/pkgs/by-name/ma/matrix-authentication-service/package.nix b/pkgs/by-name/ma/matrix-authentication-service/package.nix
index b88b92d78f90..ad5639754927 100644
--- a/pkgs/by-name/ma/matrix-authentication-service/package.nix
+++ b/pkgs/by-name/ma/matrix-authentication-service/package.nix
@@ -10,7 +10,6 @@
   sqlite,
   zstd,
   stdenv,
-  darwin,
   open-policy-agent,
   cctools,
 }:
@@ -46,16 +45,10 @@ rustPlatform.buildRustPackage rec {
     (python3.withPackages (ps: [ ps.setuptools ])) # Used by gyp
   ] ++ lib.optional stdenv.hostPlatform.isDarwin cctools; # libtool used by gyp;
 
-  buildInputs =
-    [
-      sqlite
-      zstd
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk_11_0.frameworks.CoreFoundation
-      darwin.apple_sdk_11_0.frameworks.Security
-      darwin.apple_sdk_11_0.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    sqlite
+    zstd
+  ];
 
   env = {
     ZSTD_SYS_USE_PKG_CONFIG = true;
diff --git a/pkgs/by-name/ma/matrix-commander-rs/package.nix b/pkgs/by-name/ma/matrix-commander-rs/package.nix
index 1248862513b4..b5782bd57d1b 100644
--- a/pkgs/by-name/ma/matrix-commander-rs/package.nix
+++ b/pkgs/by-name/ma/matrix-commander-rs/package.nix
@@ -1,7 +1,5 @@
 {
   lib,
-  stdenv,
-  darwin,
   fetchFromGitHub,
   openssl,
   pkg-config,
@@ -28,12 +26,7 @@ rustPlatform.buildRustPackage rec {
     perl
   ];
 
-  buildInputs =
-    [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [ openssl ];
 
   meta = {
     description = "CLI-based Matrix client app for sending and receiving";
diff --git a/pkgs/by-name/ma/matrix-conduit/package.nix b/pkgs/by-name/ma/matrix-conduit/package.nix
index 6dcea572c57f..16d1ad758aa3 100644
--- a/pkgs/by-name/ma/matrix-conduit/package.nix
+++ b/pkgs/by-name/ma/matrix-conduit/package.nix
@@ -5,7 +5,6 @@
   pkg-config,
   sqlite,
   stdenv,
-  darwin,
   nixosTests,
   rocksdb,
   rust-jemalloc-sys,
@@ -36,15 +35,10 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      sqlite
-      rust-jemalloc-sys
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    sqlite
+    rust-jemalloc-sys
+  ];
 
   env = {
     ROCKSDB_INCLUDE_DIR = "${rocksdb}/include";
diff --git a/pkgs/by-name/ma/maturin/package.nix b/pkgs/by-name/ma/maturin/package.nix
index 0e846eacf47a..c9f694e68cf9 100644
--- a/pkgs/by-name/ma/maturin/package.nix
+++ b/pkgs/by-name/ma/maturin/package.nix
@@ -3,7 +3,7 @@
   stdenv,
   fetchFromGitHub,
   rustPlatform,
-  darwin,
+  fetchpatch,
   libiconv,
   testers,
   nix-update-script,
@@ -25,8 +25,17 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-7YPUTTRo9+aBmVXLq5NfU+t5VPxfEQc4+rdQnPN+AZ0=";
 
+  patches = [
+    # Sorts RECORD file in wheel archives to make them deterministic. See: https://github.com/NixOS/nixpkgs/issues/384708
+    # Remove on next bump https://github.com/PyO3/maturin/pull/2550
+    (fetchpatch {
+      name = "wheel-deterministic-record.patch";
+      url = "https://github.com/PyO3/maturin/commit/bade37e108514f4288c1dd6457119a257bf95db4.patch";
+      hash = "sha256-jcZ/NMHKFYQuOfR+fu5UPykEljUq3l/+ZAx0Tlyu3Zw=";
+    })
+  ];
+
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Security
     libiconv
   ];
 
diff --git a/pkgs/by-name/mc/mchprs/package.nix b/pkgs/by-name/mc/mchprs/package.nix
index c3a38d74b0cd..d562355d6c00 100644
--- a/pkgs/by-name/mc/mchprs/package.nix
+++ b/pkgs/by-name/mc/mchprs/package.nix
@@ -6,8 +6,6 @@
   openssl,
   sqlite,
   zlib,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -29,17 +27,11 @@ rustPlatform.buildRustPackage rec {
     rustPlatform.bindgenHook
   ];
 
-  buildInputs =
-    [
-      openssl
-      sqlite
-      zlib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.CoreFoundation
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    openssl
+    sqlite
+    zlib
+  ];
 
   meta = with lib; {
     mainProgram = "mchprs";
diff --git a/pkgs/by-name/mc/mcumgr-client/package.nix b/pkgs/by-name/mc/mcumgr-client/package.nix
index 21b12fc2501b..a69f81120099 100644
--- a/pkgs/by-name/mc/mcumgr-client/package.nix
+++ b/pkgs/by-name/mc/mcumgr-client/package.nix
@@ -6,7 +6,6 @@
   pkg-config,
   udev,
   stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -27,9 +26,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [ udev ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.IOKit ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ udev ];
 
   meta = with lib; {
     description = "Client for mcumgr commands";
diff --git a/pkgs/by-name/md/md-tui/package.nix b/pkgs/by-name/md/md-tui/package.nix
index 5956ad70637a..abbb890aa74a 100644
--- a/pkgs/by-name/md/md-tui/package.nix
+++ b/pkgs/by-name/md/md-tui/package.nix
@@ -3,8 +3,6 @@
   rustPlatform,
   fetchFromGitHub,
   pkg-config,
-  stdenv,
-  darwin,
   nix-update-script,
 }:
 
@@ -24,12 +22,6 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.CoreFoundation
-    darwin.apple_sdk.frameworks.CoreServices
-    darwin.apple_sdk.frameworks.Security
-  ];
-
   passthru = {
     updateScript = nix-update-script { };
   };
diff --git a/pkgs/by-name/md/mdbook-d2/package.nix b/pkgs/by-name/md/mdbook-d2/package.nix
index 2a0d2922dfa0..f1a888e02180 100644
--- a/pkgs/by-name/md/mdbook-d2/package.nix
+++ b/pkgs/by-name/md/mdbook-d2/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -21,11 +19,6 @@ rustPlatform.buildRustPackage rec {
   cargoHash = "sha256-emfO7D7JU/fQYdnaK7eWR8tCPx3ffvU/pTutSURZMBQ=";
   doCheck = false;
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.CoreFoundation
-    darwin.apple_sdk.frameworks.CoreServices
-  ];
-
   meta = with lib; {
     description = "D2 diagram generator plugin for MdBook";
     mainProgram = "mdbook-d2";
diff --git a/pkgs/by-name/md/mdbook-emojicodes/package.nix b/pkgs/by-name/md/mdbook-emojicodes/package.nix
index 430e3f32f30a..5de989c1176a 100644
--- a/pkgs/by-name/md/mdbook-emojicodes/package.nix
+++ b/pkgs/by-name/md/mdbook-emojicodes/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,10 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-+VVkrXvsqtizeVhfuO0U8ADfSkmovpT7DVwrz7QljU0=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.CoreFoundation
-  ];
-
   meta = with lib; {
     description = "MDBook preprocessor for converting emojicodes (e.g. `: cat :`) into emojis 🐱";
     mainProgram = "mdbook-emojicodes";
diff --git a/pkgs/by-name/md/mdbook-kroki-preprocessor/package.nix b/pkgs/by-name/md/mdbook-kroki-preprocessor/package.nix
index fd18fe07fc96..a97b80644f49 100644
--- a/pkgs/by-name/md/mdbook-kroki-preprocessor/package.nix
+++ b/pkgs/by-name/md/mdbook-kroki-preprocessor/package.nix
@@ -4,8 +4,6 @@
   fetchFromGitHub,
   pkg-config,
   openssl,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -26,14 +24,9 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.CoreFoundation
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = [
+    openssl
+  ];
 
   meta = with lib; {
     description = "Render Kroki diagrams from files or code blocks in mdbook";
diff --git a/pkgs/by-name/md/mdbook/package.nix b/pkgs/by-name/md/mdbook/package.nix
index 2840a37eb50b..57ad9750434f 100644
--- a/pkgs/by-name/md/mdbook/package.nix
+++ b/pkgs/by-name/md/mdbook/package.nix
@@ -4,8 +4,6 @@
   fetchFromGitHub,
   nix,
   rustPlatform,
-  darwin,
-  CoreServices ? darwin.apple_sdk.frameworks.CoreServices,
   installShellFiles,
 }:
 let
@@ -27,8 +25,6 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ CoreServices ];
-
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd mdbook \
       --bash <($out/bin/mdbook completions bash) \
diff --git a/pkgs/by-name/me/meowpdf/package.nix b/pkgs/by-name/me/meowpdf/package.nix
new file mode 100644
index 000000000000..12178de39838
--- /dev/null
+++ b/pkgs/by-name/me/meowpdf/package.nix
@@ -0,0 +1,34 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "meowpdf";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "monoamine11231";
+    repo = "meowpdf";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-C5GqyZW0pDmBuaKM890hx2JZtkZqZx+x/RZFCPhpjho=";
+  };
+
+  cargoHash = "sha256-hCGMm0ORKuyyWU5D9k+nthSwmq8ALz0qASLDaMiW30U=";
+
+  nativeBuildInputs = [
+    pkg-config
+    rustPlatform.bindgenHook
+  ];
+
+  meta = {
+    description = "PDF viewer for the Kitty terminal with GUI-like usage and Vim-like keybindings written in Rust";
+    homepage = "https://github.com/monoamine11231/meowpdf";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ arthsmn ];
+    mainProgram = "meowpdf";
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/me/meson/package.nix b/pkgs/by-name/me/meson/package.nix
index bdefa68e0390..ea9e4e002d69 100644
--- a/pkgs/by-name/me/meson/package.nix
+++ b/pkgs/by-name/me/meson/package.nix
@@ -15,13 +15,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "meson";
-  version = "1.7.0";
+  version = "1.7.2";
 
   src = fetchFromGitHub {
     owner = "mesonbuild";
     repo = "meson";
     tag = version;
-    hash = "sha256-nvaq+9evQSj/ahK68nj8FckG4nA1gs2DqcZxFEFH1iU=";
+    hash = "sha256-On67RM3u1/XhdwgtAHve1GAJwKGCnk8IOCjNZcyDfyg=";
   };
 
   patches = [
diff --git a/pkgs/by-name/me/metronome/package.nix b/pkgs/by-name/me/metronome/package.nix
index c2010ce3a10b..b9f4dee6a2ee 100644
--- a/pkgs/by-name/me/metronome/package.nix
+++ b/pkgs/by-name/me/metronome/package.nix
@@ -12,7 +12,6 @@
   desktop-file-utils,
   libadwaita,
   gst_all_1,
-  darwin,
 }:
 
 stdenv.mkDerivation rec {
@@ -44,16 +43,12 @@ stdenv.mkDerivation rec {
     desktop-file-utils
   ];
 
-  buildInputs =
-    [
-      libadwaita
-      gst_all_1.gstreamer
-      gst_all_1.gst-plugins-base
-      gst_all_1.gst-plugins-bad
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Foundation
-    ];
+  buildInputs = [
+    libadwaita
+    gst_all_1.gstreamer
+    gst_all_1.gst-plugins-base
+    gst_all_1.gst-plugins-bad
+  ];
 
   # Workaround for the gettext-sys issue
   # https://github.com/Koka/gettext-rs/issues/114
diff --git a/pkgs/by-name/mi/microbin/package.nix b/pkgs/by-name/mi/microbin/package.nix
index 2f5d08158f94..dc44e039ccd7 100644
--- a/pkgs/by-name/mi/microbin/package.nix
+++ b/pkgs/by-name/mi/microbin/package.nix
@@ -1,5 +1,4 @@
 {
-  darwin,
   fetchFromGitHub,
   fetchpatch,
   lib,
@@ -7,7 +6,6 @@
   openssl,
   pkg-config,
   rustPlatform,
-  stdenv,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -66,14 +64,10 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      oniguruma
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = [
+    oniguruma
+    openssl
+  ];
 
   env = {
     OPENSSL_NO_VENDOR = true;
diff --git a/pkgs/by-name/mi/microserver/package.nix b/pkgs/by-name/mi/microserver/package.nix
index 84f46fd49e25..af9f172fa69c 100644
--- a/pkgs/by-name/mi/microserver/package.nix
+++ b/pkgs/by-name/mi/microserver/package.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,10 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-IPJJ9kv7gf5l7Y2JLCLjkNFao42h/VmkTd3LF5BCMLU=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin (
-    with darwin.apple_sdk.frameworks; [ Security ]
-  );
-
   meta = with lib; {
     homepage = "https://github.com/robertohuertasm/microserver";
     description = "Simple ad-hoc server with SPA support";
diff --git a/pkgs/by-name/mi/miniserve/package.nix b/pkgs/by-name/mi/miniserve/package.nix
index d85fd90783b0..36b2f3f5e609 100644
--- a/pkgs/by-name/mi/miniserve/package.nix
+++ b/pkgs/by-name/mi/miniserve/package.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   installShellFiles,
   stdenv,
-  darwin,
   curl,
 }:
 
@@ -26,11 +25,6 @@ rustPlatform.buildRustPackage rec {
     installShellFiles
   ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-    darwin.apple_sdk.frameworks.SystemConfiguration
-  ];
-
   nativeCheckInputs = [
     curl
   ];
diff --git a/pkgs/by-name/mi/mise/package.nix b/pkgs/by-name/mi/mise/package.nix
index 958ddc1a131d..7c9f33511237 100644
--- a/pkgs/by-name/mi/mise/package.nix
+++ b/pkgs/by-name/mi/mise/package.nix
@@ -1,10 +1,10 @@
 {
+  stdenv,
   lib,
   nix-update-script,
   rustPlatform,
   fetchFromGitHub,
   installShellFiles,
-  stdenv,
   coreutils,
   bash,
   direnv,
@@ -12,8 +12,6 @@
   pkg-config,
   openssl,
   cacert,
-  Security,
-  SystemConfiguration,
   usage,
   mise,
   testers,
@@ -40,12 +38,7 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Security
-      SystemConfiguration
-    ];
+  buildInputs = [ openssl ];
 
   postPatch = ''
     patchShebangs --build \
diff --git a/pkgs/by-name/mi/mitra/package.nix b/pkgs/by-name/mi/mitra/package.nix
index 0e48aff13306..068569310029 100644
--- a/pkgs/by-name/mi/mitra/package.nix
+++ b/pkgs/by-name/mi/mitra/package.nix
@@ -6,18 +6,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mitra";
-  version = "3.23.0";
+  version = "4.1.1";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "silverpill";
     repo = "mitra";
     rev = "v${version}";
-    hash = "sha256-QE/K9Hhu7e1y1JzuA8YxRTGDV6uAoSA+h1iWXH/4M8g=";
+    hash = "sha256-GKatTwdgBhhYtnKm+UNTJpcspG5pQBqHA616ELGGucg=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-JmX4Cbpj5gA0XWA5NQLfyFAQnoJmRCOaiNew96sWABI=";
+  cargoHash = "sha256-E6Sdu5QmALroJ6QLLy7QZOjieGut41lcoHwHuZftXvs=";
 
   # require running database
   doCheck = false;
diff --git a/pkgs/by-name/mj/mjolnir/package.json b/pkgs/by-name/mj/mjolnir/package.json
deleted file mode 100644
index d0ffe772a827..000000000000
--- a/pkgs/by-name/mj/mjolnir/package.json
+++ /dev/null
@@ -1,75 +0,0 @@
-{
-  "name": "mjolnir",
-  "version": "1.9.1",
-  "description": "A moderation tool for Matrix",
-  "main": "lib/index.js",
-  "repository": "git@github.com:matrix-org/mjolnir.git",
-  "author": "The Matrix.org Foundation C.I.C.",
-  "license": "Apache-2.0",
-  "private": true,
-  "scripts": {
-    "build": "tsc",
-    "postbuild": "rm -rf lib/test/ && cp -r lib/src/* lib/ && rm -rf lib/src/",
-    "lint": "tslint --project ./tsconfig.json -t stylish && npx prettier . --check",
-    "start:dev": "yarn build && node --async-stack-traces lib/index.js",
-    "test": "ts-mocha --project ./tsconfig.json test/commands/**/*.ts",
-    "test:integration": "NODE_ENV=harness ts-mocha --async-stack-traces --require test/integration/fixtures.ts --timeout 300000 --project ./tsconfig.json \"test/integration/**/*Test.ts\"",
-    "test:integration:single": "NODE_ENV=harness npx ts-mocha --require test/integration/fixtures.ts --timeout 300000 --project ./tsconfig.json",
-    "test:appservice:integration": "NODE_ENV=harness ts-mocha --async-stack-traces --timeout 300000 --project ./tsconfig.json \"test/appservice/integration/**/*Test.ts\"",
-    "test:appservice:integration:single": "NODE_ENV=harness npx ts-mocha --timeout 300000 --project ./tsconfig.json",
-    "test:manual": "NODE_ENV=harness ts-node test/integration/manualLaunchScript.ts",
-    "version": "sed -i '/# version automated/s/[0-9][0-9]*\\.[0-9][0-9]*\\.[0-9][0-9]*/'$npm_package_version'/' synapse_antispam/setup.py && git add synapse_antispam/setup.py && cat synapse_antispam/setup.py"
-  },
-  "devDependencies": {
-    "@types/config": "^3.3.0",
-    "@types/crypto-js": "^4.0.2",
-    "@types/express": "^4.17.13",
-    "@types/html-to-text": "^8.0.1",
-    "@types/humanize-duration": "^3.27.1",
-    "@types/js-yaml": "^4.0.5",
-    "@types/jsdom": "^16.2.11",
-    "@types/mocha": "^9.0.0",
-    "@types/nedb": "^1.8.12",
-    "@types/node": "^18.0.0",
-    "@types/pg": "^8.6.5",
-    "@types/request": "^2.48.8",
-    "@types/shell-quote": "1.7.1",
-    "crypto-js": "^4.2.0",
-    "eslint": "^7.32",
-    "expect": "^27.0.6",
-    "mocha": "^9.0.1",
-    "ts-mocha": "^9.0.2",
-    "tslint": "^6.1.3",
-    "typescript": "^4.8.4",
-    "typescript-formatter": "^7.2"
-  },
-  "dependencies": {
-    "@sentry/node": "^7.17.2",
-    "@sentry/tracing": "^7.17.2",
-    "@tensorflow/tfjs-node": "^4.21.0",
-    "@vector-im/matrix-bot-sdk": "^0.7.1-element.6",
-    "await-lock": "^2.2.2",
-    "axios": "^1.7.6",
-    "body-parser": "^1.20.1",
-    "config": "^3.3.8",
-    "express": "^4.20",
-    "html-to-text": "^8.0.0",
-    "humanize-duration": "^3.27.1",
-    "humanize-duration-ts": "^2.1.1",
-    "js-yaml": "^4.1.0",
-    "jsdom": "^16.6.0",
-    "lru-cache": "^11.0.1",
-    "matrix-appservice-bridge": "10.3.1",
-    "nsfwjs": "^4.1.0",
-    "parse-duration": "^1.0.2",
-    "pg": "^8.8.0",
-    "prom-client": "^14.1.0",
-    "shell-quote": "^1.7.3",
-    "ulidx": "^0.3.0",
-    "yaml": "^2.2.2"
-  },
-  "engines": {
-    "node": ">=20.0.0"
-  },
-  "packageManager": "yarn@1.22.22+sha512.a6b2f7906b721bba3d67d4aff083df04dad64c399707841b7acf00f6b133b7ac24255f2652fa22ae3534329dc6180534e98d17432037ff6fd140556e2bb3137e"
-}
diff --git a/pkgs/by-name/mj/mjolnir/package.nix b/pkgs/by-name/mj/mjolnir/package.nix
index dae472d6c015..7f97fc48f1b0 100644
--- a/pkgs/by-name/mj/mjolnir/package.nix
+++ b/pkgs/by-name/mj/mjolnir/package.nix
@@ -1,23 +1,26 @@
 {
   lib,
-  mkYarnPackage,
+  stdenv,
+  yarnConfigHook,
+  yarnBuildHook,
+  yarnInstallHook,
+  nodejs,
   fetchFromGitHub,
   fetchYarnDeps,
   matrix-sdk-crypto-nodejs,
   makeWrapper,
-  nodejs,
   nixosTests,
 }:
 
-mkYarnPackage rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "mjolnir";
-  version = "1.9.1";
+  version = "1.9.2";
 
   src = fetchFromGitHub {
     owner = "matrix-org";
     repo = "mjolnir";
-    tag = "v${version}";
-    hash = "sha256-LK2CgMLDJHfr1+ejHYeJNw2ekCnUA8GHufZ6vbifzGQ=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-OxHnCMP6IP0EaAs4YQgmV04tq6IdAYmKQX8O9Q48CPk=";
   };
 
   patches = [
@@ -25,33 +28,27 @@ mkYarnPackage rec {
     ./001-disable-nsfwprotection.patch
   ];
 
-  packageJSON = ./package.json;
-
   offlineCache = fetchYarnDeps {
-    yarnLock = src + "/yarn.lock";
+    yarnLock = "${finalAttrs.src}/yarn.lock";
     hash = "sha256-1V7ooONt9j+4hk/3w6Dsv/SdWwa1xsLk97EwhuPegNo=";
   };
 
-  packageResolutions = {
-    "@matrix-org/matrix-sdk-crypto-nodejs" =
-      "${matrix-sdk-crypto-nodejs}/lib/node_modules/@matrix-org/matrix-sdk-crypto-nodejs";
-  };
-
-  nativeBuildInputs = [ makeWrapper ];
-
-  buildPhase = ''
-    runHook preBuild
-
-    pushd deps/${pname}
-    yarn run build
-    popd
-
-    runHook postBuild
-  '';
+  nativeBuildInputs = [
+    yarnConfigHook
+    yarnBuildHook
+    yarnInstallHook
+    nodejs
+    makeWrapper
+  ];
 
   postInstall = ''
+    cp -r lib/* $out/lib/node_modules/mjolnir/lib/
+
+    rm -rf $out/lib/node_modules/mjolnir/node_modules/@matrix-org/matrix-sdk-crypto-nodejs
+    ln -s ${matrix-sdk-crypto-nodejs}/lib/node_modules/@matrix-org/matrix-sdk-crypto-nodejs $out/lib/node_modules/mjolnir/node_modules/@matrix-org/matrix-sdk-crypto-nodejs
+
     makeWrapper ${nodejs}/bin/node "$out/bin/mjolnir" \
-      --add-flags "$out/libexec/mjolnir/deps/mjolnir/lib/index.js"
+      --add-flags "$out/lib/node_modules/mjolnir/lib/index.js"
   '';
 
   passthru = {
@@ -60,7 +57,7 @@ mkYarnPackage rec {
     };
   };
 
-  meta = with lib; {
+  meta = {
     description = "Moderation tool for Matrix";
     homepage = "https://github.com/matrix-org/mjolnir";
     longDescription = ''
@@ -77,8 +74,8 @@ mkYarnPackage rec {
       A Synapse module is also available to apply the same rulesets the bot
       uses across an entire homeserver.
     '';
-    license = licenses.asl20;
-    maintainers = with maintainers; [ jojosch ];
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ jojosch ];
     mainProgram = "mjolnir";
   };
-}
+})
diff --git a/pkgs/by-name/mk/mkalias/package.nix b/pkgs/by-name/mk/mkalias/package.nix
index 38f326992f67..a9c57605e1de 100644
--- a/pkgs/by-name/mk/mkalias/package.nix
+++ b/pkgs/by-name/mk/mkalias/package.nix
@@ -3,7 +3,6 @@
   stdenv,
   fetchFromGitHub,
   cmake,
-  darwin,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -21,10 +20,6 @@ stdenv.mkDerivation (finalAttrs: {
     cmake
   ];
 
-  buildInputs = [
-    darwin.apple_sdk.frameworks.Foundation
-  ];
-
   cmakeFlags = [
     "-DMKALIAS_VERSION=${finalAttrs.version}"
   ];
diff --git a/pkgs/by-name/mo/mollysocket/package.nix b/pkgs/by-name/mo/mollysocket/package.nix
index aede71ab8bc2..1f3b5add9fed 100644
--- a/pkgs/by-name/mo/mollysocket/package.nix
+++ b/pkgs/by-name/mo/mollysocket/package.nix
@@ -5,8 +5,6 @@
   pkg-config,
   openssl,
   sqlite,
-  stdenv,
-  darwin,
   nixosTests,
 }:
 
@@ -28,14 +26,10 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      openssl
-      sqlite
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = [
+    openssl
+    sqlite
+  ];
 
   checkFlags = [
     # tests interact with Signal servers
diff --git a/pkgs/by-name/mo/monit/package.nix b/pkgs/by-name/mo/monit/package.nix
index f0a2e64e1048..bd2777f294d1 100644
--- a/pkgs/by-name/mo/monit/package.nix
+++ b/pkgs/by-name/mo/monit/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  darwin,
   bison,
   flex,
   zlib,
@@ -22,15 +21,10 @@ stdenv.mkDerivation rec {
     hash = "sha256-6VIqeLlU6u6TPEgQ23uZo2+UHgIsorAVcBhdTOQdjxI=";
   };
 
-  nativeBuildInputs =
-    [
-      bison
-      flex
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.DiskArbitration
-      darwin.apple_sdk.frameworks.System
-    ];
+  nativeBuildInputs = [
+    bison
+    flex
+  ];
 
   buildInputs =
     [
diff --git a/pkgs/by-name/mo/monophony/package.nix b/pkgs/by-name/mo/monophony/package.nix
index 07c48e1f24c8..2b13dd852402 100644
--- a/pkgs/by-name/mo/monophony/package.nix
+++ b/pkgs/by-name/mo/monophony/package.nix
@@ -12,7 +12,7 @@
 }:
 python3Packages.buildPythonApplication rec {
   pname = "monophony";
-  version = "3.3.2";
+  version = "2.15.0";
   pyproject = false;
 
   sourceRoot = "${src.name}/source";
@@ -20,7 +20,7 @@ python3Packages.buildPythonApplication rec {
     owner = "zehkira";
     repo = "monophony";
     rev = "v${version}";
-    hash = "sha256-UpklkBKssnwSnh9FeW5gOxY3EkwMbWAM/UEHpq+SIQo=";
+    hash = "sha256-fC+XXOGBpG5pIQW1tCNtQaptBCyLM+YGgsZLjWrMoDA=";
   };
 
   pythonPath = with python3Packages; [
diff --git a/pkgs/by-name/mo/moonfire-nvr/package.nix b/pkgs/by-name/mo/moonfire-nvr/package.nix
index 0d9e3bc642dd..2923cf1db51c 100644
--- a/pkgs/by-name/mo/moonfire-nvr/package.nix
+++ b/pkgs/by-name/mo/moonfire-nvr/package.nix
@@ -8,7 +8,6 @@
   sqlite,
   testers,
   moonfire-nvr,
-  darwin,
   nodejs,
   pnpm_9,
 }:
@@ -59,17 +58,10 @@ rustPlatform.buildRustPackage {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      ncurses
-      sqlite
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        Security
-      ]
-    );
+  buildInputs = [
+    ncurses
+    sqlite
+  ];
 
   postInstall = ''
     mkdir -p $out/lib/ui
diff --git a/pkgs/by-name/mo/movine/package.nix b/pkgs/by-name/mo/movine/package.nix
index 34f8a00ce89c..0539ec1e8bf5 100644
--- a/pkgs/by-name/mo/movine/package.nix
+++ b/pkgs/by-name/mo/movine/package.nix
@@ -4,8 +4,6 @@
   fetchCrate,
   pkg-config,
   openssl,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -24,13 +22,9 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = [
+    openssl
+  ];
 
   meta = with lib; {
     description = "Migration manager written in Rust, that attempts to be smart yet minimal";
diff --git a/pkgs/by-name/mo/movit/package.nix b/pkgs/by-name/mo/movit/package.nix
index ebda6555cd13..b4575cb3f5ca 100644
--- a/pkgs/by-name/mo/movit/package.nix
+++ b/pkgs/by-name/mo/movit/package.nix
@@ -6,7 +6,6 @@
   SDL2,
   fftw,
   gtest,
-  darwin,
   eigen,
   libepoxy,
   libGL,
@@ -33,18 +32,13 @@ stdenv.mkDerivation rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      SDL2
-      fftw
-      gtest
-      libGL
-      libX11
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.OpenGL
-      darwin.libobjc
-    ];
+  buildInputs = [
+    SDL2
+    fftw
+    gtest
+    libGL
+    libX11
+  ];
 
   propagatedBuildInputs = [
     eigen
diff --git a/pkgs/by-name/mp/mpd-discord-rpc/package.nix b/pkgs/by-name/mp/mpd-discord-rpc/package.nix
index 589e27d4f32b..51578dd19063 100644
--- a/pkgs/by-name/mp/mpd-discord-rpc/package.nix
+++ b/pkgs/by-name/mp/mpd-discord-rpc/package.nix
@@ -4,8 +4,6 @@
   fetchFromGitHub,
   pkg-config,
   openssl,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -26,14 +24,9 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    openssl
+  ];
 
   meta = with lib; {
     description = "Rust application which displays your currently playing song / album / artist from MPD in Discord using Rich Presence";
diff --git a/pkgs/by-name/mp/mpfr/package.nix b/pkgs/by-name/mp/mpfr/package.nix
index 79de1ab9de90..9874292c6f8a 100644
--- a/pkgs/by-name/mp/mpfr/package.nix
+++ b/pkgs/by-name/mp/mpfr/package.nix
@@ -13,7 +13,7 @@
 # files.
 
 stdenv.mkDerivation rec {
-  version = "4.2.1";
+  version = "4.2.2";
   pname = "mpfr";
 
   src = fetchurl {
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
       "https://www.mpfr.org/${pname}-${version}/${pname}-${version}.tar.xz"
       "mirror://gnu/mpfr/${pname}-${version}.tar.xz"
     ];
-    hash = "sha256-J3gHNTpnJpeJlpRa8T5Sgp46vXqaW3+yeTiU4Y8fy7I=";
+    hash = "sha256-tnugOD736KhWNzTi6InvXsPDuJigHQD6CmhprYHGzgE=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/mp/mpris-notifier/package.nix b/pkgs/by-name/mp/mpris-notifier/package.nix
index 6e52b2ecaa37..0bb272ac6609 100644
--- a/pkgs/by-name/mp/mpris-notifier/package.nix
+++ b/pkgs/by-name/mp/mpris-notifier/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,10 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-5LDhxciLpDYd4isUQNx8LF3y7m6cfcuIF2atHj/kayg=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-  ];
-
   meta = with lib; {
     description = "Dependency-light, highly-customizable, XDG desktop notification generator for MPRIS status changes";
     homepage = "https://github.com/l1na-forever/mpris-notifier";
diff --git a/pkgs/by-name/mq/mqttui/package.nix b/pkgs/by-name/mq/mqttui/package.nix
index 01d4cddc5bbc..8a0f001b1788 100644
--- a/pkgs/by-name/mq/mqttui/package.nix
+++ b/pkgs/by-name/mq/mqttui/package.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,8 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-gk5nA6np7dK4+j26aySNWfMZ9t/+7nZRaPsnhlDEnes=";
 
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.frameworks.Security;
-
   meta = {
     description = "Terminal client for MQTT";
     homepage = "https://github.com/EdJoPaTo/mqttui";
diff --git a/pkgs/by-name/mu/mupdf/package.nix b/pkgs/by-name/mu/mupdf/package.nix
index 79fc67987ca6..50344eb22589 100644
--- a/pkgs/by-name/mu/mupdf/package.nix
+++ b/pkgs/by-name/mu/mupdf/package.nix
@@ -14,7 +14,6 @@
   openjpeg,
   jbig2dec,
   libjpeg,
-  darwin,
   gumbo,
   enableX11 ? (!stdenv.hostPlatform.isDarwin),
   libX11,
@@ -142,19 +141,10 @@ stdenv.mkDerivation rec {
       curl
       openssl
     ]
-    ++ lib.optionals enableGL (
-      if stdenv.hostPlatform.isDarwin then
-        with darwin.apple_sdk.frameworks;
-        [
-          GLUT
-          OpenGL
-        ]
-      else
-        [
-          freeglut-mupdf
-          libGLU
-        ]
-    )
+    ++ lib.optionals (enableGL && !stdenv.hostPlatform.isDarwin) [
+      freeglut-mupdf
+      libGLU
+    ]
     ++ lib.optionals enableOcr [
       leptonica
       tesseract
diff --git a/pkgs/by-name/mu/musikcube/package.nix b/pkgs/by-name/mu/musikcube/package.nix
index 8c59e9833985..fa94ea6ff806 100644
--- a/pkgs/by-name/mu/musikcube/package.nix
+++ b/pkgs/by-name/mu/musikcube/package.nix
@@ -26,8 +26,6 @@
   sndio,
   systemd,
   systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd,
-  # Darwin Dependencies
-  darwin,
   coreaudioSupport ? stdenv.hostPlatform.isDarwin,
 }:
 
@@ -76,14 +74,6 @@ stdenv.mkDerivation (finalAttrs: {
       alsa-lib
       pulseaudio
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        Cocoa
-        SystemConfiguration
-      ]
-    )
-    ++ lib.optionals coreaudioSupport (with darwin.apple_sdk.frameworks; [ CoreAudio ])
     ++ lib.optionals sndioSupport [ sndio ]
     ++ lib.optionals pipewireSupport [ pipewire ];
 
diff --git a/pkgs/by-name/mv/mvfst/package.nix b/pkgs/by-name/mv/mvfst/package.nix
index edc2a6808b6f..4246792a4db9 100644
--- a/pkgs/by-name/mv/mvfst/package.nix
+++ b/pkgs/by-name/mv/mvfst/package.nix
@@ -21,7 +21,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mvfst";
-  version = "2025.02.10.00";
+  version = "2025.04.21.00";
 
   outputs = [
     "bin"
@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "facebook";
     repo = "mvfst";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-IsBydt1T33yedlaoyKl43fB7Dsuu4RPPiJuUtwZIUGg=";
+    hash = "sha256-/84smnZ2L1zDmkO1w9VQzVhXKt/S5azQr7Xpr8/dOA4=";
   };
 
   patches = [
diff --git a/pkgs/by-name/mv/mvnd/package.nix b/pkgs/by-name/mv/mvnd/package.nix
index 7e347bafcab7..473580df7738 100644
--- a/pkgs/by-name/mv/mvnd/package.nix
+++ b/pkgs/by-name/mv/mvnd/package.nix
@@ -1,5 +1,4 @@
 {
-  darwin,
   fetchFromGitHub,
   graalvmPackages,
   installShellFiles,
@@ -40,7 +39,7 @@ maven.buildMavenPackage rec {
     graalvmPackages.graalvm-ce
     installShellFiles
     makeWrapper
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk_11_0.frameworks.Foundation ];
+  ];
 
   mvnDepsParameters = mvnParameters;
   mvnParameters = lib.concatStringsSep " " [
diff --git a/pkgs/by-name/my/mycelium/package.nix b/pkgs/by-name/my/mycelium/package.nix
index 77f4525ec95a..4d882527c115 100644
--- a/pkgs/by-name/my/mycelium/package.nix
+++ b/pkgs/by-name/my/mycelium/package.nix
@@ -2,9 +2,7 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
   openssl,
-  darwin,
   nixosTests,
   nix-update-script,
   versionCheckHook,
@@ -27,10 +25,6 @@ rustPlatform.buildRustPackage rec {
   cargoHash = "sha256-9eiBFTb1dMKnM9VDPcV8dF7ChswVha0zCXjxlD2NCNc=";
 
   nativeBuildInputs = [ versionCheckHook ];
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-    darwin.apple_sdk.frameworks.SystemConfiguration
-  ];
 
   doInstallCheck = true;
 
diff --git a/pkgs/by-name/my/mysql84/package.nix b/pkgs/by-name/my/mysql84/package.nix
index d601857dded1..d0e39e5dccea 100644
--- a/pkgs/by-name/my/mysql84/package.nix
+++ b/pkgs/by-name/my/mysql84/package.nix
@@ -72,7 +72,6 @@ stdenv.mkDerivation (finalAttrs: {
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       cctools
-      darwin.apple_sdk.frameworks.CoreServices
       darwin.developer_cmds
       darwin.DarwinTools
     ];
diff --git a/pkgs/by-name/na/narrowlink/package.nix b/pkgs/by-name/na/narrowlink/package.nix
index 66168b2e7cd8..c67aaa36d62d 100644
--- a/pkgs/by-name/na/narrowlink/package.nix
+++ b/pkgs/by-name/na/narrowlink/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -24,11 +22,6 @@ rustPlatform.buildRustPackage rec {
     rustPlatform.bindgenHook
   ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.IOKit
-    darwin.apple_sdk.frameworks.Security
-  ];
-
   meta = {
     description = "Self-hosted solution to enable secure connectivity between devices across restricted networks like NAT or firewalls";
     homepage = "https://github.com/narrowlink/narrowlink";
diff --git a/pkgs/by-name/nb/nbtscanner/package.nix b/pkgs/by-name/nb/nbtscanner/package.nix
index 31efe5a446b5..7700a16fe628 100644
--- a/pkgs/by-name/nb/nbtscanner/package.nix
+++ b/pkgs/by-name/nb/nbtscanner/package.nix
@@ -1,7 +1,5 @@
 {
   lib,
-  stdenv,
-  darwin,
   fetchFromGitHub,
   rustPlatform,
   versionCheckHook,
@@ -31,8 +29,6 @@ rustPlatform.buildRustPackage rec {
       --replace-fail '.version("0.1")' '.version("${version}")'
   '';
 
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.Security ];
-
   nativeInstallCheckInputs = [ versionCheckHook ];
 
   doInstallCheck = true;
diff --git a/pkgs/by-name/nc/nchat/package.nix b/pkgs/by-name/nc/nchat/package.nix
index 4ab6257c3f7a..ba46eeda5f8d 100644
--- a/pkgs/by-name/nc/nchat/package.nix
+++ b/pkgs/by-name/nc/nchat/package.nix
@@ -11,7 +11,6 @@
   cmake,
   gperf,
   stdenv,
-  darwin,
 }:
 
 let
@@ -75,23 +74,14 @@ stdenv.mkDerivation rec {
     libcgowm
   ];
 
-  buildInputs =
-    [
-      file # for libmagic
-      ncurses
-      openssl
-      readline
-      sqlite
-      zlib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        AppKit
-        Cocoa
-        Foundation
-      ]
-    );
+  buildInputs = [
+    file # for libmagic
+    ncurses
+    openssl
+    readline
+    sqlite
+    zlib
+  ];
 
   cmakeFlags = [
     "-DCMAKE_INSTALL_LIBDIR=lib"
diff --git a/pkgs/by-name/ne/neko/package.nix b/pkgs/by-name/ne/neko/package.nix
index 22dc97f7d1d6..ee69504c27fe 100644
--- a/pkgs/by-name/ne/neko/package.nix
+++ b/pkgs/by-name/ne/neko/package.nix
@@ -45,25 +45,19 @@ stdenv.mkDerivation rec {
     pkg-config
     git
   ];
-  buildInputs =
-    [
-      boehmgc
-      zlib
-      sqlite
-      pcre
-      apacheHttpd
-      apr
-      aprutil
-      libmysqlclient
-      mbedtls_2
-      openssl
-      libpthreadstubs
-    ]
-    ++ lib.optional stdenv.hostPlatform.isLinux gtk2
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      pkgs.darwin.apple_sdk.frameworks.Security
-      pkgs.darwin.apple_sdk.frameworks.Carbon
-    ];
+  buildInputs = [
+    boehmgc
+    zlib
+    sqlite
+    pcre
+    apacheHttpd
+    apr
+    aprutil
+    libmysqlclient
+    mbedtls_2
+    openssl
+    libpthreadstubs
+  ] ++ lib.optional stdenv.hostPlatform.isLinux gtk2;
   cmakeFlags = [ "-DRUN_LDCONFIG=OFF" ];
   env = lib.optionalAttrs stdenv.cc.isClang {
     NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
diff --git a/pkgs/by-name/ne/nekoray/package.nix b/pkgs/by-name/ne/nekoray/package.nix
index d0e751d03f3c..fc524827a1d6 100644
--- a/pkgs/by-name/ne/nekoray/package.nix
+++ b/pkgs/by-name/ne/nekoray/package.nix
@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nekoray";
-  version = "4.2.12";
+  version = "4.3.4";
 
   src = fetchFromGitHub {
     owner = "Mahdi-zarei";
     repo = "nekoray";
     tag = finalAttrs.version;
-    hash = "sha256-5BXrfNPBZ+smpniA1jOPWE0X/be/C9MzswfbwmWEnyQ=";
+    hash = "sha256-h0LkH58+QQFeSwqhqOZDcFF0n98YJEHH/1tq72LdZpI=";
   };
 
   strictDeps = true;
@@ -96,7 +96,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) version src;
     sourceRoot = "${finalAttrs.src.name}/core/server";
 
-    vendorHash = "sha256-PDED6Haa3m2CZLij2A8Am7vSwep2YFrR984UNypduWo=";
+    vendorHash = "sha256-CTI9wDPJ9dYpUwvszY2nRfi+NW0nO8imt9lsQ7Nd1Q8=";
 
     # ldflags and tags are taken from script/build_go.sh
     ldflags = [
@@ -116,6 +116,9 @@ stdenv.mkDerivation (finalAttrs: {
     ];
   };
 
+  # this tricks nix-update into also updating the vendorHash of nekobox-core
+  passthru.goModules = finalAttrs.passthru.nekobox-core.goModules;
+
   meta = {
     description = "Qt based cross-platform GUI proxy configuration manager";
     homepage = "https://github.com/Mahdi-zarei/nekoray";
diff --git a/pkgs/by-name/ne/nest-cli/package.nix b/pkgs/by-name/ne/nest-cli/package.nix
index 76c5f37fb143..3a8feae70c07 100644
--- a/pkgs/by-name/ne/nest-cli/package.nix
+++ b/pkgs/by-name/ne/nest-cli/package.nix
@@ -1,10 +1,8 @@
 {
   buildNpmPackage,
-  darwin,
   fetchFromGitHub,
   lib,
   python3,
-  stdenv,
 }:
 
 buildNpmPackage rec {
@@ -28,10 +26,6 @@ buildNpmPackage rec {
     python3
   ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.CoreServices
-  ];
-
   meta = with lib; {
     description = "CLI tool for Nest applications";
     homepage = "https://nestjs.com";
diff --git a/pkgs/by-name/ne/net-snmp/package.nix b/pkgs/by-name/ne/net-snmp/package.nix
index a8c268e2abb9..c1ad4ea5d064 100644
--- a/pkgs/by-name/ne/net-snmp/package.nix
+++ b/pkgs/by-name/ne/net-snmp/package.nix
@@ -9,7 +9,6 @@
   nettools,
   autoreconfHook,
   withPerlTools ? false,
-  darwin,
 }:
 let
 
@@ -84,15 +83,7 @@ stdenv.mkDerivation rec {
     file
     autoreconfHook
   ];
-  buildInputs =
-    [ openssl ]
-    ++ lib.optional withPerlTools perlWithPkgs
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.ApplicationServices
-      darwin.apple_sdk.frameworks.CoreServices
-      darwin.apple_sdk.frameworks.IOKit
-      darwin.apple_sdk.frameworks.DiskArbitration
-    ];
+  buildInputs = [ openssl ] ++ lib.optional withPerlTools perlWithPkgs;
 
   enableParallelBuilding = true;
   # Missing dependencies during relinking:
diff --git a/pkgs/by-name/ne/netbox2netshot/package.nix b/pkgs/by-name/ne/netbox2netshot/package.nix
index 96d1bbb78e00..c6191cd6bdfa 100644
--- a/pkgs/by-name/ne/netbox2netshot/package.nix
+++ b/pkgs/by-name/ne/netbox2netshot/package.nix
@@ -4,8 +4,6 @@
   fetchFromGitHub,
   pkg-config,
   openssl,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -26,14 +24,9 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.CoreFoundation
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = [
+    openssl
+  ];
 
   meta = with lib; {
     description = "Inventory synchronization tool between Netbox and Netshot";
diff --git a/pkgs/by-name/ne/neverest/package.nix b/pkgs/by-name/ne/neverest/package.nix
index 8a54783f91f6..fd45a8ee81cd 100644
--- a/pkgs/by-name/ne/neverest/package.nix
+++ b/pkgs/by-name/ne/neverest/package.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   stdenv,
   pkg-config,
-  darwin,
   installShellFiles,
   installShellCompletions ? stdenv.buildPlatform.canExecute stdenv.hostPlatform,
   installManPages ? stdenv.buildPlatform.canExecute stdenv.hostPlatform,
@@ -36,17 +35,7 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ] ++ lib.optional (installManPages || installShellCompletions) installShellFiles;
 
-  buildInputs =
-    [ ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        AppKit
-        Cocoa
-        Security
-      ]
-    )
-    ++ lib.optional (builtins.elem "notmuch" buildFeatures) notmuch;
+  buildInputs = lib.optional (builtins.elem "notmuch" buildFeatures) notmuch;
 
   # TODO: unit tests temporarily broken, remove this line for the next
   # beta.2 release
diff --git a/pkgs/by-name/ne/newsboat/package.nix b/pkgs/by-name/ne/newsboat/package.nix
index 96c63f9951a9..8e9d82719ffd 100644
--- a/pkgs/by-name/ne/newsboat/package.nix
+++ b/pkgs/by-name/ne/newsboat/package.nix
@@ -11,7 +11,6 @@
   libxml2,
   json_c,
   ncurses,
-  darwin,
   asciidoctor,
   libiconv,
   makeWrapper,
@@ -59,15 +58,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
       json_c
       ncurses
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        Security
-        Foundation
-        libiconv
-        gettext
-      ]
-    );
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      libiconv
+      gettext
+    ];
 
   postBuild = ''
     make -j $NIX_BUILD_CORES prefix="$out"
diff --git a/pkgs/by-name/nh/nh/package.nix b/pkgs/by-name/nh/nh/package.nix
index 34c912a8afc1..83a6d04ed5f9 100644
--- a/pkgs/by-name/nh/nh/package.nix
+++ b/pkgs/by-name/nh/nh/package.nix
@@ -4,7 +4,6 @@
   rustPlatform,
   installShellFiles,
   makeBinaryWrapper,
-  darwin,
   fetchFromGitHub,
   nix-update-script,
   nvd,
@@ -35,10 +34,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     makeBinaryWrapper
   ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.SystemConfiguration
-  ];
-
   preFixup = lib.optionalString (stdenv.hostPlatform.emulatorAvailable buildPackages) (
     let
       emulator = stdenv.hostPlatform.emulator buildPackages;
diff --git a/pkgs/by-name/ni/nim-2_2/package.nix b/pkgs/by-name/ni/nim-2_2/package.nix
index f97506eb624a..0253925887ce 100644
--- a/pkgs/by-name/ni/nim-2_2/package.nix
+++ b/pkgs/by-name/ni/nim-2_2/package.nix
@@ -28,7 +28,6 @@ let
 
       # Needed for any nim package that uses the standard library's
       # 'std/sysrand' module.
-      depsTargetTargetPropagated = lib.optional stdenv.hostPlatform.isDarwin Security;
 
       inherit patches;
 
diff --git a/pkgs/by-name/ni/nim-unwrapped-2_2/package.nix b/pkgs/by-name/ni/nim-unwrapped-2_2/package.nix
index b9d371763bd0..5c2504413a03 100644
--- a/pkgs/by-name/ni/nim-unwrapped-2_2/package.nix
+++ b/pkgs/by-name/ni/nim-unwrapped-2_2/package.nix
@@ -99,7 +99,7 @@ stdenv.mkDerivation (finalAttrs: {
     pcre
     readline
     sqlite
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin Security;
+  ];
 
   patches = [
     ./NIM_CONFIG_DIR.patch
diff --git a/pkgs/by-name/ni/nix-btm/package.nix b/pkgs/by-name/ni/nix-btm/package.nix
index 742da2fb0a68..c14740055ad0 100644
--- a/pkgs/by-name/ni/nix-btm/package.nix
+++ b/pkgs/by-name/ni/nix-btm/package.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchCrate,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -19,14 +17,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-zMQw3Q9t6JSMDt7xHMGTgAu9LW6MhG+Rrjpp5IEs/qQ=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin (
-    with darwin.apple_sdk.frameworks;
-    [
-      CoreServices
-      SystemConfiguration
-    ]
-  );
-
   meta = with lib; {
     description = "Rust tool to monitor Nix processes";
     homepage = "https://github.com/DieracDelta/nix-btm";
diff --git a/pkgs/by-name/ni/nix-health/package.nix b/pkgs/by-name/ni/nix-health/package.nix
index ab6cf7acfec3..5ca8e3ca2b9d 100644
--- a/pkgs/by-name/ni/nix-health/package.nix
+++ b/pkgs/by-name/ni/nix-health/package.nix
@@ -1,12 +1,10 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchCrate,
   libiconv,
   openssl,
   pkg-config,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -23,20 +21,10 @@ rustPlatform.buildRustPackage rec {
   cargoHash = "sha256-3DE/NwPdi//7xaoV2SVgF5l3ndrEYraoyg5NLJzvzBI=";
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs =
-    [
-      libiconv
-      openssl
-    ]
-    # Use a newer SDK for CoreFoundation, because the sysinfo crate requires
-    # it, https://github.com/GuillaumeGomez/sysinfo/issues/915
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk_11_0.frameworks;
-      [
-        IOKit
-        CoreFoundation
-      ]
-    );
+  buildInputs = [
+    libiconv
+    openssl
+  ];
 
   meta = with lib; {
     description = "Check the health of your Nix setup";
diff --git a/pkgs/by-name/ni/nix-weather/package.nix b/pkgs/by-name/ni/nix-weather/package.nix
index 961ea4afe735..fa4ad7a7a722 100644
--- a/pkgs/by-name/ni/nix-weather/package.nix
+++ b/pkgs/by-name/ni/nix-weather/package.nix
@@ -5,7 +5,6 @@
   rustPlatform,
   pkg-config,
   openssl,
-  darwin,
   libiconv,
   installShellFiles,
   nix-update-script,
@@ -36,8 +35,6 @@ rustPlatform.buildRustPackage rec {
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       libiconv
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
     ];
 
   outputs = [
diff --git a/pkgs/by-name/ni/nix-web/package.nix b/pkgs/by-name/ni/nix-web/package.nix
index 2511a260b279..9149274b37d3 100644
--- a/pkgs/by-name/ni/nix-web/package.nix
+++ b/pkgs/by-name/ni/nix-web/package.nix
@@ -7,7 +7,6 @@
   openssl,
   nixVersions,
   nixPackage ? nixVersions.stable,
-  darwin,
 }:
 
 let
@@ -31,15 +30,7 @@ rustPlatform.buildRustPackage rec {
   cargoHash = "sha256-PfbDod1vQDnWqbhRgXbOvidxGWIXIe7XIgqiLVbovh0=";
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs =
-    lib.optional (!stdenv.hostPlatform.isDarwin) openssl
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        Security
-        SystemConfiguration
-      ]
-    );
+  buildInputs = lib.optional (!stdenv.hostPlatform.isDarwin) openssl;
 
   postPatch = ''
     substituteInPlace nix-web/nix-web.service \
diff --git a/pkgs/by-name/ni/nixci/package.nix b/pkgs/by-name/ni/nixci/package.nix
index 458a03ade240..267107cbdb46 100644
--- a/pkgs/by-name/ni/nixci/package.nix
+++ b/pkgs/by-name/ni/nixci/package.nix
@@ -5,9 +5,6 @@
   fetchFromGitHub,
   openssl,
   pkg-config,
-  Security,
-  SystemConfiguration,
-  IOKit,
   installShellFiles,
   nix,
 }:
@@ -32,15 +29,9 @@ rustPlatform.buildRustPackage rec {
     nix
   ];
 
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      IOKit
-      Security
-      SystemConfiguration
-    ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    openssl
+  ];
 
   postInstall = ''
     installShellCompletion --cmd nixci \
diff --git a/pkgs/by-name/ni/nixdoc/package.nix b/pkgs/by-name/ni/nixdoc/package.nix
index 8e895030339f..9f6077c56768 100644
--- a/pkgs/by-name/ni/nixdoc/package.nix
+++ b/pkgs/by-name/ni/nixdoc/package.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,8 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-Aw794yhIET8/pnlQiK2xKVbYC/Kd5MExvFTwkv4LLTc=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ darwin.Security ];
-
   meta = with lib; {
     description = "Generate documentation for Nix functions";
     mainProgram = "nixdoc";
diff --git a/pkgs/by-name/ni/nixtract/package.nix b/pkgs/by-name/ni/nixtract/package.nix
index 13139e54b6db..71bc900fed88 100644
--- a/pkgs/by-name/ni/nixtract/package.nix
+++ b/pkgs/by-name/ni/nixtract/package.nix
@@ -6,7 +6,6 @@
   openssl,
   stdenv,
   libiconv,
-  darwin,
   nix,
   testers,
   nixtract,
@@ -32,7 +31,6 @@ rustPlatform.buildRustPackage rec {
     [ openssl ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       libiconv
-      darwin.apple_sdk.frameworks.SystemConfiguration
     ];
 
   nativeCheckInputs = [ nix ];
diff --git a/pkgs/by-name/no/nodehun/package.nix b/pkgs/by-name/no/nodehun/package.nix
index 36426f03ea83..d903cf04e92d 100644
--- a/pkgs/by-name/no/nodehun/package.nix
+++ b/pkgs/by-name/no/nodehun/package.nix
@@ -1,7 +1,6 @@
 {
   buildNpmPackage,
   cctools,
-  darwin,
   fetchFromGitHub,
   lib,
   node-gyp,
@@ -30,10 +29,6 @@ buildNpmPackage {
   ];
 
   npmDepsHash = "sha256-mV6rWNf2p2w4H0ESUT0/Ybtx9YEdvO5l2gCvlWFXK+U=";
-
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.CoreServices
-  ];
   nativeBuildInputs = [
     node-gyp
     python3
diff --git a/pkgs/by-name/no/nostr-rs-relay/package.nix b/pkgs/by-name/no/nostr-rs-relay/package.nix
index 485cced95575..f73007bf9a08 100644
--- a/pkgs/by-name/no/nostr-rs-relay/package.nix
+++ b/pkgs/by-name/no/nostr-rs-relay/package.nix
@@ -6,7 +6,6 @@
   openssl,
   pkg-config,
   libiconv,
-  darwin,
   protobuf,
 }:
 
@@ -27,8 +26,6 @@ rustPlatform.buildRustPackage rec {
     [ openssl.dev ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       libiconv
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
     ];
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/no/nostui/package.nix b/pkgs/by-name/no/nostui/package.nix
index 6c32f8c19c94..97413ca90f7c 100644
--- a/pkgs/by-name/no/nostui/package.nix
+++ b/pkgs/by-name/no/nostui/package.nix
@@ -2,8 +2,6 @@
   lib,
   fetchFromGitHub,
   rustPlatform,
-  darwin,
-  stdenv,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -17,10 +15,6 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-RCD11KdzM66Mkydc51r6fG+q8bmKl5eZma58YoARwPo=";
   };
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin (
-    with darwin.apple_sdk; [ frameworks.SystemConfiguration ]
-  );
-
   GIT_HASH = "000000000000000000000000000000000000000000000000000";
 
   checkFlags = [
diff --git a/pkgs/by-name/no/notes/package.nix b/pkgs/by-name/no/notes/package.nix
index af926182fa91..2a5317c2f459 100644
--- a/pkgs/by-name/no/notes/package.nix
+++ b/pkgs/by-name/no/notes/package.nix
@@ -4,13 +4,8 @@
   fetchFromGitHub,
   cmake,
   qt6,
-  darwin,
-  overrideSDK,
 }:
-let
-  stdenv' = if stdenv.hostPlatform.isDarwin then overrideSDK stdenv "11.0" else stdenv;
-in
-stdenv'.mkDerivation (finalAttrs: {
+stdenv.mkDerivation (finalAttrs: {
   pname = "notes";
   version = "2.3.1";
 
@@ -29,14 +24,10 @@ stdenv'.mkDerivation (finalAttrs: {
     qt6.wrapQtAppsHook
   ];
 
-  buildInputs =
-    [
-      qt6.qtbase
-      qt6.qtdeclarative
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk_11_0.frameworks.Cocoa
-    ];
+  buildInputs = [
+    qt6.qtbase
+    qt6.qtdeclarative
+  ];
 
   postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
     mkdir $out/Applications
diff --git a/pkgs/by-name/no/novops/package.nix b/pkgs/by-name/no/novops/package.nix
index 3c9db899f070..8898152794e1 100644
--- a/pkgs/by-name/no/novops/package.nix
+++ b/pkgs/by-name/no/novops/package.nix
@@ -7,7 +7,6 @@
   stdenv,
   installShellFiles,
   libiconv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -30,7 +29,6 @@ rustPlatform.buildRustPackage rec {
     ]
     ++ lib.optional stdenv.hostPlatform.isDarwin [
       libiconv
-      darwin.apple_sdk.frameworks.SystemConfiguration
     ];
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/no/nowplaying-cli/package.nix b/pkgs/by-name/no/nowplaying-cli/package.nix
index f959cfd02c6f..61f46f60930c 100644
--- a/pkgs/by-name/no/nowplaying-cli/package.nix
+++ b/pkgs/by-name/no/nowplaying-cli/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  darwin,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -16,12 +15,6 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-FkyrtgsGzpK2rLNr+oxfPUbX43TVXYeiBg7CN1JUg8Y=";
   };
 
-  buildInputs = [
-    darwin.apple_sdk.frameworks.Foundation
-    darwin.apple_sdk.frameworks.AppKit
-    darwin.apple_sdk.frameworks.Cocoa
-  ];
-
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/by-name/np/npins/package.nix b/pkgs/by-name/np/npins/package.nix
index 4b9269f11d14..db9340044293 100644
--- a/pkgs/by-name/np/npins/package.nix
+++ b/pkgs/by-name/np/npins/package.nix
@@ -3,8 +3,6 @@
   rustPlatform,
   fetchFromGitHub,
   makeWrapper,
-  stdenv,
-  darwin,
 
   # runtime dependencies
   nix, # for nix-prefetch-url
@@ -33,13 +31,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-HnX7dkWLxa3DARXG8y9OVBRwvwgxwRIs4mWK3VNblG0=";
 
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin (
-    with darwin.apple_sdk.frameworks;
-    [
-      Security
-      SystemConfiguration
-    ]
-  );
   nativeBuildInputs = [ makeWrapper ];
 
   # (Almost) all tests require internet
diff --git a/pkgs/by-name/nu/nurl/package.nix b/pkgs/by-name/nu/nurl/package.nix
index 0946695d21ad..4da4d7f0e896 100644
--- a/pkgs/by-name/nu/nurl/package.nix
+++ b/pkgs/by-name/nu/nurl/package.nix
@@ -4,8 +4,6 @@
   fetchFromGitHub,
   installShellFiles,
   makeBinaryWrapper,
-  stdenv,
-  darwin,
   gitMinimal,
   mercurial,
   nixForLinking,
@@ -30,10 +28,6 @@ rustPlatform.buildRustPackage rec {
     makeBinaryWrapper
   ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-  ];
-
   # tests require internet access
   doCheck = false;
 
diff --git a/pkgs/by-name/nw/nwg-panel/package.nix b/pkgs/by-name/nw/nwg-panel/package.nix
index fa7b790d2f01..cb77ab815cd7 100644
--- a/pkgs/by-name/nw/nwg-panel/package.nix
+++ b/pkgs/by-name/nw/nwg-panel/package.nix
@@ -23,13 +23,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "nwg-panel";
-  version = "0.10.1";
+  version = "0.10.2";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = "nwg-panel";
     tag = "v${version}";
-    hash = "sha256-ZQQRuYcctVKkE1GLx0VRAOZc0VTl1DuyR6y9CE5TbcE=";
+    hash = "sha256-Wml9FXktLjTtYWTE/yoYDwFcPXeL1zhY3VgzrMW8DzE=";
   };
 
   # No tests
diff --git a/pkgs/by-name/oa/oakctl/package.nix b/pkgs/by-name/oa/oakctl/package.nix
new file mode 100644
index 000000000000..1b0de871f1d0
--- /dev/null
+++ b/pkgs/by-name/oa/oakctl/package.nix
@@ -0,0 +1,80 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  libgcc,
+  autoPatchelfHook,
+  testers,
+  oakctl,
+}:
+
+let
+  version = "0.2.12";
+
+  # Note: Extracted from install script
+  # https://oakctl-releases.luxonis.com/oakctl-installer.sh
+  sources = {
+    x86_64-linux = fetchurl {
+      url = "https://oakctl-releases.luxonis.com/data/${version}/linux_x86_64/oakctl";
+      hash = "sha256-HCnFD0LD6sQp9k3SP2g4svjA5/kLvfrnN+IwiuMWGCY=";
+    };
+    aarch64-linux = fetchurl {
+      url = "https://oakctl-releases.luxonis.com/data/${version}/linux_aarch64/oakctl";
+      hash = "sha256-1oJQs57/tW3rsMM+LAuKiBUf1aKOKFoPQAMcVUfXqlE=";
+    };
+    aarch64-darwin = fetchurl {
+      url = "https://oakctl-releases.luxonis.com/data/${version}/darwin_arm64/oakctl";
+      hash = "sha256-arS2qfd/Z/ZCNWAKD9bc2PMwkhVtO5WViTibMST7zd8=";
+    };
+    x86_64-darwin = fetchurl {
+      url = "https://oakctl-releases.luxonis.com/data/${version}/darwin_x86_64/oakctl";
+      hash = "sha256-yyvDQbFEtlB8xmdbxquy22wAIUcCSVchP/AuSpi4TAU=";
+    };
+  };
+
+  src =
+    sources.${stdenv.hostPlatform.system}
+      or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "oakctl";
+  inherit version src;
+
+  dontUnpack = true;
+  dontConfigure = true;
+  dontBuild = true;
+
+  passthru.tests.version = testers.testVersion {
+    command = "HOME=$TMPDIR oakctl version";
+    package = oakctl;
+  };
+
+  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ];
+
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ libgcc ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    install -D -m 0755 $src $out/bin/${finalAttrs.pname}
+
+    runHook postInstall
+  '';
+
+  # Note: The command 'oakctl self-update' won't work as the binary is located in the nix/store
+  meta = {
+    description = "Tool to interact with Luxonis OAK4 cameras";
+    homepage = "https://rvc4.docs.luxonis.com/software/tools/oakctl";
+    license = lib.licenses.unfree;
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+      "x86_64-darwin"
+      "aarch64-darwin"
+    ];
+    mainProgram = "oakctl";
+    maintainers = with lib.maintainers; [ phodina ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+})
diff --git a/pkgs/by-name/oc/oculante/package.nix b/pkgs/by-name/oc/oculante/package.nix
index 332329aac083..3c59d77be355 100644
--- a/pkgs/by-name/oc/oculante/package.nix
+++ b/pkgs/by-name/oc/oculante/package.nix
@@ -16,7 +16,6 @@
   wayland,
   stdenv,
   gtk3,
-  darwin,
   perl,
   wrapGAppsHook3,
 }:
@@ -57,9 +56,6 @@ rustPlatform.buildRustPackage rec {
       gtk3
       libxkbcommon
       wayland
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.libobjc
     ];
 
   checkFlags = [
diff --git a/pkgs/by-name/od/ode/package.nix b/pkgs/by-name/od/ode/package.nix
index cdef316b45a2..b41cb0e48b31 100644
--- a/pkgs/by-name/od/ode/package.nix
+++ b/pkgs/by-name/od/ode/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  darwin,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -14,11 +13,6 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-yRooxv8mUChHhKeccmo4DWr+yH7PejXDKmvgxbdFE+g=";
   };
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.CoreServices
-    darwin.apple_sdk.frameworks.GLUT
-  ];
-
   env.CXXFLAGS = lib.optionalString stdenv.cc.isClang (toString [
     "-std=c++14"
     "-Wno-error=c++11-narrowing"
diff --git a/pkgs/by-name/od/odin/darwin-remove-impure-links.patch b/pkgs/by-name/od/odin/darwin-remove-impure-links.patch
new file mode 100644
index 000000000000..eb7fa04c415a
--- /dev/null
+++ b/pkgs/by-name/od/odin/darwin-remove-impure-links.patch
@@ -0,0 +1,23 @@
+diff --git a/src/linker.cpp b/src/linker.cpp
+index ec165ef7d..91a28b8fc 100644
+--- a/src/linker.cpp
++++ b/src/linker.cpp
+@@ -769,18 +769,6 @@ try_cross_linking:;
+ 			gbString platform_lib_str = gb_string_make(heap_allocator(), "");
+ 			defer (gb_string_free(platform_lib_str));
+ 			if (build_context.metrics.os == TargetOs_darwin) {
+-				platform_lib_str = gb_string_appendc(platform_lib_str, "-Wl,-syslibroot /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk -L/usr/local/lib ");
+-
+-				// Homebrew's default library path, checking if it exists to avoid linking warnings.
+-				if (gb_file_exists("/opt/homebrew/lib")) {
+-					platform_lib_str = gb_string_appendc(platform_lib_str, "-L/opt/homebrew/lib ");
+-				}
+-
+-				// MacPort's default library path, checking if it exists to avoid linking warnings.
+-				if (gb_file_exists("/opt/local/lib")) {
+-					platform_lib_str = gb_string_appendc(platform_lib_str, "-L/opt/local/lib ");
+-				}
+-
+ 				// Only specify this flag if the user has given a minimum version to target.
+ 				// This will cause warnings to show up for mismatched libraries.
+ 				if (build_context.minimum_os_version_string_given) {
diff --git a/pkgs/by-name/od/odin/package.nix b/pkgs/by-name/od/odin/package.nix
index 8b8ce9205098..c30f50c52bda 100644
--- a/pkgs/by-name/od/odin/package.nix
+++ b/pkgs/by-name/od/odin/package.nix
@@ -1,12 +1,9 @@
 {
   fetchFromGitHub,
   lib,
-  libiconv,
   llvmPackages,
-  MacOSX-SDK,
   makeBinaryWrapper,
   nix-update-script,
-  Security,
   which,
 }:
 
@@ -24,16 +21,9 @@ stdenv.mkDerivation {
     hash = "sha256-GXea4+OIFyAhTqmDh2q+ewTUqI92ikOsa2s83UH2r58=";
   };
 
-  postPatch =
-    lib.optionalString stdenv.hostPlatform.isDarwin ''
-      substituteInPlace src/linker.cpp \
-          --replace-fail '/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk' ${MacOSX-SDK}
-    ''
-    + ''
-      substituteInPlace build_odin.sh \
-          --replace-fail '-framework System' '-lSystem'
-      patchShebangs build_odin.sh
-    '';
+  patches = [
+    ./darwin-remove-impure-links.patch
+  ];
 
   LLVM_CONFIG = "${llvmPackages.llvm.dev}/bin/llvm-config";
 
@@ -46,11 +36,6 @@ stdenv.mkDerivation {
     which
   ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    libiconv
-    Security
-  ];
-
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/by-name/oh/oha/package.nix b/pkgs/by-name/oh/oha/package.nix
index 7ba4aa030a47..20cadb0eff29 100644
--- a/pkgs/by-name/oh/oha/package.nix
+++ b/pkgs/by-name/oh/oha/package.nix
@@ -5,7 +5,6 @@
   stdenv,
   pkg-config,
   openssl,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -26,13 +25,9 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    openssl
+  ];
 
   # tests don't work inside the sandbox
   doCheck = false;
diff --git a/pkgs/by-name/ol/ollama/package.nix b/pkgs/by-name/ol/ollama/package.nix
index 805880ed1de7..4142c4ef3fa2 100644
--- a/pkgs/by-name/ol/ollama/package.nix
+++ b/pkgs/by-name/ol/ollama/package.nix
@@ -17,7 +17,6 @@
   rocmGpuTargets ? rocmPackages.clr.gpuTargets or [ ],
   cudaPackages,
   cudaArches ? cudaPackages.cudaFlags.realArches or [ ],
-  darwin,
   autoAddDriverRunpath,
 
   # passthru
@@ -89,13 +88,6 @@ let
 
   cudaPath = lib.removeSuffix "-${cudaMajorVersion}" cudaToolkit;
 
-  metalFrameworks = with darwin.apple_sdk_11_0.frameworks; [
-    Accelerate
-    Metal
-    MetalKit
-    MetalPerformanceShaders
-  ];
-
   wrapperOptions =
     [
       # ollama embeds llama-cpp binaries which actually run the ai models
@@ -166,13 +158,11 @@ goBuild (finalAttrs: {
     ++ lib.optionals (enableRocm || enableCuda) [
       makeWrapper
       autoAddDriverRunpath
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin metalFrameworks;
+    ];
 
   buildInputs =
     lib.optionals enableRocm (rocmLibs ++ [ libdrm ])
-    ++ lib.optionals enableCuda cudaLibs
-    ++ lib.optionals stdenv.hostPlatform.isDarwin metalFrameworks;
+    ++ lib.optionals enableCuda cudaLibs;
 
   # replace inaccurate version number with actual release version
   postPatch = ''
diff --git a/pkgs/by-name/op/open-scq30/package.nix b/pkgs/by-name/op/open-scq30/package.nix
index 7ae098af1898..eb59f6b8e6d3 100644
--- a/pkgs/by-name/op/open-scq30/package.nix
+++ b/pkgs/by-name/op/open-scq30/package.nix
@@ -12,8 +12,6 @@
   gtk4,
   libadwaita,
   pango,
-  stdenv,
-  darwin,
   cargo-make,
 }:
 
@@ -35,22 +33,15 @@ rustPlatform.buildRustPackage rec {
     cargo-make
   ];
 
-  buildInputs =
-    [
-      cairo
-      dbus
-      gdk-pixbuf
-      glib
-      gtk4
-      libadwaita
-      pango
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.AppKit
-      darwin.apple_sdk.frameworks.CoreBluetooth
-      darwin.apple_sdk.frameworks.CoreGraphics
-      darwin.apple_sdk.frameworks.Foundation
-    ];
+  buildInputs = [
+    cairo
+    dbus
+    gdk-pixbuf
+    glib
+    gtk4
+    libadwaita
+    pango
+  ];
 
   useFetchCargoVendor = true;
   cargoHash = "sha256-3K+/CpTGWSjCRa2vOEcDvLIiZMdntugIqnzkXF4wkng=";
diff --git a/pkgs/by-name/op/openboardview/package.nix b/pkgs/by-name/op/openboardview/package.nix
index c68764ee1f6a..71f71e966e61 100644
--- a/pkgs/by-name/op/openboardview/package.nix
+++ b/pkgs/by-name/op/openboardview/package.nix
@@ -11,12 +11,8 @@
   fontconfig,
   gtk3,
   wrapGAppsHook3,
-  darwin,
 }:
 
-let
-  inherit (darwin.apple_sdk.frameworks) Cocoa;
-in
 stdenv.mkDerivation rec {
   pname = "openboardview";
   version = "9.95.0";
@@ -44,15 +40,11 @@ stdenv.mkDerivation rec {
     python3
     wrapGAppsHook3
   ];
-  buildInputs =
-    [
-      SDL2
-      fontconfig
-      gtk3
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Cocoa
-    ];
+  buildInputs = [
+    SDL2
+    fontconfig
+    gtk3
+  ];
 
   postPatch = ''
     substituteInPlace src/openboardview/CMakeLists.txt \
diff --git a/pkgs/by-name/op/opencascade-occt/package.nix b/pkgs/by-name/op/opencascade-occt/package.nix
index 293eac8660b2..6295a0c98e38 100644
--- a/pkgs/by-name/op/opencascade-occt/package.nix
+++ b/pkgs/by-name/op/opencascade-occt/package.nix
@@ -13,7 +13,6 @@
   libXext,
   libXmu,
   libXi,
-  darwin,
 }:
 
 stdenv.mkDerivation rec {
@@ -50,7 +49,7 @@ stdenv.mkDerivation rec {
     libXmu
     libXi
     rapidjson
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.frameworks.Cocoa;
+  ];
 
   NIX_CFLAGS_COMPILE = [ "-fpermissive" ];
   cmakeFlags = [ "-DUSE_RAPIDJSON=ON" ];
diff --git a/pkgs/by-name/op/openctm/package.nix b/pkgs/by-name/op/openctm/package.nix
index bb6bd763ea1d..84c4f11dfdea 100644
--- a/pkgs/by-name/op/openctm/package.nix
+++ b/pkgs/by-name/op/openctm/package.nix
@@ -6,7 +6,6 @@
   libglut,
   gtk2,
   libGLU,
-  darwin,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -27,13 +26,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    [
-      libglut
-      libGLU
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [ gtk2 ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.Cocoa ];
+  buildInputs = [
+    libglut
+    libGLU
+  ] ++ lib.optionals stdenv.hostPlatform.isLinux [ gtk2 ];
 
   postPatch =
     lib.optionalString stdenv.hostPlatform.isLinux ''
diff --git a/pkgs/by-name/op/openimagedenoise/package.nix b/pkgs/by-name/op/openimagedenoise/package.nix
index 7bdfe8e24f14..d70de0343f30 100644
--- a/pkgs/by-name/op/openimagedenoise/package.nix
+++ b/pkgs/by-name/op/openimagedenoise/package.nix
@@ -3,7 +3,6 @@
   config,
   cudaPackages,
   cudaSupport ? config.cudaSupport,
-  darwin,
   fetchzip,
   ispc,
   lib,
@@ -42,14 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs =
     [ tbb ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk_11_0.frameworks;
-      [
-        Accelerate
-        MetalKit
-        MetalPerformanceShadersGraph
-      ]
-    )
+
     ++ lib.optionals cudaSupport [
       cudaPackages.cuda_cudart
       cudaPackages.cuda_cccl
diff --git a/pkgs/by-name/op/openpgp-ca/package.nix b/pkgs/by-name/op/openpgp-ca/package.nix
index 7b5e0bffc3d2..55195c940688 100644
--- a/pkgs/by-name/op/openpgp-ca/package.nix
+++ b/pkgs/by-name/op/openpgp-ca/package.nix
@@ -1,8 +1,6 @@
 {
-  stdenv,
   fetchFromGitLab,
   lib,
-  darwin,
   nettle,
   nix-update-script,
   rustPlatform,
@@ -36,21 +34,12 @@ rustPlatform.buildRustPackage rec {
     gnupg
   ];
 
-  buildInputs =
-    [
-      openssl
-      sqlite
-      pcsclite
-      nettle
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        PCSC
-        Security
-        SystemConfiguration
-      ]
-    );
+  buildInputs = [
+    openssl
+    sqlite
+    pcsclite
+    nettle
+  ];
 
   # Most tests rely on gnupg being able to write to /run/user
   # gnupg refuses to respect the XDG_RUNTIME_DIR variable, so we skip the tests
diff --git a/pkgs/by-name/op/opensaml-cpp/package.nix b/pkgs/by-name/op/opensaml-cpp/package.nix
index 9eac6e3074da..6bbe4f57d718 100644
--- a/pkgs/by-name/op/opensaml-cpp/package.nix
+++ b/pkgs/by-name/op/opensaml-cpp/package.nix
@@ -4,7 +4,6 @@
   fetchgit,
   autoreconfHook,
   pkg-config,
-  darwin,
   boost,
   openssl,
   log4shib,
@@ -24,23 +23,15 @@ stdenv.mkDerivation rec {
     sha256 = "0ms3sqmwqkrqb92d7jy2hqwnz5yd7cbrz73n321jik0jilrwl5w8";
   };
 
-  buildInputs =
-    [
-      boost
-      openssl
-      log4shib
-      xercesc
-      xml-security-c
-      xml-tooling-c
-      zlib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        CoreServices
-        SystemConfiguration
-      ]
-    );
+  buildInputs = [
+    boost
+    openssl
+    log4shib
+    xercesc
+    xml-security-c
+    xml-tooling-c
+    zlib
+  ];
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
diff --git a/pkgs/by-name/op/opensc/package.nix b/pkgs/by-name/op/opensc/package.nix
index 4714e994308a..8c642beb23da 100644
--- a/pkgs/by-name/op/opensc/package.nix
+++ b/pkgs/by-name/op/opensc/package.nix
@@ -14,9 +14,7 @@
   docbook_xsl,
   libxslt,
   docbook_xml_dtd_412,
-  darwin,
   nix-update-script,
-  withApplePCSC ? stdenv.hostPlatform.isDarwin,
 }:
 
 stdenv.mkDerivation rec {
@@ -35,46 +33,33 @@ stdenv.mkDerivation rec {
     autoreconfHook
     libxslt # xsltproc
   ];
-  buildInputs =
-    [
-      zlib
-      readline
-      openssl
-      libassuan
-      libXt
-      libiconv
-      docbook_xml_dtd_412
-    ]
-    ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.frameworks.Carbon
-    ++ (if withApplePCSC then [ darwin.apple_sdk.frameworks.PCSC ] else [ pcsclite ]);
+  buildInputs = [
+    zlib
+    readline
+    openssl
+    libassuan
+    libXt
+    libiconv
+    docbook_xml_dtd_412
+  ] ++ lib.optional (!stdenv.hostPlatform.isDarwin) pcsclite;
 
   env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
-  configureFlags = [
-    "--enable-zlib"
-    "--enable-readline"
-    "--enable-openssl"
-    "--enable-pcsc"
-    "--enable-sm"
-    "--enable-man"
-    "--enable-doc"
-    "--localstatedir=/var"
-    "--sysconfdir=/etc"
-    "--with-xsl-stylesheetsdir=${docbook_xsl}/xml/xsl/docbook"
-    "--with-pcsc-provider=${
-      if withApplePCSC then
-        "${darwin.apple_sdk.frameworks.PCSC}/Library/Frameworks/PCSC.framework/PCSC"
-      else
-        "${lib.getLib pcsclite}/lib/libpcsclite${stdenv.hostPlatform.extensions.sharedLibrary}"
-    }"
-  ];
-
-  PCSC_CFLAGS = lib.concatStringsSep " " (
-    lib.optionals withApplePCSC [
-      "-I${darwin.apple_sdk.frameworks.PCSC}/Library/Frameworks/PCSC.framework/Headers"
-      "-I${lib.getDev pcsclite}/include/PCSC"
+  configureFlags =
+    [
+      "--enable-zlib"
+      "--enable-readline"
+      "--enable-openssl"
+      "--enable-pcsc"
+      "--enable-sm"
+      "--enable-man"
+      "--enable-doc"
+      "--localstatedir=/var"
+      "--sysconfdir=/etc"
+      "--with-xsl-stylesheetsdir=${docbook_xsl}/xml/xsl/docbook"
     ]
-  );
+    ++ lib.optional (!stdenv.hostPlatform.isDarwin)
+      "--with-pcsc-provider=${lib.getLib pcsclite}/lib/libpcsclite${stdenv.hostPlatform.extensions.sharedLibrary}";
 
   installFlags = [
     "sysconfdir=$(out)/etc"
diff --git a/pkgs/by-name/op/opensubdiv/package.nix b/pkgs/by-name/op/opensubdiv/package.nix
index 588993c98e37..8d42b97d3640 100644
--- a/pkgs/by-name/op/opensubdiv/package.nix
+++ b/pkgs/by-name/op/opensubdiv/package.nix
@@ -14,7 +14,6 @@
   cudaSupport ? config.cudaSupport,
   cudaPackages,
   openclSupport ? !cudaSupport,
-  darwin,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -57,18 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
       xorg.libXi
     ]
     ++ lib.optionals (openclSupport && stdenv.hostPlatform.isLinux) [ ocl-icd ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        OpenCL
-        Cocoa
-        CoreVideo
-        IOKit
-        AppKit
-        AGL
-        MetalKit
-      ]
-    )
+
     ++ lib.optionals cudaSupport [
       cudaPackages.cuda_cudart
     ];
diff --git a/pkgs/by-name/op/openturns/package.nix b/pkgs/by-name/op/openturns/package.nix
index f6c984e4b9df..c93d0ba40100 100644
--- a/pkgs/by-name/op/openturns/package.nix
+++ b/pkgs/by-name/op/openturns/package.nix
@@ -4,7 +4,6 @@
   ceres-solver,
   cmake,
   cminpack,
-  darwin,
   dlib,
   fetchFromGitHub,
   hdf5,
@@ -24,9 +23,6 @@
   enablePython ? false,
 }:
 
-let
-  inherit (darwin.apple_sdk.frameworks) Accelerate;
-in
 stdenv.mkDerivation (finalAttrs: {
   pname = "openturns";
   version = "1.24";
@@ -64,9 +60,6 @@ stdenv.mkDerivation (finalAttrs: {
       python3Packages.matplotlib
       python3Packages.psutil
       python3Packages.python
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Accelerate
     ];
 
   cmakeFlags = [
diff --git a/pkgs/by-name/op/openvr/package.nix b/pkgs/by-name/op/openvr/package.nix
index 501a74ec098f..fa65d10af9e3 100644
--- a/pkgs/by-name/op/openvr/package.nix
+++ b/pkgs/by-name/op/openvr/package.nix
@@ -1,9 +1,7 @@
 {
-  AppKit,
   cmake,
   fetchFromGitHub,
   fetchpatch2,
-  Foundation,
   jsoncpp,
   lib,
   libGL,
@@ -48,15 +46,10 @@ stdenv.mkDerivation (finalAttrs: {
     cmake
   ];
 
-  buildInputs =
-    [
-      jsoncpp
-      libGL
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AppKit
-      Foundation
-    ];
+  buildInputs = [
+    jsoncpp
+    libGL
+  ];
 
   cmakeFlags = [
     "-DUSE_SYSTEM_JSONCPP=ON"
diff --git a/pkgs/by-name/or/oranda/package.nix b/pkgs/by-name/or/oranda/package.nix
index 5cf56cc1bf9c..482bd1c767f3 100644
--- a/pkgs/by-name/or/oranda/package.nix
+++ b/pkgs/by-name/or/oranda/package.nix
@@ -6,7 +6,6 @@
   tailwindcss,
   oniguruma,
   stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -28,14 +27,9 @@ rustPlatform.buildRustPackage rec {
     tailwindcss
   ];
 
-  buildInputs =
-    [
-      oniguruma
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.CoreServices
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    oniguruma
+  ];
 
   # requires internet access
   checkFlags = [
diff --git a/pkgs/by-name/or/ord/package.nix b/pkgs/by-name/or/ord/package.nix
index 6f03e4c6c1cc..29f9deb8bca1 100644
--- a/pkgs/by-name/or/ord/package.nix
+++ b/pkgs/by-name/or/ord/package.nix
@@ -4,8 +4,6 @@
   fetchFromGitHub,
   pkg-config,
   openssl,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -26,14 +24,9 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    openssl
+  ];
 
   dontUseCargoParallelTests = true;
 
diff --git a/pkgs/by-name/or/orogene/package.nix b/pkgs/by-name/or/orogene/package.nix
index c19b5e3a4f3b..f1fbb658b10c 100644
--- a/pkgs/by-name/or/orogene/package.nix
+++ b/pkgs/by-name/or/orogene/package.nix
@@ -4,8 +4,6 @@
   fetchFromGitHub,
   pkg-config,
   openssl,
-  stdenv,
-  darwin,
   versionCheckHook,
 }:
 
@@ -34,13 +32,9 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    openssl
+  ];
 
   preCheck = ''
     export CI=true
diff --git a/pkgs/by-name/os/osxsnarf/package.nix b/pkgs/by-name/os/osxsnarf/package.nix
index aa4f22baa43e..d57c7523b53d 100644
--- a/pkgs/by-name/os/osxsnarf/package.nix
+++ b/pkgs/by-name/os/osxsnarf/package.nix
@@ -3,7 +3,6 @@
   lib,
   fetchFromGitHub,
   plan9port,
-  darwin,
   ...
 }:
 
@@ -20,7 +19,6 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     plan9port
-    darwin.apple_sdk.frameworks.Carbon
   ];
   makeFlags = [ "prefix=${placeholder "out"}" ];
 
diff --git a/pkgs/by-name/ot/otto-matic/package.nix b/pkgs/by-name/ot/otto-matic/package.nix
index 717154698f77..f58ce12e8bd4 100644
--- a/pkgs/by-name/ot/otto-matic/package.nix
+++ b/pkgs/by-name/ot/otto-matic/package.nix
@@ -2,20 +2,22 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  SDL2,
+  sdl3,
+  libGL,
   cmake,
   makeWrapper,
+  unstableGitUpdater,
 }:
 
 stdenv.mkDerivation rec {
   pname = "OttoMatic";
-  version = "unstable-2023-11-13";
+  version = "4.0.1-unstable-2025-04-27";
 
   src = fetchFromGitHub {
     owner = "jorio";
-    repo = pname;
-    rev = "8a5411779762684066d3748fbf4d33747ca871a4";
-    hash = "sha256-cZ2gHNXmjMocfTgbA+0T2nwKs55ZMDoB+JTf0Qdqe8U=";
+    repo = "OttoMatic";
+    rev = "69f0111d1768abe56498bf8121f0f9cbc85aedd3";
+    hash = "sha256-7RpEVL3tNhEhkZYVjgsI6S+CQfyiz/ukroldrtohA4k=";
     fetchSubmodules = true;
   };
 
@@ -25,7 +27,8 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    SDL2
+    sdl3
+    libGL
   ];
 
   installPhase = ''
@@ -38,15 +41,18 @@ stdenv.mkDerivation rec {
     wrapProgram $out/bin/OttoMatic --chdir "$out/share/OttoMatic"
     install -Dm644 $src/packaging/io.jor.ottomatic.desktop $out/share/applications/io.jor.ottomatic.desktop
     install -Dm644 $src/packaging/io.jor.ottomatic.png $out/share/pixmaps/io.jor.ottomatic.png
+
     runHook postInstall
   '';
 
-  meta = with lib; {
+  passthru.updateScript = unstableGitUpdater { };
+
+  meta = {
     description = "Port of Otto Matic, a 2001 Macintosh game by Pangea Software, for modern operating systems";
     homepage = "https://github.com/jorio/OttoMatic";
-    license = licenses.cc-by-sa-40;
-    maintainers = with maintainers; [ lux ];
-    platforms = platforms.linux;
+    license = lib.licenses.cc-by-sa-40;
+    maintainers = with lib.maintainers; [ lux ];
+    platforms = lib.platforms.linux;
     mainProgram = "OttoMatic";
   };
 }
diff --git a/pkgs/by-name/ov/ovftool/package.nix b/pkgs/by-name/ov/ovftool/package.nix
index 67c8c1b9bd5f..3176c2f5c4c8 100644
--- a/pkgs/by-name/ov/ovftool/package.nix
+++ b/pkgs/by-name/ov/ovftool/package.nix
@@ -129,7 +129,6 @@ stdenv.mkDerivation (final: {
       openssl
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.Libsystem
       libxml2
     ];
 
@@ -244,7 +243,6 @@ stdenv.mkDerivation (final: {
       done
 
       # Patches for ovftool binary
-      change_args+=(-change /usr/lib/libSystem.B.dylib ${darwin.Libsystem}/lib/libSystem.B.dylib)
       change_args+=(-change /usr/lib/libc++.1.dylib ${stdenv.cc.libcxx}/lib/libc++.1.dylib)
       change_args+=(-change /usr/lib/libiconv.2.dylib ${libiconv}/lib/libiconv.2.dylib)
       change_args+=(-change /usr/lib/libxml2.2.dylib ${libxml2}/lib/libxml2.2.dylib)
@@ -263,7 +261,7 @@ stdenv.mkDerivation (final: {
       otool -L "$out/libexec/ovftool"
 
       # Additional patches for ovftool dylibs
-      change_args+=(-change /usr/lib/libresolv.9.dylib ${darwin.Libsystem}/lib/libresolv.9.dylib)
+      change_args+=(-change /usr/lib/libresolv.9.dylib ${lib.getLib darwin.libresolv}/lib/libresolv.9.dylib)
       change_args+=(-change @loader_path/libcares.2.dylib ${c-ares}/lib/libcares.2.dylib)
       change_args+=(-change @loader_path/libexpat.dylib ${expat}/lib/libexpat.dylib)
       change_args+=(-change @loader_path/libicudata.60.2.dylib ${icu60}/lib/libicudata.60.2.dylib)
diff --git a/pkgs/by-name/ow/owl-compositor/package.nix b/pkgs/by-name/ow/owl-compositor/package.nix
index 6a25f6a56879..95e664b19889 100644
--- a/pkgs/by-name/ow/owl-compositor/package.nix
+++ b/pkgs/by-name/ow/owl-compositor/package.nix
@@ -54,9 +54,6 @@ stdenv.mkDerivation {
       libxkbcommon
       wayland
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Cocoa
-    ]
     ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
       gnustep-back
     ];
diff --git a/pkgs/by-name/ow/owmods-cli/package.nix b/pkgs/by-name/ow/owmods-cli/package.nix
index 75e98dd7d0e9..082265addff8 100644
--- a/pkgs/by-name/ow/owmods-cli/package.nix
+++ b/pkgs/by-name/ow/owmods-cli/package.nix
@@ -12,7 +12,6 @@
   mono,
   wrapWithMono ? true,
   openssl,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -41,10 +40,6 @@ rustPlatform.buildRustPackage rec {
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
     ];
 
   env = {
diff --git a/pkgs/by-name/ox/oxide-rs/package.nix b/pkgs/by-name/ox/oxide-rs/package.nix
index fc18cc37c64a..3176d0ffcdd1 100644
--- a/pkgs/by-name/ox/oxide-rs/package.nix
+++ b/pkgs/by-name/ox/oxide-rs/package.nix
@@ -7,8 +7,6 @@
   libgit2,
   openssl,
   zlib,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -47,17 +45,12 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      curl
-      libgit2
-      openssl
-      zlib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    curl
+    libgit2
+    openssl
+    zlib
+  ];
 
   env = {
     OPENSSL_NO_VENDOR = true;
diff --git a/pkgs/by-name/ox/oxlint/package.nix b/pkgs/by-name/ox/oxlint/package.nix
index ac9043901a7c..7d3e3580ba05 100644
--- a/pkgs/by-name/ox/oxlint/package.nix
+++ b/pkgs/by-name/ox/oxlint/package.nix
@@ -3,8 +3,6 @@
   rustPlatform,
   fetchFromGitHub,
   rust-jemalloc-sys,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -21,13 +19,9 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-OdV80+B/H/xMfZDeFw+oaoFLgJrIDsR3mDkfaSw5+W4=";
 
-  buildInputs =
-    [
-      rust-jemalloc-sys
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = [
+    rust-jemalloc-sys
+  ];
 
   env.OXC_VERSION = version;
 
diff --git a/pkgs/by-name/p2/p2pool/package.nix b/pkgs/by-name/p2/p2pool/package.nix
index 16fb274d0130..d004151ec79c 100644
--- a/pkgs/by-name/p2/p2pool/package.nix
+++ b/pkgs/by-name/p2/p2pool/package.nix
@@ -12,12 +12,8 @@
   openssl,
   pkg-config,
   zeromq,
-  darwin,
 }:
 
-let
-  inherit (darwin.apple_sdk.frameworks) Foundation;
-in
 stdenv.mkDerivation rec {
   pname = "p2pool";
   version = "4.4";
@@ -42,7 +38,7 @@ stdenv.mkDerivation rec {
     hwloc
     openssl
     curl
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Foundation ];
+  ];
 
   cmakeFlags = [ "-DWITH_LTO=OFF" ];
 
diff --git a/pkgs/by-name/pa/pam_rssh/package.nix b/pkgs/by-name/pa/pam_rssh/package.nix
index a3168a587419..cc95d3acc04a 100644
--- a/pkgs/by-name/pa/pam_rssh/package.nix
+++ b/pkgs/by-name/pa/pam_rssh/package.nix
@@ -40,9 +40,11 @@ rustPlatform.buildRustPackage rec {
   checkFlags = [
     # Fails because it tries finding authorized_keys in /home/$USER.
     "--skip=tests::parse_user_authorized_keys"
+    # Skip unsupported DSA keys since OpenSSH v10.
+    "--skip=sign_verify::test_dsa_sign_verify"
   ];
 
-  nativeCheckInputs = [ (openssh.override { dsaKeysSupport = true; }) ];
+  nativeCheckInputs = [ openssh ];
 
   env.USER = "nixbld";
 
@@ -55,7 +57,6 @@ rustPlatform.buildRustPackage rec {
     ssh-keygen -q -N "" -t ecdsa -b 256 -f $HOME/.ssh/id_ecdsa256
     ssh-keygen -q -N "" -t ed25519 -f $HOME/.ssh/id_ed25519
     ssh-keygen -q -N "" -t rsa -f $HOME/.ssh/id_rsa
-    ssh-keygen -q -N "" -t dsa -f $HOME/.ssh/id_dsa
     export SSH_AUTH_SOCK=$HOME/ssh-agent.sock
     eval $(ssh-agent -a $SSH_AUTH_SOCK)
     ssh-add $HOME/.ssh/id_ecdsa521
@@ -63,7 +64,6 @@ rustPlatform.buildRustPackage rec {
     ssh-add $HOME/.ssh/id_ecdsa256
     ssh-add $HOME/.ssh/id_ed25519
     ssh-add $HOME/.ssh/id_rsa
-    ssh-add $HOME/.ssh/id_dsa
   '';
 
   meta = with lib; {
diff --git a/pkgs/by-name/pa/panamax/package.nix b/pkgs/by-name/pa/panamax/package.nix
index 7834c46fc2e7..c8c579a074d7 100644
--- a/pkgs/by-name/pa/panamax/package.nix
+++ b/pkgs/by-name/pa/panamax/package.nix
@@ -6,8 +6,6 @@
   libgit2,
   openssl,
   zlib,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -24,16 +22,11 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    [
-      libgit2
-      openssl
-      zlib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    libgit2
+    openssl
+    zlib
+  ];
 
   meta = with lib; {
     description = "Mirror rustup and crates.io repositories for offline Rust and cargo usage";
diff --git a/pkgs/by-name/pa/panotools/package.nix b/pkgs/by-name/pa/panotools/package.nix
index 1616159e31c1..f9af218e70ed 100644
--- a/pkgs/by-name/pa/panotools/package.nix
+++ b/pkgs/by-name/pa/panotools/package.nix
@@ -7,7 +7,6 @@
   libpng,
   libtiff,
   perl,
-  darwin,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -26,15 +25,11 @@ stdenv.mkDerivation (finalAttrs: {
     perl
   ];
 
-  buildInputs =
-    [
-      libjpeg
-      libpng
-      libtiff
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Carbon
-    ];
+  buildInputs = [
+    libjpeg
+    libpng
+    libtiff
+  ];
 
   meta = {
     description = "Free software suite for authoring and displaying virtual reality panoramas";
diff --git a/pkgs/by-name/pa/paper-plane/package.nix b/pkgs/by-name/pa/paper-plane/package.nix
index b2f852a4709a..065a5354c571 100644
--- a/pkgs/by-name/pa/paper-plane/package.nix
+++ b/pkgs/by-name/pa/paper-plane/package.nix
@@ -17,7 +17,6 @@
   libxml2,
   libshumate,
   gst_all_1,
-  darwin,
   buildPackages,
 }:
 
@@ -90,20 +89,16 @@ stdenv.mkDerivation {
     libxml2.bin
   ];
 
-  buildInputs =
-    [
-      libshumate
-      libadwaita-paperplane
-      tdlib-paperplane
-      rlottie-paperplane
-      gst_all_1.gstreamer
-      gst_all_1.gst-libav
-      gst_all_1.gst-plugins-base
-      gst_all_1.gst-plugins-good
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Foundation
-    ];
+  buildInputs = [
+    libshumate
+    libadwaita-paperplane
+    tdlib-paperplane
+    rlottie-paperplane
+    gst_all_1.gstreamer
+    gst_all_1.gst-libav
+    gst_all_1.gst-plugins-base
+    gst_all_1.gst-plugins-good
+  ];
 
   mesonFlags = [
     # The API ID and hash provided here are for use with Paper Plane only.
diff --git a/pkgs/by-name/pa/paperless-ngx/package.nix b/pkgs/by-name/pa/paperless-ngx/package.nix
index c4abb4bd887e..41445394d5b8 100644
--- a/pkgs/by-name/pa/paperless-ngx/package.nix
+++ b/pkgs/by-name/pa/paperless-ngx/package.nix
@@ -8,7 +8,6 @@
   gettext,
   python3,
   giflib,
-  darwin,
   ghostscript_headless,
   imagemagickBig,
   jbig2enc,
@@ -91,7 +90,6 @@ let
         ]
         ++ lib.optionals stdenv.hostPlatform.isDarwin [
           giflib
-          darwin.apple_sdk.frameworks.CoreText
         ];
 
       CYPRESS_INSTALL_BINARY = "0";
diff --git a/pkgs/by-name/pa/papers/package.nix b/pkgs/by-name/pa/papers/package.nix
index a57016c84c36..ebc7a6ff1c45 100644
--- a/pkgs/by-name/pa/papers/package.nix
+++ b/pkgs/by-name/pa/papers/package.nix
@@ -15,7 +15,6 @@
   itstool,
   poppler,
   nautilus,
-  darwin,
   djvulibre,
   libspectre,
   libarchive,
@@ -100,9 +99,6 @@ stdenv.mkDerivation (finalAttrs: {
     ]
     ++ lib.optionals supportNautilus [
       nautilus
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Foundation
     ];
 
   mesonFlags =
diff --git a/pkgs/by-name/pa/paretosecurity/package.nix b/pkgs/by-name/pa/paretosecurity/package.nix
index c9b63a34b459..a7cdc8cccf74 100644
--- a/pkgs/by-name/pa/paretosecurity/package.nix
+++ b/pkgs/by-name/pa/paretosecurity/package.nix
@@ -17,13 +17,13 @@ buildGoModule (finalAttrs: {
     webkitgtk_4_1
   ];
   pname = "paretosecurity";
-  version = "0.2.13";
+  version = "0.2.14";
 
   src = fetchFromGitHub {
     owner = "ParetoSecurity";
     repo = "agent";
     rev = finalAttrs.version;
-    hash = "sha256-G2An1Br/NJcIEKaM/pPEGkJazD9UFypRZ/KLmqkNUTo=";
+    hash = "sha256-/3TTSaio24cuXmPvPVRZE4JqddWYezyAFCqYJRiMG7M=";
   };
 
   vendorHash = "sha256-YnyACP/hJYxi4AWMwr0We4YUTbWwahKAIYN6RnHmzls=";
diff --git a/pkgs/by-name/pa/partio/package.nix b/pkgs/by-name/pa/partio/package.nix
index 771169e90c28..9c2cc4c91f7e 100644
--- a/pkgs/by-name/pa/partio/package.nix
+++ b/pkgs/by-name/pa/partio/package.nix
@@ -12,7 +12,6 @@
   doxygen,
   xorg,
   python3,
-  darwin,
 }:
 
 stdenv.mkDerivation rec {
@@ -46,10 +45,6 @@ stdenv.mkDerivation rec {
       xorg.libXi
       xorg.libXmu
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Cocoa
-      darwin.apple_sdk.frameworks.GLUT
-    ]
     ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
       libglut
       libGLU
diff --git a/pkgs/by-name/pa/pazi/package.nix b/pkgs/by-name/pa/pazi/package.nix
index 560f1e7c7a10..59aad8623053 100644
--- a/pkgs/by-name/pa/pazi/package.nix
+++ b/pkgs/by-name/pa/pazi/package.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
-  darwin,
   installShellFiles,
 }:
 
@@ -20,8 +18,6 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.Security ];
-
   useFetchCargoVendor = true;
   cargoHash = "sha256-/r/nRQ/7KyUmJK19F557AcxXEXa85E/CE6+YFU6DdR4=";
 
diff --git a/pkgs/by-name/pd/pdm/package.nix b/pkgs/by-name/pd/pdm/package.nix
index 2e4837f6899a..0eeb269bb258 100644
--- a/pkgs/by-name/pd/pdm/package.nix
+++ b/pkgs/by-name/pd/pdm/package.nix
@@ -19,12 +19,6 @@ let
           hash = "sha256-UBdgFN+fvbjz+rp8+rog8FW2jwO/jCfUPV7UehJKiV8=";
         };
       });
-      # pdm requires hishel and subsequentially pytest-regressions -> matplotlib -> ghostscript -> jbig2dec which is AGPL only
-      matplotlib = super.matplotlib.override ({ enableGhostscript = false; });
-      # avoid many extra dependencies
-      moto = super.moto.overridePythonAttrs (old: rec {
-        doCheck = false;
-      });
     };
   };
 in
diff --git a/pkgs/by-name/pe/pest-ide-tools/package.nix b/pkgs/by-name/pe/pest-ide-tools/package.nix
index a06b35650757..933156c3e5d6 100644
--- a/pkgs/by-name/pe/pest-ide-tools/package.nix
+++ b/pkgs/by-name/pe/pest-ide-tools/package.nix
@@ -1,10 +1,8 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
   nix-update-script,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -19,9 +17,6 @@ rustPlatform.buildRustPackage rec {
     rev = "v${version}";
     sha256 = "sha256-12/FndzUbUlgcYcwMT1OfamSKgy2q+CvtGyx5YY4IFQ=";
   };
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-  ];
 
   passthru = {
     updateScript = nix-update-script { };
diff --git a/pkgs/by-name/pf/pfetch-rs/package.nix b/pkgs/by-name/pf/pfetch-rs/package.nix
index 33ffa99ff901..b01632e6a4fb 100644
--- a/pkgs/by-name/pf/pfetch-rs/package.nix
+++ b/pkgs/by-name/pf/pfetch-rs/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,11 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-36MjBzSzEOVaSnd6dTqYnV+Pi+5EDoUskkYsvYMGrgg=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.AppKit
-    darwin.apple_sdk.frameworks.DisplayServices
-  ];
-
   meta = with lib; {
     description = "Rewrite of the pfetch system information tool in Rust";
     homepage = "https://github.com/Gobidev/pfetch-rs";
diff --git a/pkgs/by-name/pg/pg_checksums/package.nix b/pkgs/by-name/pg/pg_checksums/package.nix
index 19806488fa7f..35cfe1463b83 100644
--- a/pkgs/by-name/pg/pg_checksums/package.nix
+++ b/pkgs/by-name/pg/pg_checksums/package.nix
@@ -1,13 +1,13 @@
 {
   lib,
-  stdenv,
+  clangStdenv,
   fetchFromGitHub,
   libxslt,
   docbook_xsl,
   postgresql,
 }:
 
-stdenv.mkDerivation rec {
+clangStdenv.mkDerivation rec {
   pname = "pg_checksums";
   version = "1.2";
 
diff --git a/pkgs/by-name/pg/pgcat/package.nix b/pkgs/by-name/pg/pgcat/package.nix
index 159acd4ca1e7..e0e8945250a8 100644
--- a/pkgs/by-name/pg/pgcat/package.nix
+++ b/pkgs/by-name/pg/pgcat/package.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
-  darwin,
   nix-update-script,
   testers,
   pgcat,
@@ -23,10 +21,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-6x/IPFncfOPxautW7gVUh5LG0hK4h6T4QL7B82Moi6o=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-  ];
-
   checkFlags = [
     # requires network access
     "--skip=dns_cache"
diff --git a/pkgs/by-name/pg/pgcopydb/package.nix b/pkgs/by-name/pg/pgcopydb/package.nix
index 5e9ca01c8e8f..86a346c55fdd 100644
--- a/pkgs/by-name/pg/pgcopydb/package.nix
+++ b/pkgs/by-name/pg/pgcopydb/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  stdenv,
+  clangStdenv,
   fetchFromGitHub,
   libkrb5,
   openssl,
@@ -13,7 +13,7 @@
   zlib,
 }:
 
-stdenv.mkDerivation (finalAttrs: {
+clangStdenv.mkDerivation (finalAttrs: {
   pname = "pgcopydb";
   version = "0.15";
 
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
       sqlite
       zlib
     ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [
+    ++ lib.optionals clangStdenv.hostPlatform.isLinux [
       pam
     ];
 
diff --git a/pkgs/by-name/pi/picocom/package.nix b/pkgs/by-name/pi/picocom/package.nix
index 4a549e27921c..bca2dbd1f25d 100644
--- a/pkgs/by-name/pi/picocom/package.nix
+++ b/pkgs/by-name/pi/picocom/package.nix
@@ -7,7 +7,6 @@
   go-md2man,
   installShellFiles,
   linenoise,
-  darwin,
   lrzsz,
 }:
 
@@ -35,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     linenoise
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.IOKit ];
+  ];
 
   makeFlags = [
     "HISTFILE=.cache/picocom_history"
diff --git a/pkgs/by-name/pi/pict-rs/package.nix b/pkgs/by-name/pi/pict-rs/package.nix
index b36051cd5e42..c57f590b7e6f 100644
--- a/pkgs/by-name/pi/pict-rs/package.nix
+++ b/pkgs/by-name/pi/pict-rs/package.nix
@@ -5,7 +5,6 @@
   rustPlatform,
   makeWrapper,
   protobuf,
-  darwin,
   imagemagick,
   ffmpeg,
   exiftool,
@@ -32,7 +31,6 @@ rustPlatform.buildRustPackage rec {
   PROTOC_INCLUDE = "${protobuf}/include";
 
   nativeBuildInputs = [ makeWrapper ];
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.frameworks.Security;
 
   postInstall = ''
     wrapProgram "$out/bin/pict-rs" \
diff --git a/pkgs/by-name/pi/pijul/package.nix b/pkgs/by-name/pi/pijul/package.nix
index 6e2e45eac3b0..8f7cbd50042d 100644
--- a/pkgs/by-name/pi/pijul/package.nix
+++ b/pkgs/by-name/pi/pijul/package.nix
@@ -8,7 +8,6 @@
   libsodium,
   openssl,
   xxHash,
-  darwin,
   gitImportSupport ? true,
   libgit2 ? null,
 }:
@@ -30,21 +29,11 @@ rustPlatform.buildRustPackage rec {
     installShellFiles
     pkg-config
   ];
-  buildInputs =
-    [
-      openssl
-      libsodium
-      xxHash
-    ]
-    ++ (lib.optionals gitImportSupport [ libgit2 ])
-    ++ (lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        CoreServices
-        Security
-        SystemConfiguration
-      ]
-    ));
+  buildInputs = [
+    openssl
+    libsodium
+    xxHash
+  ] ++ (lib.optionals gitImportSupport [ libgit2 ]);
 
   buildFeatures = lib.optional gitImportSupport "git";
 
diff --git a/pkgs/by-name/pi/pilot-link/package.nix b/pkgs/by-name/pi/pilot-link/package.nix
index d79d200af788..a7b6f3813b50 100644
--- a/pkgs/by-name/pi/pilot-link/package.nix
+++ b/pkgs/by-name/pi/pilot-link/package.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   autoreconfHook,
   pkg-config,
-  darwin,
   popt,
   bluezSupport ? stdenv.hostPlatform.isLinux,
   bluez,
@@ -50,8 +49,7 @@ stdenv.mkDerivation {
     ++ lib.optionals bluezSupport [ bluez ]
     ++ lib.optionals enableLibpng [ libpng ]
     ++ lib.optionals enableLibusb [ libusb-compat-0_1 ]
-    ++ lib.optionals readlineSupport [ readline ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (with darwin.apple_sdk.frameworks; [ IOKit ]);
+    ++ lib.optionals readlineSupport [ readline ];
 
   configureFlags =
     [ "--with-libiconv" ]
diff --git a/pkgs/by-name/pi/piv-agent/package.nix b/pkgs/by-name/pi/piv-agent/package.nix
index 87f4935e2cf5..2db2d3e0cb2c 100644
--- a/pkgs/by-name/pi/piv-agent/package.nix
+++ b/pkgs/by-name/pi/piv-agent/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   buildGoModule,
-  darwin,
   fetchFromGitHub,
   pcsclite,
   pkg-config,
@@ -32,8 +31,7 @@ buildGoModule rec {
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ pkg-config ];
 
-  buildInputs =
-    if stdenv.hostPlatform.isDarwin then [ darwin.apple_sdk.frameworks.PCSC ] else [ pcsclite ];
+  buildInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) [ pcsclite ];
 
   meta = with lib; {
     description = "SSH and GPG agent which you can use with your PIV hardware security device (e.g. a Yubikey)";
diff --git a/pkgs/by-name/pk/pkarr/package.nix b/pkgs/by-name/pk/pkarr/package.nix
index 3ddc577400bb..60d6d1174605 100644
--- a/pkgs/by-name/pk/pkarr/package.nix
+++ b/pkgs/by-name/pk/pkarr/package.nix
@@ -1,9 +1,7 @@
 {
   lib,
   fetchFromGitHub,
-  darwin,
   rustPlatform,
-  stdenv,
 }:
 rustPlatform.buildRustPackage rec {
   pname = "pkarr";
@@ -19,14 +17,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-y20vVO714WPcB2aYzo0LBuJhy224bsHA7O9Dj00ViWE=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin (
-    with darwin.apple_sdk.frameworks;
-    [
-      Security
-      SystemConfiguration
-    ]
-  );
-
   meta = {
     description = "Public Key Addressable Resource Records (sovereign TLDs) ";
     homepage = "https://github.com/pubky/pkarr";
diff --git a/pkgs/by-name/pl/plink-ng/package.nix b/pkgs/by-name/pl/plink-ng/package.nix
index 74b04c56ecce..ea697c070e4e 100644
--- a/pkgs/by-name/pl/plink-ng/package.nix
+++ b/pkgs/by-name/pl/plink-ng/package.nix
@@ -5,7 +5,6 @@
   zlib,
   blas,
   lapack,
-  darwin,
 }:
 
 stdenv.mkDerivation rec {
@@ -20,16 +19,13 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs =
-    [ zlib ]
-    ++ (
-      if stdenv.hostPlatform.isDarwin then
-        [ darwin.apple_sdk.frameworks.Accelerate ]
-      else
-        [
-          blas
-          lapack
-        ]
-    );
+    [
+      zlib
+    ]
+    ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
+      blas
+      lapack
+    ];
 
   preBuild = ''
     sed -i 's|zlib-1.2.8/zlib.h|zlib.h|g' *.c *.h
diff --git a/pkgs/by-name/po/pocket-id/package.nix b/pkgs/by-name/po/pocket-id/package.nix
index 8116962252f2..61e47a833357 100644
--- a/pkgs/by-name/po/pocket-id/package.nix
+++ b/pkgs/by-name/po/pocket-id/package.nix
@@ -12,13 +12,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "pocket-id";
-  version = "0.51.0";
+  version = "0.51.1";
 
   src = fetchFromGitHub {
     owner = "pocket-id";
     repo = "pocket-id";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tNPbowMytALmvJ1H8IWCmXIQFlXKEHA5+T9FWdpaLi0=";
+    hash = "sha256-L+Mmgyeiv/AoboGN1ux4BDhEyVQ8w7IMR8Z34eM8tSU=";
   };
 
   backend = buildGoModule {
@@ -40,7 +40,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
     sourceRoot = "${finalAttrs.src.name}/frontend";
 
-    npmDepsHash = "sha256-CKxa0uL7pBQJiA2LPDA/HQvRk8sjphZ9nur8jb7BnU8=";
+    npmDepsHash = "sha256-UjYAndueuJU07unbNFoTQHqRFkdyaBKHyT4k3Ex4pg0=";
     npmFlags = [ "--legacy-peer-deps" ];
 
     nativeBuildInputs = [
diff --git a/pkgs/by-name/po/ponyc/fix-darwin-build.patch b/pkgs/by-name/po/ponyc/fix-darwin-build.patch
index bca8f19d537d..60446f73452e 100644
--- a/pkgs/by-name/po/ponyc/fix-darwin-build.patch
+++ b/pkgs/by-name/po/ponyc/fix-darwin-build.patch
@@ -1,18 +1,13 @@
 diff --git a/src/libponyc/codegen/genexe.c b/src/libponyc/codegen/genexe.c
-index 9ae3ff16..fdfe2bc5 100644
+index 3f0348eaa1..76b03030bf 100644
 --- a/src/libponyc/codegen/genexe.c
 +++ b/src/libponyc/codegen/genexe.c
-@@ -296,10 +296,10 @@ static bool link_exe(compile_t* c, ast_t* program,
-   char* ld_cmd = (char*)ponyint_pool_alloc_size(ld_len);
- 
+@@ -308,7 +308,7 @@
    snprintf(ld_cmd, ld_len,
--    "%s -execute -arch %.*s "
-+    "%s -execute "
+     "%s -execute -arch %.*s "
      "-o %s %s %s %s "
 -    "-L/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/lib -lSystem %s -platform_version macos '" STR(PONY_OSX_PLATFORM) "' '0.0.0'",
--           linker, (int)arch_len, c->opt->triple, file_exe, file_o,
-+    "-L@libSystem@/lib -lSystem %s -platform_version macos '" STR(PONY_OSX_PLATFORM) "' '0.0.0'",
-+           linker, file_exe, file_o,
++    "-L\"${SDKROOT:-${DEVELOPER_DIR:-@apple-sdk@}/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk}/usr/lib\" -lSystem %s -platform_version macos '" STR(PONY_OSX_PLATFORM) "' '0.0.0'",
+            linker, (int)arch_len, c->opt->triple, file_exe, file_o,
             lib_args, ponyrt, sanitizer_arg
      );
- 
diff --git a/pkgs/by-name/po/ponyc/package.nix b/pkgs/by-name/po/ponyc/package.nix
index b290f5c69bb4..77979b862a05 100644
--- a/pkgs/by-name/po/ponyc/package.nix
+++ b/pkgs/by-name/po/ponyc/package.nix
@@ -2,8 +2,10 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  apple-sdk_13,
   cmake,
   coreutils,
+  darwinMinVersionHook,
   libxml2,
   lto ? true,
   makeWrapper,
@@ -17,7 +19,6 @@
   which,
   z3,
   cctools,
-  darwin,
 }:
 
 stdenv.mkDerivation (rec {
@@ -48,13 +49,20 @@ stdenv.mkDerivation (rec {
     hash = "sha256-1OJ2SeSscRBNr7zZ/a8bJGIqAnhkg45re0j3DtPfcXM=";
   };
 
-  nativeBuildInputs = [
-    cmake
-    makeWrapper
-    which
-    python3
-    git
-  ] ++ lib.optionals (stdenv.hostPlatform.isDarwin) [ cctools ];
+  nativeBuildInputs =
+    [
+      cmake
+      makeWrapper
+      which
+      python3
+      git
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      # Keep in sync with `PONY_OSX_PLATFORM`.
+      apple-sdk_13
+      (darwinMinVersionHook "13.0")
+      cctools.libtool
+    ];
 
   buildInputs = [
     libxml2
@@ -68,7 +76,7 @@ stdenv.mkDerivation (rec {
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       (replaceVars ./fix-darwin-build.patch {
-        libSystem = darwin.Libsystem;
+        apple-sdk = apple-sdk_13;
       })
     ];
 
diff --git a/pkgs/by-name/po/porsmo/package.nix b/pkgs/by-name/po/porsmo/package.nix
index 21dba217b326..4ae2993d59d1 100644
--- a/pkgs/by-name/po/porsmo/package.nix
+++ b/pkgs/by-name/po/porsmo/package.nix
@@ -4,8 +4,6 @@
   fetchFromGitHub,
   pkg-config,
   alsa-lib,
-  stdenv,
-  darwin,
   testers,
   porsmo,
 }:
@@ -29,14 +27,9 @@ rustPlatform.buildRustPackage rec {
     rustPlatform.bindgenHook
   ];
 
-  buildInputs =
-    [
-      alsa-lib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.CoreAudio
-      darwin.apple_sdk.frameworks.CoreFoundation
-    ];
+  buildInputs = [
+    alsa-lib
+  ];
 
   passthru.tests.version = testers.testVersion {
     package = porsmo;
diff --git a/pkgs/by-name/po/powershell/package.nix b/pkgs/by-name/po/powershell/package.nix
index 258528daa8c3..e03d277dd3af 100644
--- a/pkgs/by-name/po/powershell/package.nix
+++ b/pkgs/by-name/po/powershell/package.nix
@@ -10,7 +10,6 @@
   libuuid,
   libunwind,
   openssl,
-  darwin,
   lttng-ust,
   pam,
   testers,
@@ -66,9 +65,6 @@ stdenv.mkDerivation rec {
       libunwind
       openssl
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.Libsystem
-    ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       lttng-ust
       pam
diff --git a/pkgs/by-name/pr/process-viewer/package.nix b/pkgs/by-name/pr/process-viewer/package.nix
index 4dce0784aca0..06fdc363d711 100644
--- a/pkgs/by-name/pr/process-viewer/package.nix
+++ b/pkgs/by-name/pr/process-viewer/package.nix
@@ -4,8 +4,6 @@
   fetchCrate,
   pkg-config,
   gtk4,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -22,11 +20,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    [ gtk4 ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk_11_0.frameworks.Foundation
-    ];
+  buildInputs = [ gtk4 ];
 
   postInstall = ''
     install -Dm644 assets/fr.guillaume_gomez.ProcessViewer.desktop -t $out/share/applications
diff --git a/pkgs/by-name/pr/procmail/package.nix b/pkgs/by-name/pr/procmail/package.nix
index f5e2f75bbacd..47f77406421d 100644
--- a/pkgs/by-name/pr/procmail/package.nix
+++ b/pkgs/by-name/pr/procmail/package.nix
@@ -16,6 +16,9 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
+    # Avoid benchmarking the build machine to determine compilation results
+    # https://build.opensuse.org/projects/server:mail/packages/procmail/files/reproducible.patch?expand=1
+    ./reproducible.patch
     # Fix clang-16 and gcc-14 build failures:
     #   https://github.com/BuGlessRB/procmail/pull/7
     (fetchpatch {
diff --git a/pkgs/by-name/pr/procmail/reproducible.patch b/pkgs/by-name/pr/procmail/reproducible.patch
new file mode 100644
index 000000000000..7098b1789fb1
--- /dev/null
+++ b/pkgs/by-name/pr/procmail/reproducible.patch
@@ -0,0 +1,40 @@
+https://bugzilla.opensuse.org/show_bug.cgi?id=1041534
+
+Avoid benchmarking the build machine
+to determine compilation results
+
+Index: procmail-3.24/src/autoconf
+===================================================================
+--- procmail-3.24.orig/src/autoconf
++++ procmail-3.24/src/autoconf
+@@ -951,6 +951,7 @@ void*realloc(),*malloc();
+ #endif
+ int main()
+ { char*p=malloc(1),*q=0;
++#if 0
+   size_t len,last,max=BLKSIZ*64;	      /* 1M on non-SMALLHEAP systems */
+   int count=0;
+   for(last=len=INITIAL;len<=max+INITIAL;len+=BLKSIZ)
+@@ -968,6 +969,7 @@ int main()
+    { puts("#define INEFFICIENTrealloc");
+      exit(1);
+    }
++#endif
+   exit(0);
+ }
+ HERE
+@@ -1248,10 +1250,9 @@ int main(argc,argv)int argc;const char*a
+ 	if(!iter)
+ 	   iter=1;
+ 	printf("\
+-/* Your system's strstr() is %.2f times %sER than my C-routine */\n",
+-	 syscnt>=iter?(double)syscnt/iter:(double)iter/syscnt,
+-	 syscnt>=iter?"SLOW":"FAST");
+-	if(syscnt>iter+iter/16)		  /* if at least 1.0625 times slower */
++/* Your system's strstr() is %sER than my C-routine */\n",
++	 "FAST");
++	if(0)		  /* always use system strstr to have reproducible binaries */
+ 	   printf("\
+ #define SLOWstrstr\t\t\t      /* using my substitute instead */\n");
+       }
+
diff --git a/pkgs/by-name/pr/projectable/package.nix b/pkgs/by-name/pr/projectable/package.nix
index 5b27b6ffe9ce..657d2616f4b7 100644
--- a/pkgs/by-name/pr/projectable/package.nix
+++ b/pkgs/by-name/pr/projectable/package.nix
@@ -6,8 +6,6 @@
   libgit2,
   openssl,
   zlib,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -28,15 +26,11 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      libgit2
-      openssl
-      zlib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.CoreServices
-    ];
+  buildInputs = [
+    libgit2
+    openssl
+    zlib
+  ];
 
   env = {
     LIBGIT2_NO_VENDOR = 1;
diff --git a/pkgs/by-name/pr/prometheus-node-exporter/package.nix b/pkgs/by-name/pr/prometheus-node-exporter/package.nix
index 3d805a9bd28a..d36c608385af 100644
--- a/pkgs/by-name/pr/prometheus-node-exporter/package.nix
+++ b/pkgs/by-name/pr/prometheus-node-exporter/package.nix
@@ -1,10 +1,8 @@
 {
   lib,
-  stdenv,
   buildGoModule,
   fetchFromGitHub,
   nixosTests,
-  darwin,
 }:
 
 buildGoModule rec {
@@ -24,14 +22,6 @@ buildGoModule rec {
   # FIXME: tests fail due to read-only nix store
   doCheck = false;
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin (
-    with darwin.apple_sdk.frameworks;
-    [
-      CoreFoundation
-      IOKit
-    ]
-  );
-
   excludedPackages = [ "docs/node-mixin" ];
 
   ldflags = [
diff --git a/pkgs/by-name/pr/proto/package.nix b/pkgs/by-name/pr/proto/package.nix
index ce3a229d3039..92ae4632363a 100644
--- a/pkgs/by-name/pr/proto/package.nix
+++ b/pkgs/by-name/pr/proto/package.nix
@@ -3,7 +3,6 @@
   stdenv,
   fetchFromGitHub,
   rustPlatform,
-  darwin,
   libiconv,
   makeBinaryWrapper,
   pkg-config,
@@ -24,7 +23,6 @@ rustPlatform.buildRustPackage rec {
   cargoHash = "sha256-oyATT8lEzBltT6+jXMAHvhPTdXGO4Hm5WwEjy/2bgmE=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.SystemConfiguration
     libiconv
   ];
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pr/protobufc/package.nix b/pkgs/by-name/pr/protobufc/package.nix
index 7273982206f5..8531f723018e 100644
--- a/pkgs/by-name/pr/protobufc/package.nix
+++ b/pkgs/by-name/pr/protobufc/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "protobuf-c";
-  version = "1.5.1";
+  version = "1.5.2";
 
   src = fetchFromGitHub {
     owner = "protobuf-c";
     repo = "protobuf-c";
     tag = "v${version}";
-    hash = "sha256-usfONVSq0/V9GRrBx9RwO/hCrVJ8d17mvAgTKpKUssQ=";
+    hash = "sha256-bpxk2o5rYLFkx532A3PYyhh2MwVH2Dqf3p/bnNpQV7s=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/pr/prr/package.nix b/pkgs/by-name/pr/prr/package.nix
index 4715f0cf80ca..d16e452b3a9c 100644
--- a/pkgs/by-name/pr/prr/package.nix
+++ b/pkgs/by-name/pr/prr/package.nix
@@ -2,10 +2,8 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
   openssl,
   pkg-config,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -22,12 +20,7 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-VIJFr1HpXMC2DXt79Yb1DuLYSbo9g6zsXaNDTXjtlR4=";
 
-  buildInputs =
-    [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [ openssl ];
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/ps/psc-package/package.nix b/pkgs/by-name/ps/psc-package/package.nix
index dcdceee7cd93..0b69b4db9bd0 100644
--- a/pkgs/by-name/ps/psc-package/package.nix
+++ b/pkgs/by-name/ps/psc-package/package.nix
@@ -6,7 +6,6 @@
   gmp,
   zlib,
   libiconv,
-  darwin,
   installShellFiles,
 }:
 
@@ -52,7 +51,6 @@ stdenv.mkDerivation rec {
     ''
     + lib.optionalString stdenv.hostPlatform.isDarwin ''
       install_name_tool \
-        -change /usr/lib/libSystem.B.dylib ${darwin.Libsystem}/lib/libSystem.B.dylib \
         -change /usr/lib/libiconv.2.dylib ${libiconv}/libiconv.2.dylib \
         $PSC_PACKAGE
     ''
diff --git a/pkgs/by-name/ps/pstoedit/package.nix b/pkgs/by-name/ps/pstoedit/package.nix
index af1916667b2d..3a09cd624692 100644
--- a/pkgs/by-name/ps/pstoedit/package.nix
+++ b/pkgs/by-name/ps/pstoedit/package.nix
@@ -2,7 +2,6 @@
   stdenv,
   fetchurl,
   pkg-config,
-  darwin,
   lib,
   zlib,
   ghostscript,
@@ -42,13 +41,9 @@ stdenv.mkDerivation rec {
       libjpeg
       libwebp
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        libiconv
-        ApplicationServices
-      ]
-    );
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      libiconv
+    ];
 
   # '@LIBPNG_LDFLAGS@' is no longer substituted by autoconf (the code is commented out)
   # so we need to remove it from the pkg-config file as well
diff --git a/pkgs/by-name/pw/pwsafe/package.nix b/pkgs/by-name/pw/pwsafe/package.nix
index cafec2153e6d..55978beac35d 100644
--- a/pkgs/by-name/pw/pwsafe/package.nix
+++ b/pkgs/by-name/pw/pwsafe/package.nix
@@ -20,13 +20,9 @@
   curl,
   openssl,
   file,
-  darwin,
   gitUpdater,
 }:
 
-let
-  inherit (darwin.apple_sdk.frameworks) Cocoa;
-in
 stdenv.mkDerivation rec {
   pname = "pwsafe";
   version = "1.21.0fp"; # do NOT update to 3.x Windows releases
@@ -66,9 +62,6 @@ stdenv.mkDerivation rec {
       libuuid
       libyubikey
       yubikey-personalization
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Cocoa
     ];
 
   cmakeFlags =
diff --git a/pkgs/by-name/py/pyright/package.nix b/pkgs/by-name/py/pyright/package.nix
index 91077b29dbe7..ed278678450d 100644
--- a/pkgs/by-name/py/pyright/package.nix
+++ b/pkgs/by-name/py/pyright/package.nix
@@ -7,13 +7,13 @@
 }:
 
 let
-  version = "1.1.397";
+  version = "1.1.399";
 
   src = fetchFromGitHub {
     owner = "Microsoft";
     repo = "pyright";
     tag = version;
-    hash = "sha256-hae897LVowpgd3mWttBJAEuLiMPt0J4Z0WfMQ68RFZY=";
+    hash = "sha256-AEdzc0ZC40k+ZUOL6JmFTR2iFYUiQMKnilPFLKoBbDY=";
   };
 
   patchedPackageJSON = runCommand "package.json" { } ''
@@ -44,7 +44,7 @@ let
     pname = "pyright-internal";
     inherit version src;
     sourceRoot = "${src.name}/packages/pyright-internal";
-    npmDepsHash = "sha256-sk66nzCyU2ZRhq65B4Z5dVwRz096Mdw14fWojIfIsnE=";
+    npmDepsHash = "sha256-idKRVd3xYreLQe5cc5jRYCB6BKsnrBbYs91FdnNE1KU=";
     dontNpmBuild = true;
     installPhase = ''
       runHook preInstall
@@ -58,7 +58,7 @@ buildNpmPackage rec {
   inherit version src;
 
   sourceRoot = "${src.name}/packages/pyright";
-  npmDepsHash = "sha256-UpDvOgR7j5Z6/ht/QFoGaUuf6TxMujAq76YmONDkOfU=";
+  npmDepsHash = "sha256-lgnTbvlwOcGr2E/X6pMebxwaIXo/Fqd8cjcSUmihKe4=";
 
   postPatch = ''
     chmod +w ../../
diff --git a/pkgs/by-name/qg/qgrep/package.nix b/pkgs/by-name/qg/qgrep/package.nix
index dbcd06c4ce67..a6961947e75c 100644
--- a/pkgs/by-name/qg/qgrep/package.nix
+++ b/pkgs/by-name/qg/qgrep/package.nix
@@ -3,7 +3,6 @@
   stdenv,
   fetchFromGitHub,
   fetchpatch,
-  darwin,
 }:
 
 stdenv.mkDerivation rec {
@@ -26,11 +25,6 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.CoreServices
-    darwin.apple_sdk.frameworks.CoreFoundation
-  ];
-
   env.NIX_CFLAGS_COMPILE = toString (
     lib.optionals stdenv.hostPlatform.isDarwin [
       "-Wno-error=unused-command-line-argument"
diff --git a/pkgs/by-name/ql/qlog/package.nix b/pkgs/by-name/ql/qlog/package.nix
index b6aef313ad21..9a6121bdb15f 100644
--- a/pkgs/by-name/ql/qlog/package.nix
+++ b/pkgs/by-name/ql/qlog/package.nix
@@ -33,9 +33,9 @@ stdenv.mkDerivation rec {
       qt6.qtwebengine
       qt6Packages.qtkeychain
     ]
-    ++ (lib.optionals stdenv.hostPlatform.isDarwin [
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
       cups
-    ]);
+    ];
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/qp/qpdf/package.nix b/pkgs/by-name/qp/qpdf/package.nix
index 618e9741370b..857ea50290a1 100644
--- a/pkgs/by-name/qp/qpdf/package.nix
+++ b/pkgs/by-name/qp/qpdf/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "qpdf";
-  version = "11.10.0";
+  version = "11.10.1";
 
   src = fetchFromGitHub {
     owner = "qpdf";
     repo = "qpdf";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-X5VF7kwnpNNWuQ7iA12qh6JwGU/40EKnGxWst0U+T8k=";
+    hash = "sha256-MkJpbAIoPZmsYupOjQKOwZomh/rUF+r/kKTdHfT5Dc8=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/r0/r0vm/package.nix b/pkgs/by-name/r0/r0vm/package.nix
index 2620a8d0057d..1c7f55d5f828 100644
--- a/pkgs/by-name/r0/r0vm/package.nix
+++ b/pkgs/by-name/r0/r0vm/package.nix
@@ -1,13 +1,11 @@
 {
   rustPlatform,
-  stdenv,
   fetchFromGitHub,
   fetchurl,
   pkg-config,
   perl,
   openssl,
   lib,
-  darwin,
 }:
 rustPlatform.buildRustPackage rec {
   pname = "r0vm";
@@ -26,13 +24,9 @@ rustPlatform.buildRustPackage rec {
     perl
   ];
 
-  buildInputs =
-    [
-      openssl.dev
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    openssl.dev
+  ];
 
   doCheck = false;
 
diff --git a/pkgs/by-name/ra/radicle-httpd/package.nix b/pkgs/by-name/ra/radicle-httpd/package.nix
index 5b4acfd1c8b8..262de4fba351 100644
--- a/pkgs/by-name/ra/radicle-httpd/package.nix
+++ b/pkgs/by-name/ra/radicle-httpd/package.nix
@@ -1,6 +1,5 @@
 {
   asciidoctor,
-  darwin,
   fetchgit,
   git,
   installShellFiles,
@@ -34,7 +33,6 @@ rustPlatform.buildRustPackage rec {
     makeWrapper
   ];
   nativeCheckInputs = [ git ];
-  buildInputs = lib.optionals stdenv.buildPlatform.isDarwin [ darwin.apple_sdk.frameworks.Security ];
 
   doCheck = stdenv.hostPlatform.isLinux;
 
diff --git a/pkgs/by-name/ra/radicle-node/package.nix b/pkgs/by-name/ra/radicle-node/package.nix
index b0a6bae693e1..a9bcb469f4f8 100644
--- a/pkgs/by-name/ra/radicle-node/package.nix
+++ b/pkgs/by-name/ra/radicle-node/package.nix
@@ -1,6 +1,5 @@
 {
   asciidoctor,
-  darwin,
   fetchgit,
   git,
   installShellFiles,
@@ -41,9 +40,6 @@ rustPlatform.buildRustPackage rec {
     makeWrapper
   ];
   nativeCheckInputs = [ git ];
-  buildInputs = lib.optionals stdenv.buildPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-  ];
 
   # tests regularly time out on aarch64
   doCheck = stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isx86;
diff --git a/pkgs/by-name/ra/rage/package.nix b/pkgs/by-name/ra/rage/package.nix
index 1de79c3d1b7f..9c359fa71505 100644
--- a/pkgs/by-name/ra/rage/package.nix
+++ b/pkgs/by-name/ra/rage/package.nix
@@ -4,7 +4,6 @@
   rustPlatform,
   fetchFromGitHub,
   installShellFiles,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -25,10 +24,6 @@ rustPlatform.buildRustPackage rec {
     installShellFiles
   ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Foundation
-  ];
-
   # cargo test has an x86-only dependency
   doCheck = stdenv.hostPlatform.isx86;
 
diff --git a/pkgs/by-name/ra/railway/package.nix b/pkgs/by-name/ra/railway/package.nix
index 09e1f8ab6c9f..7f98cc842b76 100644
--- a/pkgs/by-name/ra/railway/package.nix
+++ b/pkgs/by-name/ra/railway/package.nix
@@ -1,15 +1,10 @@
 {
   lib,
-  darwin,
   rustPlatform,
   fetchFromGitHub,
   pkg-config,
   openssl,
-  stdenv,
 }:
-let
-  inherit (darwin.apple_sdk.frameworks) CoreServices Security SystemConfiguration;
-in
 rustPlatform.buildRustPackage rec {
   pname = "railway";
   version = "4.0.1";
@@ -26,13 +21,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CoreServices
-      Security
-      SystemConfiguration
-    ];
+  buildInputs = [ openssl ];
 
   OPENSSL_NO_VENDOR = 1;
 
diff --git a/pkgs/by-name/ra/rainfrog/package.nix b/pkgs/by-name/ra/rainfrog/package.nix
index bc0636c17b4d..3931848bdafa 100644
--- a/pkgs/by-name/ra/rainfrog/package.nix
+++ b/pkgs/by-name/ra/rainfrog/package.nix
@@ -1,11 +1,9 @@
 {
   lib,
-  darwin,
   fetchFromGitHub,
   testers,
   nix-update-script,
   rustPlatform,
-  stdenv,
   rainfrog,
 }:
 let
@@ -25,15 +23,6 @@ rustPlatform.buildRustPackage {
   useFetchCargoVendor = true;
   cargoHash = "sha256-wgJWPlURS2DxcRMzDEAXa50nQswcjbe0zj2QgF0HZys=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin (
-    with darwin.apple_sdk.frameworks;
-    [
-      AppKit
-      CoreGraphics
-      SystemConfiguration
-    ]
-  );
-
   passthru = {
     tests.version = testers.testVersion {
       package = rainfrog;
diff --git a/pkgs/by-name/ra/rapidsvn/package.nix b/pkgs/by-name/ra/rapidsvn/package.nix
index e6d2b1f5ca8a..abbaeca4ef56 100644
--- a/pkgs/by-name/ra/rapidsvn/package.nix
+++ b/pkgs/by-name/ra/rapidsvn/package.nix
@@ -8,7 +8,6 @@
   apr,
   aprutil,
   python3,
-  darwin,
 }:
 
 stdenv.mkDerivation {
@@ -31,17 +30,13 @@ stdenv.mkDerivation {
     autoreconfHook
   ];
 
-  buildInputs =
-    [
-      wxGTK32
-      subversion
-      apr
-      aprutil
-      python3
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Cocoa
-    ];
+  buildInputs = [
+    wxGTK32
+    subversion
+    apr
+    aprutil
+    python3
+  ];
 
   configureFlags = [
     "--with-svn-include=${subversion.dev}/include"
diff --git a/pkgs/by-name/ra/rates/package.nix b/pkgs/by-name/ra/rates/package.nix
index 314b69d7890e..9621e30adc04 100644
--- a/pkgs/by-name/ra/rates/package.nix
+++ b/pkgs/by-name/ra/rates/package.nix
@@ -1,7 +1,5 @@
 {
   lib,
-  stdenv,
-  darwin,
   fetchFromGitHub,
   rustPlatform,
   versionCheckHook,
@@ -21,8 +19,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-qfuCA1kAEbYIYI274lNrEKZNhltQP71CwtsjBr0REJs=";
 
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.Security ];
-
   nativeInstallCheckInputs = [ versionCheckHook ];
 
   doInstallCheck = true;
diff --git a/pkgs/by-name/ra/raylib-games/package.nix b/pkgs/by-name/ra/raylib-games/package.nix
index 8bc325841060..3ca74877fbb4 100644
--- a/pkgs/by-name/ra/raylib-games/package.nix
+++ b/pkgs/by-name/ra/raylib-games/package.nix
@@ -3,12 +3,8 @@
   stdenv,
   fetchFromGitHub,
   raylib,
-  darwin,
 }:
 
-let
-  inherit (darwin.apple_sdk.frameworks) Cocoa;
-in
 stdenv.mkDerivation rec {
   pname = "raylib-games";
   version = "2022-10-24";
@@ -20,7 +16,7 @@ stdenv.mkDerivation rec {
     hash = "sha256-N9ip8yFUqXmNMKcvQuOyxDI4yF/w1YaoIh0prvS4Xr4=";
   };
 
-  buildInputs = [ raylib ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Cocoa ];
+  buildInputs = [ raylib ];
 
   configurePhase = ''
     runHook preConfigure
diff --git a/pkgs/by-name/re/re2/package.nix b/pkgs/by-name/re/re2/package.nix
index 278d63702ed2..8781413e48ba 100644
--- a/pkgs/by-name/re/re2/package.nix
+++ b/pkgs/by-name/re/re2/package.nix
@@ -44,7 +44,10 @@ stdenv.mkDerivation (finalAttrs: {
   propagatedBuildInputs = [ abseil-cpp ] ++ lib.optionals (!stdenv.hostPlatform.isStatic) [ icu ];
 
   cmakeFlags =
-    [ (lib.cmakeBool "RE2_BUILD_TESTING" true) ]
+    [
+      (lib.cmakeBool "RE2_BUILD_TESTING" true)
+      (lib.cmakeFeature "CMAKE_CTEST_ARGUMENTS" "--timeout;999999")
+    ]
     ++ lib.optionals (!stdenv.hostPlatform.isStatic) [
       (lib.cmakeBool "RE2_USE_ICU" true)
       (lib.cmakeBool "BUILD_SHARED_LIBS" true)
diff --git a/pkgs/by-name/re/re2c/package.nix b/pkgs/by-name/re/re2c/package.nix
index 02859a9bc813..bc7ee4beba24 100644
--- a/pkgs/by-name/re/re2c/package.nix
+++ b/pkgs/by-name/re/re2c/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "re2c";
-  version = "4.0.2";
+  version = "4.1";
 
   src = fetchFromGitHub {
     owner = "skvadrik";
     repo = "re2c";
     rev = version;
-    sha256 = "sha256-hp9kwsoSRdel1z1+VWREPQdigI1rQ5GrM5/Z6wpnmE0=";
+    sha256 = "sha256-xB4oH0QS0VKTK2we+wdylS8VBijpp6tv7YV7fIX1s4A=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/re/realm/package.nix b/pkgs/by-name/re/realm/package.nix
index b32356df4cb7..6edeccfdd07d 100644
--- a/pkgs/by-name/re/realm/package.nix
+++ b/pkgs/by-name/re/realm/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  darwin,
   nix-update-script,
   nixosTests,
 }:
@@ -22,10 +20,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-Oe64l16uYdU6NvTl7XrEm6dAtRFngI9yHC4fe4hpTNA=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-  ];
-
   env.RUSTC_BOOTSTRAP = 1;
 
   passthru = {
diff --git a/pkgs/by-name/re/reason-shell/package.nix b/pkgs/by-name/re/reason-shell/package.nix
index 9a3dc6692732..e3ce9f006665 100644
--- a/pkgs/by-name/re/reason-shell/package.nix
+++ b/pkgs/by-name/re/reason-shell/package.nix
@@ -4,8 +4,6 @@
   fetchFromGitHub,
   pkg-config,
   openssl,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -26,13 +24,9 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.CoreServices
-    ];
+  buildInputs = [
+    openssl
+  ];
 
   meta = with lib; {
     description = "Shell for research papers";
diff --git a/pkgs/by-name/re/rebuilderd/package.nix b/pkgs/by-name/re/rebuilderd/package.nix
index e8400ee8c1b9..31b05abbb910 100644
--- a/pkgs/by-name/re/rebuilderd/package.nix
+++ b/pkgs/by-name/re/rebuilderd/package.nix
@@ -12,7 +12,6 @@
   xz,
   zstd,
   stdenv,
-  darwin,
   buildPackages,
   versionCheckHook,
   nixosTests,
@@ -50,19 +49,14 @@ rustPlatform.buildRustPackage (finalAttrs: {
     scdoc
   ];
 
-  buildInputs =
-    [
-      bzip2
-      openssl
-      shared-mime-info
-      sqlite
-      xz
-      zstd
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    bzip2
+    openssl
+    shared-mime-info
+    sqlite
+    xz
+    zstd
+  ];
 
   postInstall =
     let
diff --git a/pkgs/by-name/re/redlib/package.nix b/pkgs/by-name/re/redlib/package.nix
index 0bcfd5c58d5f..b5c569a9f01f 100644
--- a/pkgs/by-name/re/redlib/package.nix
+++ b/pkgs/by-name/re/redlib/package.nix
@@ -1,11 +1,9 @@
 {
   lib,
-  stdenv,
   cacert,
   nixosTests,
   rustPlatform,
   fetchFromGitHub,
-  darwin,
 }:
 rustPlatform.buildRustPackage rec {
   pname = "redlib";
@@ -21,10 +19,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-1zPLnkNZvuZS5z9AEJvhyIv+8/y+YhqFcj5Mu7RSqnE=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-  ];
-
   postInstall = ''
     install -D contrib/redlib.service $out/lib/systemd/system/redlib.service
     substituteInPlace $out/lib/systemd/system/redlib.service \
diff --git a/pkgs/by-name/re/refinery-cli/package.nix b/pkgs/by-name/re/refinery-cli/package.nix
index cedd6767ce95..56ceae80fe14 100644
--- a/pkgs/by-name/re/refinery-cli/package.nix
+++ b/pkgs/by-name/re/refinery-cli/package.nix
@@ -1,11 +1,9 @@
 {
   fetchCrate,
   lib,
-  stdenv,
   openssl,
   pkg-config,
   rustPlatform,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -29,7 +27,7 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = [
     openssl
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.SystemConfiguration ];
+  ];
 
   meta = with lib; {
     description = "Run migrations for the Refinery ORM for Rust via the CLI";
diff --git a/pkgs/by-name/re/remarshal_0_17/package.nix b/pkgs/by-name/re/remarshal_0_17/package.nix
index 112df133fcd0..c3813d5c80e6 100644
--- a/pkgs/by-name/re/remarshal_0_17/package.nix
+++ b/pkgs/by-name/re/remarshal_0_17/package.nix
@@ -3,6 +3,7 @@
   python3Packages,
   fetchFromGitHub,
   fetchPypi,
+  fetchpatch,
 }:
 
 let
@@ -16,6 +17,13 @@ let
           inherit version;
           hash = "sha256-7vNPujmDTU1rc8m6fz5NHEF6Tlb4mn6W4JDdDSS4+zw=";
         };
+        patches = [
+          (fetchpatch {
+            url = "https://github.com/python-poetry/tomlkit/commit/05d9be1c2b2a95a4eb3a53d999f1483dd7abae5a.patch";
+            hash = "sha256-9pLGxcGHs+XoKrqlh7Q0dyc07XrK7J6u2T7Kvfd0ICc=";
+            excludes = [ ".github/workflows/tests.yml" ];
+          })
+        ];
       });
     };
   };
diff --git a/pkgs/by-name/re/renpy/package.nix b/pkgs/by-name/re/renpy/package.nix
index dc72a086f7e0..bdc76102fdc4 100644
--- a/pkgs/by-name/re/renpy/package.nix
+++ b/pkgs/by-name/re/renpy/package.nix
@@ -65,20 +65,6 @@ stdenv.mkDerivation (finalAttrs: {
       tkinter
     ]);
 
-  RENPY_DEPS_INSTALL = lib.concatStringsSep "::" [
-    ffmpeg.lib
-    freetype
-    fribidi
-    glew.dev
-    harfbuzz.dev
-    libGL
-    libGLU
-    libpng
-    SDL2
-    (lib.getDev SDL2)
-    zlib
-  ];
-
   enableParallelBuilding = true;
 
   patches = [
diff --git a/pkgs/by-name/re/reshape/package.nix b/pkgs/by-name/re/reshape/package.nix
index 6b44a65c5030..c9a5cef39e03 100644
--- a/pkgs/by-name/re/reshape/package.nix
+++ b/pkgs/by-name/re/reshape/package.nix
@@ -2,10 +2,8 @@
   lib,
   rustPlatform,
   fetchCrate,
-  darwin,
   postgresqlTestHook,
   postgresql,
-  stdenv,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,10 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-lK54SEayI015f2AQ6h4zadgkECLp4jCeJO7enBG0LeM=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.SystemConfiguration
-  ];
-
   nativeCheckInputs = [
     postgresqlTestHook
     postgresql
diff --git a/pkgs/by-name/re/restic-browser/package.nix b/pkgs/by-name/re/restic-browser/package.nix
index 0333ab8f71b3..7cfba5fae808 100644
--- a/pkgs/by-name/re/restic-browser/package.nix
+++ b/pkgs/by-name/re/restic-browser/package.nix
@@ -11,7 +11,6 @@
   wrapGAppsHook3,
   webkitgtk_4_0,
   dbus,
-  darwin,
   nix-update-script,
 }:
 rustPlatform.buildRustPackage rec {
@@ -46,17 +45,10 @@ rustPlatform.buildRustPackage rec {
       wrapGAppsHook3
     ];
 
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [
-      webkitgtk_4_0
-      dbus
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        WebKit
-      ]
-    );
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    webkitgtk_4_0
+    dbus
+  ];
 
   cargoRoot = "src-tauri";
   buildAndTestSubdir = cargoRoot;
diff --git a/pkgs/by-name/re/restish/package.nix b/pkgs/by-name/re/restish/package.nix
index 153e083f313c..4a849ef4ed27 100644
--- a/pkgs/by-name/re/restish/package.nix
+++ b/pkgs/by-name/re/restish/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   buildGoModule,
-  darwin,
   fetchFromGitHub,
   restish,
   testers,
@@ -22,18 +21,13 @@ buildGoModule rec {
 
   vendorHash = "sha256-qeArar0WnMACUnKBlC+PcFeJPzofwbK440A4M/rQ04U=";
 
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Cocoa
-      darwin.apple_sdk.frameworks.Kernel
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [
-      xorg.libX11
-      xorg.libXcursor
-      xorg.libXi
-      xorg.libXinerama
-      xorg.libXrandr
-    ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    xorg.libX11
+    xorg.libXcursor
+    xorg.libXi
+    xorg.libXinerama
+    xorg.libXrandr
+  ];
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/re/rewrk/package.nix b/pkgs/by-name/re/rewrk/package.nix
index 5e87c9104bea..86d3063460d5 100644
--- a/pkgs/by-name/re/rewrk/package.nix
+++ b/pkgs/by-name/re/rewrk/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -23,10 +21,6 @@ rustPlatform.buildRustPackage rec {
     ln -s ${./Cargo.lock} Cargo.lock
   '';
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-  ];
-
   meta = with lib; {
     description = "More modern http framework benchmarker supporting HTTP/1 and HTTP/2 benchmarks";
     homepage = "https://github.com/lnx-search/rewrk";
diff --git a/pkgs/by-name/ri/riff/package.nix b/pkgs/by-name/ri/riff/package.nix
index 944baa2255ca..63a7972968cb 100644
--- a/pkgs/by-name/ri/riff/package.nix
+++ b/pkgs/by-name/ri/riff/package.nix
@@ -5,8 +5,6 @@
   makeWrapper,
   pkg-config,
   openssl,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -28,13 +26,9 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = [
+    openssl
+  ];
 
   postInstall = ''
     wrapProgram $out/bin/riff --set-default RIFF_DISABLE_TELEMETRY true
diff --git a/pkgs/by-name/ri/ripunzip/package.nix b/pkgs/by-name/ri/ripunzip/package.nix
index b06fb109bc2e..9ffa2846b826 100644
--- a/pkgs/by-name/ri/ripunzip/package.nix
+++ b/pkgs/by-name/ri/ripunzip/package.nix
@@ -1,10 +1,8 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
   openssl,
-  darwin,
   pkg-config,
   testers,
   fetchzip,
@@ -25,15 +23,7 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-3bzIScXVxT8HFmFc0svincvTyuT2F2nfFs/3ApnCBUs=";
 
-  buildInputs =
-    [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        Security
-        SystemConfiguration
-      ]
-    );
+  buildInputs = [ openssl ];
   nativeBuildInputs = [ pkg-config ];
 
   checkFlags = [
diff --git a/pkgs/by-name/ro/rojo/package.nix b/pkgs/by-name/ro/rojo/package.nix
index 40ad6406465f..a0849be55e55 100644
--- a/pkgs/by-name/ro/rojo/package.nix
+++ b/pkgs/by-name/ro/rojo/package.nix
@@ -5,12 +5,8 @@
   rustPlatform,
   pkg-config,
   openssl,
-  darwin,
 }:
 
-let
-  inherit (darwin.apple_sdk.frameworks) CoreServices SystemConfiguration;
-in
 rustPlatform.buildRustPackage rec {
   pname = "rojo";
   version = "7.5.0";
@@ -30,14 +26,9 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CoreServices
-      SystemConfiguration
-    ];
+  buildInputs = [
+    openssl
+  ];
 
   # reqwest's native-tls-vendored feature flag uses vendored openssl. this disables that
   OPENSSL_NO_VENDOR = "1";
diff --git a/pkgs/by-name/ro/routinator/package.nix b/pkgs/by-name/ro/routinator/package.nix
index c9e5437b32d2..b394ddc6d0e4 100644
--- a/pkgs/by-name/ro/routinator/package.nix
+++ b/pkgs/by-name/ro/routinator/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  darwin,
   nixosTests,
 }:
 
@@ -21,14 +19,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-58EnGouq8iKkgsvyHqARoQ0u4QXjw0m6pv4Am4J9wlU=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin (
-    with darwin.apple_sdk.frameworks;
-    [
-      Security
-      SystemConfiguration
-    ]
-  );
-
   meta = with lib; {
     description = "RPKI Validator written in Rust";
     homepage = "https://github.com/NLnetLabs/routinator";
diff --git a/pkgs/by-name/rr/rrdtool/package.nix b/pkgs/by-name/rr/rrdtool/package.nix
index 1a66700b17d9..1aad60b8ec24 100644
--- a/pkgs/by-name/rr/rrdtool/package.nix
+++ b/pkgs/by-name/rr/rrdtool/package.nix
@@ -12,7 +12,6 @@
   cairo,
   groff,
   tcl,
-  darwin,
 }:
 
 perl.pkgs.toPerlModule (
@@ -49,7 +48,6 @@ perl.pkgs.toPerlModule (
       ]
       ++ lib.optionals stdenv.hostPlatform.isDarwin [
         tcl
-        darwin.apple_sdk.frameworks.ApplicationServices
       ];
 
     postInstall = ''
diff --git a/pkgs/by-name/rt/rtaudio_6/package.nix b/pkgs/by-name/rt/rtaudio_6/package.nix
index b57810ba7e15..b1da7ea2825a 100644
--- a/pkgs/by-name/rt/rtaudio_6/package.nix
+++ b/pkgs/by-name/rt/rtaudio_6/package.nix
@@ -13,7 +13,6 @@
   jackSupport ? true,
   libjack2,
   coreaudioSupport ? stdenv.hostPlatform.isDarwin,
-  darwin,
   validatePkgConfig,
 }:
 
@@ -45,9 +44,6 @@ stdenv.mkDerivation (finalAttrs: {
     ]
     ++ lib.optionals jackSupport [
       libjack2
-    ]
-    ++ lib.optionals coreaudioSupport [
-      darwin.apple_sdk.frameworks.CoreAudio
     ];
 
   cmakeFlags = [
diff --git a/pkgs/by-name/rt/rtz/package.nix b/pkgs/by-name/rt/rtz/package.nix
index 51ed10eababb..3dd5f8d13335 100644
--- a/pkgs/by-name/rt/rtz/package.nix
+++ b/pkgs/by-name/rt/rtz/package.nix
@@ -6,8 +6,6 @@
   bzip2,
   openssl,
   zstd,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -28,16 +26,11 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      bzip2
-      openssl
-      zstd
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    bzip2
+    openssl
+    zstd
+  ];
 
   buildFeatures = [ "web" ];
 
diff --git a/pkgs/by-name/ru/rubberband/package.nix b/pkgs/by-name/ru/rubberband/package.nix
index 684bb97a1709..f64817adec84 100644
--- a/pkgs/by-name/ru/rubberband/package.nix
+++ b/pkgs/by-name/ru/rubberband/package.nix
@@ -12,7 +12,6 @@
   ladspaH,
   meson,
   ninja,
-  darwin,
 }:
 
 stdenv.mkDerivation rec {
@@ -30,23 +29,14 @@ stdenv.mkDerivation rec {
     ninja
     jdk_headless
   ];
-  buildInputs =
-    [
-      libsamplerate
-      libsndfile
-      fftw
-      vamp-plugin-sdk
-      ladspaH
-      lv2
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        Accelerate
-        CoreGraphics
-        CoreVideo
-      ]
-    );
+  buildInputs = [
+    libsamplerate
+    libsndfile
+    fftw
+    vamp-plugin-sdk
+    ladspaH
+    lv2
+  ];
   makeFlags = [ "AR:=$(AR)" ];
 
   # TODO: package boost-test, so we can run the test suite. (Currently it fails
diff --git a/pkgs/by-name/ru/ruffle/package.nix b/pkgs/by-name/ru/ruffle/package.nix
index 76a0c47c198b..1c71446d2a43 100644
--- a/pkgs/by-name/ru/ruffle/package.nix
+++ b/pkgs/by-name/ru/ruffle/package.nix
@@ -7,7 +7,6 @@
   jre_minimal,
   pkg-config,
   wrapGAppsHook3,
-  darwin,
   alsa-lib,
   gtk3,
   openssl,
@@ -56,16 +55,14 @@ rustPlatform.buildRustPackage (finalAttrs: {
     ]
     ++ lib.optionals stdenvNoCC.hostPlatform.isDarwin [ rustPlatform.bindgenHook ];
 
-  buildInputs =
-    lib.optionals stdenvNoCC.hostPlatform.isLinux [
-      alsa-lib
-      gtk3
-      openssl
-      wayland
-      vulkan-loader
-      udev
-    ]
-    ++ lib.optionals stdenvNoCC.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.AppKit ];
+  buildInputs = lib.optionals stdenvNoCC.hostPlatform.isLinux [
+    alsa-lib
+    gtk3
+    openssl
+    wayland
+    vulkan-loader
+    udev
+  ];
 
   postInstall =
     ''
diff --git a/pkgs/by-name/ru/rune-languageserver/package.nix b/pkgs/by-name/ru/rune-languageserver/package.nix
index 35316fdc68a6..750b5a897dd9 100644
--- a/pkgs/by-name/ru/rune-languageserver/package.nix
+++ b/pkgs/by-name/ru/rune-languageserver/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchCrate,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -18,10 +16,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-YviRACndc4r4ul72ZF3I/R/nEsIoML2Ek2xqUUE3FDQ=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-  ];
-
   env = {
     RUNE_VERSION = version;
   };
diff --git a/pkgs/by-name/ru/rune/package.nix b/pkgs/by-name/ru/rune/package.nix
index 8f962d69c6f5..61915b6e9801 100644
--- a/pkgs/by-name/ru/rune/package.nix
+++ b/pkgs/by-name/ru/rune/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchCrate,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -19,11 +17,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-SgfgoMqr2Cc7+qhf9Ejl4Ect1JR9RqI9I0b+PrdvdOs=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.CoreServices
-    darwin.apple_sdk.frameworks.SystemConfiguration
-  ];
-
   env = {
     RUNE_VERSION = version;
   };
diff --git a/pkgs/by-name/ru/runiq/package.nix b/pkgs/by-name/ru/runiq/package.nix
index 198d3041a849..85cd0995f1f5 100644
--- a/pkgs/by-name/ru/runiq/package.nix
+++ b/pkgs/by-name/ru/runiq/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage {
@@ -23,10 +21,6 @@ rustPlatform.buildRustPackage {
     ln -s ${./Cargo.lock} Cargo.lock
   '';
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-  ];
-
   meta = with lib; {
     description = "Efficient way to filter duplicate lines from input, à la uniq";
     mainProgram = "runiq";
diff --git a/pkgs/by-name/ru/runit/package.nix b/pkgs/by-name/ru/runit/package.nix
index 9e8a971f81a1..d3ac271a2a62 100644
--- a/pkgs/by-name/ru/runit/package.nix
+++ b/pkgs/by-name/ru/runit/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  darwin,
 
   # Build runit-init as a static binary
   static ? false,
@@ -30,12 +29,10 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  buildInputs =
-    lib.optionals static [
-      stdenv.cc.libc
-      stdenv.cc.libc.static
-    ]
-    ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.libs.utmp;
+  buildInputs = lib.optionals static [
+    stdenv.cc.libc
+    stdenv.cc.libc.static
+  ];
 
   postPatch =
     ''
diff --git a/pkgs/by-name/ru/russ/package.nix b/pkgs/by-name/ru/russ/package.nix
index a90b0628dcac..73ba1fa99527 100644
--- a/pkgs/by-name/ru/russ/package.nix
+++ b/pkgs/by-name/ru/russ/package.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage {
@@ -23,14 +21,6 @@ rustPlatform.buildRustPackage {
   # tests are network based :(
   doCheck = false;
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin (
-    with darwin.apple_sdk.frameworks;
-    [
-      CoreServices
-      AppKit
-    ]
-  );
-
   meta = {
     changelog = "https://github.com/ckampfe/russ/blob/master/CHANGELOG.md";
     description = "TUI RSS reader with vim-like controls and a local-first, offline-first focus";
diff --git a/pkgs/by-name/ru/rust-traverse/package.nix b/pkgs/by-name/ru/rust-traverse/package.nix
index a5d80ba81433..d969e4023c44 100644
--- a/pkgs/by-name/ru/rust-traverse/package.nix
+++ b/pkgs/by-name/ru/rust-traverse/package.nix
@@ -5,8 +5,6 @@
   pkg-config,
   bzip2,
   zstd,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -27,14 +25,10 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      bzip2
-      zstd
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk_11_0.frameworks.Foundation
-    ];
+  buildInputs = [
+    bzip2
+    zstd
+  ];
 
   env = {
     ZSTD_SYS_USE_PKG_CONFIG = true;
diff --git a/pkgs/by-name/ru/rustcat/package.nix b/pkgs/by-name/ru/rustcat/package.nix
index 47c78d76b292..0d6d73f63266 100644
--- a/pkgs/by-name/ru/rustcat/package.nix
+++ b/pkgs/by-name/ru/rustcat/package.nix
@@ -1,7 +1,5 @@
 {
   lib,
-  stdenv,
-  darwin,
   fetchFromGitHub,
   rustPlatform,
   versionCheckHook,
@@ -21,8 +19,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-76/JK9IKYD6mxMddUyTgKAw53GM4EUhC0NbKFKdg8CI=";
 
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.Security ];
-
   nativeInstallCheckInputs = [ versionCheckHook ];
 
   doInstallCheck = true;
diff --git a/pkgs/by-name/ru/rustdesk-server/package.nix b/pkgs/by-name/ru/rustdesk-server/package.nix
index 9f15d8a80ba0..b561f3525b2d 100644
--- a/pkgs/by-name/ru/rustdesk-server/package.nix
+++ b/pkgs/by-name/ru/rustdesk-server/package.nix
@@ -1,11 +1,9 @@
 {
-  stdenv,
   lib,
   rustPlatform,
   fetchFromGitHub,
   pkg-config,
   libsodium,
-  Security,
   sqlite,
   nix-update-script,
   testers,
@@ -41,14 +39,10 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      libsodium
-      sqlite
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Security
-    ];
+  buildInputs = [
+    libsodium
+    sqlite
+  ];
 
   passthru = {
     updateScript = nix-update-script { };
diff --git a/pkgs/by-name/ru/rustdesk/package.nix b/pkgs/by-name/ru/rustdesk/package.nix
index 67e4eaf6a680..d7da3b26e7d3 100644
--- a/pkgs/by-name/ru/rustdesk/package.nix
+++ b/pkgs/by-name/ru/rustdesk/package.nix
@@ -29,7 +29,6 @@
   zlib,
   zstd,
   stdenv,
-  darwin,
   alsa-lib,
   makeDesktopItem,
   copyDesktopItems,
@@ -144,19 +143,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       zlib
       zstd
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        AppKit
-        CoreAudio
-        CoreFoundation
-        CoreGraphics
-        Foundation
-        IOKit
-        Security
-        SystemConfiguration
-      ]
-    )
+
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       alsa-lib
       xdotool
diff --git a/pkgs/by-name/ru/rusti-cal/package.nix b/pkgs/by-name/ru/rusti-cal/package.nix
index 96cbda420d44..a706c00408be 100644
--- a/pkgs/by-name/ru/rusti-cal/package.nix
+++ b/pkgs/by-name/ru/rusti-cal/package.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitHub,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,10 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-9nd8xm3jAFouRYKSFpx3vQQaI/2wQzTaaehXjqljIfw=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Foundation
-  ];
-
   meta = with lib; {
     description = "Minimal command line calendar, similar to cal";
     mainProgram = "rusti-cal";
diff --git a/pkgs/by-name/ru/rustic/package.nix b/pkgs/by-name/ru/rustic/package.nix
index 1b2b632438ab..ea400d9b6ce3 100644
--- a/pkgs/by-name/ru/rustic/package.nix
+++ b/pkgs/by-name/ru/rustic/package.nix
@@ -2,9 +2,6 @@
   lib,
   fetchFromGitHub,
   rustPlatform,
-  stdenv,
-  Security,
-  SystemConfiguration,
   installShellFiles,
   nix-update-script,
 }:
@@ -25,11 +22,6 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    Security
-    SystemConfiguration
-  ];
-
   postInstall = ''
     for shell in {ba,fi,z}sh; do
       $out/bin/rustic completions $shell > rustic.$shell
diff --git a/pkgs/by-name/ru/rustlings/package.nix b/pkgs/by-name/ru/rustlings/package.nix
index 5c3f1549df0c..136cddb89013 100644
--- a/pkgs/by-name/ru/rustlings/package.nix
+++ b/pkgs/by-name/ru/rustlings/package.nix
@@ -1,7 +1,5 @@
 {
   lib,
-  stdenv,
-  darwin,
   rustPlatform,
   fetchFromGitHub,
   pkg-config,
@@ -38,10 +36,6 @@ rustPlatform.buildRustPackage {
     makeWrapper
   ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin (
-    with darwin.apple_sdk.frameworks; [ CoreServices ]
-  );
-
   postFixup = ''
     wrapProgram $out/bin/rustlings --suffix PATH : ${
       lib.makeBinPath [
diff --git a/pkgs/by-name/ru/rustls-ffi/package.nix b/pkgs/by-name/ru/rustls-ffi/package.nix
index 5327908e3684..11dca679d168 100644
--- a/pkgs/by-name/ru/rustls-ffi/package.nix
+++ b/pkgs/by-name/ru/rustls-ffi/package.nix
@@ -8,7 +8,6 @@
   validatePkgConfig,
   rust,
   libiconv,
-  darwin,
   curl,
   apacheHttpd,
   testers,
@@ -33,7 +32,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   propagatedBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     libiconv
-    darwin.apple_sdk.frameworks.Security
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ru/rustmission/package.nix b/pkgs/by-name/ru/rustmission/package.nix
index a87e24b16802..932876025231 100644
--- a/pkgs/by-name/ru/rustmission/package.nix
+++ b/pkgs/by-name/ru/rustmission/package.nix
@@ -4,8 +4,6 @@
   rustPlatform,
   pkg-config,
   openssl,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -24,13 +22,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.CoreFoundation
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [ openssl ];
 
   # There is no tests
   doCheck = false;
diff --git a/pkgs/by-name/ru/rustus/package.nix b/pkgs/by-name/ru/rustus/package.nix
index 2d6e9126502c..647f86a3d7c7 100644
--- a/pkgs/by-name/ru/rustus/package.nix
+++ b/pkgs/by-name/ru/rustus/package.nix
@@ -1,12 +1,10 @@
 {
-  stdenv,
   lib,
   fetchFromGitHub,
   rustPlatform,
   nix-update-script,
   pkg-config,
   openssl,
-  darwin,
   rdkafka,
 }:
 
@@ -36,14 +34,10 @@ rustPlatform.buildRustPackage {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      openssl
-      rdkafka
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = [
+    openssl
+    rdkafka
+  ];
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/ru/rustycli/package.nix b/pkgs/by-name/ru/rustycli/package.nix
index 5e7c9d6a7e5f..337bd547c497 100644
--- a/pkgs/by-name/ru/rustycli/package.nix
+++ b/pkgs/by-name/ru/rustycli/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchCrate,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -18,10 +16,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-QjkUiPwjG25NsvAXM3jqQVtJzYiXhzVqFaDN1b7DXDE=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-  ];
-
   # some examples fail to compile
   cargoTestFlags = [ "--tests" ];
 
diff --git a/pkgs/by-name/ru/rustypaste-cli/package.nix b/pkgs/by-name/ru/rustypaste-cli/package.nix
index a19879a1d41c..6ed96164be17 100644
--- a/pkgs/by-name/ru/rustypaste-cli/package.nix
+++ b/pkgs/by-name/ru/rustypaste-cli/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,10 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-R6mdHoARtnIRpN18KF1TVIgBzEtCinb0xfCM3nz2sxk=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-  ];
-
   meta = with lib; {
     description = "CLI tool for rustypaste";
     homepage = "https://github.com/orhun/rustypaste-cli";
diff --git a/pkgs/by-name/ru/rustypaste/package.nix b/pkgs/by-name/ru/rustypaste/package.nix
index 9548360b2f22..c97756291304 100644
--- a/pkgs/by-name/ru/rustypaste/package.nix
+++ b/pkgs/by-name/ru/rustypaste/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,10 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-10tBbn4XtdUNhfzb+KpwFGZAc7YVIEQRaqNLzJC1GGI=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.CoreServices
-  ];
-
   dontUseCargoParallelTests = true;
 
   checkFlags = [
diff --git a/pkgs/by-name/ru/rustywind/package.nix b/pkgs/by-name/ru/rustywind/package.nix
index b0b5bbf2b2e9..72e4d59d6ea7 100644
--- a/pkgs/by-name/ru/rustywind/package.nix
+++ b/pkgs/by-name/ru/rustywind/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,10 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-jq8d+ndPOu07YO5PJ5YfWTeG70bZnr0i8vMwv7Dw5GY=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-  ];
-
   meta = with lib; {
     description = "CLI for organizing Tailwind CSS classes";
     mainProgram = "rustywind";
diff --git a/pkgs/by-name/sa/safecloset/package.nix b/pkgs/by-name/sa/safecloset/package.nix
index 31756bdf7d66..db379c5c85e1 100644
--- a/pkgs/by-name/sa/safecloset/package.nix
+++ b/pkgs/by-name/sa/safecloset/package.nix
@@ -3,7 +3,6 @@
   rustPlatform,
   fetchFromGitHub,
   stdenv,
-  darwin,
   xorg,
 }:
 
@@ -21,13 +20,9 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-/AnzUaya+dgckcilxj9ZZbDNqmfj1uTWkzhVphpZIsM=";
 
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.AppKit
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [
-      xorg.libxcb
-    ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    xorg.libxcb
+  ];
 
   checkFlags = [
     # skip flaky test
diff --git a/pkgs/by-name/sa/saga/package.nix b/pkgs/by-name/sa/saga/package.nix
index f36d1683b0e2..321eeb33b522 100644
--- a/pkgs/by-name/sa/saga/package.nix
+++ b/pkgs/by-name/sa/saga/package.nix
@@ -20,7 +20,6 @@
   vigra,
   pdal,
   libpq,
-  darwin,
   unixODBC,
   poppler,
   hdf5,
@@ -80,7 +79,6 @@ stdenv.mkDerivation rec {
     # See https://groups.google.com/forum/#!topic/nix-devel/h_vSzEJAPXs
     # for why the have additional buildInputs on darwin
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Cocoa
       unixODBC
       poppler
       netcdf
diff --git a/pkgs/by-name/sa/sagoin/package.nix b/pkgs/by-name/sa/sagoin/package.nix
index e7bfd4246292..8d2e0bb7b656 100644
--- a/pkgs/by-name/sa/sagoin/package.nix
+++ b/pkgs/by-name/sa/sagoin/package.nix
@@ -3,8 +3,6 @@
   rustPlatform,
   fetchFromGitHub,
   installShellFiles,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -23,10 +21,6 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.CoreServices
-  ];
-
   postInstall = ''
     installManPage artifacts/sagoin.1
     installShellCompletion artifacts/sagoin.{bash,fish} --zsh artifacts/_sagoin
diff --git a/pkgs/by-name/sa/sampler/package.nix b/pkgs/by-name/sa/sampler/package.nix
index ec2e35728b1c..1f1f993d4915 100644
--- a/pkgs/by-name/sa/sampler/package.nix
+++ b/pkgs/by-name/sa/sampler/package.nix
@@ -3,7 +3,6 @@
   buildGoModule,
   fetchFromGitHub,
   fetchpatch,
-  darwin,
   alsa-lib,
   stdenv,
 }:
@@ -33,11 +32,7 @@ buildGoModule rec {
 
   subPackages = [ "." ];
 
-  buildInputs =
-    lib.optional stdenv.hostPlatform.isLinux alsa-lib
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.OpenAL
-    ];
+  buildInputs = lib.optional stdenv.hostPlatform.isLinux alsa-lib;
 
   meta = with lib; {
     description = "Tool for shell commands execution, visualization and alerting";
diff --git a/pkgs/by-name/sa/samply/package.nix b/pkgs/by-name/sa/samply/package.nix
index b0fba4887cd4..1c6d2f8a4db3 100644
--- a/pkgs/by-name/sa/samply/package.nix
+++ b/pkgs/by-name/sa/samply/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchCrate,
-  stdenv,
-  darwin,
   versionCheckHook,
   nix-update-script,
 }:
@@ -20,10 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-mQykzO9Ldokd3PZ1fY4pK/GtLmYMVas2iHj1Pqi9WqQ=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.CoreServices
-  ];
-
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "--version";
   doInstallCheck = true;
diff --git a/pkgs/by-name/sc/sccache/package.nix b/pkgs/by-name/sc/sccache/package.nix
index f5e89c173587..04a95c7e1bdd 100644
--- a/pkgs/by-name/sc/sccache/package.nix
+++ b/pkgs/by-name/sc/sccache/package.nix
@@ -4,8 +4,6 @@
   rustPlatform,
   pkg-config,
   openssl,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -25,14 +23,9 @@ rustPlatform.buildRustPackage rec {
   nativeBuildInputs = [
     pkg-config
   ];
-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    openssl
+  ];
 
   # Tests fail because of client server setup which is not possible inside the
   # pure environment, see https://github.com/mozilla/sccache/issues/460
diff --git a/pkgs/by-name/sc/schemamap/package.nix b/pkgs/by-name/sc/schemamap/package.nix
index 7705bd0d0746..d148bfe1123a 100644
--- a/pkgs/by-name/sc/schemamap/package.nix
+++ b/pkgs/by-name/sc/schemamap/package.nix
@@ -1,11 +1,9 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
   pkg-config,
   openssl,
-  darwin,
 }:
 
 let
@@ -27,17 +25,7 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-8UmLAT7Etb9MARoGhvOHPhkdR/8jCEAjAK/mWRHL9hk=";
 
-  buildInputs =
-    [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk;
-      [
-        frameworks.Security
-        frameworks.CoreFoundation
-        frameworks.CoreServices
-        frameworks.SystemConfiguration
-      ]
-    );
+  buildInputs = [ openssl ];
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/sc/screenly-cli/package.nix b/pkgs/by-name/sc/screenly-cli/package.nix
index 191cfa461cfd..226000e3902c 100644
--- a/pkgs/by-name/sc/screenly-cli/package.nix
+++ b/pkgs/by-name/sc/screenly-cli/package.nix
@@ -1,12 +1,10 @@
 {
-  darwin,
   fetchFromGitHub,
   lib,
   perl,
   pkg-config,
   openssl,
   rustPlatform,
-  stdenv,
   nix-update-script,
 }:
 
@@ -29,14 +27,7 @@ rustPlatform.buildRustPackage rec {
     perl
   ];
 
-  buildInputs =
-    [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.CoreFoundation
-      darwin.apple_sdk.frameworks.CoreServices
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [ openssl ];
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/sc/scryer-prolog/package.nix b/pkgs/by-name/sc/scryer-prolog/package.nix
index 3a7274f7af72..261e830134af 100644
--- a/pkgs/by-name/sc/scryer-prolog/package.nix
+++ b/pkgs/by-name/sc/scryer-prolog/package.nix
@@ -4,8 +4,6 @@
   fetchFromGitHub,
   pkg-config,
   openssl,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -24,11 +22,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [ openssl ];
 
   CARGO_FEATURE_USE_SYSTEM_LIBS = true;
 
diff --git a/pkgs/by-name/sd/SDL2_Pango/package.nix b/pkgs/by-name/sd/SDL2_Pango/package.nix
index b9a7797cc20a..f04bf88ecb9b 100644
--- a/pkgs/by-name/sd/SDL2_Pango/package.nix
+++ b/pkgs/by-name/sd/SDL2_Pango/package.nix
@@ -2,7 +2,6 @@
   lib,
   SDL2,
   autoreconfHook,
-  darwin,
   fetchFromGitHub,
   freetype,
   pango,
@@ -27,15 +26,11 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      SDL2
-      freetype
-      pango
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.libobjc
-    ];
+  buildInputs = [
+    SDL2
+    freetype
+    pango
+  ];
 
   outputs = [
     "out"
diff --git a/pkgs/by-name/sd/SDL2_classic/package.nix b/pkgs/by-name/sd/SDL2_classic/package.nix
index cac5b62199d9..040917569f8e 100644
--- a/pkgs/by-name/sd/SDL2_classic/package.nix
+++ b/pkgs/by-name/sd/SDL2_classic/package.nix
@@ -43,12 +43,6 @@
   pulseaudioSupport ?
     config.pulseaudio or stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isAndroid,
   libpulseaudio,
-  AudioUnit,
-  Cocoa,
-  CoreAudio,
-  CoreServices,
-  ForceFeedback,
-  OpenGL,
   audiofile,
   libiconv,
   withStatic ? stdenv.hostPlatform.isMinGW,
@@ -154,15 +148,7 @@ stdenv.mkDerivation (finalAttrs: {
     [ libiconv ]
     ++ finalAttrs.dlopenBuildInputs
     ++ lib.optional ibusSupport ibus
-    ++ lib.optionals waylandSupport [ wayland-protocols ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AudioUnit
-      Cocoa
-      CoreAudio
-      CoreServices
-      ForceFeedback
-      OpenGL
-    ];
+    ++ lib.optionals waylandSupport [ wayland-protocols ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/by-name/sd/SDL2_gfx/package.nix b/pkgs/by-name/sd/SDL2_gfx/package.nix
index d2a71e7ad740..814e10a603eb 100644
--- a/pkgs/by-name/sd/SDL2_gfx/package.nix
+++ b/pkgs/by-name/sd/SDL2_gfx/package.nix
@@ -1,7 +1,6 @@
 {
   lib,
   SDL2,
-  darwin,
   fetchurl,
   pkg-config,
   stdenv,
@@ -25,13 +24,9 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      SDL2
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.libobjc
-    ];
+  buildInputs = [
+    SDL2
+  ];
 
   outputs = [
     "out"
diff --git a/pkgs/by-name/sd/SDL2_image/package.nix b/pkgs/by-name/sd/SDL2_image/package.nix
index 85734436ee18..06d6d99209dd 100644
--- a/pkgs/by-name/sd/SDL2_image/package.nix
+++ b/pkgs/by-name/sd/SDL2_image/package.nix
@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "SDL2_image";
-  version = "2.8.5";
+  version = "2.8.8";
 
   src = fetchurl {
     url = "https://www.libsdl.org/projects/SDL_image/release/SDL2_image-${finalAttrs.version}.tar.gz";
-    hash = "sha256-i8TFf0HiwNt/m3SbJT72zs3G8LaJ7L427pe1ARX/9kU=";
+    hash = "sha256-IhO1b9r/IiDQ44yOQgy+GoPIc3QZDLqMcK8hVgl84wo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sd/SDL2_mixer/package.nix b/pkgs/by-name/sd/SDL2_mixer/package.nix
index 6f5441f3ebf4..228f35554a70 100644
--- a/pkgs/by-name/sd/SDL2_mixer/package.nix
+++ b/pkgs/by-name/sd/SDL2_mixer/package.nix
@@ -19,6 +19,7 @@
   # Boolean flags
   enableSdltest ? (!stdenv.hostPlatform.isDarwin),
 }:
+
 stdenv.mkDerivation (finalAttrs: {
   pname = "SDL2_mixer";
   version = "2.8.1";
diff --git a/pkgs/by-name/sd/SDL2_net/package.nix b/pkgs/by-name/sd/SDL2_net/package.nix
index d8665d231921..6a12a05f87ec 100644
--- a/pkgs/by-name/sd/SDL2_net/package.nix
+++ b/pkgs/by-name/sd/SDL2_net/package.nix
@@ -1,7 +1,6 @@
 {
   lib,
   SDL2,
-  darwin,
   fetchFromGitHub,
   pkg-config,
   stdenv,
@@ -30,10 +29,6 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
   ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.libobjc
-  ];
-
   propagatedBuildInputs = [ SDL2 ];
 
   configureFlags = [
diff --git a/pkgs/by-name/sd/SDL2_sound/package.nix b/pkgs/by-name/sd/SDL2_sound/package.nix
index 9ec2ec4e3cff..19fb33b41129 100644
--- a/pkgs/by-name/sd/SDL2_sound/package.nix
+++ b/pkgs/by-name/sd/SDL2_sound/package.nix
@@ -9,15 +9,8 @@
   libmikmod,
   libvorbis,
   timidity,
-  darwin,
 }:
 
-let
-  inherit (darwin.apple_sdk.frameworks)
-    AudioToolbox
-    CoreAudio
-    ;
-in
 stdenv.mkDerivation rec {
   pname = "SDL2_sound";
   version = "2.0.1";
@@ -42,18 +35,13 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [ "-DSDLSOUND_DECODER_MIDI=1" ];
 
-  buildInputs =
-    [
-      SDL2
-      flac
-      libmikmod
-      libvorbis
-      timidity
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AudioToolbox
-      CoreAudio
-    ];
+  buildInputs = [
+    SDL2
+    flac
+    libmikmod
+    libvorbis
+    timidity
+  ];
 
   meta = with lib; {
     description = "SDL2 sound library";
diff --git a/pkgs/by-name/sd/SDL2_ttf/package.nix b/pkgs/by-name/sd/SDL2_ttf/package.nix
index fef712b1998b..f8968606c561 100644
--- a/pkgs/by-name/sd/SDL2_ttf/package.nix
+++ b/pkgs/by-name/sd/SDL2_ttf/package.nix
@@ -1,7 +1,6 @@
 {
   lib,
   SDL2,
-  darwin,
   fetchurl,
   freetype,
   harfbuzz,
@@ -35,9 +34,6 @@ stdenv.mkDerivation (finalAttrs: {
     ]
     ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
       libGL
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.libobjc
     ];
 
   configureFlags = [
diff --git a/pkgs/by-name/sd/SDL_compat/package.nix b/pkgs/by-name/sd/SDL_compat/package.nix
index 5dfad7645e3c..59788c98bbcf 100644
--- a/pkgs/by-name/sd/SDL_compat/package.nix
+++ b/pkgs/by-name/sd/SDL_compat/package.nix
@@ -17,7 +17,6 @@
 }:
 
 let
-  inherit (darwin.apple_sdk.frameworks) Cocoa;
   inherit (darwin) autoSignDarwinBinariesHook;
 in
 stdenv.mkDerivation (finalAttrs: {
@@ -50,7 +49,6 @@ stdenv.mkDerivation (finalAttrs: {
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       libiconv
-      Cocoa
     ]
     ++ lib.optionals openglSupport [ libGLU ];
 
diff --git a/pkgs/by-name/sd/sdcc/package.nix b/pkgs/by-name/sd/sdcc/package.nix
index cc9e0512dcb4..d8361e04a744 100644
--- a/pkgs/by-name/sd/sdcc/package.nix
+++ b/pkgs/by-name/sd/sdcc/package.nix
@@ -63,6 +63,23 @@ stdenv.mkDerivation (finalAttrs: {
       gputils
     ];
 
+  # sdcc 4.5.0 massively rewrote sim/ucsim/Makefile.in, and lost the `.PHONY`
+  # rule in the process. As a result, on macOS (which uses a case-insensitive
+  # filesystem), the INSTALL file keeps the `install` target in the ucsim
+  # directory from running. Nothing else creates the `man` output, causing the
+  # entire build to fail.
+  #
+  # TODO: remove this when updating to the next release - it's been fixed in
+  # upstream sdcc r15384 <https://sourceforge.net/p/sdcc/code/15384/>.
+
+  postPatch = ''
+    if grep -q '\.PHONY:.*install' sim/ucsim/Makefile.in; then
+      echo 'Upstream has added `.PHONY: install` rule; must remove `postPatch` from the Nix file.' >&2
+      exit 1
+    fi
+    echo '.PHONY: install' >> sim/ucsim/Makefile.in
+  '';
+
   configureFlags =
     let
       excludedPorts =
diff --git a/pkgs/by-name/sd/sdl2-compat/package.nix b/pkgs/by-name/sd/sdl2-compat/package.nix
index 571619c61ff7..23da12cc8057 100644
--- a/pkgs/by-name/sd/sdl2-compat/package.nix
+++ b/pkgs/by-name/sd/sdl2-compat/package.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sdl2-compat";
-  version = "2.32.52";
+  version = "2.32.54";
 
   src = fetchFromGitHub {
     owner = "libsdl-org";
     repo = "sdl2-compat";
     tag = "release-${finalAttrs.version}";
-    hash = "sha256-adtFcBFclfub//KGpxqObuTIZbh9r4k/jdJEnP1Hzpw=";
+    hash = "sha256-tkiKJ/YPipeqAiioWZKlL1dXKPnvbW57v97rtITpV0Y=";
   };
 
   nativeBuildInputs = [
@@ -68,7 +68,7 @@ stdenv.mkDerivation (finalAttrs: {
   postFixup = ''
     # allow as a drop in replacement for SDL2
     # Can be removed after treewide switch from pkg-config to pkgconf
-    ln -s $dev/lib/pkgconfig/sdl2_compat.pc $dev/lib/pkgconfig/sdl2.pc
+    ln -s $dev/lib/pkgconfig/sdl2-compat.pc $dev/lib/pkgconfig/sdl2.pc
   '';
 
   passthru = {
@@ -108,6 +108,6 @@ stdenv.mkDerivation (finalAttrs: {
       marcin-serwin
     ];
     platforms = lib.platforms.all;
-    pkgConfigModules = [ "sdl2_compat" ];
+    pkgConfigModules = [ "sdl2-compat" ];
   };
 })
diff --git a/pkgs/by-name/se/selene/package.nix b/pkgs/by-name/se/selene/package.nix
index 31bf523f7900..c488e4b816ff 100644
--- a/pkgs/by-name/se/selene/package.nix
+++ b/pkgs/by-name/se/selene/package.nix
@@ -5,8 +5,6 @@
   robloxSupport ? true,
   pkg-config,
   openssl,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -27,13 +25,9 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    lib.optionals robloxSupport [
-      openssl
-    ]
-    ++ lib.optionals (robloxSupport && stdenv.hostPlatform.isDarwin) [
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = lib.optionals robloxSupport [
+    openssl
+  ];
 
   buildNoDefaultFeatures = !robloxSupport;
 
diff --git a/pkgs/by-name/se/selenium-manager/package.nix b/pkgs/by-name/se/selenium-manager/package.nix
index 02ce397ea19a..15f5b3ff4960 100644
--- a/pkgs/by-name/se/selenium-manager/package.nix
+++ b/pkgs/by-name/se/selenium-manager/package.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -26,10 +24,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-MgnmEJif4Z4CcmBFkC5BJR67DMGm1ttObtl4LhAFw4g=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.SystemConfiguration
-  ];
-
   # TODO: enable tests
   # The test suite depends on a number of browsers and network requests,
   # check the Gentoo package for inspiration
diff --git a/pkgs/by-name/se/selinux-python/package.nix b/pkgs/by-name/se/selinux-python/package.nix
index 3d15b6dd502c..2d05e602d171 100644
--- a/pkgs/by-name/se/selinux-python/package.nix
+++ b/pkgs/by-name/se/selinux-python/package.nix
@@ -3,47 +3,67 @@
   stdenv,
   fetchurl,
   python3,
+  gettext,
   libselinux,
   libsemanage,
   libsepol,
   setools,
 }:
 
-# this is python3 only because setools only supports python3
-stdenv.mkDerivation rec {
+let
+  selinuxPython3 = python3.withPackages (
+    ps: with ps; [
+      pip
+      setuptools
+    ]
+  );
+in
+stdenv.mkDerivation (finalAttrs: {
   pname = "selinux-python";
-  version = "3.3";
+  version = "3.8.1";
 
   inherit (libsepol) se_url;
 
   src = fetchurl {
-    url = "${se_url}/${version}/selinux-python-${version}.tar.gz";
-    sha256 = "1v244hpb45my303793xa4kcn7qnxjgxn4ja7rdn9k1q361hi1nca";
+    url = "${finalAttrs.se_url}/${finalAttrs.version}/selinux-python-${finalAttrs.version}.tar.gz";
+    hash = "sha256-dJAlv6SqDgCb8//EVdVloY1Ntxz+eWvkQFghcXIGwlo=";
   };
 
   strictDeps = true;
 
   nativeBuildInputs = [
-    python3
-    python3.pkgs.distutils
+    selinuxPython3
     python3.pkgs.wrapPython
+    gettext
   ];
-  buildInputs = [ libsepol ];
-  propagatedBuildInputs = [
+
+  buildInputs = [
+    python3
+    libsepol
     libselinux
-    libsemanage
+  ];
+
+  pythonPath = [
+    python3.pkgs.libselinux.py
+    libsemanage.py
     setools
-    python3.pkgs.ipy
   ];
 
   postPatch = ''
-    substituteInPlace sepolicy/Makefile --replace "echo --root" "echo --prefix"
-    substituteInPlace sepolgen/src/share/Makefile --replace "/var/lib/sepolgen" \
-                                                            "\$PREFIX/var/lib/sepolgen"
+    # We would like to disable build isolation so we use the provided setuptools (this is part of a `pip install` command)
+    substituteInPlace sepolicy/Makefile --replace-fail 'echo --root' 'echo --no-build-isolation --root'
+
+    # Replace hardcoded paths.
+    substituteInPlace sepolgen/src/share/Makefile --replace-fail "/var/lib/sepolgen" \
+                                                            '$(PREFIX)/var/lib/sepolgen'
+    substituteInPlace po/Makefile --replace-fail "/usr/bin/install" "install"
   '';
 
   makeFlags = [
     "PREFIX=$(out)"
+    # This makes pip successfully install it (note the test -n "$(DESTDIR)" nonsense)
+    # https://github.com/SELinuxProject/selinux/blob/d1e3170556e1023e07b3c071ce89543ead6ba6f8/python/sepolicy/Makefile#L30
+    "DESTDIR=/"
     "LOCALEDIR=$(out)/share/locale"
     "BASHCOMPLETIONDIR=$(out)/share/bash-completion/completions"
     "PYTHON=python"
@@ -51,15 +71,41 @@ stdenv.mkDerivation rec {
     "LIBSEPOLA=${lib.getLib libsepol}/lib/libsepol.a"
   ];
 
+  preFixup = ''
+    patchShebangs --host $out/bin/*
+  '';
+
   postFixup = ''
     wrapPythonPrograms
   '';
 
+  doInstallCheck = true;
+
+  installCheckPhase = ''
+    # Version hasn't changed in 17 years, if it suddenly does these tests deserve to break
+    $out/bin/audit2allow --version | grep -Fm1 'audit2allow .1'
+    $out/bin/audit2why --version | grep -Fm1 'audit2allow .1'
+    $out/bin/sepolgen-ifgen --version | grep -Fm1 'sepolgen-ifgen .1'
+
+    # "chcat: Requires a mls enabled system" or help, which includes chcat
+    { $out/bin/chcat --help || true; } | grep -Fm1 'chcat'
+
+    $out/bin/semanage --help | grep -Fm1 'semanage'
+    $out/bin/sepolgen --help | grep -Fm1 'sepolicy'
+    $out/bin/sepolicy --help | grep -Fm1 'sepolicy'
+
+    # Should at least run, even if we can't provide it a policy file and need to provide /dev/zero
+    { $out/bin/sepolgen-ifgen-attr-helper test /dev/null 2>&1 || true; } | grep -Fm1 'error(s) encountered' >/dev/null
+  '';
+
   meta = with lib; {
     description = "SELinux policy core utilities written in Python";
     license = licenses.gpl2Plus;
     homepage = "https://selinuxproject.org";
-    maintainers = with lib.maintainers; [ RossComputerGuy ];
+    maintainers = with lib.maintainers; [
+      RossComputerGuy
+      numinit
+    ];
     platforms = platforms.linux;
   };
-}
+})
diff --git a/pkgs/by-name/se/sendme/package.nix b/pkgs/by-name/se/sendme/package.nix
index bc68f58f9745..432265d65ac7 100644
--- a/pkgs/by-name/se/sendme/package.nix
+++ b/pkgs/by-name/se/sendme/package.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,13 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-8Ry3rpGTNcvMIA3Q10Cb3uJHOBQin9AhlLNRekaKw/0=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin (
-    with darwin.apple_sdk.frameworks;
-    [
-      SystemConfiguration
-    ]
-  );
-
   meta = with lib; {
     description = "Tool to send files and directories, based on iroh";
     homepage = "https://iroh.computer/sendme";
diff --git a/pkgs/by-name/se/sequoia-sq/package.nix b/pkgs/by-name/se/sequoia-sq/package.nix
index 9f239af4f2f9..5d8084732036 100644
--- a/pkgs/by-name/se/sequoia-sq/package.nix
+++ b/pkgs/by-name/se/sequoia-sq/package.nix
@@ -1,8 +1,6 @@
 {
-  stdenv,
   fetchFromGitLab,
   lib,
-  darwin,
   nettle,
   nix-update-script,
   rustPlatform,
@@ -35,19 +33,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
     installShellFiles
   ];
 
-  buildInputs =
-    [
-      openssl
-      sqlite
-      nettle
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        Security
-        SystemConfiguration
-      ]
-    );
+  buildInputs = [
+    openssl
+    sqlite
+    nettle
+  ];
 
   # Needed for tests to be able to create a ~/.local/share/sequoia directory
   # Needed for avoiding "OpenSSL error" since 1.2.0
diff --git a/pkgs/by-name/se/sequoia-wot/package.nix b/pkgs/by-name/se/sequoia-wot/package.nix
index b9aaf9dc9a92..d949f6743ca0 100644
--- a/pkgs/by-name/se/sequoia-wot/package.nix
+++ b/pkgs/by-name/se/sequoia-wot/package.nix
@@ -8,7 +8,6 @@
   nettle,
   openssl,
   sqlite,
-  darwin,
   gnupg,
 }:
 rustPlatform.buildRustPackage rec {
@@ -36,10 +35,6 @@ rustPlatform.buildRustPackage rec {
       openssl
       sqlite
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.SystemConfiguration
-      # See comment near sequoia-openpgp/crypto- buildFeatures
-    ]
     ++ lib.optionals (!stdenv.targetPlatform.isWindows) [
       nettle
     ];
diff --git a/pkgs/by-name/se/serie/package.nix b/pkgs/by-name/se/serie/package.nix
index 8888b8870555..28939ed70d01 100644
--- a/pkgs/by-name/se/serie/package.nix
+++ b/pkgs/by-name/se/serie/package.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
-  darwin,
   testers,
   gitMinimal,
   serie,
@@ -23,14 +21,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-Bdk553tECJiMxJlXj147Sv2LzH+nM+/Cm5BpBr78I4o=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin (
-    with darwin.apple_sdk.frameworks;
-    [
-      CoreGraphics
-      AppKit
-    ]
-  );
-
   nativeCheckInputs = [ gitMinimal ];
 
   passthru.tests.version = testers.testVersion { package = serie; };
diff --git a/pkgs/by-name/sh/share-preview/package.nix b/pkgs/by-name/sh/share-preview/package.nix
index 2a439fbf37f6..6ecd9e27d25b 100644
--- a/pkgs/by-name/sh/share-preview/package.nix
+++ b/pkgs/by-name/sh/share-preview/package.nix
@@ -12,7 +12,6 @@
   desktop-file-utils,
   libadwaita,
   openssl,
-  darwin,
   nix-update-script,
 }:
 
@@ -48,15 +47,10 @@ stdenv.mkDerivation (finalAttrs: {
     desktop-file-utils
   ];
 
-  buildInputs =
-    [
-      libadwaita
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Foundation
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    libadwaita
+    openssl
+  ];
 
   env.NIX_CFLAGS_COMPILE = toString (
     lib.optionals stdenv.hostPlatform.isDarwin [ "-Wno-error=incompatible-function-pointer-types" ]
diff --git a/pkgs/by-name/sh/shibboleth-sp/package.nix b/pkgs/by-name/sh/shibboleth-sp/package.nix
index 4a300718c737..8f1950d375ef 100644
--- a/pkgs/by-name/sh/shibboleth-sp/package.nix
+++ b/pkgs/by-name/sh/shibboleth-sp/package.nix
@@ -12,7 +12,6 @@
   xercesc,
   xml-security-c,
   xml-tooling-c,
-  darwin,
 }:
 
 stdenv.mkDerivation rec {
@@ -29,24 +28,16 @@ stdenv.mkDerivation rec {
     autoreconfHook
     pkg-config
   ];
-  buildInputs =
-    [
-      boost
-      fcgi
-      openssl
-      opensaml-cpp
-      log4shib
-      xercesc
-      xml-security-c
-      xml-tooling-c
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        CoreServices
-        SystemConfiguration
-      ]
-    );
+  buildInputs = [
+    boost
+    fcgi
+    openssl
+    opensaml-cpp
+    log4shib
+    xercesc
+    xml-security-c
+    xml-tooling-c
+  ];
 
   configureFlags = [
     "--without-apxs"
diff --git a/pkgs/by-name/sh/shotcut/package.nix b/pkgs/by-name/sh/shotcut/package.nix
index d58b91f080ad..0e1d20f3e69e 100644
--- a/pkgs/by-name/sh/shotcut/package.nix
+++ b/pkgs/by-name/sh/shotcut/package.nix
@@ -13,7 +13,6 @@
   fftw,
   qt6,
   cmake,
-  darwin,
   gitUpdater,
   ffmpeg,
 }:
@@ -47,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
     qt6.qtmultimedia
     qt6.qtcharts
     qt6.qtwayland
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.Cocoa ];
+  ];
 
   env.NIX_CFLAGS_COMPILE = "-DSHOTCUT_NOUPGRADE";
 
diff --git a/pkgs/by-name/si/silicon/package.nix b/pkgs/by-name/si/silicon/package.nix
index 9fbf5ac29326..9d3444805172 100644
--- a/pkgs/by-name/si/silicon/package.nix
+++ b/pkgs/by-name/si/silicon/package.nix
@@ -10,7 +10,6 @@
   libxcb,
   python3,
   libiconv,
-  darwin,
   fira-code,
   fontconfig,
   harfbuzz,
@@ -39,15 +38,9 @@ rustPlatform.buildRustPackage rec {
       harfbuzz
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [ libxcb ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        libiconv
-        AppKit
-        CoreText
-        Security
-      ]
-    );
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      libiconv
+    ];
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/by-name/si/simple-http-server/package.nix b/pkgs/by-name/si/simple-http-server/package.nix
index d13c5485db55..66e8bbcdc790 100644
--- a/pkgs/by-name/si/simple-http-server/package.nix
+++ b/pkgs/by-name/si/simple-http-server/package.nix
@@ -4,8 +4,6 @@
   fetchFromGitHub,
   pkg-config,
   openssl,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -24,11 +22,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = [ openssl ];
 
   # Currently no tests are implemented, so we avoid building the package twice
   doCheck = false;
diff --git a/pkgs/by-name/sl/slippy/package.nix b/pkgs/by-name/sl/slippy/package.nix
index 70e757d7c1a1..c50ce43067eb 100644
--- a/pkgs/by-name/sl/slippy/package.nix
+++ b/pkgs/by-name/sl/slippy/package.nix
@@ -4,8 +4,6 @@
   fetchFromGitHub,
   pkg-config,
   openssl,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -26,13 +24,9 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = [
+    openssl
+  ];
 
   meta = with lib; {
     description = "Markdown slideshows in Rust";
diff --git a/pkgs/by-name/sl/slowlorust/package.nix b/pkgs/by-name/sl/slowlorust/package.nix
index 14b538ece5ae..71b74b20e646 100644
--- a/pkgs/by-name/sl/slowlorust/package.nix
+++ b/pkgs/by-name/sl/slowlorust/package.nix
@@ -1,7 +1,5 @@
 {
   lib,
-  stdenv,
-  darwin,
   fetchFromGitHub,
   rustPlatform,
   versionCheckHook,
@@ -27,8 +25,6 @@ rustPlatform.buildRustPackage rec {
       --replace-fail 'version = "1.0"' 'version = "${version}"'
   '';
 
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.Security ];
-
   nativeInstallCheckInputs = [ versionCheckHook ];
 
   doInstallCheck = true;
diff --git a/pkgs/by-name/sl/slumber/package.nix b/pkgs/by-name/sl/slumber/package.nix
index c8fc7133dd19..2a30e3b05680 100644
--- a/pkgs/by-name/sl/slumber/package.nix
+++ b/pkgs/by-name/sl/slumber/package.nix
@@ -1,7 +1,5 @@
 {
   lib,
-  stdenv,
-  darwin,
   fetchFromGitHub,
   rustPlatform,
 }:
@@ -20,8 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-acWEinwYCCtoapFkL6XyASvFX4bqYS/HrKjlaAZabi4=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.AppKit ];
-
   meta = with lib; {
     description = "Terminal-based HTTP/REST client";
     homepage = "https://slumber.lucaspickering.me";
diff --git a/pkgs/by-name/sm/smartcat/package.nix b/pkgs/by-name/sm/smartcat/package.nix
index a06d2d8b151a..77f38f36f665 100644
--- a/pkgs/by-name/sm/smartcat/package.nix
+++ b/pkgs/by-name/sm/smartcat/package.nix
@@ -3,10 +3,8 @@
   fetchFromGitHub,
   rustPlatform,
 
-  darwin,
   openssl,
   pkg-config,
-  stdenv,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -27,15 +25,9 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.AppKit
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    openssl
+  ];
 
   meta = {
     description = "Integrate large language models into the command line";
diff --git a/pkgs/by-name/sm/smc-fuzzer/package.nix b/pkgs/by-name/sm/smc-fuzzer/package.nix
index 7d10da09bed5..255182141c8d 100644
--- a/pkgs/by-name/sm/smc-fuzzer/package.nix
+++ b/pkgs/by-name/sm/smc-fuzzer/package.nix
@@ -16,8 +16,6 @@ stdenv.mkDerivation {
     hash = "sha256-FyiFSVeO46UnBrpC8AhSuGe7alo37pT8J1qQWGPqV2U=";
   };
 
-  buildInputs = [ swiftPackages.apple_sdk.frameworks.AppKit ];
-
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/by-name/sm/smpeg2/package.nix b/pkgs/by-name/sm/smpeg2/package.nix
index 983d28d30334..ad1912931c3e 100644
--- a/pkgs/by-name/sm/smpeg2/package.nix
+++ b/pkgs/by-name/sm/smpeg2/package.nix
@@ -3,7 +3,6 @@
   stdenv,
   autoconf,
   automake,
-  darwin,
   fetchFromGitHub,
   makeWrapper,
   pkg-config,
@@ -28,7 +27,7 @@ stdenv.mkDerivation {
     pkg-config
   ];
 
-  buildInputs = [ SDL2 ] ++ lib.optional stdenv.hostPlatform.isDarwin darwin.libobjc;
+  buildInputs = [ SDL2 ];
 
   outputs = [
     "out"
diff --git a/pkgs/by-name/sn/sn0int/package.nix b/pkgs/by-name/sn/sn0int/package.nix
index 98e03da7a41d..60e876a69e43 100644
--- a/pkgs/by-name/sn/sn0int/package.nix
+++ b/pkgs/by-name/sn/sn0int/package.nix
@@ -37,9 +37,6 @@ rustPlatform.buildRustPackage rec {
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       libseccomp
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      pkgs.darwin.apple_sdk.frameworks.Security
     ];
 
   # One of the dependencies (chrootable-https) tries to read "/etc/resolv.conf"
diff --git a/pkgs/by-name/sn/snes9x/package.nix b/pkgs/by-name/sn/snes9x/package.nix
index 970f4a48ee26..77fdf7877922 100644
--- a/pkgs/by-name/sn/snes9x/package.nix
+++ b/pkgs/by-name/sn/snes9x/package.nix
@@ -5,7 +5,7 @@
   cmake,
   fetchFromGitHub,
   gtkmm3,
-  libGL,
+  libGLX,
   libX11,
   libXdmcp,
   libXext,
@@ -91,11 +91,11 @@ stdenv.mkDerivation (finalAttrs: {
       "--enable-avx2"
     ];
 
-  postPatch = ''
+  postPatch = lib.optionalString withGtk ''
     substituteInPlace external/glad/src/egl.c \
-      --replace-fail libEGL.so.1 "${lib.getLib libGL}/lib/libEGL.so.1"
+      --replace-fail libEGL.so.1 "${lib.getLib libGLX}/lib/libEGL.so.1"
     substituteInPlace external/glad/src/glx.c \
-      --replace-fail libGL.so.1 ${lib.getLib libGL}/lib/libGL.so.1
+      --replace-fail libGL.so.1 ${lib.getLib libGLX}/lib/libGL.so.1
   '';
 
   preConfigure = ''
diff --git a/pkgs/by-name/sn/sniffnet/package.nix b/pkgs/by-name/sn/sniffnet/package.nix
index 7f64f2fe7e1a..f8d82b213b31 100644
--- a/pkgs/by-name/sn/sniffnet/package.nix
+++ b/pkgs/by-name/sn/sniffnet/package.nix
@@ -13,7 +13,6 @@
   vulkan-loader,
   wayland,
   xorg,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -48,7 +47,6 @@ rustPlatform.buildRustPackage rec {
       xorg.libXrandr
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.AppKit
       rustPlatform.bindgenHook
     ];
 
diff --git a/pkgs/by-name/so/so/package.nix b/pkgs/by-name/so/so/package.nix
index df39145c5973..ad1150c4b03e 100644
--- a/pkgs/by-name/so/so/package.nix
+++ b/pkgs/by-name/so/so/package.nix
@@ -1,6 +1,5 @@
 {
   lib,
-  darwin,
   fetchFromGitHub,
   libiconv,
   openssl,
@@ -11,7 +10,6 @@
 }:
 
 let
-  inherit (darwin.apple_sdk.frameworks) CoreServices Security SystemConfiguration;
   self = rustPlatform.buildRustPackage {
     pname = "so";
     version = "0.4.10";
@@ -34,9 +32,6 @@ let
       [ openssl ]
       ++ lib.optionals stdenv.hostPlatform.isDarwin [
         libiconv
-        CoreServices
-        Security
-        SystemConfiguration
       ];
 
     strictDeps = true;
diff --git a/pkgs/by-name/so/soapyplutosdr/package.nix b/pkgs/by-name/so/soapyplutosdr/package.nix
index 07e4fda8cc76..8fc1c04ec6b5 100644
--- a/pkgs/by-name/so/soapyplutosdr/package.nix
+++ b/pkgs/by-name/so/soapyplutosdr/package.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   cmake,
   pkg-config,
-  darwin,
   libad9361,
   libiio,
   libusb1,
@@ -26,18 +25,12 @@ stdenv.mkDerivation (finalAttrs: {
     cmake
     pkg-config
   ];
-  buildInputs =
-    [
-      libad9361
-      libiio
-      libusb1
-      soapysdr
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.IOKit
-      darwin.libobjc
-    ];
+  buildInputs = [
+    libad9361
+    libiio
+    libusb1
+    soapysdr
+  ];
 
   cmakeFlags = [ "-DSoapySDR_DIR=${soapysdr}/share/cmake/SoapySDR/" ];
 
diff --git a/pkgs/by-name/so/solana-cli/package.nix b/pkgs/by-name/so/solana-cli/package.nix
index 5535c8796580..cf8a4471b41b 100644
--- a/pkgs/by-name/so/solana-cli/package.nix
+++ b/pkgs/by-name/so/solana-cli/package.nix
@@ -3,7 +3,6 @@
   fetchFromGitHub,
   lib,
   rustPlatform,
-  darwin,
   udev,
   protobuf,
   rocksdb_8_3,
@@ -41,14 +40,6 @@ let
   version = "1.18.26";
   hash = "sha256-sJ0Zn5GMi64/S8zqomL/dYRVW8SOQWsP+bpcdatJC0A=";
   rocksdb = rocksdb_8_3;
-
-  inherit (darwin.apple_sdk_11_0) Libsystem;
-  inherit (darwin.apple_sdk_11_0.frameworks)
-    System
-    IOKit
-    AppKit
-    Security
-    ;
 in
 rustPlatform.buildRustPackage rec {
   pname = "solana-cli";
@@ -91,19 +82,10 @@ rustPlatform.buildRustPackage rec {
     protobuf
     pkg-config
   ];
-  buildInputs =
-    [
-      openssl
-      rustPlatform.bindgenHook
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [ udev ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      IOKit
-      Security
-      AppKit
-      System
-      Libsystem
-    ];
+  buildInputs = [
+    openssl
+    rustPlatform.bindgenHook
+  ] ++ lib.optionals stdenv.hostPlatform.isLinux [ udev ];
 
   doInstallCheck = true;
 
diff --git a/pkgs/by-name/so/soupault/package.nix b/pkgs/by-name/so/soupault/package.nix
index 583ced6bbe5d..cc3506ca0fbb 100644
--- a/pkgs/by-name/so/soupault/package.nix
+++ b/pkgs/by-name/so/soupault/package.nix
@@ -12,7 +12,7 @@
 
 ocamlPackages.buildDunePackage rec {
   pname = "soupault";
-  version = "4.11.0";
+  version = "5.0.0";
 
   minimalOCamlVersion = "4.13";
 
@@ -21,7 +21,7 @@ ocamlPackages.buildDunePackage rec {
       "https://github.com/PataphysicalSociety/soupault/archive/${version}.tar.gz"
       "https://codeberg.org/PataphysicalSociety/soupault/archive/${version}.tar.gz"
     ];
-    hash = "sha256-UABbrNNcNaN9NgtAjCs4HUoNXMaK4QvCuWERuEnMG6I=";
+    hash = "sha256-patZn5z+ZT3dONdUojSvFgaVOmG1IpVGdehCUh2uRT8=";
   };
 
   nativeBuildInputs =
@@ -33,6 +33,7 @@ ocamlPackages.buildDunePackage rec {
   buildInputs = with ocamlPackages; [
     base64
     camomile
+    cmarkit
     containers
     csv
     digestif
diff --git a/pkgs/by-name/so/soxr/package.nix b/pkgs/by-name/so/soxr/package.nix
index 61121b019e5f..156650a09ef1 100644
--- a/pkgs/by-name/so/soxr/package.nix
+++ b/pkgs/by-name/so/soxr/package.nix
@@ -27,6 +27,11 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
+  cmakeFlags = [
+    # Workaround for upstream not using GNUInstallDirs.
+    "-DINCLUDE_INSTALL_DIR=${placeholder "dev"}/include"
+  ];
+
   meta = with lib; {
     description = "Audio resampling library";
     homepage = "https://soxr.sourceforge.net";
diff --git a/pkgs/by-name/so/sozu/package.nix b/pkgs/by-name/so/sozu/package.nix
index cd8a5bae52ca..a14e5f750236 100644
--- a/pkgs/by-name/so/sozu/package.nix
+++ b/pkgs/by-name/so/sozu/package.nix
@@ -3,7 +3,6 @@
   stdenv,
   rustPlatform,
   fetchFromGitHub,
-  darwin,
   protobuf,
   nix-update-script,
   testers,
@@ -26,8 +25,6 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ protobuf ];
 
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.frameworks.Security;
-
   doCheck = false;
 
   passthru = {
diff --git a/pkgs/by-name/sp/speedtest-rs/package.nix b/pkgs/by-name/sp/speedtest-rs/package.nix
index c28c1c8f52eb..e5d5b402b826 100644
--- a/pkgs/by-name/sp/speedtest-rs/package.nix
+++ b/pkgs/by-name/sp/speedtest-rs/package.nix
@@ -5,7 +5,6 @@
   openssl,
   pkg-config,
   stdenv,
-  darwin,
   nix-update-script,
   testers,
   speedtest-rs,
@@ -22,12 +21,7 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-1FAFYiWDD/KG/7/UTv/EW6Nj2GnU0GZFFq6ouMc0URA=";
   };
 
-  buildInputs =
-    [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [ openssl ];
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/sq/sql-studio/package.nix b/pkgs/by-name/sq/sql-studio/package.nix
index 1624d07f80aa..d0e0d18282d5 100644
--- a/pkgs/by-name/sq/sql-studio/package.nix
+++ b/pkgs/by-name/sq/sql-studio/package.nix
@@ -1,7 +1,5 @@
 {
   lib,
-  stdenv,
-  darwin,
   rustPlatform,
   buildNpmPackage,
   fetchFromGitHub,
@@ -38,8 +36,6 @@ rustPlatform.buildRustPackage {
     cp -pr --reflink=auto -- ${ui} ui/dist
   '';
 
-  buildInputs = lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Foundation ];
-
   meta = {
     description = "SQL Database Explorer [SQLite, libSQL, PostgreSQL, MySQL/MariaDB, ClickHouse, Microsoft SQL Server]";
     homepage = "https://github.com/frectonz/sql-studio";
diff --git a/pkgs/by-name/sq/sqld/package.nix b/pkgs/by-name/sq/sqld/package.nix
index f7934b44ebf8..b6812fe601a4 100644
--- a/pkgs/by-name/sq/sqld/package.nix
+++ b/pkgs/by-name/sq/sqld/package.nix
@@ -8,8 +8,6 @@
   openssl,
   sqlite,
   zstd,
-  stdenv,
-  darwin,
   cmake,
 
   nix-update-script,
@@ -56,7 +54,7 @@ rustPlatform.buildRustPackage rec {
     openssl
     sqlite
     zstd
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.Security ];
+  ];
 
   env.ZSTD_SYS_USE_PKG_CONFIG = true;
 
diff --git a/pkgs/by-name/sq/sqruff/package.nix b/pkgs/by-name/sq/sqruff/package.nix
index 3d34a3dc0547..f497f538e290 100644
--- a/pkgs/by-name/sq/sqruff/package.nix
+++ b/pkgs/by-name/sq/sqruff/package.nix
@@ -3,7 +3,6 @@
   rustPlatform,
   fetchFromGitHub,
   stdenv,
-  darwin,
   rust-jemalloc-sys,
   nix-update-script,
   versionCheckHook,
@@ -24,7 +23,7 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = [
     rust-jemalloc-sys
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.CoreServices ];
+  ];
 
   # Patch the tests to find the binary
   postPatch = ''
diff --git a/pkgs/by-name/sq/squawk/package.nix b/pkgs/by-name/sq/squawk/package.nix
index 66065fd74588..1496229ad9e8 100644
--- a/pkgs/by-name/sq/squawk/package.nix
+++ b/pkgs/by-name/sq/squawk/package.nix
@@ -1,5 +1,4 @@
 {
-  darwin,
   fetchFromGitHub,
   lib,
   libiconv,
@@ -29,18 +28,10 @@ rustPlatform.buildRustPackage rec {
     rustPlatform.bindgenHook
   ];
 
-  buildInputs =
-    lib.optionals (!stdenv.hostPlatform.isDarwin) [
-      libiconv
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        CoreFoundation
-        Security
-      ]
-    );
+  buildInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) [
+    libiconv
+    openssl
+  ];
 
   OPENSSL_NO_VENDOR = 1;
 
diff --git a/pkgs/by-name/sq/squeezelite/package.nix b/pkgs/by-name/sq/squeezelite/package.nix
index b2b403461222..8980661212e7 100644
--- a/pkgs/by-name/sq/squeezelite/package.nix
+++ b/pkgs/by-name/sq/squeezelite/package.nix
@@ -1,7 +1,6 @@
 {
   lib,
   stdenv,
-  darwin,
   fetchFromGitHub,
   flac,
   libgpiod,
@@ -59,17 +58,7 @@ stdenv.mkDerivation {
     ++ optional pulseSupport libpulseaudio
     ++ optional alsaSupport alsa-lib
     ++ optional portaudioSupport portaudio
-    ++ optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk_11_0.frameworks;
-      [
-        CoreVideo
-        VideoDecodeAcceleration
-        CoreAudio
-        AudioToolbox
-        AudioUnit
-        Carbon
-      ]
-    )
+
     ++ optional faad2Support faad2
     ++ optional ffmpegSupport ffmpeg
     ++ optional opusSupport opusfile
diff --git a/pkgs/by-name/sr/src-cli/package.nix b/pkgs/by-name/sr/src-cli/package.nix
index 3057f97ad5ae..f80017b8c57c 100644
--- a/pkgs/by-name/sr/src-cli/package.nix
+++ b/pkgs/by-name/sr/src-cli/package.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   stdenv,
   xorg,
-  darwin,
   testers,
   src-cli,
 }:
@@ -26,13 +25,9 @@ buildGoModule rec {
     "cmd/src"
   ];
 
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [
-      xorg.libX11
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Cocoa
-    ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    xorg.libX11
+  ];
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ss/ssh-openpgp-auth/generic.nix b/pkgs/by-name/ss/ssh-openpgp-auth/generic.nix
index 6de2efdc2821..b5a5ff2c8282 100644
--- a/pkgs/by-name/ss/ssh-openpgp-auth/generic.nix
+++ b/pkgs/by-name/ss/ssh-openpgp-auth/generic.nix
@@ -11,8 +11,6 @@
   nettle,
   openssl,
   sqlite,
-  stdenv,
-  darwin,
   openssh,
   # Arguments not supplied by callPackage
   pname,
@@ -60,18 +58,11 @@ rustPlatform.buildRustPackage {
       --zsh  shell_completions/_${pname}
   '';
 
-  buildInputs =
-    [
-      nettle
-      openssl
-      sqlite
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk_11_0.frameworks.CoreFoundation
-      darwin.apple_sdk_11_0.frameworks.IOKit
-      darwin.apple_sdk_11_0.frameworks.Security
-      darwin.apple_sdk_11_0.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    nettle
+    openssl
+    sqlite
+  ];
 
   doCheck = true;
   nativeCheckInputs = [
diff --git a/pkgs/by-name/st/stabber/package.nix b/pkgs/by-name/st/stabber/package.nix
index a2d3a8c6587e..5c269a2e8606 100644
--- a/pkgs/by-name/st/stabber/package.nix
+++ b/pkgs/by-name/st/stabber/package.nix
@@ -7,7 +7,6 @@
   glib,
   expat,
   libmicrohttpd,
-  darwin,
 }:
 stdenv.mkDerivation {
   pname = "stabber-unstable";
@@ -37,7 +36,7 @@ stdenv.mkDerivation {
     glib
     expat
     libmicrohttpd
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.Security ];
+  ];
 
   meta = with lib; {
     description = "Stubbed XMPP Server";
diff --git a/pkgs/by-name/st/stalwart-mail/package.nix b/pkgs/by-name/st/stalwart-mail/package.nix
index 7c442b483ad0..77f48d5cadfe 100644
--- a/pkgs/by-name/st/stalwart-mail/package.nix
+++ b/pkgs/by-name/st/stalwart-mail/package.nix
@@ -10,7 +10,6 @@
   foundationdb,
   zstd,
   stdenv,
-  darwin,
   nix-update-script,
   nixosTests,
   rocksdb,
@@ -20,17 +19,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "stalwart-mail";
-  version = "0.11.7";
+  version = "0.11.8";
 
   src = fetchFromGitHub {
     owner = "stalwartlabs";
     repo = "mail-server";
     tag = "v${version}";
-    hash = "sha256-pBCj/im5UB7A92LBuLeB6EAHTJEuN62BG5Nkj8qsNNA=";
+    hash = "sha256-VqGosbSQxNeOS+kGtvXAmz6vyz5mJlXvKZM57B1Xue4=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-B+xsTVsh9QBAybKiJq0Sb7rveOsH05vuCmNQ5t/UZnk=";
+  cargoHash = "sha256-iheURWxO0cOvO+FV01l2Vmo0B+S2mXzue6mx3gapftQ=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/st/star-history/package.nix b/pkgs/by-name/st/star-history/package.nix
index bf082e1b358f..8701b9450836 100644
--- a/pkgs/by-name/st/star-history/package.nix
+++ b/pkgs/by-name/st/star-history/package.nix
@@ -1,11 +1,9 @@
 {
   lib,
   rustPlatform,
-  darwin,
   fetchCrate,
   pkg-config,
   openssl,
-  stdenv,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -22,11 +20,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [ openssl ];
 
   meta = with lib; {
     description = "Command line program to generate a graph showing number of GitHub stars of a user, org or repo over time";
diff --git a/pkgs/by-name/st/starry/package.nix b/pkgs/by-name/st/starry/package.nix
index 244d19a3eed8..c51dc81506e3 100644
--- a/pkgs/by-name/st/starry/package.nix
+++ b/pkgs/by-name/st/starry/package.nix
@@ -4,8 +4,6 @@
   fetchCrate,
   pkg-config,
   openssl,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -24,13 +22,9 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = [
+    openssl
+  ];
 
   meta = with lib; {
     description = "Current stars history tells only half the story";
diff --git a/pkgs/by-name/st/static-web-server/package.nix b/pkgs/by-name/st/static-web-server/package.nix
index f31a7d1ccbec..83f1cb8cb49d 100644
--- a/pkgs/by-name/st/static-web-server/package.nix
+++ b/pkgs/by-name/st/static-web-server/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  darwin,
   nixosTests,
 }:
 
@@ -21,8 +19,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-Sri2NTCN5vIf/5KVI+BtyOBAjkXoGpOJjP2iOh/M5NU=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.Security ];
-
   # Some tests rely on timestamps newer than 18 Nov 1974 00:00:00
   preCheck = ''
     find docker/public -exec touch -m {} \;
diff --git a/pkgs/by-name/st/step-ca/package.nix b/pkgs/by-name/st/step-ca/package.nix
index 92763dd75952..d0a241f2606c 100644
--- a/pkgs/by-name/st/step-ca/package.nix
+++ b/pkgs/by-name/st/step-ca/package.nix
@@ -8,7 +8,6 @@
   pkg-config,
   hsmSupport ? true,
   nixosTests,
-  darwin,
 }:
 
 buildGoModule rec {
@@ -31,9 +30,7 @@ buildGoModule rec {
 
   nativeBuildInputs = lib.optionals hsmSupport [ pkg-config ];
 
-  buildInputs =
-    lib.optionals (hsmSupport && stdenv.hostPlatform.isLinux) [ pcsclite ]
-    ++ lib.optionals (hsmSupport && stdenv.hostPlatform.isDarwin) [ darwin.apple_sdk.frameworks.PCSC ];
+  buildInputs = lib.optionals (hsmSupport && stdenv.hostPlatform.isLinux) [ pcsclite ];
   postPatch = ''
     substituteInPlace authority/http_client_test.go --replace-fail 't.Run("SystemCertPool", func(t *testing.T) {' 't.Skip("SystemCertPool", func(t *testing.T) {'
     substituteInPlace systemd/step-ca.service --replace "/bin/kill" "${coreutils}/bin/kill"
diff --git a/pkgs/by-name/st/stormlib/package.nix b/pkgs/by-name/st/stormlib/package.nix
index f7cd1b2b55d5..55b1badd1c83 100644
--- a/pkgs/by-name/st/stormlib/package.nix
+++ b/pkgs/by-name/st/stormlib/package.nix
@@ -3,7 +3,6 @@
   stdenv,
   bzip2,
   cmake,
-  darwin,
   fetchFromGitHub,
   libtomcrypt,
   zlib,
@@ -26,15 +25,11 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      bzip2
-      libtomcrypt
-      zlib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Carbon
-    ];
+  buildInputs = [
+    bzip2
+    libtomcrypt
+    zlib
+  ];
 
   cmakeFlags = [
     (lib.cmakeBool "BUILD_SHARED_LIBS" (!stdenv.hostPlatform.isStatic))
diff --git a/pkgs/by-name/st/strongswan/package.nix b/pkgs/by-name/st/strongswan/package.nix
index c014a2080be4..48c8c18b5676 100644
--- a/pkgs/by-name/st/strongswan/package.nix
+++ b/pkgs/by-name/st/strongswan/package.nix
@@ -28,7 +28,6 @@
   tpm2-tss,
   enableNetworkManager ? false,
   networkmanager,
-  darwin,
   nixosTests,
 }:
 
@@ -78,9 +77,6 @@ stdenv.mkDerivation rec {
       pam
       iptables
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks; [ SystemConfiguration ]
-    )
     ++ lib.optionals enableNetworkManager [
       networkmanager
       glib
diff --git a/pkgs/by-name/su/subxt/package.nix b/pkgs/by-name/su/subxt/package.nix
index 53969233d425..1976b966ebf3 100644
--- a/pkgs/by-name/su/subxt/package.nix
+++ b/pkgs/by-name/su/subxt/package.nix
@@ -1,10 +1,8 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitHub,
   cmake,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -30,10 +28,6 @@ rustPlatform.buildRustPackage rec {
   # Needed by wabt-sys
   nativeBuildInputs = [ cmake ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-  ];
-
   # Requires a running substrate node
   doCheck = false;
 
diff --git a/pkgs/by-name/su/supersonic/package.nix b/pkgs/by-name/su/supersonic/package.nix
index 0e618abc6cbd..17d452b3d8a9 100644
--- a/pkgs/by-name/su/supersonic/package.nix
+++ b/pkgs/by-name/su/supersonic/package.nix
@@ -13,7 +13,6 @@
   libxkbcommon,
   libglvnd,
   mpv-unwrapped,
-  darwin,
   waylandSupport ? false,
 }:
 
@@ -64,13 +63,6 @@ buildGoModule rec {
       wayland
       wayland-protocols
       libxkbcommon
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk_11_0.frameworks.Cocoa
-      darwin.apple_sdk_11_0.frameworks.Kernel
-      darwin.apple_sdk_11_0.frameworks.OpenGL
-      darwin.apple_sdk_11_0.frameworks.UserNotifications
-      darwin.apple_sdk_11_0.frameworks.MediaPlayer
     ];
 
   postInstall =
diff --git a/pkgs/by-name/su/surfer/package.nix b/pkgs/by-name/su/surfer/package.nix
index 8cffcf7dd82d..bf145ff65ea4 100644
--- a/pkgs/by-name/su/surfer/package.nix
+++ b/pkgs/by-name/su/surfer/package.nix
@@ -12,7 +12,6 @@
   libXcursor,
   libXi,
   stdenv,
-  darwin,
   makeWrapper,
   zenity,
 }:
@@ -34,12 +33,10 @@ rustPlatform.buildRustPackage rec {
     makeWrapper
   ];
 
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [
-      openssl
-      (lib.getLib stdenv.cc.cc)
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.AppKit ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    openssl
+    (lib.getLib stdenv.cc.cc)
+  ];
 
   # Wayland and X11 libs are required at runtime since winit uses dlopen
   runtimeDependencies = lib.optionals stdenv.hostPlatform.isLinux [
diff --git a/pkgs/by-name/su/surrealdb/package.nix b/pkgs/by-name/su/surrealdb/package.nix
index 40a12490e3ca..dbcf1e5d5248 100644
--- a/pkgs/by-name/su/surrealdb/package.nix
+++ b/pkgs/by-name/su/surrealdb/package.nix
@@ -1,6 +1,5 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitHub,
   pkg-config,
@@ -8,7 +7,6 @@
   rocksdb,
   testers,
   surrealdb,
-  darwin,
   protobuf,
 }:
 rustPlatform.buildRustPackage rec {
@@ -45,7 +43,7 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = [
     openssl
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.SystemConfiguration ];
+  ];
 
   doCheck = false;
 
diff --git a/pkgs/by-name/sv/svix-server/package.nix b/pkgs/by-name/sv/svix-server/package.nix
index 0903acf482e7..94ce548bf251 100644
--- a/pkgs/by-name/sv/svix-server/package.nix
+++ b/pkgs/by-name/sv/svix-server/package.nix
@@ -6,7 +6,6 @@
   openssl,
   protobuf,
   stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -27,16 +26,10 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    [
-      openssl
-      protobuf
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.CoreServices
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    openssl
+    protobuf
+  ];
 
   # needed for internal protobuf c wrapper library
   PROTOC = "${protobuf}/bin/protoc";
diff --git a/pkgs/by-name/sw/swim/package.nix b/pkgs/by-name/sw/swim/package.nix
index bf8d01099dab..448d972eaa9d 100644
--- a/pkgs/by-name/sw/swim/package.nix
+++ b/pkgs/by-name/sw/swim/package.nix
@@ -5,8 +5,6 @@
   pkg-config,
   openssl,
   spade,
-  stdenv,
-  darwin,
   git,
 }:
 
@@ -35,14 +33,9 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    openssl
+  ];
 
   nativeCheckInputs = [ git ];
 
diff --git a/pkgs/by-name/sw/switcheroo/package.nix b/pkgs/by-name/sw/switcheroo/package.nix
index bc3b1e9af873..cb6199997e44 100644
--- a/pkgs/by-name/sw/switcheroo/package.nix
+++ b/pkgs/by-name/sw/switcheroo/package.nix
@@ -2,7 +2,6 @@
   lib,
   blueprint-compiler,
   cargo,
-  darwin,
   desktop-file-utils,
   fetchFromGitLab,
   glib,
@@ -48,15 +47,11 @@ stdenv.mkDerivation (finalAttrs: {
     wrapGAppsHook4
   ];
 
-  buildInputs =
-    [
-      glib
-      gtk4
-      libadwaita
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Foundation
-    ];
+  buildInputs = [
+    glib
+    gtk4
+    libadwaita
+  ];
 
   preFixup = ''
     gappsWrapperArgs+=(
diff --git a/pkgs/by-name/sy/symbolicator/package.nix b/pkgs/by-name/sy/symbolicator/package.nix
index 916b5ebfaa17..be724331796c 100644
--- a/pkgs/by-name/sy/symbolicator/package.nix
+++ b/pkgs/by-name/sy/symbolicator/package.nix
@@ -6,8 +6,6 @@
   bzip2,
   openssl,
   zstd,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -30,16 +28,11 @@ rustPlatform.buildRustPackage rec {
     rustPlatform.bindgenHook
   ];
 
-  buildInputs =
-    [
-      bzip2
-      openssl
-      zstd
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    bzip2
+    openssl
+    zstd
+  ];
 
   env = {
     SYMBOLICATOR_GIT_VERSION = src.rev;
diff --git a/pkgs/by-name/sy/synfigstudio/package.nix b/pkgs/by-name/sy/synfigstudio/package.nix
index 3d5cee8a5931..c8dfde12d0c5 100644
--- a/pkgs/by-name/sy/synfigstudio/package.nix
+++ b/pkgs/by-name/sy/synfigstudio/package.nix
@@ -8,7 +8,6 @@
 
   boost,
   cairo,
-  darwin,
   gettext,
   glibmm,
   gtk3,
@@ -77,26 +76,22 @@ let
       gettext
       intltool
     ];
-    buildInputs =
-      [
-        ETL
-        boost
-        cairo
-        glibmm
-        mlt
-        libsigcxx
-        libxmlxx
-        pango
-        imagemagick
-        harfbuzz
-        freetype
-        fribidi
-        openexr
-        fftw
-      ]
-      ++ lib.optionals stdenv.hostPlatform.isDarwin [
-        darwin.apple_sdk.frameworks.Foundation
-      ];
+    buildInputs = [
+      ETL
+      boost
+      cairo
+      glibmm
+      mlt
+      libsigcxx
+      libxmlxx
+      pango
+      imagemagick
+      harfbuzz
+      freetype
+      fribidi
+      openexr
+      fftw
+    ];
   };
 in
 stdenv.mkDerivation {
diff --git a/pkgs/by-name/sy/syslogng/package.nix b/pkgs/by-name/sy/syslogng/package.nix
index 5618b841d3e0..455aff78d5d9 100644
--- a/pkgs/by-name/sy/syslogng/package.nix
+++ b/pkgs/by-name/sy/syslogng/package.nix
@@ -35,7 +35,8 @@
   gperf,
   withGrpc ? true,
   grpc,
-  protobuf,
+  # see https://github.com/syslog-ng/syslog-ng/pull/5263
+  protobuf_29,
 }:
 let
   python-deps =
@@ -111,7 +112,7 @@ stdenv.mkDerivation (finalAttrs: {
       rdkafka
     ]
     ++ (lib.optionals withGrpc [
-      protobuf
+      protobuf_29
       grpc
     ]);
 
diff --git a/pkgs/by-name/sz/szyszka/package.nix b/pkgs/by-name/sz/szyszka/package.nix
index 97cb882bff2c..17a9a6b342ee 100644
--- a/pkgs/by-name/sz/szyszka/package.nix
+++ b/pkgs/by-name/sz/szyszka/package.nix
@@ -1,6 +1,5 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitHub,
   pkg-config,
@@ -11,7 +10,6 @@
   gdk-pixbuf,
   gtk4,
   wrapGAppsHook4,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -33,21 +31,14 @@ rustPlatform.buildRustPackage rec {
     wrapGAppsHook4
   ];
 
-  buildInputs =
-    [
-      glib
-      cairo
-      pango
-      atk
-      gdk-pixbuf
-      gtk4
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        Foundation
-      ]
-    );
+  buildInputs = [
+    glib
+    cairo
+    pango
+    atk
+    gdk-pixbuf
+    gtk4
+  ];
 
   postInstall = ''
     install -m 444 \
diff --git a/pkgs/by-name/t-/t-rex/package.nix b/pkgs/by-name/t-/t-rex/package.nix
index b4defe6ce338..997d56ada495 100644
--- a/pkgs/by-name/t-/t-rex/package.nix
+++ b/pkgs/by-name/t-/t-rex/package.nix
@@ -1,12 +1,10 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitHub,
   pkg-config,
   gdal,
   openssl,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -31,7 +29,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [
     gdal
     openssl
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.frameworks.Security;
+  ];
 
   meta = with lib; {
     description = "Vector tile server specialized on publishing MVT tiles";
diff --git a/pkgs/by-name/ta/tailwindcss-language-server/package.nix b/pkgs/by-name/ta/tailwindcss-language-server/package.nix
index 287908ce87fe..2a3d43c70141 100644
--- a/pkgs/by-name/ta/tailwindcss-language-server/package.nix
+++ b/pkgs/by-name/ta/tailwindcss-language-server/package.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  nodejs_23,
+  nodejs_latest,
   pnpm_9,
   cacert,
 }:
@@ -33,12 +33,12 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   nativeBuildInputs = [
-    nodejs_23
+    nodejs_latest
     pnpm_9.configHook
   ];
 
   buildInputs = [
-    nodejs_23
+    nodejs_latest
   ];
 
   pnpmWorkspaces = [ "@tailwindcss/language-server..." ];
diff --git a/pkgs/by-name/ta/taizen/package.nix b/pkgs/by-name/ta/taizen/package.nix
index ac4dbb58a009..5e43f0426b9d 100644
--- a/pkgs/by-name/ta/taizen/package.nix
+++ b/pkgs/by-name/ta/taizen/package.nix
@@ -6,8 +6,6 @@
   pkg-config,
   ncurses,
   openssl,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage {
@@ -35,14 +33,10 @@ rustPlatform.buildRustPackage {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    [
-      ncurses
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = [
+    ncurses
+    openssl
+  ];
 
   meta = with lib; {
     description = "curses based mediawiki browser";
diff --git a/pkgs/by-name/ta/talecast/package.nix b/pkgs/by-name/ta/talecast/package.nix
index 9d304d75d517..1b42df36c220 100644
--- a/pkgs/by-name/ta/talecast/package.nix
+++ b/pkgs/by-name/ta/talecast/package.nix
@@ -1,12 +1,10 @@
 {
   lib,
   fetchCrate,
-  darwin,
   rustPlatform,
   pkg-config,
   openssl,
   nix-update-script,
-  stdenv,
   testers,
   talecast,
 }:
@@ -27,7 +25,7 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = [
     openssl
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.SystemConfiguration ];
+  ];
 
   passthru = {
     updateScript = nix-update-script { };
diff --git a/pkgs/by-name/ta/taler-depolymerization/package.nix b/pkgs/by-name/ta/taler-depolymerization/package.nix
index f29d5fe0c4c7..544ce7aaa895 100644
--- a/pkgs/by-name/ta/taler-depolymerization/package.nix
+++ b/pkgs/by-name/ta/taler-depolymerization/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchgit,
-  stdenv,
-  darwin,
 }:
 rustPlatform.buildRustPackage {
   pname = "taler-depolymerization";
@@ -36,15 +34,6 @@ rustPlatform.buildRustPackage {
     cp docs/*.conf $out/share/examples
   '';
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin (
-    with darwin.apple_sdk.frameworks;
-    [
-      CoreFoundation
-      Security
-      SystemConfiguration
-    ]
-  );
-
   meta = {
     description = "Wire gateway for Bitcoin/Ethereum";
     homepage = "https://git.taler.net/depolymerization.git/";
diff --git a/pkgs/by-name/ta/taplo/package.nix b/pkgs/by-name/ta/taplo/package.nix
index e748d95922cc..6e00d8f1c2b3 100644
--- a/pkgs/by-name/ta/taplo/package.nix
+++ b/pkgs/by-name/ta/taplo/package.nix
@@ -4,8 +4,6 @@
   fetchCrate,
   pkg-config,
   openssl,
-  stdenv,
-  darwin,
   withLsp ? true,
 }:
 
@@ -26,14 +24,9 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    openssl
+  ];
 
   buildFeatures = lib.optional withLsp "lsp";
 
diff --git a/pkgs/by-name/te/teller/package.nix b/pkgs/by-name/te/teller/package.nix
index 1fcdbcd46ff7..f3b6564c1617 100644
--- a/pkgs/by-name/te/teller/package.nix
+++ b/pkgs/by-name/te/teller/package.nix
@@ -4,8 +4,6 @@
   fetchFromGitHub,
   nix-update-script,
   protobuf,
-  stdenv,
-  darwin,
   pkg-config,
   openssl,
 }:
@@ -34,7 +32,7 @@ rustPlatform.buildRustPackage {
 
   buildInputs = [
     openssl
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.SystemConfiguration ];
+  ];
 
   doCheck = false;
 
diff --git a/pkgs/by-name/te/termbook/package.nix b/pkgs/by-name/te/termbook/package.nix
index d6b450f6b7de..70b63b9daedd 100644
--- a/pkgs/by-name/te/termbook/package.nix
+++ b/pkgs/by-name/te/termbook/package.nix
@@ -6,7 +6,6 @@
   pkg-config,
   oniguruma,
   stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -29,13 +28,9 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      oniguruma
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = [
+    oniguruma
+  ];
 
   env = {
     RUSTONIG_SYSTEM_LIBONIG = true;
diff --git a/pkgs/by-name/th/the-powder-toy/package.nix b/pkgs/by-name/th/the-powder-toy/package.nix
index 5e752571669e..4f05c970dfcb 100644
--- a/pkgs/by-name/th/the-powder-toy/package.nix
+++ b/pkgs/by-name/th/the-powder-toy/package.nix
@@ -1,6 +1,5 @@
 {
   bzip2,
-  Cocoa,
   copyDesktopItems,
   curl,
   fetchFromGitHub,
@@ -48,7 +47,7 @@ stdenv.mkDerivation rec {
     luajit
     SDL2
     zlib
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin Cocoa;
+  ];
 
   mesonFlags = [ "-Dworkaround_elusive_bzip2=false" ];
 
diff --git a/pkgs/by-name/th/the-way/package.nix b/pkgs/by-name/th/the-way/package.nix
index ca41c64a18c3..80adfe234002 100644
--- a/pkgs/by-name/th/the-way/package.nix
+++ b/pkgs/by-name/th/the-way/package.nix
@@ -3,8 +3,6 @@
   rustPlatform,
   fetchCrate,
   installShellFiles,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -21,10 +19,6 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.AppKit
-  ];
-
   useNextest = true;
 
   postInstall = ''
diff --git a/pkgs/by-name/ti/tickrs/package.nix b/pkgs/by-name/ti/tickrs/package.nix
index 76af2e026e12..d9b682eb2160 100644
--- a/pkgs/by-name/ti/tickrs/package.nix
+++ b/pkgs/by-name/ti/tickrs/package.nix
@@ -5,8 +5,6 @@
   pkg-config,
   openssl,
   zlib,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -27,14 +25,10 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      openssl
-      zlib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    openssl
+    zlib
+  ];
 
   env = {
     OPENSSL_NO_VENDOR = true;
diff --git a/pkgs/by-name/ti/tio/package.nix b/pkgs/by-name/ti/tio/package.nix
index bb654032f60f..4fdf3dc622da 100644
--- a/pkgs/by-name/ti/tio/package.nix
+++ b/pkgs/by-name/ti/tio/package.nix
@@ -9,7 +9,6 @@
   inih,
   lua,
   bash-completion,
-  darwin,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -29,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
     inih
     lua
     glib
-  ] ++ lib.optionals (stdenv.hostPlatform.isDarwin) [ darwin.apple_sdk.frameworks.IOKit ];
+  ];
 
   nativeBuildInputs = [
     meson
diff --git a/pkgs/by-name/tl/tlrc/package.nix b/pkgs/by-name/tl/tlrc/package.nix
index a1ff5926d464..87147b7fa4a7 100644
--- a/pkgs/by-name/tl/tlrc/package.nix
+++ b/pkgs/by-name/tl/tlrc/package.nix
@@ -1,10 +1,8 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
   installShellFiles,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -23,10 +21,6 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-  ];
-
   postInstall = ''
     installManPage tldr.1
     installShellCompletion completions/{tldr.bash,_tldr,tldr.fish}
diff --git a/pkgs/by-name/tp/tpnote/package.nix b/pkgs/by-name/tp/tpnote/package.nix
index 40a7ebdc2ab0..9e4c19cde600 100644
--- a/pkgs/by-name/tp/tpnote/package.nix
+++ b/pkgs/by-name/tp/tpnote/package.nix
@@ -1,12 +1,10 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
   cmake,
   pkg-config,
   oniguruma,
-  darwin,
   installShellFiles,
   tpnote,
   testers,
@@ -32,18 +30,9 @@ rustPlatform.buildRustPackage rec {
     installShellFiles
   ];
 
-  buildInputs =
-    [
-      oniguruma
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        AppKit
-        CoreServices
-        SystemConfiguration
-      ]
-    );
+  buildInputs = [
+    oniguruma
+  ];
 
   postInstall = ''
     installManPage docs/build/man/man1/tpnote.1
diff --git a/pkgs/by-name/tr/tracy/package.nix b/pkgs/by-name/tr/tracy/package.nix
index 5916ac4cca4f..2fcf417165a0 100644
--- a/pkgs/by-name/tr/tracy/package.nix
+++ b/pkgs/by-name/tr/tracy/package.nix
@@ -9,7 +9,6 @@
   wayland-scanner,
 
   capstone,
-  darwin,
   dbus,
   freetype,
   glfw,
@@ -68,11 +67,7 @@ stdenv.mkDerivation rec {
     ]
     ++ lib.optionals (stdenv.hostPlatform.isDarwin || (stdenv.hostPlatform.isLinux && !withWayland)) [
       glfw
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.AppKit ]
-    ++ lib.optionals (
-      stdenv.hostPlatform.isDarwin && lib.versionAtLeast stdenv.hostPlatform.darwinMinVersion "11"
-    ) [ darwin.apple_sdk.frameworks.UniformTypeIdentifiers ];
+    ];
 
   cmakeFlags =
     [
diff --git a/pkgs/by-name/tr/transmission-rss/package.nix b/pkgs/by-name/tr/transmission-rss/package.nix
index 1fceafe35b86..e87517d42903 100644
--- a/pkgs/by-name/tr/transmission-rss/package.nix
+++ b/pkgs/by-name/tr/transmission-rss/package.nix
@@ -1,11 +1,9 @@
 {
-  stdenv,
   lib,
   rustPlatform,
   fetchFromGitHub,
   pkg-config,
   openssl,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage {
@@ -25,15 +23,7 @@ rustPlatform.buildRustPackage {
   cargoHash = "sha256-ETbWV5OjRzQuq/rVyu22YRFjeQcuNA1REyzg46s3q5A=";
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs =
-    [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        Security
-        SystemConfiguration
-      ]
-    );
+  buildInputs = [ openssl ];
 
   OPENSSL_NO_VENDOR = 1;
 
diff --git a/pkgs/by-name/tr/tre/package.nix b/pkgs/by-name/tr/tre/package.nix
index ccfb9d4937c9..268f561fbaf5 100644
--- a/pkgs/by-name/tr/tre/package.nix
+++ b/pkgs/by-name/tr/tre/package.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   autoconf,
   automake,
-  darwin,
   gettext,
   libiconv,
   libtool,
diff --git a/pkgs/by-name/tr/trunk-ng/package.nix b/pkgs/by-name/tr/trunk-ng/package.nix
index 47959e4eddbf..3a865c733f70 100644
--- a/pkgs/by-name/tr/trunk-ng/package.nix
+++ b/pkgs/by-name/tr/trunk-ng/package.nix
@@ -6,9 +6,6 @@
   pkg-config,
   openssl,
   libiconv,
-  CoreServices,
-  Security,
-  SystemConfiguration,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -27,9 +24,6 @@ rustPlatform.buildRustPackage rec {
     if stdenv.hostPlatform.isDarwin then
       [
         libiconv
-        CoreServices
-        Security
-        SystemConfiguration
       ]
     else
       [ openssl ];
diff --git a/pkgs/by-name/tt/ttfb/package.nix b/pkgs/by-name/tt/ttfb/package.nix
index 61414492cff0..31d4e2bc9212 100644
--- a/pkgs/by-name/tt/ttfb/package.nix
+++ b/pkgs/by-name/tt/ttfb/package.nix
@@ -1,9 +1,7 @@
 {
-  darwin,
   fetchCrate,
   lib,
   rustPlatform,
-  stdenv,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -15,10 +13,6 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-OOVqCWeF5cHMweEGWYIiWWWsw1QlNDFgnia05Qxo7uo=";
   };
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-  ];
-
   useFetchCargoVendor = true;
   cargoHash = "sha256-4Nsg5/66enMgAfPrUQHuhOTTwG2OWyyvKMHIhPnlHko=";
 
diff --git a/pkgs/by-name/tu/tui-journal/package.nix b/pkgs/by-name/tu/tui-journal/package.nix
index cf11de57e07f..079e09d45ec9 100644
--- a/pkgs/by-name/tu/tui-journal/package.nix
+++ b/pkgs/by-name/tu/tui-journal/package.nix
@@ -6,8 +6,6 @@
   libgit2,
   openssl,
   zlib,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -28,16 +26,11 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      libgit2
-      openssl
-      zlib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.AppKit
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = [
+    libgit2
+    openssl
+    zlib
+  ];
 
   meta = with lib; {
     description = "Your journal app if you live in a terminal";
diff --git a/pkgs/by-name/tw/twitch-hls-client/package.nix b/pkgs/by-name/tw/twitch-hls-client/package.nix
index 7e2a7e5ffaee..cf7311e0c4c9 100644
--- a/pkgs/by-name/tw/twitch-hls-client/package.nix
+++ b/pkgs/by-name/tw/twitch-hls-client/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,10 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-TvgRj6OyDcL0/I0o14CD8t2+VYu37kFXMwrS093uA1o=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-  ];
-
   meta = with lib; {
     description = "Minimal CLI client for watching/recording Twitch streams";
     homepage = "https://github.com/2bc4/twitch-hls-client.git";
diff --git a/pkgs/by-name/ty/typst-live/package.nix b/pkgs/by-name/ty/typst-live/package.nix
index 1dbb2ea22744..830ceb928b9d 100644
--- a/pkgs/by-name/ty/typst-live/package.nix
+++ b/pkgs/by-name/ty/typst-live/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchCrate,
-  stdenv,
-  darwin,
   makeWrapper,
   typst,
 }:
@@ -24,10 +22,6 @@ rustPlatform.buildRustPackage rec {
     makeWrapper
   ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.CoreServices
-  ];
-
   postInstall = ''
     wrapProgram $out/bin/typst-live \
       --suffix PATH : ${lib.makeBinPath [ typst ]}
diff --git a/pkgs/by-name/ty/typst/typst-packages-from-universe.toml b/pkgs/by-name/ty/typst/typst-packages-from-universe.toml
index fb1a54456677..46d7c4dba3e0 100644
--- a/pkgs/by-name/ty/typst/typst-packages-from-universe.toml
+++ b/pkgs/by-name/ty/typst/typst-packages-from-universe.toml
@@ -84,6 +84,18 @@ license = [
 ]
 homepage = "https://github.com/JL-ghcoder/Typst-Pre-Template"
 
+[academicv."1.1.0"]
+url = "https://packages.typst.org/preview/academicv-1.1.0.tar.gz"
+hash = "sha256-OzuK3FlqGPgFEoBz3J8zTJXfxG5qbO0oZFGVPofXqA0="
+typstDeps = [
+    "academicv_1_0_0",
+]
+description = "A clean, flexible curriculum vitae (CV) template using Typst and YAML"
+license = [
+    "Apache-2.0",
+]
+homepage = "https://github.com/roaldarbol/academicv"
+
 [academicv."1.0.0"]
 url = "https://packages.typst.org/preview/academicv-1.0.0.tar.gz"
 hash = "sha256-GHXDKGpD9JZIZbCmziNORHx4n6VjwY4R4nh8bUyGYQ4="
@@ -445,6 +457,16 @@ license = [
 ]
 homepage = "https://github.com/Robotechnic/alchemist"
 
+[alexandria."0.2.0"]
+url = "https://packages.typst.org/preview/alexandria-0.2.0.tar.gz"
+hash = "sha256-N8O9v1tD6CemqbJjX8yTMK2ZGFFASLchZSEie1v2Y3w="
+typstDeps = []
+description = "Use multiple bibliographies in a single Typst document "
+license = [
+    "MIT",
+]
+homepage = "https://github.com/SillyFreak/typst-alexandria"
+
 [alexandria."0.1.3"]
 url = "https://packages.typst.org/preview/alexandria-0.1.3.tar.gz"
 hash = "sha256-gYQFCxmSzEyhAFM70sKuTJIbS81IAS6g/Qy/DSR0irs="
@@ -910,6 +932,18 @@ license = [
 ]
 homepage = "https://github.com/typst/templates"
 
+[arborly."0.3.0"]
+url = "https://packages.typst.org/preview/arborly-0.3.0.tar.gz"
+hash = "sha256-/5uZL6VbHbNkof5ffFuqnzl1EALCaZ4wdxrYn+IjdSU="
+typstDeps = [
+    "mantys_1_0_1",
+]
+description = "A library for producing beautiful syntax tree graphs"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/pearcebasmanm/arborly"
+
 [arborly."0.2.0"]
 url = "https://packages.typst.org/preview/arborly-0.2.0.tar.gz"
 hash = "sha256-PotA4XfhbE8qPcPUgq4dtbwrGPnP1dT7i4bRqgj4SY4="
@@ -1203,6 +1237,33 @@ license = [
 ]
 homepage = "https://github.com/avonmoll/bamdone-rebuttal"
 
+[barcala."0.1.1"]
+url = "https://packages.typst.org/preview/barcala-0.1.1.tar.gz"
+hash = "sha256-CrtqR7G1X0Uert3ZILtxBn50feB6VtgyR3DoJFvDkok="
+typstDeps = [
+    "fancy-units_0_1_1",
+    "lilaq_0_2_0",
+    "physica_0_9_5",
+    "valkyrie_0_2_2",
+]
+description = "A report template for UNLP students, specially for engineering"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/JuanM04/barcala"
+
+[barcala."0.1.0"]
+url = "https://packages.typst.org/preview/barcala-0.1.0.tar.gz"
+hash = "sha256-DcG8bHqYciFELaKKXqS4/wOT9EwlWh/sihySjwBKV8I="
+typstDeps = [
+    "valkyrie_0_2_2",
+]
+description = "A report template for UNLP students, specially for engineering"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/JuanM04/barcala"
+
 [basalt-backlinks."0.1.1"]
 url = "https://packages.typst.org/preview/basalt-backlinks-0.1.1.tar.gz"
 hash = "sha256-ynoLsV664bY6MyJF5BXM3/tBXO28g3ZxW567MKg1SgY="
@@ -1275,6 +1336,18 @@ license = [
 ]
 homepage = "https://github.com/polylux-typ/basic"
 
+[basic-report."0.2.0"]
+url = "https://packages.typst.org/preview/basic-report-0.2.0.tar.gz"
+hash = "sha256-WXemvfXuIw/fBgJ9adUjcbovK797F1lPXvcKLELrs00="
+typstDeps = [
+    "hydra_0_6_0",
+]
+description = "A simple template for reports"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/roland-KA/basic-report-typst-template"
+
 [basic-report."0.1.2"]
 url = "https://packages.typst.org/preview/basic-report-0.1.2.tar.gz"
 hash = "sha256-1gyKqdnYu/T7bJahuonb/f8N3tc+w8k3eVLAWo4SmFs="
@@ -1311,6 +1384,18 @@ license = [
 ]
 homepage = "https://github.com/roland-KA/basic-report-typst-template"
 
+[basic-resume."0.2.7"]
+url = "https://packages.typst.org/preview/basic-resume-0.2.7.tar.gz"
+hash = "sha256-qKv8c853nKkPEzW04MEoa4wK0/6dm0lDG6rKU+f6OpI="
+typstDeps = [
+    "scienceicons_0_1_0",
+]
+description = "A simple, standard resume, designed to work well with ATS"
+license = [
+    "Unlicense",
+]
+homepage = "https://github.com/stuxf/basic-typst-resume-template"
+
 [basic-resume."0.2.4"]
 url = "https://packages.typst.org/preview/basic-resume-0.2.4.tar.gz"
 hash = "sha256-5j37vf3Xa3Js6uf4z8/KldWbnxfzMz6kBlQ3gWxcw/o="
@@ -1683,6 +1768,16 @@ license = [
 ]
 homepage = "https://github.com/Lypsilonx/boxr"
 
+[brain-transplant."0.1.0"]
+url = "https://packages.typst.org/preview/brain-transplant-0.1.0.tar.gz"
+hash = "sha256-8kPaIV5h/xOrwMuLSyO0uFEw8mk89+GZDB8zMMZKgJg="
+typstDeps = []
+description = "Transpile Brainfuck code to Typst"
+license = [
+    "MIT-0",
+]
+homepage = "https://app.radicle.xyz/nodes/seed.radicle.garden/rad:z3bYXx6FurPtAURke7sUV8ktrtFNt"
+
 [brilliant-cv."2.0.5"]
 url = "https://packages.typst.org/preview/brilliant-cv-2.0.5.tar.gz"
 hash = "sha256-55ldsGnrsDowYYz1mxIlcLXIna8gRteDikv6K56aXDo="
@@ -1926,6 +2021,20 @@ license = [
 ]
 homepage = "https://github.com/cu1ch3n/caidan"
 
+[callisto."0.2.2"]
+url = "https://packages.typst.org/preview/callisto-0.2.2.tar.gz"
+hash = "sha256-uX1REI/dk8FlXAE7mGGOI6IuJQh73gWNd5ZOhjrd/gw="
+typstDeps = [
+    "based_0_2_0",
+    "cmarker_0_1_3",
+    "mitex_0_2_5",
+]
+description = "Import Jupyter notebooks"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/knuesel/callisto"
+
 [callisto."0.1.0"]
 url = "https://packages.typst.org/preview/callisto-0.1.0.tar.gz"
 hash = "sha256-NFM3r0abms6sKHF5YEAm2DaxaN+Wo6UcclZviMAFTdc="
@@ -2769,6 +2878,18 @@ license = [
 ]
 homepage = "https://github.com/alexanderkoller/typst-citegeist"
 
+[cjk-unbreak."0.1.0"]
+url = "https://packages.typst.org/preview/cjk-unbreak-0.1.0.tar.gz"
+hash = "sha256-i4Rql1otEyJZW1ib987ZACP9u8fx7S8wvMlrZFvLLrI="
+typstDeps = [
+    "touying_0_6_1",
+]
+description = "Remove spaces caused by line breaks around CJK"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/KZNS/cjk-unbreak"
+
 [classic-aau-report."0.3.0"]
 url = "https://packages.typst.org/preview/classic-aau-report-0.3.0.tar.gz"
 hash = "sha256-SqWI3LPyvv5nGWeLfrMD3rLOMXer2UT2djt/iA9NlSE="
@@ -2904,6 +3025,26 @@ license = [
 ]
 homepage = "https://github.com/Gowee/typst-clatter"
 
+[clean-acmart."0.0.1"]
+url = "https://packages.typst.org/preview/clean-acmart-0.0.1.tar.gz"
+hash = "sha256-2xb7rRpMwA0FEIgZwzTUia1DoOQDU3Otc48Qc9YZe3U="
+typstDeps = []
+description = "Simple and clean Typst paper template for ACM conferences following the original acmart style"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/vtta/clean-acmart"
+
+[clean-agh-thesis."0.1.0"]
+url = "https://packages.typst.org/preview/clean-agh-thesis-0.1.0.tar.gz"
+hash = "sha256-dFhLL2pFSYtizKGoKpegQppBdFsai9TQUPJWVdFOmtQ="
+typstDeps = []
+description = "AGH-compliant thesis template"
+license = [
+    "MIT-0",
+]
+homepage = "https://github.com/matisiekpl/agh-typst"
+
 [clean-dhbw."0.2.1"]
 url = "https://packages.typst.org/preview/clean-dhbw-0.2.1.tar.gz"
 hash = "sha256-JAF0qUnqAlKzVU2g8XYrRJRDX2whTeS5rq8Jfo/upk4="
@@ -3060,6 +3201,16 @@ license = [
 ]
 homepage = "https://github.com/sebaseb98/clean-math-thesis"
 
+[clear-iclr."0.7.0"]
+url = "https://packages.typst.org/preview/clear-iclr-0.7.0.tar.gz"
+hash = "sha256-d5Jv1xtNJllFK6nC56jU6xmfMZa2tp2GvNwspDLxW6c="
+typstDeps = []
+description = "Paper template for submission to International Conference on Learning\nRepresentations (ICLR"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/daskol/typst-templates"
+
 [clear-iclr."0.4.0"]
 url = "https://packages.typst.org/preview/clear-iclr-0.4.0.tar.gz"
 hash = "sha256-hpHIcxCB5ZE8ZJITOzUYuiFEuV/Fs2UiSVhrX86r6MQ="
@@ -3070,6 +3221,26 @@ license = [
 ]
 homepage = "https://github.com/daskol/typst-templates"
 
+[cmarker."0.1.5"]
+url = "https://packages.typst.org/preview/cmarker-0.1.5.tar.gz"
+hash = "sha256-5Y9ucv5QfjvrHG8ZxypW88XjjjB8XWqxm5Y2pwFgQDA="
+typstDeps = []
+description = "Transpile CommonMark Markdown to Typst, from within Typst"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/SabrinaJewson/cmarker.typ"
+
+[cmarker."0.1.4"]
+url = "https://packages.typst.org/preview/cmarker-0.1.4.tar.gz"
+hash = "sha256-TVbvfBOivVXn9sFMswRptRhNXasTKLy3GtDFGDOhE1A="
+typstDeps = []
+description = "Transpile CommonMark Markdown to Typst, from within Typst"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/SabrinaJewson/cmarker.typ"
+
 [cmarker."0.1.3"]
 url = "https://packages.typst.org/preview/cmarker-0.1.3.tar.gz"
 hash = "sha256-0DdRW8WuX4kLZrPyWZOe7yhm77oX8IwrqrhOkbSjyKc="
@@ -3826,6 +3997,16 @@ license = [
 ]
 homepage = "https://github.com/philkleer/create-lattes-cv"
 
+[curryst."0.5.1"]
+url = "https://packages.typst.org/preview/curryst-0.5.1.tar.gz"
+hash = "sha256-aDSFHAGqdWYTQzUuwgVtDaprCsFsT+7zt28abBm4QDo="
+typstDeps = []
+description = "Typeset trees of inference rules"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/pauladam94/curryst"
+
 [curryst."0.5.0"]
 url = "https://packages.typst.org/preview/curryst-0.5.0.tar.gz"
 hash = "sha256-WBGZ8nmCrB8iihmkjzdrA7l2U3ff3TKpvQh/XAmTE8Y="
@@ -3940,6 +4121,18 @@ license = [
 ]
 homepage = "https://github.com/csimide/cuti"
 
+[cvssc."0.1.1"]
+url = "https://packages.typst.org/preview/cvssc-0.1.1.tar.gz"
+hash = "sha256-COZzBQ2MqLGKlUlXweYpkERIzC3OE4OUeKNKntQhPpg="
+typstDeps = [
+    "codly_0_1_0",
+    "tidy_0_3_0",
+]
+description = "Common Vulnerability Scoring System Calculator"
+license = [
+    "MIT",
+]
+
 [cvssc."0.1.0"]
 url = "https://packages.typst.org/preview/cvssc-0.1.0.tar.gz"
 hash = "sha256-pCeczpz4B70NefSn79TL/zFjwZG5A+W2QsYedUjvg5o="
@@ -3952,6 +4145,19 @@ license = [
     "MIT",
 ]
 
+[cyberschool-errorteaplate."0.1.4"]
+url = "https://packages.typst.org/preview/cyberschool-errorteaplate-0.1.4.tar.gz"
+hash = "sha256-BHJNjdvj53BHDhvqjkSRk0bLBUzlbYazd+ZXzgj0FSo="
+typstDeps = [
+    "codly_1_3_0",
+    "codly-languages_0_1_8",
+]
+description = "This is a template originaly made for the Cyberschool of Rennes, a Cybersecurity school"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/ErrorTeaPot/Cyberschool_template"
+
 [cyberschool-errorteaplate."0.1.3"]
 url = "https://packages.typst.org/preview/cyberschool-errorteaplate-0.1.3.tar.gz"
 hash = "sha256-k/zpxcsIv47M6YPy5eNl2YVh/RicIVJH595xbzSicqY="
@@ -4087,6 +4293,18 @@ license = [
 ]
 homepage = "https://github.com/profetia/defined"
 
+[definitely-not-isec-thesis."2.0.1"]
+url = "https://packages.typst.org/preview/definitely-not-isec-thesis-2.0.1.tar.gz"
+hash = "sha256-5mxFjH8gF1biPwEclEdRpMgth8FHBcrJWauc3PCYmIo="
+typstDeps = [
+    "definitely-not-isec-thesis_2_0_0",
+]
+description = "An unofficial ISEC TUGraz Master's Thesis template"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/ecomaikgolf/typst-isec-master-thesis-template/"
+
 [definitely-not-isec-thesis."2.0.0"]
 url = "https://packages.typst.org/preview/definitely-not-isec-thesis-2.0.0.tar.gz"
 hash = "sha256-VTdCWyOS5RCXQ0hQq+QPsn8T9vzDGv8dWLajNz89UT8="
@@ -5759,6 +5977,16 @@ license = [
 ]
 homepage = "https://github.com/duskmoon314/typst-fontawesome"
 
+[formalettre."0.1.3"]
+url = "https://packages.typst.org/preview/formalettre-0.1.3.tar.gz"
+hash = "sha256-51SXjB7Icsb0NUPvhPhmaZxa2AJF8D0DLhm5zFzH7YI="
+typstDeps = []
+description = "French formal letter template"
+license = [
+    "BSD-3-Clause",
+]
+homepage = "https://github.com/Brndan/lettre"
+
 [formalettre."0.1.2"]
 url = "https://packages.typst.org/preview/formalettre-0.1.2.tar.gz"
 hash = "sha256-pAfyUg/DQ0a8EoRPRc9rIV+URWHP8ea32R8gevkcjJQ="
@@ -5819,6 +6047,30 @@ license = [
 ]
 homepage = "https://github.com/ejbasas/fractus"
 
+[fractusist."0.3.2"]
+url = "https://packages.typst.org/preview/fractusist-0.3.2.tar.gz"
+hash = "sha256-MZLCEJq/4006XsJyf91k2WlF/zgQo2Nx0Ng1FsV4ojI="
+typstDeps = [
+    "suiji_0_3_0",
+]
+description = "Create a variety of wonderful fractals and curves in Typst"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/liuguangxi/fractusist"
+
+[fractusist."0.3.1"]
+url = "https://packages.typst.org/preview/fractusist-0.3.1.tar.gz"
+hash = "sha256-r2W2PTjgLYmBW2J8AMP6KMZC8QtJ0NfesIcEZHVNxSs="
+typstDeps = [
+    "suiji_0_3_0",
+]
+description = "Create a variety of wonderful fractals and curves in Typst"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/liuguangxi/fractusist"
+
 [fractusist."0.3.0"]
 url = "https://packages.typst.org/preview/fractusist-0.3.0.tar.gz"
 hash = "sha256-wwfAXz3v0fNXpfoAPwGrhnywurAbNRqteP5iXO2eNBY="
@@ -6167,6 +6419,18 @@ license = [
 ]
 homepage = "https://github.com/connortwiegand/game-theoryst"
 
+[gantty."0.2.0"]
+url = "https://packages.typst.org/preview/gantty-0.2.0.tar.gz"
+hash = "sha256-AFrlAvMhIeQ8yP9Oa8ID4eO9eA4jGzEGxI6BnBjHlik="
+typstDeps = [
+    "cetz_0_3_1",
+]
+description = "Create gantt charts using datetimes"
+license = [
+    "LGPL-3.0-only",
+]
+homepage = "https://gitlab.com/john_t/typst-gantty"
+
 [gantty."0.1.0"]
 url = "https://packages.typst.org/preview/gantty-0.1.0.tar.gz"
 hash = "sha256-x2Pqz9YNFGBAPludpA8EcnQ6pizeRC2kes4gK5etqSc="
@@ -7068,6 +7332,36 @@ license = [
 ]
 homepage = "https://codeberg.org/Sekoia/gviz-typst"
 
+[hagakiii."0.1.0"]
+url = "https://packages.typst.org/preview/hagakiii-0.1.0.tar.gz"
+hash = "sha256-cIJ562PgOM0flVEhS+7tyuMX+SH/2rxlifpqI5PBr+E="
+typstDeps = []
+description = "Print address labels on Japanese postcards"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/34j/typst-hagakiii"
+
+[hamnosys-includer."0.1.0"]
+url = "https://packages.typst.org/preview/hamnosys-includer-0.1.0.tar.gz"
+hash = "sha256-kLu2ci0HW9sRpop9HZ1Hd8UcBrozLcn4LDuubXrFjKM="
+typstDeps = []
+description = "For using HamNoSys in Typst"
+license = [
+    "LPPL-1.3c",
+]
+homepage = "https://github.com/TestTimothy/Typst-HamNoSys"
+
+[hand-in."1.0.0"]
+url = "https://packages.typst.org/preview/hand-in-1.0.0.tar.gz"
+hash = "sha256-c7xX5I3AImc7cWhxtLhsHa3EOx5zNAq4Tlqtn/DV5EM="
+typstDeps = []
+description = "Clean and minimalist assignment"
+license = [
+    "MIT-0",
+]
+homepage = "https://github.com/mkorje/typst-hand-in"
+
 [handy-dora."0.1.0"]
 url = "https://packages.typst.org/preview/handy-dora-0.1.0.tar.gz"
 hash = "sha256-3cDtmhJjp2GgBMQGUyUrd8hq6SQ9ggKD7vsR9e1OUvQ="
@@ -7537,6 +7831,18 @@ license = [
 ]
 homepage = "https://github.com/hei-templates/hei-synd-thesis"
 
+[herodot."0.1.0"]
+url = "https://packages.typst.org/preview/herodot-0.1.0.tar.gz"
+hash = "sha256-hZItUzNJe3TNxMjk2JiN7+wuI5AhGwUdx8p8HOUMnUI="
+typstDeps = [
+    "cetz_0_3_4",
+]
+description = "A package for making linear timelines, inspired by chronology"
+license = [
+    "GPL-3.0-only",
+]
+homepage = "https://github.com/gnist-dev/herodot"
+
 [hhn-unitylab-thesis-template."0.0.1"]
 url = "https://packages.typst.org/preview/hhn-unitylab-thesis-template-0.0.1.tar.gz"
 hash = "sha256-nUUMm1vlguTyfcHyMZ3MwzFCwCRxtFo3VLiDYyUegYE="
@@ -7608,6 +7914,26 @@ license = [
 ]
 homepage = "https://github.com/HTL3R-Typst/htl3r-da"
 
+[htlwienwest-da."0.3.3"]
+url = "https://packages.typst.org/preview/htlwienwest-da-0.3.3.tar.gz"
+hash = "sha256-MFvkmwBGhKRC1308oznAnKWAT1fKuo0l00hmHw/Vljk="
+typstDeps = []
+description = "The diploma thesis template for students of the HTL Wien West"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/htlwienwest/da-vorlage-typst"
+
+[htlwienwest-da."0.3.2"]
+url = "https://packages.typst.org/preview/htlwienwest-da-0.3.2.tar.gz"
+hash = "sha256-OAVoHBYuLe9zT3wWOgNBYTX2id/Y1ap7lKDweLgkyV4="
+typstDeps = []
+description = "The diploma thesis template for students of the HTL Wien West"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/htlwienwest/da-vorlage-typst"
+
 [htlwienwest-da."0.2.1"]
 url = "https://packages.typst.org/preview/htlwienwest-da-0.2.1.tar.gz"
 hash = "sha256-3nU774Aby7wrhNgCm8H4cOdc6cj1OD+2o8DMr7rqknE="
@@ -7981,6 +8307,34 @@ license = [
 ]
 homepage = "https://github.com/Fricsion/typst-template_ieee-style-single-column"
 
+[ijimai."0.0.4"]
+url = "https://packages.typst.org/preview/ijimai-0.0.4.tar.gz"
+hash = "sha256-TMGEcCP27e0mLbDZdsOBT0kpYdL+5rnbvr38Z2cjJIg="
+typstDeps = [
+    "datify_0_1_3",
+    "droplet_0_3_1",
+    "wrap-it_0_1_1",
+]
+description = "Template for writing articles for the International Journal of Interactive Multimedia and Artificial Intelligence (IJIMAI"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/pammacdotnet/IJIMAI"
+
+[ijimai."0.0.3"]
+url = "https://packages.typst.org/preview/ijimai-0.0.3.tar.gz"
+hash = "sha256-xZmU8c/CXwHwCv2QuU83YhOiZ6nuADn5smSMhigjQPo="
+typstDeps = [
+    "datify_0_1_3",
+    "droplet_0_3_1",
+    "wrap-it_0_1_1",
+]
+description = "Template for writing articles for the International Journal of Interactive Multimedia and Artificial Intelligence (IJIMAI"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/pammacdotnet/IJIMAI"
+
 [ijimai."0.0.2"]
 url = "https://packages.typst.org/preview/ijimai-0.0.2.tar.gz"
 hash = "sha256-Uf+PQdL6RsBiKdkbWg+msGLwpkbwiBvBUnzk0MQow3M="
@@ -8009,6 +8363,19 @@ license = [
 ]
 homepage = "https://github.com/pammacdotnet/IJIMAI"
 
+[illc-mol-thesis."0.2.0"]
+url = "https://packages.typst.org/preview/illc-mol-thesis-0.2.0.tar.gz"
+hash = "sha256-aQisDHYRzCywWs1ayT5nRFO64F2bBPUJJgANhEGZSsk="
+typstDeps = [
+    "great-theorems_0_1_2",
+    "rich-counters_0_2_2",
+]
+description = "Official Typst thesis template for Master of Logic students at the ILLC"
+license = [
+    "AGPL-3.0-or-later",
+]
+homepage = "https://codeberg.org/foxy/illc-mol-thesis"
+
 [illc-mol-thesis."0.1.2"]
 url = "https://packages.typst.org/preview/illc-mol-thesis-0.1.2.tar.gz"
 hash = "sha256-9WBdTt4Mw+XrOzJ1F1QhT8dWB/g+XwLsUf+EaSFwJUE="
@@ -8482,6 +8849,16 @@ license = [
 ]
 homepage = "https://github.com/ISC-HEI/ISC-report"
 
+[its-scripted."0.1.0"]
+url = "https://packages.typst.org/preview/its-scripted-0.1.0.tar.gz"
+hash = "sha256-Q7zPoW9hjAoirl2xb5sG2/tY3ornofX1hq6B6OIQBHo="
+typstDeps = []
+description = "A template for writing movie/tv/theater-scripts in screenplay format"
+license = [
+    "LGPL-3.0-only",
+]
+homepage = "https://github.com/danielFHcode/typst-screenplay"
+
 [jaconf-mscs."0.1.0"]
 url = "https://packages.typst.org/preview/jaconf-mscs-0.1.0.tar.gz"
 hash = "sha256-Vvp2RFqMP2/Uho0VrA4ZE3DXJuj3cy5cPRaxv280x1o="
@@ -8628,6 +9005,24 @@ license = [
     "MIT",
 ]
 
+[juti."0.0.2"]
+url = "https://packages.typst.org/preview/juti-0.0.2.tar.gz"
+hash = "sha256-BcluOxlfOmvwCMGY1tnoLMOGpGw2FK+K4O9VbmAXDIc="
+typstDeps = []
+description = "Template for writing articles for JUTI: Jurnal Ilmiah Teknologi Informasi"
+license = [
+    "MIT",
+]
+
+[juti."0.0.1"]
+url = "https://packages.typst.org/preview/juti-0.0.1.tar.gz"
+hash = "sha256-vUaHThW8boRmGh6g8xnTJpyAJD6oDMI9HEq9vtSbzcY="
+typstDeps = []
+description = "Template for writing articles for JUTI: Jurnal Ilmiah Teknologi Informasi"
+license = [
+    "MIT",
+]
+
 [k-mapper."1.2.0"]
 url = "https://packages.typst.org/preview/k-mapper-1.2.0.tar.gz"
 hash = "sha256-iJj/FMGu/4DAz6yqrUZ62WeFxhXVxszkVyqeS0NOnDg="
@@ -9116,6 +9511,26 @@ license = [
 ]
 homepage = "https://github.com/Marmare314/lemmify"
 
+[leonux."1.1.0"]
+url = "https://packages.typst.org/preview/leonux-1.1.0.tar.gz"
+hash = "sha256-+kzhNhI9CeQ297PYDQ3L+BQLxZnwc/oJafNyapBY/yU="
+typstDeps = []
+description = "Minimalistic Typst slides (similar to LaTeX beamer"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/LordBlacky/leonux"
+
+[leonux."1.0.0"]
+url = "https://packages.typst.org/preview/leonux-1.0.0.tar.gz"
+hash = "sha256-r9W+jllahfpEiHMTMHQ5zMMU7LPtfdnwVnYvMWqtpaY="
+typstDeps = []
+description = "Minimalistic Typst slides (similar to LaTeX beamer"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/LordBlacky/leonux"
+
 [letter-pro."3.0.0"]
 url = "https://packages.typst.org/preview/letter-pro-3.0.0.tar.gz"
 hash = "sha256-Ow22loLjb/wiiB3iSmdZirbtfDR2XIveWgFcnWctBtI="
@@ -9393,6 +9808,44 @@ license = [
 ]
 homepage = "https://github.com/Enter-tainer/m-jaxon"
 
+[machiatto."0.1.0"]
+url = "https://packages.typst.org/preview/machiatto-0.1.0.tar.gz"
+hash = "sha256-s0fYYTMIuHrHnTqBwa132FiMi5ge0ZGezEOa6t67LCI="
+typstDeps = [
+    "minitoc_0_1_0",
+]
+description = "A package to help develop publications under MoKa Reads Specification"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/Moka-Reads/machiatto"
+
+[magnifying-glass."0.1.0"]
+url = "https://packages.typst.org/preview/magnifying-glass-0.1.0.tar.gz"
+hash = "sha256-K4NjY2JJKSijf8UVL7ujT0F2DghmV4Xu7jE9/Bzhb1s="
+typstDeps = []
+description = "Magnify part of image or content"
+license = [
+    "AGPL-3.0-only",
+]
+homepage = "https://codeberg.org/Andrew15-5/magnifying-glass"
+
+[mannot."0.3.0"]
+url = "https://packages.typst.org/preview/mannot-0.3.0.tar.gz"
+hash = "sha256-akdMPerbH8WpVQ1OACR9HOceZunKGTkj6jfh7s6ChFA="
+typstDeps = [
+    "cetz_0_3_4",
+    "codly_1_2_0",
+    "tidy_0_4_0",
+    "tidy_0_4_2",
+    "tiptoe_0_3_0",
+]
+description = "A package for marking and annotating in math blocks"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/ryuryu-ymj/mannot"
+
 [mannot."0.2.3"]
 url = "https://packages.typst.org/preview/mannot-0.2.3.tar.gz"
 hash = "sha256-FByqhbapg8hXEr2F+LsIz9chdNXLHoiOaotB6JxT+jE="
@@ -9571,6 +10024,16 @@ license = [
 ]
 homepage = "https://github.com/EpicEricEE/typst-marge"
 
+[marginalia."0.1.4"]
+url = "https://packages.typst.org/preview/marginalia-0.1.4.tar.gz"
+hash = "sha256-Z58a+K5+mGxBaRTbI6Z+e034nfJSjW4FV2tXjHqc1gk="
+typstDeps = []
+description = "Configurable margin-notes and matching wide blocks"
+license = [
+    "Unlicense",
+]
+homepage = "https://github.com/nleanba/typst-marginalia"
+
 [marginalia."0.1.3"]
 url = "https://packages.typst.org/preview/marginalia-0.1.3.tar.gz"
 hash = "sha256-c93UkMnYriR+vakF2O2r+yy1NtH6yAQAk1x/1KQER1g="
@@ -9669,6 +10132,18 @@ license = [
 ]
 homepage = "https://github.com/sxdl/MCM-Typst-template"
 
+[mechanical-system-cetz-34j."0.1.0"]
+url = "https://packages.typst.org/preview/mechanical-system-cetz-34j-0.1.0.tar.gz"
+hash = "sha256-PPoQ0Gy6Xh19JPPnL2uyGhVomZbOHOOUCFJDp/U/cTc="
+typstDeps = [
+    "cetz_0_3_0",
+]
+description = "CeTZ library for drawing mechanical systems"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/34j/typst-cetz-mechanical-system"
+
 [mephistypsteles."0.3.0"]
 url = "https://packages.typst.org/preview/mephistypsteles-0.3.0.tar.gz"
 hash = "sha256-/XWM4SMGT+ZUAEb0QCNxNp8JkHqGInjwY3/zXWrQkls="
@@ -9731,6 +10206,39 @@ license = [
 ]
 homepage = "https://github.com/CL4R3T/meppp"
 
+[messeji."0.3.0"]
+url = "https://packages.typst.org/preview/messeji-0.3.0.tar.gz"
+hash = "sha256-vqIQjUdm4KvrDNTr5SnWqzVwSkG/dRVvQy/0W6o0P/g="
+typstDeps = [
+    "codly_1_3_0",
+    "tidy_0_4_2",
+]
+description = "Typeset multi-page chat histories, including from external JSON files"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/Tanikai/messeji"
+
+[messeji."0.2.0"]
+url = "https://packages.typst.org/preview/messeji-0.2.0.tar.gz"
+hash = "sha256-ObsJGFyE7RTc6QBr/Vrvf4bwxfs2qGEcAceAxOpHlaM="
+typstDeps = []
+description = "Typeset multi-page chat histories, including from external JSON files"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/Tanikai/messeji"
+
+[messeji."0.1.0"]
+url = "https://packages.typst.org/preview/messeji-0.1.0.tar.gz"
+hash = "sha256-Aq217WNVh5jq7qrrP6xpcu5hXrPm4zQrHhL4Xugy01o="
+typstDeps = []
+description = "Typeset multi-page chat histories, with JSON support"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/Tanikai/messeji"
+
 [metalogo."1.2.0"]
 url = "https://packages.typst.org/preview/metalogo-1.2.0.tar.gz"
 hash = "sha256-BY9rUnWqGp2LvKOscA8DIYSuLuBb4zDwgd/rpe/jIFs="
@@ -10318,6 +10826,22 @@ license = [
 ]
 homepage = "https://github.com/EuanTop/modern-bnu-course-paper"
 
+[modern-bnu-thesis."0.0.2"]
+url = "https://packages.typst.org/preview/modern-bnu-thesis-0.0.2.tar.gz"
+hash = "sha256-pMg00ozQH/SRCyd/BR94OMd7lmg701RG5BGUTMXbvNY="
+typstDeps = [
+    "algo_0_3_6",
+    "cuti_0_3_0",
+    "i-figured_0_2_4",
+    "pinit_0_2_2",
+    "tablex_0_0_9",
+]
+description = "北京师范大学学位论文模板。Modern Beijing Normal University Thesis"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/mosrat/modern-bnu-thesis"
+
 [modern-bnu-thesis."0.0.1"]
 url = "https://packages.typst.org/preview/modern-bnu-thesis-0.0.1.tar.gz"
 hash = "sha256-Zw7INRq6oBSgl7ip/e6SlUgqrAvgwzTmbW0ODOQBFOU="
@@ -10671,6 +11195,42 @@ license = [
 ]
 homepage = "https://github.com/typst-g7-32/modern-g7-32"
 
+[modern-hsh-thesis."1.1.1"]
+url = "https://packages.typst.org/preview/modern-hsh-thesis-1.1.1.tar.gz"
+hash = "sha256-X7gt1MdV8F+vArCrPDwMfLlA3ZndNgo0tOXJo7OV/8M="
+typstDeps = [
+    "big-todo_0_2_0",
+    "codly_1_3_0",
+    "gentle-clues_1_2_0",
+    "gloss-awe_0_0_5",
+    "hydra_0_6_0",
+    "treet_0_1_1",
+    "wrap-it_0_1_1",
+]
+description = "Template for writing a bachelors or masters thesis at the Hochschule Hannover, Faculty 4"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/MrToWy/hsh-thesis"
+
+[modern-hsh-thesis."1.1.0"]
+url = "https://packages.typst.org/preview/modern-hsh-thesis-1.1.0.tar.gz"
+hash = "sha256-A+DECSPBeSUhEXlDGCL7xBWrQ83NGD5Xy0rAaa7TNJk="
+typstDeps = [
+    "big-todo_0_2_0",
+    "codly_1_3_0",
+    "gentle-clues_1_2_0",
+    "gloss-awe_0_0_5",
+    "hydra_0_6_0",
+    "treet_0_1_1",
+    "wrap-it_0_1_1",
+]
+description = "Template for writing a bachelors or masters thesis at the Hochschule Hannover, Faculty 4"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/MrToWy/hsh-thesis"
+
 [modern-hsh-thesis."1.0.2"]
 url = "https://packages.typst.org/preview/modern-hsh-thesis-1.0.2.tar.gz"
 hash = "sha256-RXQYwYaz/mAXMuDX7DS+Wpr8Op6x6nF2G0KB88HCauM="
@@ -10908,6 +11468,36 @@ license = [
 ]
 homepage = "https://github.com/SergeyGorchakov/russian-phd-thesis-template-typst"
 
+[modern-shu-thesis."0.3.3"]
+url = "https://packages.typst.org/preview/modern-shu-thesis-0.3.3.tar.gz"
+hash = "sha256-DgolzfJo0xU5W9dofKZt2wjOJJgke8CsIsa0/74Iv/s="
+typstDeps = [
+    "cuti_0_3_0",
+    "i-figured_0_2_4",
+    "lovelace_0_2_0",
+    "numbly_0_1_0",
+]
+description = "上海大学本科毕业论文模板"
+license = [
+    "Apache-2.0",
+]
+homepage = "https://github.com/XY-cpp/typst-shu-thesis"
+
+[modern-shu-thesis."0.3.2"]
+url = "https://packages.typst.org/preview/modern-shu-thesis-0.3.2.tar.gz"
+hash = "sha256-BSo6yklzgBm5DuJtrhaSbnVKRKO8lVUviSA1oB6rAs8="
+typstDeps = [
+    "cuti_0_3_0",
+    "i-figured_0_2_4",
+    "lovelace_0_2_0",
+    "numbly_0_1_0",
+]
+description = "上海大学本科毕业论文模板"
+license = [
+    "Apache-2.0",
+]
+homepage = "https://github.com/XY-cpp/typst-shu-thesis"
+
 [modern-shu-thesis."0.3.1"]
 url = "https://packages.typst.org/preview/modern-shu-thesis-0.3.1.tar.gz"
 hash = "sha256-25P4yWiDyB1aKjaYjfSeZzJZr7RUuDacp87HQ0zQU/Y="
@@ -10981,6 +11571,21 @@ license = [
 ]
 homepage = "https://github.com/XY-cpp/typst-shu-thesis"
 
+[modern-sjtu-thesis."0.2.2"]
+url = "https://packages.typst.org/preview/modern-sjtu-thesis-0.2.2.tar.gz"
+hash = "sha256-B3FDybHWM5G2cKeBQefMExVcYf4b2yc/gff5GfcWc6M="
+typstDeps = [
+    "a2c-nums_0_0_1",
+    "cuti_0_3_0",
+    "i-figured_0_2_4",
+    "numbly_0_1_0",
+]
+description = "上海交通大学学位论文 Typst 模板。Shanghai Jiao Tong University Thesis Typst Template"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/tzhTaylor/modern-sjtu-thesis"
+
 [modern-sjtu-thesis."0.2.1"]
 url = "https://packages.typst.org/preview/modern-sjtu-thesis-0.2.1.tar.gz"
 hash = "sha256-OTr8YH7Z3ORoj8tsDgk/+0n76lromICUkY1RklChWTk="
@@ -11866,6 +12471,19 @@ license = [
 ]
 homepage = "https://github.com/jonaspleyer/nordic-typst"
 
+[not-jku-thesis."0.2.0"]
+url = "https://packages.typst.org/preview/not-jku-thesis-0.2.0.tar.gz"
+hash = "sha256-73PcYUmXirUoOD2ya89J0GqI/lZtt9Z3FXcRqAqnwDk="
+typstDeps = [
+    "cheq_0_1_0",
+    "glossarium_0_5_4",
+    "wrap-it_0_1_1",
+]
+description = "Customizable not official template for a thesis at the JKU, derived from a template created by Fabian Scherer <https://www.linkedin.com/in/fabian-scherer-de/> with Leon Weber in an advisory role"
+license = [
+    "MIT-0",
+]
+
 [not-jku-thesis."0.1.0"]
 url = "https://packages.typst.org/preview/not-jku-thesis-0.1.0.tar.gz"
 hash = "sha256-CdIyVXvRx0S7kNPPf/3cWpRICwnHOHB8QhtcSuLDPDQ="
@@ -12153,6 +12771,32 @@ license = [
     "MIT",
 ]
 
+[nup."0.1.1"]
+url = "https://packages.typst.org/preview/nup-0.1.1.tar.gz"
+hash = "sha256-UEG7L4KtOcMsILjhcNDZPrzrjFMDqYLTMWQQnjLmNWM="
+typstDeps = [
+    "muchpdf_0_1_0",
+    "shadowed_0_2_0",
+]
+description = "Preview multipage documents with a defined grid layout"
+license = [
+    "MPL-2.0",
+]
+homepage = "https://github.com/baptiste/nup"
+
+[nup."0.1.0"]
+url = "https://packages.typst.org/preview/nup-0.1.0.tar.gz"
+hash = "sha256-vTeP+zoShfjDuXpXZ5HYyYouQrX+8XvUMgXz+a1bgik="
+typstDeps = [
+    "muchpdf_0_1_0",
+    "shadowed_0_2_0",
+]
+description = "Preview multipage documents with a defined grid layout"
+license = [
+    "MPL-2.0",
+]
+homepage = "https://github.com/baptiste/nup"
+
 [oasis-align."0.2.0"]
 url = "https://packages.typst.org/preview/oasis-align-0.2.0.tar.gz"
 hash = "sha256-XB8YyrcSP3+jHSik+aE8JybL8Pncju/2MKW3MC85TTA="
@@ -12269,6 +12913,16 @@ license = [
 ]
 homepage = "https://github.com/v411e/optimal-ovgu-thesis"
 
+[orange-book."0.6.1"]
+url = "https://packages.typst.org/preview/orange-book-0.6.1.tar.gz"
+hash = "sha256-D2WQwAS6ftls8vN2YGDvbqbXh7NC+SUqfGHzvACt4To="
+typstDeps = []
+description = "A book template inspired by The Legrand Orange Book of Mathias Legrand and Vel"
+license = [
+    "MIT-0",
+]
+homepage = "https://github.com/flavio20002/typst-orange-template"
+
 [orange-book."0.6.0"]
 url = "https://packages.typst.org/preview/orange-book-0.6.0.tar.gz"
 hash = "sha256-ZAuCUReYMujh/T7h2A7zEZER1R66IUcVbfCgnSq89Sg="
@@ -12531,6 +13185,19 @@ license = [
 ]
 homepage = "https://github.com/TJ-CSCCG/tongji-undergrad-thesis-typst.git"
 
+[parcio-thesis."0.2.2"]
+url = "https://packages.typst.org/preview/parcio-thesis-0.2.2.tar.gz"
+hash = "sha256-xcHPtq+d6hpGlMfP74XK5mokzp+lFtFDgEC2FPBu1FI="
+typstDeps = [
+    "drafting_0_2_2",
+    "subpar_0_2_2",
+]
+description = "A simple thesis template based on the ParCIO working group at OvGU Magdeburg"
+license = [
+    "0BSD",
+]
+homepage = "https://github.com/xkevio/parcio-typst/"
+
 [parcio-thesis."0.2.1"]
 url = "https://packages.typst.org/preview/parcio-thesis-0.2.1.tar.gz"
 hash = "sha256-XDh2M16Hlg6EOl9ATbxnEEqrSX1G2RzymYB+gQPB5TU="
@@ -12602,6 +13269,16 @@ license = [
 ]
 homepage = "https://github.com/QuadnucYard/pavemat"
 
+[peace-of-posters."0.5.5"]
+url = "https://packages.typst.org/preview/peace-of-posters-0.5.5.tar.gz"
+hash = "sha256-oLMQpulSwmXj7cqW+7t1ABFR2+dUGLg8PaIj+/9DIlc="
+typstDeps = []
+description = "Create scientific posters in Typst"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/jonaspleyer/peace-of-posters"
+
 [peace-of-posters."0.5.4"]
 url = "https://packages.typst.org/preview/peace-of-posters-0.5.4.tar.gz"
 hash = "sha256-fgOOhaLSCT1wW3lM1hPXlkbOM2FKWvonJWIgsh037O8="
@@ -12822,6 +13499,26 @@ license = [
 ]
 homepage = "https://github.com/Leedehai/typst-physics"
 
+[pigmentpedia."0.3.3"]
+url = "https://packages.typst.org/preview/pigmentpedia-0.3.3.tar.gz"
+hash = "sha256-xPFb9o+dHTfWvV0Hs1wuhcTniZH6SnsC0zPSwDcPayo="
+typstDeps = []
+description = "An extensive color library for Typst"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/neuralpain/pigmentpedia"
+
+[pigmentpedia."0.3.2"]
+url = "https://packages.typst.org/preview/pigmentpedia-0.3.2.tar.gz"
+hash = "sha256-j8XCfUwUF+r72tMZmEAy+hNS9yMdIWD3NlNRQ/GIFLs="
+typstDeps = []
+description = "An extensive color library for Typst"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/neuralpain/pigmentpedia"
+
 [pigmentpedia."0.3.1"]
 url = "https://packages.typst.org/preview/pigmentpedia-0.3.1.tar.gz"
 hash = "sha256-/U6/zsw3Vb/JGgsc9lgKeZ1UYnnSv8cZWUtC4wFciyc="
@@ -12852,6 +13549,18 @@ license = [
 ]
 homepage = "https://github.com/neuralpain/pigmentpedia"
 
+[pillar."0.3.2"]
+url = "https://packages.typst.org/preview/pillar-0.3.2.tar.gz"
+hash = "sha256-2Wriav61AfMHQhvwAauKKsR13aR+9x45FK/JTSGIFOg="
+typstDeps = [
+    "zero_0_3_3",
+]
+description = "Faster column specifications for tables"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/Mc-Zen/pillar"
+
 [pillar."0.3.1"]
 url = "https://packages.typst.org/preview/pillar-0.3.1.tar.gz"
 hash = "sha256-gi7l0nhNtVIFl6iHdmXD1/Rj4C4iGAS95qnjGmz+ZGg="
@@ -13241,6 +13950,18 @@ license = [
     "MIT",
 ]
 
+[project-isi-zac."0.1.0"]
+url = "https://packages.typst.org/preview/project-isi-zac-0.1.0.tar.gz"
+hash = "sha256-aBndG/X2kGLDR3A48g4B3RGvSAvYbBzpx0XBwxdEZ28="
+typstDeps = [
+    "hydra_0_6_1",
+]
+description = "A template for writing reports and thesis"
+license = [
+    "MIT-0",
+]
+homepage = "https://github.com/Jac-Zac/project-isi-zac.git"
+
 [prooftrees."0.1.0"]
 url = "https://packages.typst.org/preview/prooftrees-0.1.0.tar.gz"
 hash = "sha256-zhnOWUavOqMh3/s8CPIyw5uoX8QslITQJ81zL6WuTaI="
@@ -13265,6 +13986,18 @@ license = [
 ]
 homepage = "https://github.com/sdiebolt/psl-thesis"
 
+[pubmatter."0.2.1"]
+url = "https://packages.typst.org/preview/pubmatter-0.2.1.tar.gz"
+hash = "sha256-PuuXzQfKFtL+MYsftUaDnaQBK5LOo6EtcMzpkae0XgE="
+typstDeps = [
+    "scienceicons_0_0_6",
+]
+description = "Parse, normalize and show publication frontmatter, including authors and affiliations"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/continuous-foundation/pubmatter"
+
 [pubmatter."0.2.0"]
 url = "https://packages.typst.org/preview/pubmatter-0.2.0.tar.gz"
 hash = "sha256-1/6vhrb4PKzTxNQhGqsiCGgbYFt3lFgoa9v07NFnQPo="
@@ -13319,6 +14052,87 @@ license = [
 ]
 homepage = "https://github.com/ludwig-austermann/qcm"
 
+[qec-thrust."0.1.0"]
+url = "https://packages.typst.org/preview/qec-thrust-0.1.0.tar.gz"
+hash = "sha256-0Qofs0kXArco7PDC3iRU1Nnjm1hngYcA4tqxj/a1spo="
+typstDeps = [
+    "cetz_0_3_4",
+]
+description = "A package for drawing quantum error correction codes with Typst"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/nzy1997/qec-thrust"
+
+[qooklet."0.2.0"]
+url = "https://packages.typst.org/preview/qooklet-0.2.0.tar.gz"
+hash = "sha256-Xm7VotkOaceLlLhnXad2CpK1mXFw1pohkGz/KE2cu/I="
+typstDeps = [
+    "codly_1_3_0",
+    "codly-languages_0_1_8",
+    "ctheorems_1_1_3",
+    "fletcher_0_5_7",
+    "gentle-clues_1_2_0",
+    "hydra_0_6_1",
+    "linguify_0_4_2",
+    "physica_0_9_5",
+    "pinit_0_2_2",
+    "rexllent_0_3_0",
+    "subpar_0_2_2",
+    "wrap-it_0_1_1",
+]
+description = "A quick start template for scientific booklets"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/ivaquero/qooklet.git"
+
+[qooklet."0.1.1"]
+url = "https://packages.typst.org/preview/qooklet-0.1.1.tar.gz"
+hash = "sha256-tPewnWaTQW53UZMIWiKYrOYi31CPneUMM8VnNExhuqE="
+typstDeps = [
+    "codly_1_3_0",
+    "codly-languages_0_1_8",
+    "ctheorems_1_1_3",
+    "fletcher_0_5_7",
+    "gentle-clues_1_2_0",
+    "hydra_0_6_1",
+    "linguify_0_4_2",
+    "physica_0_9_5",
+    "pinit_0_2_2",
+    "rexllent_0_3_0",
+    "subpar_0_2_2",
+    "wrap-it_0_1_1",
+]
+description = "A quick start utility for scientific booklets"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/ivaquero/qooklet.git"
+
+[qooklet."0.1.0"]
+url = "https://packages.typst.org/preview/qooklet-0.1.0.tar.gz"
+hash = "sha256-QFOc21AbDMtoYvAwgNKQCoO9PkBhTHdELyHlm9jSddg="
+typstDeps = [
+    "codly_1_3_0",
+    "codly-languages_0_1_8",
+    "ctheorems_1_1_3",
+    "fletcher_0_5_7",
+    "gentle-clues_1_2_0",
+    "hydra_0_6_1",
+    "linguify_0_4_2",
+    "physica_0_9_5",
+    "pinit_0_2_2",
+    "rexllent_0_3_0",
+    "subpar_0_2_2",
+    "wrap-it_0_1_1",
+]
+description = "A quick start utility for scientific booklets"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/ivaquero/qooklet.git"
+
 [quetta."0.2.0"]
 url = "https://packages.typst.org/preview/quetta-0.2.0.tar.gz"
 hash = "sha256-VOTfREPGxLOnzmZV21+A+D59u1aAahyB2iJm0dNlhF8="
@@ -13665,6 +14479,16 @@ license = [
 ]
 homepage = "https://github.com/fky2015/resume-ng-typst"
 
+[rexllent."0.3.1"]
+url = "https://packages.typst.org/preview/rexllent-0.3.1.tar.gz"
+hash = "sha256-wV8Y6ZGp9jNuHBI0S4nB0KoYlD8G6oMcTmQMjDRqx08="
+typstDeps = []
+description = "Parsing xlsx file into a typst table, powered by wasm"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/hongjr03/typst-rexllent"
+
 [rexllent."0.3.0"]
 url = "https://packages.typst.org/preview/rexllent-0.3.0.tar.gz"
 hash = "sha256-xG91tiCiPZ9lItlzyyg4pXB5uqtV2tioO+RLtHb5K+w="
@@ -13865,6 +14689,32 @@ license = [
 ]
 homepage = "https://github.com/rose-pine/typst"
 
+[rubber-article."0.4.0"]
+url = "https://packages.typst.org/preview/rubber-article-0.4.0.tar.gz"
+hash = "sha256-W46qCE7HDZP24FlojvjiHu6Epxz5JEdJn43kbeVIjVE="
+typstDeps = [
+    "hydra_0_6_1",
+    "pillar_0_3_1",
+]
+description = "A simple template recreating the look of the classic LaTeX article"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/npikall/rubber-article.git"
+
+[rubber-article."0.3.2"]
+url = "https://packages.typst.org/preview/rubber-article-0.3.2.tar.gz"
+hash = "sha256-31Vnkz0ii8KxgCvdnzUjMqFHp0RLF8M6dfI4T5UHlGQ="
+typstDeps = [
+    "hydra_0_6_1",
+    "pillar_0_3_1",
+]
+description = "A simple template recreating the look of the classic LaTeX article"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/npikall/rubber-article.git"
+
 [rubber-article."0.3.1"]
 url = "https://packages.typst.org/preview/rubber-article-0.3.1.tar.gz"
 hash = "sha256-B+/lqmX27ndp/8IBGa74Y3Mnj3q9Gy6D4ywOYHvBByo="
@@ -14016,6 +14866,16 @@ license = [
 ]
 homepage = "https://github.com/sudanchapagain/sano-presentation-template"
 
+[scaffolder."0.2.1"]
+url = "https://packages.typst.org/preview/scaffolder-0.2.1.tar.gz"
+hash = "sha256-C1/wct+NAtulHWopZsztNcAUpX/0+opIknzehNLSKRs="
+typstDeps = []
+description = "Show borders around the main text area, header and footer in Typst documents"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/wisp3rwind/typst-scaffolder"
+
 [scaffolder."0.2.0"]
 url = "https://packages.typst.org/preview/scaffolder-0.2.0.tar.gz"
 hash = "sha256-iMOIGDtLE/7GDV29+efx9EX6emZ9R2y9AumEajMb7jk="
@@ -14076,6 +14936,16 @@ license = [
 ]
 homepage = "https://github.com/augustebaum/epfl-thesis-typst"
 
+[scholarly-tauthesis."0.11.2"]
+url = "https://packages.typst.org/preview/scholarly-tauthesis-0.11.2.tar.gz"
+hash = "sha256-bpRIcwvCbyemi5NSl5lHUh6yddUzFW0WozSBvTYdleA="
+typstDeps = []
+description = "A template for writing Tampere University theses"
+license = [
+    "MIT",
+]
+homepage = "https://gitlab.com/tuni-official/thesis-templates/tau-typst-thesis-template"
+
 [scholarly-tauthesis."0.11.0"]
 url = "https://packages.typst.org/preview/scholarly-tauthesis-0.11.0.tar.gz"
 hash = "sha256-lcmQOo6gRrNpeknvK9HvHbvGTxQc7v45CQJBZyMtn+k="
@@ -14176,6 +15046,16 @@ license = [
 ]
 homepage = "https://gitlab.com/tuni-official/thesis-templates/tau-typst-thesis-template"
 
+[scienceicons."0.1.0"]
+url = "https://packages.typst.org/preview/scienceicons-0.1.0.tar.gz"
+hash = "sha256-xbqURYis+fBX0Wozcv8Ld0CAZv0zH05pYqylJhSmYjQ="
+typstDeps = []
+description = "SVG icons for open-science articles"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/continuous-foundation/scienceicons"
+
 [scienceicons."0.0.6"]
 url = "https://packages.typst.org/preview/scienceicons-0.0.6.tar.gz"
 hash = "sha256-n3GMd9uPpqK2G5aD4+g8D5Egm/OwgGQ2yrZVgeD+lNM="
@@ -14262,6 +15142,41 @@ license = [
 ]
 homepage = "https://github.com/Dregen-Yor/sdu-exp-report"
 
+[sdu-touying-simpl."0.3.0"]
+url = "https://packages.typst.org/preview/sdu-touying-simpl-0.3.0.tar.gz"
+hash = "sha256-m3FzWgM6/45k9dapyJMUVAii3f7a93SDfRcjLxNppy0="
+typstDeps = [
+    "codly_1_3_0",
+    "codly-languages_0_1_8",
+    "fletcher_0_5_7",
+    "showybox_2_0_4",
+    "timeliney_0_2_1",
+    "touying_0_6_1",
+]
+description = "An templete based on touying, "
+license = [
+    "GPL-3.0-only",
+]
+homepage = "https://github.com/Dregen-Yor/sdu-touying-simpl"
+
+[sdu-touying-simpl."0.2.2"]
+url = "https://packages.typst.org/preview/sdu-touying-simpl-0.2.2.tar.gz"
+hash = "sha256-Fa6IS+3xj8Sz8dxV+AP5hUxEUn0kfQhFwCbw0OKKxFg="
+typstDeps = [
+    "codly_1_3_0",
+    "ctheorems_1_1_3",
+    "fletcher_0_5_7",
+    "gentle-clues_1_2_0",
+    "showybox_2_0_4",
+    "timeliney_0_2_0",
+    "touying_0_6_1",
+]
+description = "An templete based on touying, "
+license = [
+    "GPL-3.0-only",
+]
+homepage = "https://github.com/Dregen-Yor/sdu-touying-simpl"
+
 [sdu-touying-simpl."0.2.1"]
 url = "https://packages.typst.org/preview/sdu-touying-simpl-0.2.1.tar.gz"
 hash = "sha256-OcF+mGfjzr3icGXjL3kJsWvWcT9Th5mmfcu0VpSCQdc="
@@ -14412,6 +15327,16 @@ license = [
 ]
 homepage = "https://github.com/shaneworld/HHU-Thesis-Template"
 
+[shiroa."0.2.3"]
+url = "https://packages.typst.org/preview/shiroa-0.2.3.tar.gz"
+hash = "sha256-Yb2tdrqI1j/hZDV0gBctZssJaj3b7qqVVfCQ6BhG5uY="
+typstDeps = []
+description = "A simple tool for creating modern online books in pure typst"
+license = [
+    "Apache-2.0",
+]
+homepage = "https://github.com/Myriad-Dreamin/shiroa"
+
 [shiroa."0.2.2"]
 url = "https://packages.typst.org/preview/shiroa-0.2.2.tar.gz"
 hash = "sha256-fBC4alolwFH+92J3ph1UqXxIO/GutiC6puNS9lMwBRs="
@@ -14613,6 +15538,46 @@ license = [
     "MIT",
 ]
 
+[shuosc-shu-bachelor-thesis."0.1.2"]
+url = "https://packages.typst.org/preview/shuosc-shu-bachelor-thesis-0.1.2.tar.gz"
+hash = "sha256-JxZ8ID9XQX9knDDIBVSrHre3PGXVZGJ1qSdkuM9ID9k="
+typstDeps = [
+    "cuti_0_3_0",
+    "i-figured_0_2_4",
+    "lovelace_0_2_0",
+    "numbly_0_1_0",
+]
+description = "上海大学本科生毕业论文 Typst 模板 - 上海大学开源社区版 (SHUOSC"
+license = [
+    "Apache-2.0",
+]
+homepage = "https://github.com/shuosc/SHU-Bachelor-Thesis-Typst"
+
+[shuosc-shu-bachelor-thesis."0.1.1"]
+url = "https://packages.typst.org/preview/shuosc-shu-bachelor-thesis-0.1.1.tar.gz"
+hash = "sha256-yLT54a9Bxh0llQvzWrz7ZIDuJZB7PUGvHo201ANoGTc="
+typstDeps = [
+    "cuti_0_3_0",
+    "i-figured_0_2_4",
+    "lovelace_0_2_0",
+    "numbly_0_1_0",
+]
+description = "上海大学本科生毕业论文 Typst 模板 - 上海大学开源社区版 (SHUOSC"
+license = [
+    "Apache-2.0",
+]
+homepage = "https://github.com/shuosc/SHU-Bachelor-Thesis-Typst"
+
+[shuxuejuan."0.1.2"]
+url = "https://packages.typst.org/preview/shuxuejuan-0.1.2.tar.gz"
+hash = "sha256-oLT87kWugcdSIUGHlM89j+j15BcXA0PK+Yl3VJWrs3s="
+typstDeps = []
+description = "A simple Typst template for math exam in Chinese"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/VWWVVW/shuxuejuan"
+
 [shuxuejuan."0.1.1"]
 url = "https://packages.typst.org/preview/shuxuejuan-0.1.1.tar.gz"
 hash = "sha256-srMnXvFwGS/BvnQc+7ts0GGJMzKW42BnZkc8CWvvf8E="
@@ -14693,6 +15658,16 @@ license = [
 ]
 homepage = "https://github.com/SkytAsul/INSA-Typst-Template"
 
+[silky-report-insa."0.5.0"]
+url = "https://packages.typst.org/preview/silky-report-insa-0.5.0.tar.gz"
+hash = "sha256-MCwrH+qsAML2U/KwWsnw7nFGlJbGgIq3nprlOnAGTDo="
+typstDeps = []
+description = "A template made for reports and other documents of INSA, a French engineering school"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/SkytAsul/INSA-Typst-Template"
+
 [silky-report-insa."0.4.0"]
 url = "https://packages.typst.org/preview/silky-report-insa-0.4.0.tar.gz"
 hash = "sha256-Pcsnm1nYr1xTKZ8x0vRQDn8oqy2HvbEGa7Rf1eZbETg="
@@ -14804,6 +15779,16 @@ license = [
     "MIT",
 ]
 
+[simple-bupt-report."0.1.0"]
+url = "https://packages.typst.org/preview/simple-bupt-report-0.1.0.tar.gz"
+hash = "sha256-GeL1I2NCqZItRhfDPHI1u0aXJtTGnaYmFzouZ0fIIvk="
+typstDeps = []
+description = "一份简单的北邮实验报告模板 Simple BUPT Report"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/zhao-leo/BUPT-Report-Typst"
+
 [simple-preavis."0.1.0"]
 url = "https://packages.typst.org/preview/simple-preavis-0.1.0.tar.gz"
 hash = "sha256-x5dtbcF3MGGGkGjAYSLHphn7XcrCnmRsf1g27aAq3vI="
@@ -14824,6 +15809,26 @@ license = [
 ]
 homepage = "https://github.com/steadyfall/simple-technical-resume-template"
 
+[simple-tubs-letter."0.1.1"]
+url = "https://packages.typst.org/preview/simple-tubs-letter-0.1.1.tar.gz"
+hash = "sha256-rmfej0OOGXNDntzUN3N/WsJ4h6A/TISccg0KI9P/JpI="
+typstDeps = []
+description = "A letter template resembling the TUBS coorperate design"
+license = [
+    "GPL-3.0-only",
+]
+homepage = "https://github.com/Cangarw/simple-tubs-letter"
+
+[simple-tubs-letter."0.1.0"]
+url = "https://packages.typst.org/preview/simple-tubs-letter-0.1.0.tar.gz"
+hash = "sha256-Jq9eSrmAFuYwwXAv5BMElIMngdy8WkoqZgbbw8SFHEA="
+typstDeps = []
+description = "A letter template resembling the TUBS coorperate design"
+license = [
+    "GPL-3.0-only",
+]
+homepage = "https://github.com/Cangarw/simple-tubs-letter"
+
 [simplebnf."0.1.1"]
 url = "https://packages.typst.org/preview/simplebnf-0.1.1.tar.gz"
 hash = "sha256-dGCrPJW/E4rRKwO8Q+M0g1+zuC5N58Y5nrp1l4Q/9W8="
@@ -14969,6 +15974,30 @@ license = [
 ]
 homepage = "https://github.com/daskol/typst-templates"
 
+[sns-polylux-template."0.1.0"]
+url = "https://packages.typst.org/preview/sns-polylux-template-0.1.0.tar.gz"
+hash = "sha256-TZ1xokDMAoajLEj2xgG8z74I+iyi9QAKdul62SUnpUo="
+typstDeps = [
+    "polylux_0_4_0",
+]
+description = "Unofficial template for slides in Polylux with SNS and UniPi colors"
+license = [
+    "MIT-0",
+]
+homepage = "https://gitlab.com/martino.barbieri/polylux-sns-template"
+
+[socialhub-fa."1.0.1"]
+url = "https://packages.typst.org/preview/socialhub-fa-1.0.1.tar.gz"
+hash = "sha256-PKN4zsbdZ1/YRFUrEiadzvlT1zUmUZZGdu+t3XNb3fM="
+typstDeps = [
+    "fontawesome_0_1_0",
+]
+description = "A Typst library for Social Media references with icons based on Font Awesome"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/Bi0T1N/typst-socialhub-fa"
+
 [socialhub-fa."1.0.0"]
 url = "https://packages.typst.org/preview/socialhub-fa-1.0.0.tar.gz"
 hash = "sha256-peWWI/ULorfjvD7I8+rh9jm9MIrI/p+8y/kaH9MKM3k="
@@ -15070,6 +16099,16 @@ license = [
 ]
 homepage = "https://github.com/YouXam/soviet-matrix"
 
+[splash."0.5.0"]
+url = "https://packages.typst.org/preview/splash-0.5.0.tar.gz"
+hash = "sha256-gqujm+2U5ufCNeSzBzLtdzCNcg/fMx7Si2jOdavc4y4="
+typstDeps = []
+description = "A library of color palettes for Typst"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/kaarmu/typst-palettes"
+
 [splash."0.4.0"]
 url = "https://packages.typst.org/preview/splash-0.4.0.tar.gz"
 hash = "sha256-NEEj4XVL18RRz96kqkUQW/aJ0p937PieIKQEgcpkP1k="
@@ -15210,6 +16249,26 @@ license = [
 ]
 homepage = "https://github.com/SillyFreak/typst-stack-pointer"
 
+[starter-journal-article."0.4.0"]
+url = "https://packages.typst.org/preview/starter-journal-article-0.4.0.tar.gz"
+hash = "sha256-e4Be7W7KlECKwqXtSt7iLeBzmzbTuoQJZvz/v4r6rwQ="
+typstDeps = []
+description = "A starter template for journal articles"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/HPDell/typst-starter-journal-article"
+
+[starter-journal-article."0.3.3"]
+url = "https://packages.typst.org/preview/starter-journal-article-0.3.3.tar.gz"
+hash = "sha256-7f8Lqvra9Hnfa7xyZGZbF7pFEQOA41bKg/FA3DxJ1v4="
+typstDeps = []
+description = "A starter template for journal articles"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/HPDell/typst-starter-journal-article"
+
 [starter-journal-article."0.3.2"]
 url = "https://packages.typst.org/preview/starter-journal-article-0.3.2.tar.gz"
 hash = "sha256-zIv5xE2rmkTPQOvUVd7/S8aVgBg27+yKaiGx250PNgo="
@@ -15464,6 +16523,18 @@ license = [
 ]
 homepage = "https://github.com/tingerrr/subpar"
 
+[suiji."0.4.0"]
+url = "https://packages.typst.org/preview/suiji-0.4.0.tar.gz"
+hash = "sha256-NG34Nbcxyq2OoK3wKBv88in0GNV6JK8mmCj9WBAY4bQ="
+typstDeps = [
+    "cetz_0_3_4",
+]
+description = "A high efficient random number generator in Typst"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/liuguangxi/suiji"
+
 [suiji."0.3.0"]
 url = "https://packages.typst.org/preview/suiji-0.3.0.tar.gz"
 hash = "sha256-Fu5fl35phzkx7cWezobq1pB17YyQVGdZ31XDJDdI5EY="
@@ -15584,6 +16655,16 @@ license = [
     "MIT",
 ]
 
+[superb-pci."0.2.0"]
+url = "https://packages.typst.org/preview/superb-pci-0.2.0.tar.gz"
+hash = "sha256-0xp+Cl2+yW9V6599VhP2NGWBKZhgMblFmcKqcNR41oc="
+typstDeps = []
+description = "A Peer Community In (PCI) and Peer Community Journal (PCJ) template"
+license = [
+    "MIT-0",
+]
+homepage = "https://codeberg.org/alxsim/superb-pci"
+
 [superb-pci."0.1.0"]
 url = "https://packages.typst.org/preview/superb-pci-0.1.0.tar.gz"
 hash = "sha256-nU4NQ+ZC2E3HBcK0GDR+TskJ4fBipsKCKTTWShttfQU="
@@ -16189,6 +17270,58 @@ license = [
 ]
 homepage = "https://github.com/7ijme/tally"
 
+[tapestry."0.0.4"]
+url = "https://packages.typst.org/preview/tapestry-0.0.4.tar.gz"
+hash = "sha256-T84c9SHNZMHAmqZuVw2VB3S5JCbfOiv3cD0UUOZGBBI="
+typstDeps = [
+    "cetz_0_3_4",
+    "cetz-plot_0_1_1",
+    "equate_0_3_1",
+    "physica_0_9_5",
+]
+description = "A template for creating LaTeX-like class notes"
+license = [
+    "MIT-0",
+]
+homepage = "https://github.com/BrandenXia/tapestry"
+
+[tapestry."0.0.3"]
+url = "https://packages.typst.org/preview/tapestry-0.0.3.tar.gz"
+hash = "sha256-j+I5k5O/4bUTEH8kI8+uaC9qXlaaipCAyY1kdQMop7k="
+typstDeps = [
+    "cetz_0_3_4",
+    "cetz-plot_0_1_1",
+    "equate_0_3_1",
+    "physica_0_9_5",
+]
+description = "A template for creating LaTeX-like class notes"
+license = [
+    "MIT-0",
+]
+homepage = "https://github.com/BrandenXia/tapestry"
+
+[tapestry."0.0.2"]
+url = "https://packages.typst.org/preview/tapestry-0.0.2.tar.gz"
+hash = "sha256-50m7fT1xli8ER/CiCkWVN1EPEO7EJIPsw/r6rKMEcKU="
+typstDeps = [
+    "equate_0_3_1",
+    "physica_0_9_5",
+]
+description = "A template for creating LaTeX-like class notes"
+license = [
+    "MIT-0",
+]
+homepage = "https://github.com/BrandenXia/tapestry"
+
+[tapestry."0.0.1"]
+url = "https://packages.typst.org/preview/tapestry-0.0.1.tar.gz"
+hash = "sha256-/UafNzzyhCV0EzwgLSxE3IWEEHgmD/MOF6Ye703m80Y="
+typstDeps = []
+description = "A template for creating LaTeX-like class notes"
+license = [
+    "MIT-0",
+]
+
 [tasteful-pairings."0.1.0"]
 url = "https://packages.typst.org/preview/tasteful-pairings-0.1.0.tar.gz"
 hash = "sha256-j68y3BmvDWBFKt5XdOHJxu3lAR5XX5PD0Tw6JXIdXSk="
@@ -16311,6 +17444,29 @@ license = [
 ]
 homepage = "https://github.com/chillcicada/typst-dotenv"
 
+[text-dirr."1.0.0"]
+url = "https://packages.typst.org/preview/text-dirr-1.0.0.tar.gz"
+hash = "sha256-qn4cfK9i1f8ClTsrA0CM5+KLsEPVCUqgDEVUIQm4iqk="
+typstDeps = []
+description = "Get resolved value for text.dir"
+license = [
+    "AGPL-3.0-only",
+]
+homepage = "https://codeberg.org/Andrew15-5/text-dirr"
+
+[tfguf."0.0.2"]
+url = "https://packages.typst.org/preview/tfguf-0.0.2.tar.gz"
+hash = "sha256-RSOTvYAxsRXzBH9vfW/9jIIk8KAMjBsmZNJe4mQQXMA="
+typstDeps = [
+    "physica_0_9_5",
+    "unify_0_7_1",
+]
+description = "Plantilla para hacer TFGs en el Grado en Física de UNIR"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/pammacdotnet/TFGUF"
+
 [tfguf."0.0.1"]
 url = "https://packages.typst.org/preview/tfguf-0.0.1.tar.gz"
 hash = "sha256-57aMGzmncJSV0LSiEcv9alhSZ95j7BDaF99Sek71lNk="
@@ -16337,6 +17493,20 @@ license = [
 ]
 homepage = "https://github.com/TGM-HIT/typst-protocol"
 
+[tgm-hit-thesis."0.3.1"]
+url = "https://packages.typst.org/preview/tgm-hit-thesis-0.3.1.tar.gz"
+hash = "sha256-9lHo3QhUG7AnjwhRBf+NLBJb9PmHvzsh9XOCgCo49TM="
+typstDeps = [
+    "alexandria_0_1_3",
+    "glossarium_0_5_2",
+    "linguify_0_4_2",
+]
+description = "Diploma thesis template for students of the HIT department at TGM Wien"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/TGM-HIT/typst-diploma-thesis"
+
 [tgm-hit-thesis."0.3.0"]
 url = "https://packages.typst.org/preview/tgm-hit-thesis-0.3.0.tar.gz"
 hash = "sha256-grS8PHu4lkietTBdZAZd60f72VpGUwtbOUlRQqunK6Q="
@@ -16626,6 +17796,16 @@ license = [
 ]
 homepage = "https://github.com/Enter-tainer/zint-wasi"
 
+[tidy."0.4.3"]
+url = "https://packages.typst.org/preview/tidy-0.4.3.tar.gz"
+hash = "sha256-3F4nBSvietpAevp+EgZIFoLfv4GRMLjSyGD+7RCYjjg="
+typstDeps = []
+description = "Documentation generator for Typst code in Typst"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/Mc-Zen/tidy"
+
 [tidy."0.4.2"]
 url = "https://packages.typst.org/preview/tidy-0.4.2.tar.gz"
 hash = "sha256-ZeHCBZWwe7G+tAfoyEzlCGQJFECMhUbiJzKRRKusF4E="
@@ -16684,6 +17864,28 @@ license = [
     "MIT",
 ]
 
+[tiefletter."0.1.1"]
+url = "https://packages.typst.org/preview/tiefletter-0.1.1.tar.gz"
+hash = "sha256-536tEljAru3xi7OaK53ehX3WeK5cdHyQkuwfQEeD580="
+typstDeps = [
+    "tiaoma_0_3_0",
+]
+description = "Invoice and offer template for Austrian freelancers"
+license = [
+    "MIT",
+]
+
+[tiefletter."0.1.0"]
+url = "https://packages.typst.org/preview/tiefletter-0.1.0.tar.gz"
+hash = "sha256-g+hC7DtT5CNf3PSTldttvSK2s2ocRnZboWhVYVmgAY4="
+typstDeps = [
+    "tiaoma_0_3_0",
+]
+description = "Invoice and offer template for Austrian freelancers"
+license = [
+    "MIT",
+]
+
 [tierpist."0.1.0"]
 url = "https://packages.typst.org/preview/tierpist-0.1.0.tar.gz"
 hash = "sha256-p9EUIa5z1f22OlPbJtdUojsnE3Kb2BDAwivkh3himQg="
@@ -16696,6 +17898,19 @@ license = [
 ]
 homepage = "https://github.com/bastienvoirin/tierpist"
 
+[timeliney."0.2.1"]
+url = "https://packages.typst.org/preview/timeliney-0.2.1.tar.gz"
+hash = "sha256-c4aWt4hEhtFN5s9zhh7kg3bBRA+6KBkO8doadd0lOi4="
+typstDeps = [
+    "cetz_0_3_2",
+    "mantys_0_1_4",
+]
+description = "Create Gantt charts in Typst"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/pta2002/typst-timeliney"
+
 [timeliney."0.2.0"]
 url = "https://packages.typst.org/preview/timeliney-0.2.0.tar.gz"
 hash = "sha256-1dQFae+mGAsCRHDWBd2saFgzYRI427Ltx6WPCLU2/pM="
@@ -16803,6 +18018,20 @@ license = [
     "MIT",
 ]
 
+[tntt."0.1.0"]
+url = "https://packages.typst.org/preview/tntt-0.1.0.tar.gz"
+hash = "sha256-f4NgrD5/fI4EQmBiYDgxFn1DqZPyvVgSgaTm3jgmmmU="
+typstDeps = [
+    "cuti_0_3_0",
+    "i-figured_0_2_4",
+    "tablex_0_0_9",
+]
+description = "Tntt is Not a Tex Thesis Template for Tsinghua university"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/chillcicada/tntt"
+
 [touying."0.6.1"]
 url = "https://packages.typst.org/preview/touying-0.6.1.tar.gz"
 hash = "sha256-AutRIIoJa75hrDTQVyoVAxajm1nmkypFLwYkmAyp39A="
@@ -17272,9 +18501,26 @@ license = [
 ]
 homepage = "https://github.com/RaVincentHuang/touying-dids"
 
+[touying-flow."1.2.0"]
+url = "https://packages.typst.org/preview/touying-flow-1.2.0.tar.gz"
+hash = "sha256-rSMg6h0ouBSgHfyy6/3j8+1MNLkjYXNE3NKcWntYGjM="
+typstDeps = [
+    "codly_1_3_0",
+    "cuti_0_3_0",
+    "lovelace_0_3_0",
+    "mitex_0_2_5",
+    "numbly_0_1_0",
+    "touying_0_6_1",
+]
+description = "Enhancing the audience's immersion and foster a deeper state of flow"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/Quaternijkon/touying-flow"
+
 [touying-flow."1.1.0"]
 url = "https://packages.typst.org/preview/touying-flow-1.1.0.tar.gz"
-hash = "sha256-KuAAoTh9fbfg+IZagElq10yPce387wsja78SXr0ZqKA="
+hash = "sha256-Hf4pRkP66FVXhTGh9eIxXW/1RqRL/X6/STVXvQeIanE="
 typstDeps = [
     "codly_1_0_0",
     "cuti_0_2_1",
@@ -17374,6 +18620,59 @@ license = [
 ]
 homepage = "https://github.com/kazuyanagimoto/quarto-clean-typst"
 
+[touying-quick."0.1.0"]
+url = "https://packages.typst.org/preview/touying-quick-0.1.0.tar.gz"
+hash = "sha256-BRYPSevmKHiy9rX6VG+yRlvbPuwoc7oy0owQdW3P3gk="
+typstDeps = [
+    "codly_1_3_0",
+    "codly-languages_0_1_8",
+    "ctheorems_1_1_3",
+    "fletcher_0_5_7",
+    "gentle-clues_1_2_0",
+    "linguify_0_4_2",
+    "physica_0_9_5",
+    "pinit_0_2_2",
+    "rexllent_0_3_0",
+    "subpar_0_2_2",
+    "touying_0_6_0",
+]
+description = "A quick-start template based on touying for academic reports"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/ivaquero/touying-quick.git"
+
+[touying-simpl-cau."0.2.0"]
+url = "https://packages.typst.org/preview/touying-simpl-cau-0.2.0.tar.gz"
+hash = "sha256-ZNqxrRPAa27RzF5Ib6u9PRAizftPqH2o8ar+NZ6yWAQ="
+typstDeps = [
+    "cetz_0_3_4",
+    "fletcher_0_5_7",
+    "numbly_0_1_0",
+    "touying_0_6_1",
+]
+description = "Touying Slide Theme for China Agricultural University"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/maxchang3/touying-simpl-cau"
+
+[touying-simpl-cau."0.1.0"]
+url = "https://packages.typst.org/preview/touying-simpl-cau-0.1.0.tar.gz"
+hash = "sha256-PzAfpKvVPs8pweoP8QwrVI58wWB+QNZ1efkDASKJqDM="
+typstDeps = [
+    "cetz_0_3_2",
+    "fletcher_0_5_5",
+    "numbly_0_1_0",
+    "touying_0_6_0",
+    "touying_0_6_1",
+]
+description = "Touying Slide Theme for China Agricultural University"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/maxchang3/touying-simpl-cau"
+
 [touying-simpl-hkustgz."0.1.1"]
 url = "https://packages.typst.org/preview/touying-simpl-hkustgz-0.1.1.tar.gz"
 hash = "sha256-hPzAv/zrLYdniHhKcXhiw4NqivEzu/MH0NO7utaIv/Q="
@@ -18465,6 +19764,18 @@ license = [
 ]
 homepage = "https://github.com/chosertech/HIT-Thesis-Typst"
 
+[unofficial-cityuhk-thesis."0.1.0"]
+url = "https://packages.typst.org/preview/unofficial-cityuhk-thesis-0.1.0.tar.gz"
+hash = "sha256-wC73F94RMGrq2iKnCTMJfhZkKctHQOiJf1KAT5DjUR4="
+typstDeps = [
+    "hydra_0_6_1",
+]
+description = "The unofficial thesis template for City University of Hong Kong"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/bowentan/unofficial-cityuhk-thesis"
+
 [unofficial-fhict-document-template."1.1.3"]
 url = "https://packages.typst.org/preview/unofficial-fhict-document-template-1.1.3.tar.gz"
 hash = "sha256-QMVNRywcGXL/YcD47I0HSPZiRcW6XT5SwGDvgHwR9es="
@@ -18644,6 +19955,37 @@ license = [
 ]
 homepage = "https://github.com/AnsgarLichter/unofficial-hka-thesis"
 
+[unofficial-sdu-thesis."0.2.2"]
+url = "https://packages.typst.org/preview/unofficial-sdu-thesis-0.2.2.tar.gz"
+hash = "sha256-PZBMLtJmY51CEKARfPcOdasT/4DnRjsBoFeabFWlopM="
+typstDeps = [
+    "cuti_0_3_0",
+    "i-figured_0_2_4",
+    "lovelace_0_2_0",
+    "numbly_0_1_0",
+    "unofficial-sdu-thesis_0_2_1",
+]
+description = "山东大学本科毕业论文（设计）模板"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/GrooveWJH/unofficial-sdu-thesis"
+
+[unofficial-sdu-thesis."0.2.1"]
+url = "https://packages.typst.org/preview/unofficial-sdu-thesis-0.2.1.tar.gz"
+hash = "sha256-dRMEQ4PtyFkOhpWyhy+X9XHdhFdH/3s67r/2khFsAc8="
+typstDeps = [
+    "cuti_0_3_0",
+    "i-figured_0_2_4",
+    "lovelace_0_2_0",
+    "numbly_0_1_0",
+]
+description = "山东大学本科毕业论文（设计）模板"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/GrooveWJH/unofficial-sdu-thesis"
+
 [unofficial-sdu-thesis."0.2.0"]
 url = "https://packages.typst.org/preview/unofficial-sdu-thesis-0.2.0.tar.gz"
 hash = "sha256-O/l47Jrk+ChI0JC7VVGLxTL250OTs4L24OlYtZeCei4="
@@ -18741,6 +20083,18 @@ license = [
 ]
 homepage = "https://github.com/dl-li/uo-Tsinghua-Thesis-Typst-Template"
 
+[upb-cn-templates."0.1.0"]
+url = "https://packages.typst.org/preview/upb-cn-templates-0.1.0.tar.gz"
+hash = "sha256-aY7EfOJN2CHoEURr65IuJwkReXF+bHJnfD9ei9bdLJE="
+typstDeps = [
+    "timeliney_0_2_0",
+]
+description = "Templates for seminar reports and thesis proposals at the Computer Networks Group of Paderborn University"
+license = [
+    "MIT-0",
+]
+homepage = "https://github.com/upb-cn/student-templates-typst"
+
 [upb-corporate-design-slides."0.1.2"]
 url = "https://packages.typst.org/preview/upb-corporate-design-slides-0.1.2.tar.gz"
 hash = "sha256-X93El+L4GAiDM9BwiVU8l48MpIAXsWPC4A7z3DTY2ng="
@@ -18897,6 +20251,42 @@ license = [
 ]
 homepage = "https://github.com/zyf722/typst-tabler-icons"
 
+[utype-neuies-reports."1.2.0"]
+url = "https://packages.typst.org/preview/utype-neuies-reports-1.2.0.tar.gz"
+hash = "sha256-zvz+mkwc2vgai0+LWbLD+j9/RNGW2iGph0qgZTrVV0M="
+typstDeps = [
+    "linguify_0_4_2",
+]
+description = "NEÜ Eğitim Bilimleri Enstitüsü için RESMÎ OLMAYAN tez önerisi, tez ve dönem projesi şablonudur. [UNOFFICIAL thesis proposal, thesis and term project template for NEU Institute of Educational Sciences"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/ertugruluyar-github/utype-neuies-reports"
+
+[utype-neuies-reports."1.1.0"]
+url = "https://packages.typst.org/preview/utype-neuies-reports-1.1.0.tar.gz"
+hash = "sha256-YPlUrEwSdm/xqtN0q4SXIZ+whrl7EmyTIzulowYJOIo="
+typstDeps = [
+    "linguify_0_4_2",
+]
+description = "NEÜ Eğitim Bilimleri Enstitüsü için RESMÎ OLMAYAN tez önerisi, tez ve dönem projesi şablonudur. [UNOFFICIAL thesis proposal, thesis and term project template for NEU Institute of Educational Sciences"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/ertugruluyar-github/utype-neuies-reports"
+
+[utype-neuies-reports."1.0.0"]
+url = "https://packages.typst.org/preview/utype-neuies-reports-1.0.0.tar.gz"
+hash = "sha256-NkL09w2FJq7orkefTPZ+74Ud/twqIrOBq9FtZdlsN48="
+typstDeps = [
+    "linguify_0_4_2",
+]
+description = "NEÜ Eğitim Bilimleri Enstitüsü için RESMÎ OLMAYAN tez önerisi, tez ve dönem projesi şablonudur. [UNOFFICIAL thesis proposal, thesis and term project template for NEU Institute of Educational Sciences"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/ertugruluyar-github/utype-neuies-reports"
+
 [valkyrie."0.2.2"]
 url = "https://packages.typst.org/preview/valkyrie-0.2.2.tar.gz"
 hash = "sha256-9FTVR2mbrCMIrsraUrx8m8U1OwMKzIlvK9ule3cQHLk="
@@ -18959,6 +20349,18 @@ license = [
 ]
 homepage = "https://github.com/sardorml/vantage-typst"
 
+[vartable."0.2.0"]
+url = "https://packages.typst.org/preview/vartable-0.2.0.tar.gz"
+hash = "sha256-nPJw1lKOeCWb03tm4l5MBn8Se7nW8PGt4ELD/9wB+iE="
+typstDeps = [
+    "cetz_0_3_4",
+]
+description = "A simple package to make variation table"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/Le-foucheur/Typst-VarTable"
+
 [vartable."0.1.2"]
 url = "https://packages.typst.org/preview/vartable-0.1.2.tar.gz"
 hash = "sha256-qdxhy9af6K4ez9UUd9sYrHR38DbCHG/D1besutjxOHE="
@@ -18995,6 +20397,16 @@ license = [
 ]
 homepage = "https://github.com/Le-foucheur/Typst-VarTable"
 
+[vercanard."1.0.3"]
+url = "https://packages.typst.org/preview/vercanard-1.0.3.tar.gz"
+hash = "sha256-yuElpbHPgUVznja91n020BA6dNoZh5Jj7vKqxx1kLFg="
+typstDeps = []
+description = "A colorful CV template"
+license = [
+    "GPL-3.0-only",
+]
+homepage = "https://github.com/elegaanz/vercanard"
+
 [vercanard."1.0.2"]
 url = "https://packages.typst.org/preview/vercanard-1.0.2.tar.gz"
 hash = "sha256-OlUnjAHq46bqpMcrfpoZs2dFMwoxydonb5nUSrMWkIA="
@@ -19027,6 +20439,16 @@ license = [
 ]
 homepage = "https://github.com/elegaanz/vercanard"
 
+[versatile-apa."7.1.2"]
+url = "https://packages.typst.org/preview/versatile-apa-7.1.2.tar.gz"
+hash = "sha256-g0w9jFsBSyeCjVWGp4/Tu++4VQ5KqRWZt6v8zpDh5k8="
+typstDeps = []
+description = "Comprehensive APA 7th Edition Style Template for Typst, suitable for both student and professional papers"
+license = [
+    "MIT-0",
+]
+homepage = "https://github.com/jassielof/typst-templates"
+
 [versatile-apa."7.1.1"]
 url = "https://packages.typst.org/preview/versatile-apa-7.1.1.tar.gz"
 hash = "sha256-KNgC1hrSLA8mtBdvnow26pZ+WuZTa0P+3vBwBUZWpsc="
@@ -19143,6 +20565,18 @@ license = [
 ]
 homepage = "https://github.com/vonsim/typst-package"
 
+[wavy."0.1.3"]
+url = "https://packages.typst.org/preview/wavy-0.1.3.tar.gz"
+hash = "sha256-iLh9y+2tL8G2RKQ7thYYfa9wyKWZR543JoIMbzqo2tA="
+typstDeps = [
+    "jogs_0_2_4",
+]
+description = "Draw digital timing diagram in Typst using Wavedrom"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/Enter-tainer/wavy"
+
 [wavy."0.1.1"]
 url = "https://packages.typst.org/preview/wavy-0.1.1.tar.gz"
 hash = "sha256-2/ZoPog8rL0/+yAx81NzVv4r0NmJ5Ox/rvmj7XYyatE="
@@ -19485,6 +20919,50 @@ license = [
 ]
 homepage = "https://github.com/visika/yuan-resume"
 
+[zebraw."0.5.4"]
+url = "https://packages.typst.org/preview/zebraw-0.5.4.tar.gz"
+hash = "sha256-mekAjJe/VoNJ9aHbOpogkEi6QKXV9W7ya+vzkiJFado="
+typstDeps = []
+description = "A lightweight and fast package for displaying code blocks with line numbers or highlighting"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/hongjr03/typst-zebraw"
+
+[zebraw."0.5.3"]
+url = "https://packages.typst.org/preview/zebraw-0.5.3.tar.gz"
+hash = "sha256-ZQAp9iWU/YDdmp9yahnA3Thy9Hv39M5+AYZ7N0l0F4w="
+typstDeps = [
+    "zebraw_0_5_2",
+]
+description = "A lightweight and fast package for displaying code blocks with line numbers or highlighting"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/hongjr03/typst-zebraw"
+
+[zebraw."0.5.2"]
+url = "https://packages.typst.org/preview/zebraw-0.5.2.tar.gz"
+hash = "sha256-4gGEiicfY4Eby8sxHdOwxs7Bh9YUtnZwqlkSTYyvCA4="
+typstDeps = []
+description = "A lightweight and fast package for displaying code blocks with line numbers or highlighting"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/hongjr03/typst-zebraw"
+
+[zebraw."0.5.1"]
+url = "https://packages.typst.org/preview/zebraw-0.5.1.tar.gz"
+hash = "sha256-yDdpAR4F+TbuCSn5bBVTDNX3BDKGH5F55eSaMNJcQz8="
+typstDeps = [
+    "tidy_0_4_2",
+]
+description = "A lightweight and fast package for displaying code blocks with line numbers or highlighting"
+license = [
+    "MIT",
+]
+homepage = "https://github.com/hongjr03/typst-zebraw"
+
 [zebraw."0.5.0"]
 url = "https://packages.typst.org/preview/zebraw-0.5.0.tar.gz"
 hash = "sha256-qR8rph7/nBgtI1m1TZ4GdCFOOBPPIu3P6BecBCp8r8o="
diff --git a/pkgs/by-name/ud/udict/package.nix b/pkgs/by-name/ud/udict/package.nix
index 881c7b8cb9ba..472834744c5d 100644
--- a/pkgs/by-name/ud/udict/package.nix
+++ b/pkgs/by-name/ud/udict/package.nix
@@ -1,11 +1,9 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitHub,
   pkg-config,
   openssl,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -30,14 +28,9 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.CoreFoundation
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = [
+    openssl
+  ];
 
   meta = with lib; {
     description = "Urban Dictionary CLI - written in Rust";
diff --git a/pkgs/by-name/ut/util-linux/package.nix b/pkgs/by-name/ut/util-linux/package.nix
index c71abfeeca7d..eef5a90698c7 100644
--- a/pkgs/by-name/ut/util-linux/package.nix
+++ b/pkgs/by-name/ut/util-linux/package.nix
@@ -3,6 +3,8 @@
   stdenv,
   fetchurl,
   pkg-config,
+  autoconf,
+  automake116x,
   zlib,
   shadow,
   capabilitiesSupport ? stdenv.hostPlatform.isLinux,
@@ -34,18 +36,26 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "util-linux" + lib.optionalString isMinimal "-minimal";
-  version = "2.40.4";
+  version = "2.41";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/util-linux/v${lib.versions.majorMinor version}/util-linux-${version}.tar.xz";
-    hash = "sha256-XB2vczsE6YWa/cO9h8xIEYDuD4i1wJRrFv3skxl1+3k=";
+    hash = "sha256-ge6Ts8/f6318QJDO3rode7zpFB/QtQG2hrP+R13cpMY=";
   };
 
-  patches = [
-    ./rtcwake-search-PATH-for-shutdown.patch
-    # https://github.com/util-linux/util-linux/pull/3013
-    ./fix-darwin-build.patch
-  ];
+  patches =
+    [
+      ./rtcwake-search-PATH-for-shutdown.patch
+      # https://github.com/util-linux/util-linux/pull/3013
+      ./fix-darwin-build.patch
+    ]
+    ++ lib.optionals (!stdenv.hostPlatform.isLinux) [
+      (fetchurl {
+        name = "bits-only-build-when-cpu_set_t-is-available.patch";
+        url = "https://lore.kernel.org/util-linux/20250501075806.88759-1-hi@alyssa.is/raw";
+        hash = "sha256-G7Cdv8636wJEjgt9am7PaDI8bpSF8sO9bFWEIiAL25A=";
+      })
+    ];
 
   # We separate some of the utilities into their own outputs. This
   # allows putting together smaller systems depending on only part of
@@ -67,7 +77,7 @@ stdenv.mkDerivation rec {
 
   postPatch =
     ''
-      patchShebangs tests/run.sh tools/all_syscalls
+      patchShebangs tests/run.sh tools/all_syscalls tools/all_errnos
 
       substituteInPlace sys-utils/eject.c \
         --replace "/bin/umount" "$bin/bin/umount"
@@ -107,6 +117,7 @@ stdenv.mkDerivation rec {
       (lib.withFeature systemdSupport "systemd")
       (lib.withFeatureAs systemdSupport "systemdsystemunitdir" "${placeholder "bin"}/lib/systemd/system/")
       (lib.withFeatureAs systemdSupport "tmpfilesdir" "${placeholder "out"}/lib/tmpfiles.d")
+      (lib.withFeatureAs systemdSupport "sysusersdir" "${placeholder "out"}/lib/sysusers.d")
       (lib.enableFeature translateManpages "poman")
       "SYSCONFSTATICDIR=${placeholder "lib"}/lib"
     ]
@@ -137,6 +148,10 @@ stdenv.mkDerivation rec {
       pkg-config
       installShellFiles
     ]
+    ++ lib.optionals (!stdenv.hostPlatform.isLinux) [
+      autoconf
+      automake116x
+    ]
     ++ lib.optionals translateManpages [ po4a ]
     ++ lib.optionals (cryptsetupSupport == "dlopen") [ cryptsetup ];
 
diff --git a/pkgs/by-name/va/vale-ls/package.nix b/pkgs/by-name/va/vale-ls/package.nix
index 056008249f69..1643a90ce1b5 100644
--- a/pkgs/by-name/va/vale-ls/package.nix
+++ b/pkgs/by-name/va/vale-ls/package.nix
@@ -6,7 +6,6 @@
   rustPlatform,
   pkg-config,
   openssl,
-  darwin,
   vale,
 }:
 
@@ -27,16 +26,9 @@ rustPlatform.buildRustPackage rec {
     makeWrapper
   ];
 
-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        SystemConfiguration
-      ]
-    );
+  buildInputs = [
+    openssl
+  ];
 
   checkFlags =
     [
diff --git a/pkgs/by-name/vc/vcdimager/package.nix b/pkgs/by-name/vc/vcdimager/package.nix
index af77f7532c30..22cc7d2101df 100644
--- a/pkgs/by-name/vc/vcdimager/package.nix
+++ b/pkgs/by-name/vc/vcdimager/package.nix
@@ -7,7 +7,6 @@
   libxml2,
   popt,
   libiconv,
-  darwin,
 }:
 
 stdenv.mkDerivation rec {
@@ -21,19 +20,11 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    [
-      libxml2
-      popt
-      libiconv
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        IOKit
-        DiskArbitration
-      ]
-    );
+  buildInputs = [
+    libxml2
+    popt
+    libiconv
+  ];
 
   propagatedBuildInputs = [ libcdio ];
 
diff --git a/pkgs/by-name/ve/veryl/package.nix b/pkgs/by-name/ve/veryl/package.nix
index 8c3340b508a9..906d68d38d48 100644
--- a/pkgs/by-name/ve/veryl/package.nix
+++ b/pkgs/by-name/ve/veryl/package.nix
@@ -6,7 +6,6 @@
   installShellFiles,
   dbus,
   stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -29,16 +28,9 @@ rustPlatform.buildRustPackage rec {
     installShellFiles
   ];
 
-  buildInputs =
-    [
-      dbus
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.CoreFoundation
-      darwin.apple_sdk.frameworks.CoreServices
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    dbus
+  ];
 
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd veryl \
diff --git a/pkgs/by-name/vi/vips/package.nix b/pkgs/by-name/vi/vips/package.nix
index 1effb0c3042b..b93504cd8443 100644
--- a/pkgs/by-name/vi/vips/package.nix
+++ b/pkgs/by-name/vi/vips/package.nix
@@ -13,9 +13,7 @@
   buildPackages,
 
   # Build inputs
-  ApplicationServices,
   expat,
-  Foundation,
   glib,
   libxml2,
   python3,
@@ -87,41 +85,36 @@ stdenv.mkDerivation (finalAttrs: {
       gtk-doc
     ];
 
-  buildInputs =
-    [
-      glib
-      libxml2
-      expat
-      (python3.withPackages (p: [ p.pycairo ]))
+  buildInputs = [
+    glib
+    libxml2
+    expat
+    (python3.withPackages (p: [ p.pycairo ]))
 
-      # Optional dependencies
-      cfitsio
-      cgif
-      fftw
-      imagemagick
-      lcms2
-      libarchive
-      libexif
-      libheif
-      libhwy
-      libimagequant
-      libjpeg
-      libjxl
-      librsvg
-      libspng
-      libtiff
-      libwebp
-      matio
-      openexr
-      openjpeg
-      openslide
-      pango
-      poppler
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      ApplicationServices
-      Foundation
-    ];
+    # Optional dependencies
+    cfitsio
+    cgif
+    fftw
+    imagemagick
+    lcms2
+    libarchive
+    libexif
+    libheif
+    libhwy
+    libimagequant
+    libjpeg
+    libjxl
+    librsvg
+    libspng
+    libtiff
+    libwebp
+    matio
+    openexr
+    openjpeg
+    openslide
+    pango
+    poppler
+  ];
 
   # Required by .pc file
   propagatedBuildInputs = [
diff --git a/pkgs/by-name/vi/virglrenderer/package.nix b/pkgs/by-name/vi/virglrenderer/package.nix
index f949538cff57..f6e57ea1d598 100644
--- a/pkgs/by-name/vi/virglrenderer/package.nix
+++ b/pkgs/by-name/vi/virglrenderer/package.nix
@@ -22,11 +22,11 @@
 
 stdenv.mkDerivation rec {
   pname = "virglrenderer";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchurl {
     url = "https://gitlab.freedesktop.org/virgl/virglrenderer/-/archive/${version}/virglrenderer-${version}.tar.bz2";
-    hash = "sha256-XGgKst7ENLKCUv0jU/HiEtTYe+7b9sHnSufj0PZVsb0=";
+    hash = "sha256-D+SJqBL76z1nGBmcJ7Dzb41RvFxU2Ak6rVOwDRB94rM=";
   };
 
   separateDebugInfo = true;
@@ -51,7 +51,9 @@ stdenv.mkDerivation rec {
     meson
     ninja
     pkg-config
-    python3
+    (python3.withPackages (ps: [
+      ps.pyyaml
+    ]))
   ];
 
   mesonFlags =
diff --git a/pkgs/by-name/vi/virtualpg/package.nix b/pkgs/by-name/vi/virtualpg/package.nix
index a32c0d46f1c6..094d74e3f5d2 100644
--- a/pkgs/by-name/vi/virtualpg/package.nix
+++ b/pkgs/by-name/vi/virtualpg/package.nix
@@ -5,7 +5,6 @@
   validatePkgConfig,
   libpq,
   sqlite,
-  darwin,
 }:
 
 stdenv.mkDerivation rec {
@@ -25,7 +24,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     libpq
     sqlite
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.Kerberos ];
+  ];
 
   meta = with lib; {
     description = "Loadable dynamic extension to both SQLite and SpatiaLite";
diff --git a/pkgs/by-name/vi/visp/package.nix b/pkgs/by-name/vi/visp/package.nix
index 59d150b95746..099aedfb91a1 100644
--- a/pkgs/by-name/vi/visp/package.nix
+++ b/pkgs/by-name/vi/visp/package.nix
@@ -1,7 +1,6 @@
 {
   cmake,
   coin3d,
-  darwin,
   doxygen,
   eigen,
   fetchFromGitHub,
@@ -95,8 +94,7 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       coin3d
       v4l-utils
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.IOKit ];
+    ];
 
   doCheck = true;
 
diff --git a/pkgs/by-name/vl/vlang/package.nix b/pkgs/by-name/vl/vlang/package.nix
index 2b3cdbaf80a0..8f5ca40616ce 100644
--- a/pkgs/by-name/vl/vlang/package.nix
+++ b/pkgs/by-name/vl/vlang/package.nix
@@ -10,7 +10,6 @@
   boehmgc,
   xorg,
   binaryen,
-  darwin,
 }:
 
 let
@@ -76,9 +75,6 @@ stdenv.mkDerivation {
     [
       binaryen
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Cocoa
-    ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       xorg.libX11
       xorg.libXau
diff --git a/pkgs/by-name/vr/vrpn/package.nix b/pkgs/by-name/vr/vrpn/package.nix
index 6351f7d1ae6e..18b4013ce58d 100644
--- a/pkgs/by-name/vr/vrpn/package.nix
+++ b/pkgs/by-name/vr/vrpn/package.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   unzip,
   cmake,
-  darwin,
   libGLU,
   libGL,
 }:
@@ -25,17 +24,10 @@ stdenv.mkDerivation rec {
     unzip
   ];
 
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.CoreFoundation
-      darwin.apple_sdk.frameworks.GLUT
-      darwin.apple_sdk.frameworks.IOKit
-      darwin.apple_sdk.frameworks.OpenGL
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [
-      libGLU
-      libGL
-    ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    libGLU
+    libGL
+  ];
 
   meta = with lib; {
     description = "Virtual Reality Peripheral Network";
diff --git a/pkgs/by-name/vs/vscode-js-debug/package.nix b/pkgs/by-name/vs/vscode-js-debug/package.nix
index 63e42bb73b67..1dd8afc27caa 100644
--- a/pkgs/by-name/vs/vscode-js-debug/package.nix
+++ b/pkgs/by-name/vs/vscode-js-debug/package.nix
@@ -6,8 +6,6 @@
   buildPackages,
   libsecret,
   xcbuild,
-  Security,
-  AppKit,
   pkg-config,
   node-gyp,
   runCommand,
@@ -33,12 +31,7 @@ buildNpmPackage rec {
     node-gyp
   ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ xcbuild ];
 
-  buildInputs =
-    lib.optionals (!stdenv.hostPlatform.isDarwin) [ libsecret ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Security
-      AppKit
-    ];
+  buildInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) [ libsecret ];
 
   postPatch = ''
     ${lib.getExe buildPackages.jq} '
diff --git a/pkgs/by-name/vs/vsmartcard-pcsc-relay/package.nix b/pkgs/by-name/vs/vsmartcard-pcsc-relay/package.nix
index 390eb579b0bf..db046be77a24 100644
--- a/pkgs/by-name/vs/vsmartcard-pcsc-relay/package.nix
+++ b/pkgs/by-name/vs/vsmartcard-pcsc-relay/package.nix
@@ -10,7 +10,6 @@
   help2man,
   gengetopt,
   vsmartcard-vpcd,
-  darwin,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -27,24 +26,20 @@ stdenv.mkDerivation (finalAttrs: {
     help2man
   ];
 
-  buildInputs =
-    [
-      pcsclite
-      libnfc
-      gengetopt
-      (python3.withPackages (
-        pp: with pp; [
-          pyscard
-          pycrypto
-          pbkdf2
-          pillow
-          gnureadline
-        ]
-      ))
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.PCSC
-    ];
+  buildInputs = [
+    pcsclite
+    libnfc
+    gengetopt
+    (python3.withPackages (
+      pp: with pp; [
+        pyscard
+        pycrypto
+        pbkdf2
+        pillow
+        gnureadline
+      ]
+    ))
+  ];
 
   meta = {
     description = "Relays a smart card using an contact-less interface";
diff --git a/pkgs/by-name/vs/vsmartcard-vpcd/package.nix b/pkgs/by-name/vs/vsmartcard-vpcd/package.nix
index 490115a6ce8b..a3f78c82d9ab 100644
--- a/pkgs/by-name/vs/vsmartcard-vpcd/package.nix
+++ b/pkgs/by-name/vs/vsmartcard-vpcd/package.nix
@@ -9,7 +9,6 @@
   qrencode,
   python3,
   help2man,
-  darwin,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -32,23 +31,19 @@ stdenv.mkDerivation (finalAttrs: {
     help2man
   ];
 
-  buildInputs =
-    [
-      pcsclite
-      qrencode
-      (python3.withPackages (
-        pp: with pp; [
-          pyscard
-          pycrypto
-          pbkdf2
-          pillow
-          gnureadline
-        ]
-      ))
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.PCSC
-    ];
+  buildInputs = [
+    pcsclite
+    qrencode
+    (python3.withPackages (
+      pp: with pp; [
+        pyscard
+        pycrypto
+        pbkdf2
+        pillow
+        gnureadline
+      ]
+    ))
+  ];
 
   configureFlags = lib.optional stdenv.hostPlatform.isDarwin "--enable-infoplist";
 
diff --git a/pkgs/by-name/vv/vvvvvv/package.nix b/pkgs/by-name/vv/vvvvvv/package.nix
index 94d1fcb6d377..e2519a1e5845 100644
--- a/pkgs/by-name/vv/vvvvvv/package.nix
+++ b/pkgs/by-name/vv/vvvvvv/package.nix
@@ -11,8 +11,6 @@
   physfs,
   SDL2,
   tinyxml-2,
-  Foundation,
-  IOKit,
   makeAndPlay ? false,
 }:
 
@@ -41,17 +39,12 @@ stdenv.mkDerivation rec {
     copyDesktopItems
   ];
 
-  buildInputs =
-    [
-      faudio
-      physfs
-      SDL2
-      tinyxml-2
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Foundation
-      IOKit
-    ];
+  buildInputs = [
+    faudio
+    physfs
+    SDL2
+    tinyxml-2
+  ];
 
   cmakeDir = "../desktop_version";
 
diff --git a/pkgs/by-name/wa/wangle/package.nix b/pkgs/by-name/wa/wangle/package.nix
index fbf0705e3cef..adb10abf9f32 100644
--- a/pkgs/by-name/wa/wangle/package.nix
+++ b/pkgs/by-name/wa/wangle/package.nix
@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wangle";
-  version = "2025.02.10.00";
+  version = "2025.04.21.00";
 
   outputs = [
     "out"
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "facebook";
     repo = "wangle";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-IlMdYOQH0iqxObyFM1F4cZqOgSbCs4cOFtcsPWG8cWk=";
+    hash = "sha256-t3b+R2tb4VTsjDL9Jzjcaehs5k+BLNLilm3+nXxyjj0=";
   };
 
   patches = [
diff --git a/pkgs/by-name/wa/wapm/package.nix b/pkgs/by-name/wa/wapm/package.nix
index d70166275e6b..385e9af0a2b1 100644
--- a/pkgs/by-name/wa/wapm/package.nix
+++ b/pkgs/by-name/wa/wapm/package.nix
@@ -5,8 +5,6 @@
   libiconv,
   openssl,
   rustPlatform,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -25,18 +23,10 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ perl ];
 
-  buildInputs =
-    [
-      libiconv
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        Security
-        SystemConfiguration
-      ]
-    );
+  buildInputs = [
+    libiconv
+    openssl
+  ];
 
   doCheck = false;
 
diff --git a/pkgs/by-name/wa/wash-cli/package.nix b/pkgs/by-name/wa/wash-cli/package.nix
index b01b2396a4bd..f3e1ff341860 100644
--- a/pkgs/by-name/wa/wash-cli/package.nix
+++ b/pkgs/by-name/wa/wash-cli/package.nix
@@ -1,11 +1,9 @@
 {
   lib,
-  stdenv,
   fetchCrate,
   rustPlatform,
   pkg-config,
   openssl,
-  darwin,
   fetchurl,
 }:
 
@@ -34,12 +32,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.SystemConfiguration
-      darwin.apple_sdk.frameworks.CoreServices
-    ];
+  buildInputs = [ openssl ];
 
   preBuild = "
     export WASI_PREVIEW1_COMMAND_COMPONENT_ADAPTER=${wasiPreviewCommandComponentAdapter}
diff --git a/pkgs/by-name/wa/wasm-pack/package.nix b/pkgs/by-name/wa/wasm-pack/package.nix
index 7810cc4a08d2..24a86a73edef 100644
--- a/pkgs/by-name/wa/wasm-pack/package.nix
+++ b/pkgs/by-name/wa/wasm-pack/package.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
-  darwin,
   cmake,
   pkg-config,
   zstd,
@@ -28,9 +26,7 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.frameworks.Security ++ [
-    zstd
-  ];
+  buildInputs = [ zstd ];
 
   # Most tests rely on external resources and build artifacts.
   # Disabling check here to work with build sandboxing.
diff --git a/pkgs/by-name/wa/wasmer-pack/package.nix b/pkgs/by-name/wa/wasmer-pack/package.nix
index 0536ed30e8f2..273be1c20296 100644
--- a/pkgs/by-name/wa/wasmer-pack/package.nix
+++ b/pkgs/by-name/wa/wasmer-pack/package.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,10 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-PZudXmdPz6fG7NDC/yN7qG+RQFSzNynXo6SpYJEku9A=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-  ];
-
   cargoBuildFlags = [ "-p=wasmer-pack-cli" ];
 
   # requires internet access
diff --git a/pkgs/by-name/wa/wastebin/package.nix b/pkgs/by-name/wa/wastebin/package.nix
index 3b8e300d2696..a1e24f12502c 100644
--- a/pkgs/by-name/wa/wastebin/package.nix
+++ b/pkgs/by-name/wa/wastebin/package.nix
@@ -5,8 +5,6 @@
   pkg-config,
   sqlite,
   zstd,
-  stdenv,
-  darwin,
   nixosTests,
 }:
 
@@ -28,14 +26,10 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      sqlite
-      zstd
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    sqlite
+    zstd
+  ];
 
   env = {
     ZSTD_SYS_USE_PKG_CONFIG = true;
diff --git a/pkgs/by-name/wa/watchman/Cargo.lock b/pkgs/by-name/wa/watchman/Cargo.lock
index 720cbbfaa865..9568411779ad 100644
--- a/pkgs/by-name/wa/watchman/Cargo.lock
+++ b/pkgs/by-name/wa/watchman/Cargo.lock
@@ -41,9 +41,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.95"
+version = "1.0.98"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34ac096ce696dc2fcabef30516bb13c0a68a11d30131d3df6f04711467681b04"
+checksum = "e16d2d3311acee920a9eb8d33b8cbc1787ce4a264e85f964c2404b969bdcd487"
 
 [[package]]
 name = "atty"
@@ -85,9 +85,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.8.0"
+version = "2.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f68f53c83ab957f72c32642f3868eec03eb974d1fb82e453128456482613d36"
+checksum = "5c8214115b7bf84099f1309324e63141d4c5d7cc26862f97a0a857dbefe165bd"
 
 [[package]]
 name = "byteorder"
@@ -97,9 +97,9 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
-version = "1.10.0"
+version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f61dac84819c6588b558454b194026eb1f09c293b9036ae9b159e74e73ab6cf9"
+checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
 dependencies = [
  "serde",
 ]
@@ -152,9 +152,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-channel"
-version = "0.5.14"
+version = "0.5.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06ba6d68e24814cb8de6bb986db8222d3a027d15872cabc0d18817bc3c0e4471"
+checksum = "82b8f8f868b36967f9606790d1903570de9ceaf870a7bf9fbbd3016d636a2cb2"
 dependencies = [
  "crossbeam-utils",
 ]
@@ -207,9 +207,9 @@ dependencies = [
 
 [[package]]
 name = "either"
-version = "1.13.0"
+version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60b1af1c220855b6ceac025d3f6ecdd2b7c4894bfe9cd9bda4fbb4bc7c0d4cf0"
+checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
 
 [[package]]
 name = "futures"
@@ -273,7 +273,7 @@ checksum = "162ee34ebcb7c64a8abebc059ce0fee27c2262618d7b60ed8faf72fef13c3650"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.98",
+ "syn 2.0.100",
 ]
 
 [[package]]
@@ -309,9 +309,9 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.2.15"
+version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c4567c8db10ae91089c99af84c68c38da3ec2f087c3f82960bcdbf3656b6f4d7"
+checksum = "335ff9f135e4384c8150d6f27c6daed433577f86b4750418338c01a1a2528592"
 dependencies = [
  "cfg-if",
  "libc",
@@ -344,9 +344,9 @@ dependencies = [
 
 [[package]]
 name = "itoa"
-version = "1.0.14"
+version = "1.0.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d75a2a4b1b190afb6f5425f10f6a8f959d2ea0b9c2b1d79553551850539e4674"
+checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
 
 [[package]]
 name = "jwalk"
@@ -366,9 +366,9 @@ checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
 
 [[package]]
 name = "libc"
-version = "0.2.169"
+version = "0.2.172"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5aba8db14291edd000dfcc4d620c7ebfb122c613afb886ca8803fa4e128a20a"
+checksum = "d750af042f7ef4f724306de029d18836c26c1765a54a6a3f094cbd23a7267ffa"
 
 [[package]]
 name = "lock_api"
@@ -382,9 +382,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.25"
+version = "0.4.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04cbf5b083de1c7e0222a7a51dbfdba1cbe1c6ab0b15e29fff3f6c077fd9cd9f"
+checksum = "13dc2df351e3202783a1fe0d44375f7295ffb4049267b0f3018346dc122a1d94"
 
 [[package]]
 name = "maplit"
@@ -409,9 +409,9 @@ dependencies = [
 
 [[package]]
 name = "miniz_oxide"
-version = "0.8.3"
+version = "0.8.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8402cab7aefae129c6977bb0ff1b8fd9a04eb5b51efc50a70bea51cda0c7924"
+checksum = "3be647b768db090acb35d5ec5db2b0e1f1de11133ca123b9eacf5137868f892a"
 dependencies = [
  "adler2",
 ]
@@ -433,7 +433,7 @@ version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "71e2746dc3a24dd78b3cfcb7be93368c6de9963d30f43a6a73998a9cf4b17b46"
 dependencies = [
- "bitflags 2.8.0",
+ "bitflags 2.9.0",
  "cfg-if",
  "cfg_aliases",
  "libc",
@@ -460,9 +460,9 @@ dependencies = [
 
 [[package]]
 name = "once_cell"
-version = "1.20.3"
+version = "1.21.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "945462a4b81e43c4e3ba96bd7b49d834c6f61198356aa858733bc4acf3cbe62e"
+checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
 
 [[package]]
 name = "os_pipe"
@@ -535,18 +535,18 @@ dependencies = [
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.93"
+version = "1.0.95"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60946a68e5f9d28b0dc1c21bb8a97ee7d018a8b322fa57838ba31cc878e22d99"
+checksum = "02b3e5e68a3a1a02aad3ec490a98007cbc13c37cbe84a3cd7b8e406d76e7f778"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.38"
+version = "1.0.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e4dccaaaf89514f546c693ddc140f729f958c247918a13380cccc6078391acc"
+checksum = "1885c039570dc00dcb4ff087a89e185fd56bae234ddc7f056a945bf36467248d"
 dependencies = [
  "proc-macro2",
 ]
@@ -573,11 +573,11 @@ dependencies = [
 
 [[package]]
 name = "redox_syscall"
-version = "0.5.8"
+version = "0.5.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03a862b389f93e68874fbf580b9de08dd02facb9a788ebadaf4a3fd33cf58834"
+checksum = "d2f103c6d277498fbceb16e84d317e2a400f160f46904d5f5410848c829511a3"
 dependencies = [
- "bitflags 2.8.0",
+ "bitflags 2.9.0",
 ]
 
 [[package]]
@@ -588,9 +588,9 @@ checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
 
 [[package]]
 name = "ryu"
-version = "1.0.19"
+version = "1.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ea1a2d0a644769cc99faa24c3ad26b379b786fe7c36fd3c546254801650e6dd"
+checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
 
 [[package]]
 name = "scopeguard"
@@ -600,9 +600,9 @@ checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
 name = "serde"
-version = "1.0.217"
+version = "1.0.219"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02fc4265df13d6fa1d00ecff087228cc0a2b5f3c0e87e258d8b94a156e984c70"
+checksum = "5f0e2c6ed6606019b4e29e69dbaba95b11854410e5347d525002456dbbb786b6"
 dependencies = [
  "serde_derive",
 ]
@@ -621,29 +621,29 @@ dependencies = [
 
 [[package]]
 name = "serde_bytes"
-version = "0.11.15"
+version = "0.11.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "387cc504cb06bb40a96c8e04e951fe01854cf6bc921053c954e4a606d9675c6a"
+checksum = "8437fd221bde2d4ca316d61b90e337e9e702b3820b87d63caa9ba6c02bd06d96"
 dependencies = [
  "serde",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.217"
+version = "1.0.219"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a9bf7cf98d04a2b28aead066b7496853d4779c9cc183c440dbac457641e19a0"
+checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.98",
+ "syn 2.0.100",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.138"
+version = "1.0.140"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d434192e7da787e94a6ea7e9670b26a036d0ca41e0b7efb2676dd32bae872949"
+checksum = "20068b6e96dc6c9bd23e01df8827e6c7e1f2fddd43c21810382803c136b99373"
 dependencies = [
  "itoa",
  "memchr",
@@ -663,9 +663,9 @@ dependencies = [
 
 [[package]]
 name = "signal-hook-registry"
-version = "1.4.2"
+version = "1.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9e9e0b4211b72e7b8b6e85c807d36c212bdb33ea8587f7569562a84df5465b1"
+checksum = "9203b8055f63a2a00e2f593bb0510367fe707d7ff1e5c872de2f537b339e5410"
 dependencies = [
  "libc",
 ]
@@ -681,15 +681,15 @@ dependencies = [
 
 [[package]]
 name = "smallvec"
-version = "1.13.2"
+version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
+checksum = "8917285742e9f3e1683f0a9c4e6b57960b7314d0b08d30d1ecd426713ee2eee9"
 
 [[package]]
 name = "socket2"
-version = "0.5.8"
+version = "0.5.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c970269d99b64e60ec3bd6ad27270092a5394c4e309314b18ae3fe575695fbe8"
+checksum = "4f5fd57c80058a56cf5c777ab8a126398ece8e442983605d280a44ce79d0edef"
 dependencies = [
  "libc",
  "windows-sys 0.52.0",
@@ -738,9 +738,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.98"
+version = "2.0.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "36147f1a48ae0ec2b5b3bc5b537d267457555a10dc06f3dbc8cb11ba3006d3b1"
+checksum = "b09a44accad81e1ba1cd74a32461ba89dee89095ba17b32f5d03683b1b1fc2a0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -797,14 +797,14 @@ checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.98",
+ "syn 2.0.100",
 ]
 
 [[package]]
 name = "tokio"
-version = "1.43.0"
+version = "1.44.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d61fa4ffa3de412bfea335c6ecff681de2b609ba3c77ef3e00e521813a9ed9e"
+checksum = "e6b88822cbe49de4185e3a4cbf8321dd487cf5fe0c5c65695fef6346371e9c48"
 dependencies = [
  "backtrace",
  "bytes",
@@ -827,7 +827,7 @@ checksum = "6e06d43f1345a3bcd39f6a56dbb7dcab2ba47e68e8ac134855e7e2bdbaf8cab8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.98",
+ "syn 2.0.100",
 ]
 
 [[package]]
@@ -867,9 +867,9 @@ dependencies = [
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.16"
+version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a210d160f08b701c8721ba1c726c11662f877ea6b7094007e1ca9a1041945034"
+checksum = "5a5f39404a5da50712a4c1eecf25e90dd62b613502b7e925fd4e4d19b5c96512"
 
 [[package]]
 name = "unicode-segmentation"
@@ -1075,5 +1075,5 @@ checksum = "fa4f8080344d4671fb4e831a13ad1e68092748387dfc4f55e356242fae12ce3e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.98",
+ "syn 2.0.100",
 ]
diff --git a/pkgs/by-name/wa/watchman/package.nix b/pkgs/by-name/wa/watchman/package.nix
index a46cc591d87f..06c45602b492 100644
--- a/pkgs/by-name/wa/watchman/package.nix
+++ b/pkgs/by-name/wa/watchman/package.nix
@@ -35,13 +35,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "watchman";
-  version = "2025.02.10.00";
+  version = "2025.04.21.00";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "watchman";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-X9cUiMrUeuuJT+0gJa9cL2mpeSEWS/DkTx7eQu8u7oY=";
+    hash = "sha256-eZRrG7bgmh7hW7ihQISQP5pnWAVGhDLL93rCP7ZtUnA=";
   };
 
   patches = [
diff --git a/pkgs/by-name/we/websocat/package.nix b/pkgs/by-name/we/websocat/package.nix
index 5e9b3602181e..f00d2aef05f3 100644
--- a/pkgs/by-name/we/websocat/package.nix
+++ b/pkgs/by-name/we/websocat/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   bash,
-  darwin,
   fetchFromGitHub,
   libiconv,
   makeWrapper,
@@ -35,7 +34,6 @@ rustPlatform.buildRustPackage rec {
     [ openssl ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       libiconv
-      darwin.apple_sdk.frameworks.Security
     ];
 
   nativeInstallCheckInputs = [ versionCheckHook ];
diff --git a/pkgs/by-name/wg/wget2/package.nix b/pkgs/by-name/wg/wget2/package.nix
index 5aa132e5ceba..f0c1c3eef7eb 100644
--- a/pkgs/by-name/wg/wget2/package.nix
+++ b/pkgs/by-name/wg/wget2/package.nix
@@ -11,7 +11,6 @@
   # libraries
   brotli,
   bzip2,
-  darwin,
   gpgme,
   libhsts,
   libidn2,
@@ -76,9 +75,6 @@ stdenv.mkDerivation rec {
     ]
     ++ lib.optionals sslSupport [
       openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.CoreServices
     ];
 
   # TODO: include translation files
diff --git a/pkgs/by-name/wg/wgpu-utils/package.nix b/pkgs/by-name/wg/wgpu-utils/package.nix
index 05adb6c51a5b..0a1141b6319c 100644
--- a/pkgs/by-name/wg/wgpu-utils/package.nix
+++ b/pkgs/by-name/wg/wgpu-utils/package.nix
@@ -1,6 +1,5 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitHub,
   pkg-config,
@@ -9,7 +8,6 @@
   vulkan-loader,
   freetype,
   fontconfig,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -32,19 +30,10 @@ rustPlatform.buildRustPackage rec {
     makeWrapper
   ];
 
-  buildInputs =
-    [
-      freetype
-      fontconfig
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        CoreServices
-        QuartzCore
-        AppKit
-      ]
-    );
+  buildInputs = [
+    freetype
+    fontconfig
+  ];
 
   # Tests fail, as the Nix sandbox doesn't provide an appropriate adapter (e.g. Vulkan).
   doCheck = false;
diff --git a/pkgs/by-name/wi/widelands/package.nix b/pkgs/by-name/wi/widelands/package.nix
index 917c1f2d4370..e91f348c20f9 100644
--- a/pkgs/by-name/wi/widelands/package.nix
+++ b/pkgs/by-name/wi/widelands/package.nix
@@ -25,7 +25,6 @@
   libSM,
   libICE,
   libXext,
-  darwin,
 }:
 
 stdenv.mkDerivation rec {
@@ -62,32 +61,24 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  buildInputs =
-    [
-      SDL2
-      SDL2_image
-      SDL2_mixer
-      SDL2_net
-      SDL2_ttf
-      curl
-      glew
-      icu
-      libpng
-      lua
-      python3
-      zlib
-      minizip
-      asio
-      libSM # XXX: these should be propagated by SDL2?
-      libICE
-    ]
-    ++ lib.optional stdenv.hostPlatform.isLinux libXext
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        Cocoa
-      ]
-    );
+  buildInputs = [
+    SDL2
+    SDL2_image
+    SDL2_mixer
+    SDL2_net
+    SDL2_ttf
+    curl
+    glew
+    icu
+    libpng
+    lua
+    python3
+    zlib
+    minizip
+    asio
+    libSM # XXX: these should be propagated by SDL2?
+    libICE
+  ] ++ lib.optional stdenv.hostPlatform.isLinux libXext;
 
   postInstall =
     lib.optionalString stdenv.hostPlatform.isLinux ''
diff --git a/pkgs/by-name/wi/windsurf/update/update.mts b/pkgs/by-name/wi/windsurf/update/update.mts
index 5db74e3b5346..64fad0bbd59f 100755
--- a/pkgs/by-name/wi/windsurf/update/update.mts
+++ b/pkgs/by-name/wi/windsurf/update/update.mts
@@ -1,6 +1,6 @@
 #!/usr/bin/env nix-shell
 /*
-#!nix-shell -i node --pure --packages cacert nodejs_23
+#!nix-shell -i node --pure --packages cacert nodejs_latest
 */
 import * as assert from "node:assert/strict";
 import * as fsPromises from "node:fs/promises";
diff --git a/pkgs/by-name/wi/wiper/package.nix b/pkgs/by-name/wi/wiper/package.nix
index bbf4eb8f3541..40772f3986bd 100644
--- a/pkgs/by-name/wi/wiper/package.nix
+++ b/pkgs/by-name/wi/wiper/package.nix
@@ -1,7 +1,5 @@
 {
   lib,
-  stdenv,
-  darwin,
   rustPlatform,
   fetchFromGitHub,
 }:
@@ -22,8 +20,6 @@ rustPlatform.buildRustPackage {
   useFetchCargoVendor = true;
   cargoHash = "sha256-p2bUiRLI0vfOAAi4Cb8B9E8kMVS6aX4ksbF+H9gMsDs=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.Foundation ];
-
   meta = {
     description = "Disk analyser and cleanup tool";
     changelog = "https://github.com/ikebastuz/wiper/releases/tag/v${version}";
diff --git a/pkgs/by-name/wo/wownero/package.nix b/pkgs/by-name/wo/wownero/package.nix
index 5933810851dd..a35b9147e956 100644
--- a/pkgs/by-name/wo/wownero/package.nix
+++ b/pkgs/by-name/wo/wownero/package.nix
@@ -12,7 +12,6 @@
   readline,
   unbound,
   zeromq,
-  darwin,
 }:
 
 let
@@ -60,19 +59,15 @@ stdenv.mkDerivation rec {
     python3
   ];
 
-  buildInputs =
-    [
-      boost186
-      libsodium
-      openssl
-      rapidjson
-      readline
-      unbound
-      zeromq
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.IOKit
-    ];
+  buildInputs = [
+    boost186
+    libsodium
+    openssl
+    rapidjson
+    readline
+    unbound
+    zeromq
+  ];
 
   postUnpack = ''
     rm -r $sourceRoot/external/miniupnp
diff --git a/pkgs/by-name/wt/wthrr/package.nix b/pkgs/by-name/wt/wthrr/package.nix
index be0b4608788e..622e19bf5ce4 100644
--- a/pkgs/by-name/wt/wthrr/package.nix
+++ b/pkgs/by-name/wt/wthrr/package.nix
@@ -4,8 +4,6 @@
   fetchFromGitHub,
   pkg-config,
   openssl,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -26,15 +24,9 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.CoreFoundation
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    openssl
+  ];
 
   checkFlags = [
     # requires internet access
diff --git a/pkgs/by-name/wt/wttrbar/package.nix b/pkgs/by-name/wt/wttrbar/package.nix
index b5bc96f793eb..6d334268964a 100644
--- a/pkgs/by-name/wt/wttrbar/package.nix
+++ b/pkgs/by-name/wt/wttrbar/package.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
-  darwin,
   nix-update-script,
 }:
 
@@ -18,14 +16,6 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-+M0s6v9ULf+D2pPOE8KlHoyV+jBMbPsAXpYxGjms5DY=";
   };
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin (
-    with darwin.apple_sdk_11_0.frameworks;
-    [
-      Security
-      SystemConfiguration
-    ]
-  );
-
   useFetchCargoVendor = true;
   cargoHash = "sha256-sv9hSTmq5J6s0PPBMJgaMUWBaRk0/NJV41nNDIj6MoY=";
 
diff --git a/pkgs/by-name/wx/wxformbuilder/package.nix b/pkgs/by-name/wx/wxformbuilder/package.nix
index 3a90c0d8e22d..b04d229c6667 100644
--- a/pkgs/by-name/wx/wxformbuilder/package.nix
+++ b/pkgs/by-name/wx/wxformbuilder/package.nix
@@ -48,14 +48,10 @@ stdenv.mkDerivation (finalAttrs: {
       shared-mime-info
     ];
 
-  buildInputs =
-    [
-      boost
-      wxGTK32
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Cocoa
-    ];
+  buildInputs = [
+    boost
+    wxGTK32
+  ];
 
   postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
     mkdir -p $out/{Applications,bin}
diff --git a/pkgs/by-name/x3/x3270/package.nix b/pkgs/by-name/x3/x3270/package.nix
index f1e182b28817..da3519ae0fd4 100644
--- a/pkgs/by-name/x3/x3270/package.nix
+++ b/pkgs/by-name/x3/x3270/package.nix
@@ -1,6 +1,5 @@
 {
   stdenv,
-  darwin,
   lib,
   libiconv,
   fetchurl,
@@ -74,7 +73,6 @@ stdenv.mkDerivation rec {
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       libiconv
-      darwin.apple_sdk.frameworks.Security
     ];
 
   meta = with lib; {
diff --git a/pkgs/by-name/x4/x4/package.nix b/pkgs/by-name/x4/x4/package.nix
index 26815dd7a0c7..c7a7e4108e5c 100644
--- a/pkgs/by-name/x4/x4/package.nix
+++ b/pkgs/by-name/x4/x4/package.nix
@@ -5,8 +5,6 @@
   pkg-config,
   openssl,
   zlib,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -27,14 +25,10 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      openssl
-      zlib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = [
+    openssl
+    zlib
+  ];
 
   env = {
     OPENSSL_NO_VENDOR = true;
diff --git a/pkgs/by-name/xc/xcbuild/package.nix b/pkgs/by-name/xc/xcbuild/package.nix
index 47cd2cae6dae..b488c3ffbf78 100644
--- a/pkgs/by-name/xc/xcbuild/package.nix
+++ b/pkgs/by-name/xc/xcbuild/package.nix
@@ -10,11 +10,6 @@
   stdenv,
   zlib,
 
-  # These arguments are obsolete but required to avoid evaluation errors (for now).
-  CoreGraphics ? null,
-  CoreServices ? null,
-  ImageIO ? null,
-
   # These are deprecated and do nothing. They’re needed for compatibility and will
   # warn eventually once in-tree uses are cleaned up.
   xcodePlatform ? null,
@@ -95,7 +90,11 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   postPatch =
-    lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
+    ''
+      substituteInPlace Libraries/pbxbuild/Sources/Tool/TouchResolver.cpp \
+        --replace-fail "/usr/bin/touch" "touch"
+    ''
+    + lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
       # Fix build on gcc-13 due to missing includes
       sed -e '1i #include <cstdint>' -i \
         Libraries/libutil/Headers/libutil/Permissions.h \
diff --git a/pkgs/by-name/xi/xiu/package.nix b/pkgs/by-name/xi/xiu/package.nix
index 7d9433cc4221..73e497710209 100644
--- a/pkgs/by-name/xi/xiu/package.nix
+++ b/pkgs/by-name/xi/xiu/package.nix
@@ -1,7 +1,6 @@
 {
   lib,
   cmake,
-  darwin,
   fetchFromGitHub,
   libopus,
   openssl,
@@ -35,9 +34,6 @@ rustPlatform.buildRustPackage rec {
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.SystemConfiguration
     ];
 
   OPENSSL_NO_VENDOR = 1;
diff --git a/pkgs/by-name/xm/xml-security-c/package.nix b/pkgs/by-name/xm/xml-security-c/package.nix
index e198848d0fa2..6a446e80abb8 100644
--- a/pkgs/by-name/xm/xml-security-c/package.nix
+++ b/pkgs/by-name/xm/xml-security-c/package.nix
@@ -7,12 +7,8 @@
   xalanc,
   xercesc,
   openssl,
-  darwin,
 }:
 
-let
-  inherit (darwin.apple_sdk.frameworks) CoreFoundation CoreServices SystemConfiguration;
-in
 stdenv.mkDerivation (finalAttrs: {
   pname = "xml-security-c";
   version = "3.0.0";
@@ -34,17 +30,11 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      xalanc
-      xercesc
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CoreFoundation
-      CoreServices
-      SystemConfiguration
-    ];
+  buildInputs = [
+    xalanc
+    xercesc
+    openssl
+  ];
 
   meta = {
     homepage = "https://shibboleth.atlassian.net/wiki/spaces/DEV/pages/3726671873/Santuario";
diff --git a/pkgs/by-name/xq/xqilla/package.nix b/pkgs/by-name/xq/xqilla/package.nix
index 1287f301f26f..626cfe2d705c 100644
--- a/pkgs/by-name/xq/xqilla/package.nix
+++ b/pkgs/by-name/xq/xqilla/package.nix
@@ -3,7 +3,6 @@
   stdenv,
   fetchurl,
   fetchpatch,
-  darwin,
   xercesc,
 }:
 
@@ -30,17 +29,9 @@ stdenv.mkDerivation rec {
     "CXXFLAGS=-std=c++14"
   ];
 
-  buildInputs =
-    [
-      xercesc
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        CoreServices
-        SystemConfiguration
-      ]
-    );
+  buildInputs = [
+    xercesc
+  ];
 
   meta = with lib; {
     description = "XQuery and XPath 2 library and command line utility written in C++, implemented on top of the Xerces-C library";
diff --git a/pkgs/by-name/ya/yazi-unwrapped/package.nix b/pkgs/by-name/ya/yazi-unwrapped/package.nix
index efd8965208dc..6b5a3a724f28 100644
--- a/pkgs/by-name/ya/yazi-unwrapped/package.nix
+++ b/pkgs/by-name/ya/yazi-unwrapped/package.nix
@@ -4,8 +4,6 @@
   lib,
 
   installShellFiles,
-  stdenv,
-  Foundation,
   rust-jemalloc-sys,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -24,7 +22,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   env.VERGEN_BUILD_DATE = "2025-04-08";
 
   nativeBuildInputs = [ installShellFiles ];
-  buildInputs = [ rust-jemalloc-sys ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Foundation ];
+  buildInputs = [ rust-jemalloc-sys ];
 
   postInstall = ''
     installShellCompletion --cmd yazi \
diff --git a/pkgs/by-name/yc/ycmd/package.nix b/pkgs/by-name/yc/ycmd/package.nix
index f6e958b02d20..b506813ccf40 100644
--- a/pkgs/by-name/yc/ycmd/package.nix
+++ b/pkgs/by-name/yc/ycmd/package.nix
@@ -17,7 +17,6 @@
   boost,
   llvmPackages,
   fixDarwinDylibNames,
-  Cocoa,
 }:
 
 stdenv.mkDerivation {
@@ -51,8 +50,7 @@ stdenv.mkDerivation {
       jedi
       jedi-language-server
       pybind11
-    ]
-    ++ lib.optional stdenv.hostPlatform.isDarwin Cocoa;
+    ];
 
   buildPhase = ''
     export EXTRA_CMAKE_ARGS="-DPATH_TO_LLVM_ROOT=${llvmPackages.libllvm} -DUSE_SYSTEM_ABSEIL=true"
diff --git a/pkgs/by-name/yt/ytui-music/package.nix b/pkgs/by-name/yt/ytui-music/package.nix
index 53ca6814919d..e0ca6316a014 100644
--- a/pkgs/by-name/yt/ytui-music/package.nix
+++ b/pkgs/by-name/yt/ytui-music/package.nix
@@ -5,8 +5,6 @@
   pkg-config,
   openssl,
   sqlite,
-  stdenv,
-  darwin,
   mpv,
   yt-dlp,
   makeBinaryWrapper,
@@ -36,16 +34,11 @@ rustPlatform.buildRustPackage rec {
     makeBinaryWrapper
   ];
 
-  buildInputs =
-    [
-      openssl
-      sqlite
-      mpv
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.CoreFoundation
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = [
+    openssl
+    sqlite
+    mpv
+  ];
 
   postInstall = ''
     wrapProgram $out/bin/ytui_music \
diff --git a/pkgs/by-name/yu/yubico-piv-tool/package.nix b/pkgs/by-name/yu/yubico-piv-tool/package.nix
index ed8ef956b590..984b869c7503 100644
--- a/pkgs/by-name/yu/yubico-piv-tool/package.nix
+++ b/pkgs/by-name/yu/yubico-piv-tool/package.nix
@@ -2,7 +2,6 @@
   lib,
   check,
   cmake,
-  darwin,
   fetchFromGitHub,
   gengetopt,
   help2man,
@@ -47,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     openssl
     zlib
-  ] ++ (if withApplePCSC then [ darwin.apple_sdk.frameworks.PCSC ] else [ pcsclite ]);
+  ] ++ lib.optionals (!withApplePCSC) [ pcsclite ];
 
   cmakeFlags = [
     (lib.cmakeBool "GENERATE_MAN_PAGES" true)
diff --git a/pkgs/by-name/yu/yubihsm-shell/package.nix b/pkgs/by-name/yu/yubihsm-shell/package.nix
index 2e67e464e636..d959351e0b24 100644
--- a/pkgs/by-name/yu/yubihsm-shell/package.nix
+++ b/pkgs/by-name/yu/yubihsm-shell/package.nix
@@ -11,7 +11,6 @@
   pkg-config,
   pcsclite,
   help2man,
-  darwin,
   libiconv,
 }:
 
@@ -54,7 +53,6 @@ stdenv.mkDerivation rec {
       pcsclite.dev
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.PCSC
       libiconv
     ];
 
diff --git a/pkgs/by-name/yu/yubikey-agent/package.nix b/pkgs/by-name/yu/yubikey-agent/package.nix
index 98a97dab94bf..e8b8a39e27be 100644
--- a/pkgs/by-name/yu/yubikey-agent/package.nix
+++ b/pkgs/by-name/yu/yubikey-agent/package.nix
@@ -6,7 +6,6 @@
   libnotify,
   pcsclite,
   pkg-config,
-  darwin,
 }:
 
 buildGoModule rec {
@@ -20,9 +19,7 @@ buildGoModule rec {
     sha256 = "sha256-Knk1ipBOzjmjrS2OFUMuxi1TkyDcSYlVKezDWT//ERY=";
   };
 
-  buildInputs =
-    lib.optional stdenv.hostPlatform.isLinux (lib.getDev pcsclite)
-    ++ lib.optional stdenv.hostPlatform.isDarwin (darwin.apple_sdk.frameworks.PCSC);
+  buildInputs = lib.optional stdenv.hostPlatform.isLinux (lib.getDev pcsclite);
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ pkg-config ];
 
diff --git a/pkgs/by-name/ze/zerotierone/package.nix b/pkgs/by-name/ze/zerotierone/package.nix
index d3d4b80297bb..cf39cf4c7cf0 100644
--- a/pkgs/by-name/ze/zerotierone/package.nix
+++ b/pkgs/by-name/ze/zerotierone/package.nix
@@ -12,7 +12,6 @@
   rustc,
   zlib,
   libiconv,
-  darwin,
   fetchpatch,
 }:
 
@@ -83,8 +82,6 @@ stdenv.mkDerivation {
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       libiconv
-      darwin.apple_sdk.frameworks.SystemConfiguration
-      darwin.apple_sdk.frameworks.CoreServices
     ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/zi/zine/package.nix b/pkgs/by-name/zi/zine/package.nix
index 0f218e6ae8e7..d592b14611f7 100644
--- a/pkgs/by-name/zi/zine/package.nix
+++ b/pkgs/by-name/zi/zine/package.nix
@@ -4,8 +4,6 @@
   fetchCrate,
   pkg-config,
   openssl,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -29,13 +27,9 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.CoreServices
-    ];
+  buildInputs = [
+    openssl
+  ];
 
   meta = with lib; {
     description = "Simple and opinionated tool to build your own magazine";
diff --git a/pkgs/by-name/zo/zola/package.nix b/pkgs/by-name/zo/zola/package.nix
index 155c6a492eec..9014dec615c5 100644
--- a/pkgs/by-name/zo/zola/package.nix
+++ b/pkgs/by-name/zo/zola/package.nix
@@ -5,7 +5,6 @@
   rustPlatform,
   pkg-config,
   oniguruma,
-  darwin,
   installShellFiles,
   zola,
   testers,
@@ -30,17 +29,9 @@ rustPlatform.buildRustPackage rec {
     installShellFiles
   ];
 
-  buildInputs =
-    [
-      oniguruma
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        CoreServices
-        SystemConfiguration
-      ]
-    );
+  buildInputs = [
+    oniguruma
+  ];
 
   RUSTONIG_SYSTEM_LIBONIG = true;
 
diff --git a/pkgs/by-name/zx/zxing-cpp/package.nix b/pkgs/by-name/zx/zxing-cpp/package.nix
index e1fc987ec466..df47193fa32c 100644
--- a/pkgs/by-name/zx/zxing-cpp/package.nix
+++ b/pkgs/by-name/zx/zxing-cpp/package.nix
@@ -1,38 +1,37 @@
 {
   lib,
-  stdenv,
-  fetchFromGitHub,
   cmake,
-  pkg-config,
-  python3,
+  fetchFromGitHub,
   gitUpdater,
+  python3,
+  stdenv,
+  zint,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zxing-cpp";
-  version = "2.2.1";
+  version = "2.3.0";
 
   src = fetchFromGitHub {
     owner = "zxing-cpp";
     repo = "zxing-cpp";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-teFspdATn9M7Z1vSr/7PdJx/xAv+TVai8rIekxqpBZk=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-e3nSxjg8p+1DEUbZOh4C2zfnA6iGhNJMPiIe2oJEbRo=";
   };
 
-  # c++ 20 needed for char8_t or clang-19 build fails
-  postPatch = ''
-    substituteInPlace CMakeLists.txt \
-      --replace-fail "CMAKE_CXX_STANDARD 17" "CMAKE_CXX_STANDARD 20"
-  '';
-
   nativeBuildInputs = [
     cmake
-    pkg-config
+  ];
+
+  buildInputs = [
+    zint
   ];
 
   cmakeFlags = [
-    "-DBUILD_EXAMPLES=OFF"
-    "-DBUILD_BLACKBOX_TESTS=OFF"
+    "-DZXING_BLACKBOX_TESTS=OFF"
+    "-DZXING_DEPENDENCIES=LOCAL"
+    "-DZXING_EXAMPLES=OFF"
+    "-DZXING_USE_BUNDLED_ZINT=OFF"
   ];
 
   passthru = {
diff --git a/pkgs/development/ada-modules/gnatcoll/bindings.nix b/pkgs/development/ada-modules/gnatcoll/bindings.nix
index 9d233cee4bd4..e1d9900a8b7f 100644
--- a/pkgs/development/ada-modules/gnatcoll/bindings.nix
+++ b/pkgs/development/ada-modules/gnatcoll/bindings.nix
@@ -14,7 +14,6 @@
   zlib,
   python3,
   ncurses,
-  darwin,
 }:
 
 let
@@ -52,10 +51,6 @@ stdenv.mkDerivation rec {
     python3
   ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.CoreFoundation
-  ];
-
   # propagate since gprbuild needs to find referenced .gpr files
   # and all dependency C libraries when statically linking a
   # downstream executable.
diff --git a/pkgs/development/compilers/chicken/5/overrides.nix b/pkgs/development/compilers/chicken/5/overrides.nix
index 9f2570038e1f..ac7355ea4ef8 100644
--- a/pkgs/development/compilers/chicken/5/overrides.nix
+++ b/pkgs/development/compilers/chicken/5/overrides.nix
@@ -37,7 +37,6 @@ in
           pkgs.libglvnd
           pkgs.libGLU
         ]
-        ++ lib.optionals stdenv.hostPlatform.isDarwin [ pkgs.darwin.apple_sdk.frameworks.OpenGL ]
         ++ lib.optionals stdenv.hostPlatform.isLinux [ pkgs.xorg.libX11 ]
       ))
       old
@@ -137,13 +136,10 @@ in
   mosquitto = addToPropagatedBuildInputs ([ pkgs.mosquitto ]);
   nanomsg = addToBuildInputs pkgs.nanomsg;
   ncurses = addToBuildInputsWithPkgConfig [ pkgs.ncurses ];
-  opencl = addToBuildInputs (
-    [
-      pkgs.opencl-headers
-      pkgs.ocl-icd
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ pkgs.darwin.apple_sdk.frameworks.OpenCL ]
-  );
+  opencl = addToBuildInputs ([
+    pkgs.opencl-headers
+    pkgs.ocl-icd
+  ]);
   openssl = addToBuildInputs pkgs.openssl;
   plot = addToBuildInputs pkgs.plotutils;
   postgresql = addToBuildInputsWithPkgConfig pkgs.libpq;
@@ -223,16 +219,10 @@ in
     };
   opengl =
     old:
-    (addToBuildInputsWithPkgConfig (
-      lib.optionals (!stdenv.hostPlatform.isDarwin) [
-        pkgs.libGL
-        pkgs.libGLU
-      ]
-      ++ lib.optionals stdenv.hostPlatform.isDarwin [
-        pkgs.darwin.apple_sdk.frameworks.Foundation
-        pkgs.darwin.apple_sdk.frameworks.OpenGL
-      ]
-    ) old)
+    (addToBuildInputsWithPkgConfig (lib.optionals (!stdenv.hostPlatform.isDarwin) [
+      pkgs.libGL
+      pkgs.libGLU
+    ]) old)
     // {
       postPatch = ''
         substituteInPlace opengl.egg \
diff --git a/pkgs/development/compilers/dotnet/vmr.nix b/pkgs/development/compilers/dotnet/vmr.nix
index f7f42bfad9ad..73ed0eae1b41 100644
--- a/pkgs/development/compilers/dotnet/vmr.nix
+++ b/pkgs/development/compilers/dotnet/vmr.nix
@@ -44,7 +44,7 @@ let
     buildPlatform
     targetPlatform
     ;
-  inherit (swiftPackages) apple_sdk swift;
+  inherit (swiftPackages) swift;
 
   releaseManifest = lib.importJSON releaseManifestFile;
   inherit (releaseManifest) release sourceRepository tag;
@@ -111,24 +111,12 @@ stdenv.mkDerivation rec {
       krb5
       lttng-ust_2_12
     ]
-    ++ lib.optionals isDarwin (
-      with apple_sdk.frameworks;
-      [
-        xcbuild
-        swift
-        (krb5.overrideAttrs (old: {
-          # the propagated build inputs break swift compilation
-          buildInputs = old.buildInputs ++ old.propagatedBuildInputs;
-          propagatedBuildInputs = [ ];
-        }))
-        sigtool
-        Foundation
-        CoreFoundation
-        CryptoKit
-        System
-      ]
-      ++ lib.optional (lib.versionAtLeast version "9") GSS
-    );
+    ++ lib.optionals isDarwin [
+      xcbuild
+      swift
+      krb5
+      sigtool
+    ];
 
   # This is required to fix the error:
   # > CSSM_ModuleLoad(): One or more parameters passed to a function were not valid.
diff --git a/pkgs/development/compilers/dotnet/wrapper.nix b/pkgs/development/compilers/dotnet/wrapper.nix
index 655bd017a782..48562a4c5955 100644
--- a/pkgs/development/compilers/dotnet/wrapper.nix
+++ b/pkgs/development/compilers/dotnet/wrapper.nix
@@ -12,7 +12,6 @@
   callPackage,
   zlib,
   swiftPackages,
-  darwin,
   icu,
   lndir,
   replaceVars,
@@ -222,17 +221,9 @@ stdenvNoCC.mkDerivation (finalAttrs: {
                 [
                   zlib
                 ]
-                ++ lib.optional stdenv.hostPlatform.isDarwin (
-                  with darwin;
-                  with apple_sdk.frameworks;
-                  [
-                    swiftPackages.swift
-                    Foundation
-                    CryptoKit
-                    GSS
-                    ICU
-                  ]
-                );
+                ++ lib.optional stdenv.hostPlatform.isDarwin [
+                  swiftPackages.swift
+                ];
               build = ''
                 dotnet restore -p:PublishAot=true
                 dotnet publish -p:PublishAot=true -o $out/bin
diff --git a/pkgs/development/compilers/elm/packages/elm-test-rs/default.nix b/pkgs/development/compilers/elm/packages/elm-test-rs/default.nix
index 09cd91fde758..7551d4762cf4 100644
--- a/pkgs/development/compilers/elm/packages/elm-test-rs/default.nix
+++ b/pkgs/development/compilers/elm/packages/elm-test-rs/default.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   openssl,
   stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -18,15 +17,7 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-l3RV+j3wAQ88QGNXLILp7YiUpdk7bkN25Y723pDZw48=";
   };
 
-  buildInputs =
-    lib.optionals (!stdenv.hostPlatform.isDarwin) [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        Security
-        CoreServices
-      ]
-    );
+  buildInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) [ openssl ];
 
   useFetchCargoVendor = true;
   cargoHash = "sha256-F3/v4zYGZRv1PRVl/Tas+e0pc/dTM6ina+/c63KVuZY=";
diff --git a/pkgs/development/compilers/gcc/common/dependencies.nix b/pkgs/development/compilers/gcc/common/dependencies.nix
index 5356ac149022..ee62f1da0e1f 100644
--- a/pkgs/development/compilers/gcc/common/dependencies.nix
+++ b/pkgs/development/compilers/gcc/common/dependencies.nix
@@ -14,7 +14,6 @@
   libmpc,
   libucontext ? null,
   libxcrypt ? null,
-  darwin ? null,
   isSnapshot ? false,
   isl ? null,
   zlib ? null,
@@ -81,10 +80,7 @@ in
     ]
     ++ optionals (isl != null) [ isl ]
     ++ optionals (zlib != null) [ zlib ]
-    ++ optionals (langGo && stdenv.hostPlatform.isMusl) [ libucontext ]
-    ++ optionals (lib.versionAtLeast version "14" && stdenv.hostPlatform.isDarwin) [
-      darwin.apple_sdk.frameworks.CoreServices
-    ];
+    ++ optionals (langGo && stdenv.hostPlatform.isMusl) [ libucontext ];
 
   depsTargetTarget = optionals (
     !withoutTargetLibc && threadsCross != { } && threadsCross.package != null
diff --git a/pkgs/development/compilers/gcc/patches/14/aarch64-fix-ice-subreg.patch b/pkgs/development/compilers/gcc/patches/14/aarch64-fix-ice-subreg.patch
new file mode 100644
index 000000000000..a8783ddbfa27
--- /dev/null
+++ b/pkgs/development/compilers/gcc/patches/14/aarch64-fix-ice-subreg.patch
@@ -0,0 +1,87 @@
+diff --git a/gcc/config/aarch64/aarch64.md b/gcc/config/aarch64/aarch64.md
+index d3c381e82ce..6a481059bf0 100644
+--- a/gcc/config/aarch64/aarch64.md
++++ b/gcc/config/aarch64/aarch64.md
+@@ -6161,8 +6161,8 @@
+ 			  (match_dup 1))
+ 	(match_dup 2))]
+   {
+-    operands[2] = lowpart_subreg (<GPI:MODE>mode, operands[2],
+-				  <ALLX:MODE>mode);
++    operands[2] = force_lowpart_subreg (<GPI:MODE>mode, operands[2],
++					<ALLX:MODE>mode);
+   }
+   [(set_attr "type" "bfm,neon_ins_q,neon_ins_q")
+    (set_attr "arch" "*,simd,simd")]
+@@ -7210,7 +7210,7 @@
+ 
+       emit_insn (gen_iorv2<v_int_equiv>3 (
+ 	lowpart_subreg (V2<V_INT_EQUIV>mode, operands[0], <MODE>mode),
+-	lowpart_subreg (V2<V_INT_EQUIV>mode, operands[1], <MODE>mode),
++	force_lowpart_subreg (V2<V_INT_EQUIV>mode, operands[1], <MODE>mode),
+ 	v_bitmask));
+       DONE;
+     }
+@@ -7255,8 +7255,8 @@
+   "TARGET_SIMD"
+ {
+   rtx tmp = gen_reg_rtx (<VCONQ>mode);
+-  rtx op1 = lowpart_subreg (<VCONQ>mode, operands[1], <MODE>mode);
+-  rtx op2 = lowpart_subreg (<VCONQ>mode, operands[2], <MODE>mode);
++  rtx op1 = force_lowpart_subreg (<VCONQ>mode, operands[1], <MODE>mode);
++  rtx op2 = force_lowpart_subreg (<VCONQ>mode, operands[2], <MODE>mode);
+   emit_insn (gen_xorsign3 (<VCONQ>mode, tmp, op1, op2));
+   emit_move_insn (operands[0],
+ 		  lowpart_subreg (<MODE>mode, tmp, <VCONQ>mode));
+diff --git a/gcc/explow.cc b/gcc/explow.cc
+index f6843398c4b..80f59418bca 100644
+--- a/gcc/explow.cc
++++ b/gcc/explow.cc
+@@ -760,6 +760,34 @@ force_subreg (machine_mode outermode, rtx op,
+   return simplify_gen_subreg (outermode, op, innermode, byte);
+ }
+ 
++/* Try to return an rvalue expression for the OUTERMODE lowpart of OP,
++   which has mode INNERMODE.  Allow OP to be forced into a new register
++   if necessary.
++
++   Return null on failure.  */
++
++rtx
++force_lowpart_subreg (machine_mode outermode, rtx op,
++		      machine_mode innermode)
++{
++  auto byte = subreg_lowpart_offset (outermode, innermode);
++  return force_subreg (outermode, op, innermode, byte);
++}
++
++/* Try to return an rvalue expression for the OUTERMODE highpart of OP,
++   which has mode INNERMODE.  Allow OP to be forced into a new register
++   if necessary.
++
++   Return null on failure.  */
++
++rtx
++force_highpart_subreg (machine_mode outermode, rtx op,
++		       machine_mode innermode)
++{
++  auto byte = subreg_highpart_offset (outermode, innermode);
++  return force_subreg (outermode, op, innermode, byte);
++}
++
+ /* If X is a memory ref, copy its contents to a new temp reg and return
+    that reg.  Otherwise, return X.  */
+ 
+diff --git a/gcc/explow.h b/gcc/explow.h
+index cbd1fcb7eb3..de89e9e2933 100644
+--- a/gcc/explow.h
++++ b/gcc/explow.h
+@@ -43,6 +43,8 @@ extern rtx copy_to_suggested_reg (rtx, rtx, machine_mode);
+ extern rtx force_reg (machine_mode, rtx);
+ 
+ extern rtx force_subreg (machine_mode, rtx, machine_mode, poly_uint64);
++extern rtx force_lowpart_subreg (machine_mode, rtx, machine_mode);
++extern rtx force_highpart_subreg (machine_mode, rtx, machine_mode);
+ 
+ /* Return given rtx, copied into a new temp reg if it was in memory.  */
+ extern rtx force_not_mem (rtx);
diff --git a/pkgs/development/compilers/gcc/patches/default.nix b/pkgs/development/compilers/gcc/patches/default.nix
index 7adc06b35779..598c42a48d3e 100644
--- a/pkgs/development/compilers/gcc/patches/default.nix
+++ b/pkgs/development/compilers/gcc/patches/default.nix
@@ -94,6 +94,11 @@ in
 ++ optional langD ./libphobos.patch
 ++ optional (!atLeast14) ./cfi_startproc-reorder-label-09-1.diff
 ++ optional (atLeast14 && !canApplyIainsDarwinPatches) ./cfi_startproc-reorder-label-14-1.diff
+# backports of https://gcc.gnu.org/bugzilla/show_bug.cgi?id=118501
+#          and https://gcc.gnu.org/bugzilla/show_bug.cgi?id=118892
+#          and https://gcc.gnu.org/bugzilla/show_bug.cgi?id=119133
+# (hopefully all three will be included in the upcoming 14.3.0 release)
+++ optional is14 ./14/aarch64-fix-ice-subreg.patch
 
 ## 2. Patches relevant to gcc>=12 on specific platforms ####################################
 
diff --git a/pkgs/development/compilers/ghc/9.8.4-binary.nix b/pkgs/development/compilers/ghc/9.8.4-binary.nix
new file mode 100644
index 000000000000..db48cfe430fd
--- /dev/null
+++ b/pkgs/development/compilers/ghc/9.8.4-binary.nix
@@ -0,0 +1,491 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  perl,
+  gcc,
+  ncurses6,
+  gmp,
+  libiconv,
+  numactl,
+  libffi,
+  llvmPackages,
+  coreutils,
+  targetPackages,
+
+  # minimal = true; will remove files that aren't strictly necessary for
+  # regular builds and GHC bootstrapping.
+  # This is "useful" for staying within hydra's output limits for at least the
+  # aarch64-linux architecture.
+  minimal ? false,
+}:
+
+# Prebuilt only does native
+assert stdenv.targetPlatform == stdenv.hostPlatform;
+
+let
+  downloadsUrl = "https://downloads.haskell.org/ghc";
+
+  # Copy sha256 from https://downloads.haskell.org/~ghc/9.8.4/SHA256SUMS
+  version = "9.8.4";
+
+  # Information about available bindists that we use in the build.
+  #
+  # # Bindist library checking
+  #
+  # The field `archSpecificLibraries` also provides a way for us get notified
+  # early when the upstream bindist changes its dependencies (e.g. because a
+  # newer Debian version is used that uses a new `ncurses` version).
+  #
+  # Usage:
+  #
+  # * You can find the `fileToCheckFor` of libraries by running `readelf -d`
+  #   on the compiler binary (`exePathForLibraryCheck`).
+  # * To skip library checking for an architecture,
+  #   set `exePathForLibraryCheck = null`.
+  # * To skip file checking for a specific arch specific library,
+  #   set `fileToCheckFor = null`.
+  ghcBinDists = {
+    # Binary distributions for the default libc (e.g. glibc, or libSystem on Darwin)
+    # nixpkgs uses for the respective system.
+    defaultLibc = {
+      i686-linux = {
+        variantSuffix = "";
+        src = {
+          url = "${downloadsUrl}/${version}/ghc-${version}-i386-deb10-linux.tar.xz";
+          sha256 = "e5efce16c654d5e702986258a87dd9531e1722b8051823c8ce1150ce3c5899ae";
+        };
+        exePathForLibraryCheck = "bin/ghc";
+        archSpecificLibraries = [
+          {
+            nixPackage = gmp;
+            fileToCheckFor = null;
+          }
+          {
+            nixPackage = ncurses6;
+            fileToCheckFor = "libtinfo.so.6";
+          }
+        ];
+      };
+      x86_64-linux = {
+        variantSuffix = "";
+        src = {
+          url = "${downloadsUrl}/${version}/ghc-${version}-x86_64-deb11-linux.tar.xz";
+          sha256 = "af151db8682b8c763f5a44f960f65453d794c95b60f151abc82dbdefcbe6f8ad";
+        };
+        exePathForLibraryCheck = "bin/ghc";
+        archSpecificLibraries = [
+          {
+            nixPackage = gmp;
+            fileToCheckFor = null;
+          }
+          {
+            nixPackage = ncurses6;
+            fileToCheckFor = "libtinfo.so.6";
+          }
+        ];
+      };
+      aarch64-linux = {
+        variantSuffix = "";
+        src = {
+          url = "${downloadsUrl}/${version}/ghc-${version}-aarch64-deb11-linux.tar.xz";
+          sha256 = "310204daf2df6ad16087be94b3498ca414a0953b29e94e8ec8eb4a5c9bf603d3";
+        };
+        exePathForLibraryCheck = "bin/ghc";
+        archSpecificLibraries = [
+          {
+            nixPackage = gmp;
+            fileToCheckFor = null;
+          }
+          {
+            nixPackage = ncurses6;
+            fileToCheckFor = "libtinfo.so.6";
+          }
+          {
+            nixPackage = numactl;
+            fileToCheckFor = null;
+          }
+        ];
+      };
+      x86_64-darwin = {
+        variantSuffix = "";
+        src = {
+          url = "${downloadsUrl}/${version}/ghc-${version}-x86_64-apple-darwin.tar.xz";
+          sha256 = "de7baacfb1513ab0e4ccf8911045cceee84bc8a4e39b89bd975ed3135e5f7d96";
+        };
+        exePathForLibraryCheck = null; # we don't have a library check for darwin yet
+        archSpecificLibraries = [
+          {
+            nixPackage = gmp;
+            fileToCheckFor = null;
+          }
+          {
+            nixPackage = ncurses6;
+            fileToCheckFor = null;
+          }
+          {
+            nixPackage = libiconv;
+            fileToCheckFor = null;
+          }
+        ];
+      };
+      aarch64-darwin = {
+        variantSuffix = "";
+        src = {
+          url = "${downloadsUrl}/${version}/ghc-${version}-aarch64-apple-darwin.tar.xz";
+          sha256 = "e2f12a922754fd28511512875bf6d9eb3e0cce7fc963a7266f6e1661aeabd7ed";
+        };
+        exePathForLibraryCheck = null; # we don't have a library check for darwin yet
+        archSpecificLibraries = [
+          {
+            nixPackage = gmp;
+            fileToCheckFor = null;
+          }
+          {
+            nixPackage = ncurses6;
+            fileToCheckFor = null;
+          }
+          {
+            nixPackage = libiconv;
+            fileToCheckFor = null;
+          }
+        ];
+      };
+    };
+    # Binary distributions for the musl libc for the respective system.
+    musl = {
+      aarch64-linux = {
+        variantSuffix = "-musl";
+        src = {
+          url = "${downloadsUrl}/${version}/ghc-${version}-aarch64-alpine3_18-linux.tar.xz";
+          sha256 = "b5c86a0cda0bd62d5eeeb52b1937c3bd00c70cd67dd74226ce787d5c429a4e62";
+        };
+        exePathForLibraryCheck = "bin/ghc";
+        archSpecificLibraries = [
+          {
+            nixPackage = gmp;
+            fileToCheckFor = null;
+          }
+          {
+            nixPackage = ncurses6;
+            fileToCheckFor = "libncursesw.so.6";
+          }
+        ];
+      };
+      x86_64-linux = {
+        variantSuffix = "-musl";
+        src = {
+          url = "${downloadsUrl}/${version}/ghc-${version}-x86_64-alpine3_12-linux.tar.xz";
+          sha256 = "e34bb16e8387509adc96a3d98b4a444bab425d12864c38a3629f2860b4bec2e7";
+        };
+        exePathForLibraryCheck = "bin/ghc";
+        archSpecificLibraries = [
+          {
+            nixPackage = gmp;
+            fileToCheckFor = null;
+          }
+          {
+            nixPackage = ncurses6;
+            fileToCheckFor = "libncursesw.so.6";
+          }
+        ];
+      };
+    };
+  };
+
+  distSetName = if stdenv.hostPlatform.isMusl then "musl" else "defaultLibc";
+
+  binDistUsed =
+    ghcBinDists.${distSetName}.${stdenv.hostPlatform.system}
+      or (throw "cannot bootstrap GHC on this platform ('${stdenv.hostPlatform.system}' with libc '${distSetName}')");
+
+  gmpUsed =
+    (builtins.head (
+      builtins.filter (
+        drv: lib.hasPrefix "gmp" (drv.nixPackage.name or "")
+      ) binDistUsed.archSpecificLibraries
+    )).nixPackage;
+
+  useLLVM = !(import ./common-have-ncg.nix { inherit lib stdenv version; });
+
+  libPath = lib.makeLibraryPath (
+    # Add arch-specific libraries.
+    map ({ nixPackage, ... }: nixPackage) binDistUsed.archSpecificLibraries
+  );
+
+  libEnvVar = lib.optionalString stdenv.hostPlatform.isDarwin "DY" + "LD_LIBRARY_PATH";
+
+  runtimeDeps =
+    [
+      targetPackages.stdenv.cc
+      targetPackages.stdenv.cc.bintools
+      coreutils # for cat
+    ]
+    ++ lib.optionals useLLVM [
+      (lib.getBin llvmPackages.llvm)
+    ]
+    # On darwin, we need unwrapped bintools as well (for otool)
+    ++ lib.optionals (stdenv.targetPlatform.linker == "cctools") [
+      targetPackages.stdenv.cc.bintools.bintools
+    ];
+
+in
+
+stdenv.mkDerivation {
+  inherit version;
+  pname = "ghc-binary${binDistUsed.variantSuffix}";
+
+  src = fetchurl binDistUsed.src;
+
+  nativeBuildInputs = [ perl ];
+
+  # Set LD_LIBRARY_PATH or equivalent so that the programs running as part
+  # of the bindist installer can find the libraries they expect.
+  # Cannot patchelf beforehand due to relative RPATHs that anticipate
+  # the final install location.
+  ${libEnvVar} = libPath;
+
+  postUnpack =
+    # Verify our assumptions of which `libtinfo.so` (ncurses) version is used,
+    # so that we know when ghc bindists upgrade that and we need to update the
+    # version used in `libPath`.
+    lib.optionalString (binDistUsed.exePathForLibraryCheck != null)
+      # Note the `*` glob because some GHCs have a suffix when unpacked, e.g.
+      # the musl bindist has dir `ghc-VERSION-x86_64-unknown-linux/`.
+      # As a result, don't shell-quote this glob when splicing the string.
+      (
+        let
+          buildExeGlob = ''ghc-${version}*/"${binDistUsed.exePathForLibraryCheck}"'';
+        in
+        lib.concatStringsSep "\n" [
+          (''
+            shopt -u nullglob
+            echo "Checking that ghc binary exists in bindist at ${buildExeGlob}"
+            if ! test -e ${buildExeGlob}; then
+              echo >&2 "GHC binary ${binDistUsed.exePathForLibraryCheck} could not be found in the bindist build directory (at ${buildExeGlob}) for arch ${stdenv.hostPlatform.system}, please check that ghcBinDists correctly reflect the bindist dependencies!"; exit 1;
+            fi
+          '')
+          (lib.concatMapStringsSep "\n" (
+            { fileToCheckFor, nixPackage }:
+            lib.optionalString (fileToCheckFor != null) ''
+              echo "Checking bindist for ${fileToCheckFor} to ensure that is still used"
+              if ! readelf -d ${buildExeGlob} | grep "${fileToCheckFor}"; then
+                echo >&2 "File ${fileToCheckFor} could not be found in ${binDistUsed.exePathForLibraryCheck} for arch ${stdenv.hostPlatform.system}, please check that ghcBinDists correctly reflect the bindist dependencies!"; exit 1;
+              fi
+
+              echo "Checking that the nix package ${nixPackage} contains ${fileToCheckFor}"
+              if ! test -e "${lib.getLib nixPackage}/lib/${fileToCheckFor}"; then
+                echo >&2 "Nix package ${nixPackage} did not contain ${fileToCheckFor} for arch ${stdenv.hostPlatform.system}, please check that ghcBinDists correctly reflect the bindist dependencies!"; exit 1;
+              fi
+            ''
+          ) binDistUsed.archSpecificLibraries)
+        ]
+      )
+    # GHC has dtrace probes, which causes ld to try to open /usr/lib/libdtrace.dylib
+    # during linking
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      export NIX_LDFLAGS+=" -no_dtrace_dof"
+      # not enough room in the object files for the full path to libiconv :(
+      for exe in $(find . -type f -executable); do
+        isMachO $exe || continue
+        ln -fs ${libiconv}/lib/libiconv.dylib $(dirname $exe)/libiconv.dylib
+        install_name_tool -change /usr/lib/libiconv.2.dylib @executable_path/libiconv.dylib -change /usr/local/lib/gcc/6/libgcc_s.1.dylib ${gcc.cc.lib}/lib/libgcc_s.1.dylib $exe
+      done
+    ''
+
+    # We have to patch the GMP paths for the ghc-bignum package, for hadrian by
+    # modifying the package-db directly
+    + ''
+      find . -name 'ghc-bignum*.conf' \
+          -exec sed -e '/^[a-z-]*library-dirs/a \    ${lib.getLib gmpUsed}/lib' -i {} \;
+    ''
+    # Similar for iconv and libffi on darwin
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      find . -name 'base*.conf' \
+          -exec sed -e '/^[a-z-]*library-dirs/a \    ${lib.getLib libiconv}/lib' -i {} \;
+
+      # To link RTS in the end we also need libffi now
+      find . -name 'rts*.conf' \
+          -exec sed -e '/^[a-z-]*library-dirs/a \    ${lib.getLib libffi}/lib' \
+                    -e 's@/Library/Developer/.*/usr/include/ffi@${lib.getDev libffi}/include@' \
+                    -i {} \;
+    ''
+    +
+      # aarch64 does HAVE_NUMA so -lnuma requires it in library-dirs in rts/package.conf.in
+      # FFI_LIB_DIR is a good indication of places it must be needed.
+      lib.optionalString (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) ''
+        find . -name package.conf.in \
+            -exec sed -i "s@FFI_LIB_DIR@FFI_LIB_DIR ${numactl.out}/lib@g" {} \;
+      ''
+    +
+      # Rename needed libraries and binaries, fix interpreter
+      lib.optionalString stdenv.hostPlatform.isLinux ''
+        find . -type f -executable -exec patchelf \
+            --interpreter ${stdenv.cc.bintools.dynamicLinker} {} \;
+      '';
+
+  # fix for `configure: error: Your linker is affected by binutils #16177`
+  preConfigure = lib.optionalString stdenv.targetPlatform.isAarch32 "LD=ld.gold";
+
+  # GHC has a patched config.sub and bindists' platforms should always work
+  dontUpdateAutotoolsGnuConfigScripts = true;
+
+  configurePlatforms = [ ];
+  configureFlags =
+    lib.optional stdenv.hostPlatform.isDarwin "--with-gcc=${./gcc-clang-wrapper.sh}"
+    # From: https://github.com/NixOS/nixpkgs/pull/43369/commits
+    ++ lib.optional stdenv.hostPlatform.isMusl "--disable-ld-override";
+
+  # No building is necessary, but calling make without flags ironically
+  # calls install-strip ...
+  dontBuild = true;
+
+  # Patch scripts to include runtime dependencies in $PATH.
+  postInstall =
+    ''
+      for i in "$out/bin/"*; do
+        test ! -h "$i" || continue
+        isScript "$i" || continue
+        sed -i -e '2i export PATH="${lib.makeBinPath runtimeDeps}:$PATH"' "$i"
+      done
+    ''
+    + lib.optionalString stdenv.targetPlatform.isDarwin ''
+      # Work around building with binary GHC on Darwin due to GHC’s use of `ar -L` when it
+      # detects `llvm-ar` even though the resulting archives are not supported by ld64.
+      # https://gitlab.haskell.org/ghc/ghc/-/issues/23188
+      # https://github.com/haskell/cabal/issues/8882
+      sed -i -e 's/,("ar supports -L", "YES")/,("ar supports -L", "NO")/' "$out/lib/ghc-${version}/lib/settings"
+    '';
+
+  # Apparently necessary for the ghc Alpine (musl) bindist:
+  # When we strip, and then run the
+  #     patchelf --set-rpath "${libPath}:$(patchelf --print-rpath $p)" $p
+  # below, running ghc (e.g. during `installCheckPhase)` gives some apparently
+  # corrupted rpath or whatever makes the loader work on nonsensical strings:
+  #     running install tests
+  #     Error relocating /nix/store/...-ghc-8.10.2-binary/lib/ghc-8.10.5/bin/ghc: : symbol not found
+  #     Error relocating /nix/store/...-ghc-8.10.2-binary/lib/ghc-8.10.5/bin/ghc: ir6zf6c9f86pfx8sr30n2vjy-ghc-8.10.2-binary/lib/ghc-8.10.5/bin/../lib/x86_64-linux-ghc-8.10.5/libHSexceptions-0.10.4-ghc8.10.5.so: symbol not found
+  #     Error relocating /nix/store/...-ghc-8.10.2-binary/lib/ghc-8.10.5/bin/ghc: y/lib/ghc-8.10.5/bin/../lib/x86_64-linux-ghc-8.10.5/libHStemplate-haskell-2.16.0.0-ghc8.10.5.so: symbol not found
+  #     Error relocating /nix/store/...-ghc-8.10.2-binary/lib/ghc-8.10.5/bin/ghc: 8.10.5/libHStemplate-haskell-2.16.0.0-ghc8.10.5.so: symbol not found
+  #     Error relocating /nix/store/...-ghc-8.10.2-binary/lib/ghc-8.10.5/bin/ghc: �: symbol not found
+  #     Error relocating /nix/store/...-ghc-8.10.2-binary/lib/ghc-8.10.5/bin/ghc: �?: symbol not found
+  #     Error relocating /nix/store/...-ghc-8.10.2-binary/lib/ghc-8.10.5/bin/ghc: 64-linux-ghc-8.10.5/libHSexceptions-0.10.4-ghc8.10.5.so: symbol not found
+  # This is extremely bogus and should be investigated.
+  dontStrip = if stdenv.hostPlatform.isMusl then true else false; # `if` for explicitness
+
+  # On Linux, use patchelf to modify the executables so that they can
+  # find editline/gmp.
+  postFixup =
+    lib.optionalString (stdenv.hostPlatform.isLinux && !(binDistUsed.isStatic or false)) (
+      if stdenv.hostPlatform.isAarch64 then
+        # Keep rpath as small as possible on aarch64 for patchelf#244.  All Elfs
+        # are 2 directories deep from $out/lib, so pooling symlinks there makes
+        # a short rpath.
+        ''
+          (cd $out/lib; ln -s ${lib.getLib gmpUsed}/lib/libgmp.so.10)
+        ''
+        + (
+          if stdenv.hostPlatform.isMusl then
+            ''
+              (cd $out/lib; ln -s ${ncurses6.out}/lib/libncursesw.so.6)
+            ''
+          else
+            ''
+              (cd $out/lib; ln -s ${ncurses6.out}/lib/libtinfo.so.6)
+            ''
+        )
+        + ''
+          for p in $(find "$out/lib" -type f -name "*\.so*"); do
+            (cd $out/lib; ln -s $p)
+          done
+
+          for p in $(find "$out/lib" -type f -executable); do
+            if isELF "$p"; then
+              echo "Patchelfing $p"
+              patchelf --set-rpath "\$ORIGIN:\$ORIGIN/../.." $p
+            fi
+          done
+        ''
+      else
+        ''
+          for p in $(find "$out" -type f -executable); do
+            if isELF "$p"; then
+              echo "Patchelfing $p"
+              patchelf --set-rpath "${libPath}:$(patchelf --print-rpath $p)" $p
+            fi
+          done
+        ''
+    )
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      # not enough room in the object files for the full path to libiconv :(
+      for exe in $(find "$out" -type f -executable); do
+        isMachO $exe || continue
+        ln -fs ${libiconv}/lib/libiconv.dylib $(dirname $exe)/libiconv.dylib
+        install_name_tool -change /usr/lib/libiconv.2.dylib @executable_path/libiconv.dylib -change /usr/local/lib/gcc/6/libgcc_s.1.dylib ${gcc.cc.lib}/lib/libgcc_s.1.dylib $exe
+      done
+
+      for file in $(find "$out" -name setup-config); do
+        substituteInPlace $file --replace /usr/bin/ranlib "$(type -P ranlib)"
+      done
+    ''
+    # Recache package db which needs to happen for Hadrian bindists
+    # where we modify the package db before installing
+    + ''
+      package_db=("$out"/lib/ghc-*/lib/package.conf.d)
+      "$out/bin/ghc-pkg" --package-db="$package_db" recache
+    '';
+
+  # GHC cannot currently produce outputs that are ready for `-pie` linking.
+  # Thus, disable `pie` hardening, otherwise `recompile with -fPIE` errors appear.
+  # See:
+  # * https://github.com/NixOS/nixpkgs/issues/129247
+  # * https://gitlab.haskell.org/ghc/ghc/-/issues/19580
+  hardeningDisable = [ "pie" ];
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    # Sanity check, can ghc create executables?
+    cd $TMP
+    mkdir test-ghc; cd test-ghc
+    cat > main.hs << EOF
+      {-# LANGUAGE TemplateHaskell #-}
+      module Main where
+      main = putStrLn \$([|"yes"|])
+    EOF
+    env -i $out/bin/ghc --make main.hs || exit 1
+    echo compilation ok
+    [ $(./main) == "yes" ]
+  '';
+
+  passthru = {
+    targetPrefix = "";
+    enableShared = true;
+
+    inherit llvmPackages;
+
+    # Our Cabal compiler name
+    haskellCompilerName = "ghc-${version}";
+
+    # Normal GHC derivations expose the hadrian derivation used to build them
+    # here. In the case of bindists we just make sure that the attribute exists,
+    # as it is used for checking if a GHC derivation has been built with hadrian.
+    hadrian = null;
+  };
+
+  meta = rec {
+    homepage = "http://haskell.org/ghc";
+    description = "Glasgow Haskell Compiler";
+    license = lib.licenses.bsd3;
+    # HACK: since we can't encode the libc / abi in platforms, we need
+    # to make the platform list dependent on the evaluation platform
+    # in order to avoid eval errors with musl which supports less
+    # platforms than the default libcs (i. e. glibc / libSystem).
+    # This is done for the benefit of Hydra, so `packagePlatforms`
+    # won't return any platforms that would cause an evaluation
+    # failure for `pkgsMusl.haskell.compiler.ghc922Binary`, as
+    # long as the evaluator runs on a platform that supports
+    # `pkgsMusl`.
+    platforms = builtins.attrNames ghcBinDists.${distSetName};
+    maintainers = lib.teams.haskell.members;
+  };
+}
diff --git a/pkgs/development/compilers/ghc/common-hadrian.nix b/pkgs/development/compilers/ghc/common-hadrian.nix
index 85123cdef37b..2ab984fa6e2e 100644
--- a/pkgs/development/compilers/ghc/common-hadrian.nix
+++ b/pkgs/development/compilers/ghc/common-hadrian.nix
@@ -22,14 +22,12 @@
 
   # build-tools
   bootPkgs,
-  autoconf,
-  automake,
+  autoreconfHook,
   coreutils,
   fetchurl,
   fetchgit,
   perl,
   python3,
-  m4,
   sphinx,
   xattr,
   autoSignDarwinBinariesHook,
@@ -273,7 +271,26 @@
           ])
           [
             ../../tools/haskell/hadrian/hadrian-9.8.1-allow-Cabal-3.10.patch
-          ];
+          ]
+      ++ lib.optionals (lib.versionAtLeast version "9.8" && lib.versionOlder version "9.12") [
+        (fetchpatch {
+          name = "enable-ignore-build-platform-mismatch.patch";
+          url = "https://gitlab.haskell.org/ghc/ghc/-/commit/4ee094d46effd06093090fcba70f0a80d2a57e6c.patch";
+          includes = [ "configure.ac" ];
+          hash = "sha256-L3FQvcm9QB59BOiR2g5/HACAufIG08HiT53EIOjj64g=";
+        })
+      ]
+      # Fixes stack overrun in rts which crashes an process whenever
+      # freeHaskellFunPtr is called with nixpkgs' hardening flags.
+      # https://gitlab.haskell.org/ghc/ghc/-/issues/25485
+      # https://gitlab.haskell.org/ghc/ghc/-/merge_requests/13599
+      ++ lib.optionals (lib.versionOlder version "9.13" && stdenv.hostPlatform.is32bit) [
+        (fetchpatch {
+          name = "ghc-rts-adjustor-fix-i386-stack-overrun.patch";
+          url = "https://gitlab.haskell.org/ghc/ghc/-/commit/39bb6e583d64738db51441a556d499aa93a4fc4a.patch";
+          sha256 = "0w5fx413z924bi2irsy1l4xapxxhrq158b5gn6jzrbsmhvmpirs0";
+        })
+      ];
 
     stdenv = stdenvNoCC;
   },
@@ -637,7 +654,15 @@ stdenv.mkDerivation (
       ]
       ++ lib.optionals enableUnregisterised [
         "--enable-unregisterised"
-      ];
+      ]
+      ++
+        lib.optionals
+          (stdenv.buildPlatform.isAarch64 && stdenv.buildPlatform.isMusl && lib.versionOlder version "9.12")
+          [
+            # The bootstrap binaries for aarch64 musl were built for the wrong triple.
+            # https://gitlab.haskell.org/ghc/ghc/-/merge_requests/13182
+            "--enable-ignore-build-platform-mismatch"
+          ];
 
     # Make sure we never relax`$PATH` and hooks support for compatibility.
     strictDeps = true;
@@ -647,15 +672,12 @@ stdenv.mkDerivation (
 
     nativeBuildInputs =
       [
+        autoreconfHook
         perl
         hadrian
         bootPkgs.alex
         bootPkgs.happy
         bootPkgs.hscolour
-        # autoconf and friends are necessary for hadrian to create the bindist
-        autoconf
-        automake
-        m4
         # Python is used in a few scripts invoked by hadrian to generate e.g. rts headers.
         python3
         # Tool used to update GHC's settings file in postInstall
@@ -693,11 +715,17 @@ stdenv.mkDerivation (
     depsTargetTarget = map lib.getDev (libDeps targetPlatform);
     depsTargetTargetPropagated = map (lib.getOutput "out") (libDeps targetPlatform);
 
-    hadrianFlags = [
-      "--flavour=${ghcFlavour}"
-      "--bignum=${if enableNativeBignum then "native" else "gmp"}"
-      "--docs=${if enableDocs then "no-sphinx-pdfs" else "no-sphinx"}"
-    ];
+    hadrianFlags =
+      [
+        "--flavour=${ghcFlavour}"
+        "--bignum=${if enableNativeBignum then "native" else "gmp"}"
+        "--docs=${if enableDocs then "no-sphinx-pdfs" else "no-sphinx"}"
+      ]
+      ++ lib.optionals (lib.versionAtLeast version "9.8") [
+        # In 9.14 this will be default with release flavour.
+        # See https://gitlab.haskell.org/ghc/ghc/-/merge_requests/13444
+        "--hash-unit-ids"
+      ];
 
     buildPhase = ''
       runHook preBuild
diff --git a/pkgs/development/compilers/graalvm/community-edition/buildGraalvmProduct.nix b/pkgs/development/compilers/graalvm/community-edition/buildGraalvmProduct.nix
index 088002e6f6d7..7934baca3a6a 100644
--- a/pkgs/development/compilers/graalvm/community-edition/buildGraalvmProduct.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/buildGraalvmProduct.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   autoPatchelfHook,
-  darwin,
   graalvm-ce,
   makeWrapper,
   zlib,
@@ -39,14 +38,11 @@ stdenv.mkDerivation (
       ++ lib.optional stdenv.hostPlatform.isLinux autoPatchelfHook
       ++ extraNativeBuildInputs;
 
-    buildInputs =
-      [
-        (lib.getLib stdenv.cc.cc) # libstdc++.so.6
-        zlib
-        libxcrypt-legacy # libcrypt.so.1 (default is .2 now)
-      ]
-      ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.frameworks.Foundation
-      ++ extraBuildInputs;
+    buildInputs = [
+      (lib.getLib stdenv.cc.cc) # libstdc++.so.6
+      zlib
+      libxcrypt-legacy # libcrypt.so.1 (default is .2 now)
+    ] ++ extraBuildInputs;
 
     unpackPhase = ''
       runHook preUnpack
diff --git a/pkgs/development/compilers/haxe/default.nix b/pkgs/development/compilers/haxe/default.nix
index 4756acfb425f..0207f345bf26 100644
--- a/pkgs/development/compilers/haxe/default.nix
+++ b/pkgs/development/compilers/haxe/default.nix
@@ -9,7 +9,6 @@
   pcre2,
   neko,
   mbedtls_2,
-  Security,
 }:
 let
   ocamlDependencies =
@@ -66,7 +65,6 @@ let
         ]
         ++ (if lib.versionAtLeast version "4.3" then [ pcre2 ] else [ pcre ])
         ++ lib.optional (lib.versionAtLeast version "4.1") mbedtls_2
-        ++ lib.optional (lib.versionAtLeast version "4.1" && stdenv.hostPlatform.isDarwin) Security
         ++ ocamlDependencies version;
 
       src = fetchFromGitHub {
diff --git a/pkgs/development/compilers/kind2/default.nix b/pkgs/development/compilers/kind2/default.nix
index 54d7f8c68977..0d1840400d7f 100644
--- a/pkgs/development/compilers/kind2/default.nix
+++ b/pkgs/development/compilers/kind2/default.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchCrate,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -25,10 +23,6 @@ rustPlatform.buildRustPackage rec {
       --replace-fail "e.message().unwrap()" "e.payload()"
   '';
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk_11_0.frameworks.Security
-  ];
-
   # requires nightly features
   RUSTC_BOOTSTRAP = true;
 
diff --git a/pkgs/development/compilers/ligo/default.nix b/pkgs/development/compilers/ligo/default.nix
index cebb3614490d..b83bb18c23bb 100644
--- a/pkgs/development/compilers/ligo/default.nix
+++ b/pkgs/development/compilers/ligo/default.nix
@@ -1,5 +1,4 @@
 {
-  stdenv,
   lib,
   fetchFromGitLab,
   git,
@@ -11,7 +10,6 @@
   mustache-go,
   yaml2json,
   tezos-rust-libs,
-  darwin,
 }:
 
 ocamlPackages.buildDunePackage rec {
@@ -46,80 +44,75 @@ ocamlPackages.buildDunePackage rec {
     yaml2json
   ];
 
-  buildInputs =
-    with ocamlPackages;
-    [
-      coq
-      menhir
-      menhirLib
-      qcheck
-      ocamlgraph
-      bisect_ppx
-      decompress
-      fileutils
-      ppx_deriving
-      ppx_deriving_yojson
-      ppx_yojson_conv
-      ppx_expect
-      ppx_import
-      terminal_size
-      ocaml-recovery-parser
-      yojson
-      getopt
-      core
-      core_unix
-      pprint
-      linenoise
-      crunch
-      semver
-      lambda-term
-      tar-unix
-      parse-argv
-      hacl-star
-      prometheus
-      lwt_ppx
-      msgpck
-      # lsp
-      linol
-      linol-lwt
-      ocaml-lsp
-      # Test helpers deps
-      qcheck
-      qcheck-alcotest
-      alcotest-lwt
-      # vendored tezos' deps
-      aches
-      aches-lwt
-      ctypes
-      ctypes_stubs_js
-      class_group_vdf
-      dune-configurator
-      hacl-star
-      hacl-star-raw
-      lwt-canceler
-      ipaddr
-      bls12-381
-      bls12-381-signature
-      ptime
-      mtime
-      lwt_log
-      secp256k1-internal
-      resto
-      resto-directory
-      resto-cohttp-self-serving-client
-      irmin-pack
-      ezjsonm
-      data-encoding
-      pure-splitmix
-      zarith_stubs_js
-      simple-diff
-      seqes
-      stdint
-      tezt
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = with ocamlPackages; [
+    coq
+    menhir
+    menhirLib
+    qcheck
+    ocamlgraph
+    bisect_ppx
+    decompress
+    fileutils
+    ppx_deriving
+    ppx_deriving_yojson
+    ppx_yojson_conv
+    ppx_expect
+    ppx_import
+    terminal_size
+    ocaml-recovery-parser
+    yojson
+    getopt
+    core
+    core_unix
+    pprint
+    linenoise
+    crunch
+    semver
+    lambda-term
+    tar-unix
+    parse-argv
+    hacl-star
+    prometheus
+    lwt_ppx
+    msgpck
+    # lsp
+    linol
+    linol-lwt
+    ocaml-lsp
+    # Test helpers deps
+    qcheck
+    qcheck-alcotest
+    alcotest-lwt
+    # vendored tezos' deps
+    aches
+    aches-lwt
+    ctypes
+    ctypes_stubs_js
+    class_group_vdf
+    dune-configurator
+    hacl-star
+    hacl-star-raw
+    lwt-canceler
+    ipaddr
+    bls12-381
+    bls12-381-signature
+    ptime
+    mtime
+    lwt_log
+    secp256k1-internal
+    resto
+    resto-directory
+    resto-cohttp-self-serving-client
+    irmin-pack
+    ezjsonm
+    data-encoding
+    pure-splitmix
+    zarith_stubs_js
+    simple-diff
+    seqes
+    stdint
+    tezt
+  ];
 
   nativeCheckInputs = [
     cacert
diff --git a/pkgs/development/compilers/llvm/common/compiler-rt/default.nix b/pkgs/development/compilers/llvm/common/compiler-rt/default.nix
index 1c9841f7501d..f3850f2cadf2 100644
--- a/pkgs/development/compilers/llvm/common/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/common/compiler-rt/default.nix
@@ -47,13 +47,15 @@ let
     && lib.versionAtLeast release_version "16";
   inherit (stdenv.hostPlatform) isMusl isAarch64 isWindows;
   noSanitizers = !haveLibc || bareMetal || isMusl || isDarwinStatic || isWindows;
+in
 
-  baseName = "compiler-rt";
-  pname = baseName + lib.optionalString (haveLibc) "-libc";
+stdenv.mkDerivation (finalAttrs: {
+  pname = "compiler-rt${lib.optionalString (haveLibc) "-libc"}";
+  inherit version;
 
-  src' =
+  src =
     if monorepoSrc != null then
-      runCommand "${baseName}-src-${version}" { inherit (monorepoSrc) passthru; } (
+      runCommand "compiler-rt-src-${version}" { inherit (monorepoSrc) passthru; } (
         ''
           mkdir -p "$out"
         ''
@@ -61,23 +63,23 @@ let
           cp -r ${monorepoSrc}/cmake "$out"
         ''
         + ''
-          cp -r ${monorepoSrc}/${baseName} "$out"
+          cp -r ${monorepoSrc}/compiler-rt "$out"
         ''
       )
     else
       src;
-in
 
-stdenv.mkDerivation {
-  inherit pname version;
-
-  src = src';
-  sourceRoot = "${src'.name}/${baseName}";
+  sourceRoot = "${finalAttrs.src.name}/compiler-rt";
 
   patches =
     lib.optional (lib.versionOlder release_version "15") (getVersionFile "compiler-rt/codesign.patch") # Revert compiler-rt commit that makes codesign mandatory
     ++ [
       (getVersionFile "compiler-rt/X86-support-extension.patch") # Add support for i486 i586 i686 by reusing i386 config
+      # ld-wrapper dislikes `-rpath-link //nix/store`, so we normalize away the
+      # extra `/`.
+      (getVersionFile "compiler-rt/normalize-var.patch")
+      # Fix build on armv6l
+      ./armv6-no-ldrexd-strexd.patch
     ]
     ++ lib.optional (lib.versions.major release_version == "12") (fetchpatch {
       # fixes the parallel build on aarch64 darwin
@@ -98,11 +100,6 @@ stdenv.mkDerivation {
           stripLen = 1;
           hash = "sha256-tGqXsYvUllFrPa/r/dsKVlwx5IrcJGccuR1WAtUg7/o=";
         })
-    ++ [
-      # ld-wrapper dislikes `-rpath-link //nix/store`, so we normalize away the
-      # extra `/`.
-      (getVersionFile "compiler-rt/normalize-var.patch")
-    ]
     ++
       lib.optional (lib.versionAtLeast release_version "13" && lib.versionOlder release_version "18")
         # Prevent a compilation error on darwin
@@ -129,10 +126,6 @@ stdenv.mkDerivation {
           # Fix build on armv6l
           ./armv6-scudo-no-yield.patch
         ]
-    ++ [
-      # Fix build on armv6l
-      ./armv6-no-ldrexd-strexd.patch
-    ]
     ++ lib.optionals (lib.versionAtLeast release_version "13") [
       (getVersionFile "compiler-rt/armv6-scudo-libatomic.patch")
     ]
@@ -143,118 +136,112 @@ stdenv.mkDerivation {
     });
 
   nativeBuildInputs =
-    [ cmake ]
-    ++ (lib.optional (lib.versionAtLeast release_version "15") ninja)
-    ++ [
+    [
+      cmake
       python3
       libllvm.dev
     ]
+    ++ (lib.optional (lib.versionAtLeast release_version "15") ninja)
     ++ lib.optionals stdenv.hostPlatform.isDarwin [ jq ];
   buildInputs =
     lib.optional (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isRiscV) linuxHeaders
     ++ lib.optional (stdenv.hostPlatform.isFreeBSD) freebsd.include;
 
-  env =
-    {
-      NIX_CFLAGS_COMPILE = toString (
-        [
-          "-DSCUDO_DEFAULT_OPTIONS=DeleteSizeMismatch=0:DeallocationTypeMismatch=0"
-        ]
-        ++ lib.optionals (!haveLibc) [
-          # The compiler got stricter about this, and there is a usellvm patch below
-          # which patches out the assert include causing an implicit definition of
-          # assert. It would be nicer to understand why compiler-rt thinks it should
-          # be able to #include <assert.h> in the first place; perhaps it's in the
-          # wrong, or perhaps there is a way to provide an assert.h.
-          "-Wno-error=implicit-function-declaration"
-        ]
-      );
-    }
-    // lib.optionalAttrs (stdenv.hostPlatform.isDarwin) {
-      # Work around clang’s trying to invoke unprefixed-ld on Darwin when `-target` is passed.
-      NIX_CFLAGS_LINK = "--ld-path=${stdenv.cc.bintools}/bin/${stdenv.cc.targetPrefix}ld";
-    };
+  env = {
+    NIX_CFLAGS_COMPILE = toString (
+      [
+        "-DSCUDO_DEFAULT_OPTIONS=DeleteSizeMismatch=0:DeallocationTypeMismatch=0"
+      ]
+      ++ lib.optionals (!haveLibc) [
+        # The compiler got stricter about this, and there is a usellvm patch below
+        # which patches out the assert include causing an implicit definition of
+        # assert. It would be nicer to understand why compiler-rt thinks it should
+        # be able to #include <assert.h> in the first place; perhaps it's in the
+        # wrong, or perhaps there is a way to provide an assert.h.
+        "-Wno-error=implicit-function-declaration"
+      ]
+    );
+
+    # Work around clang’s trying to invoke unprefixed-ld on Darwin when `-target` is passed.
+    NIX_CFLAGS_LINK = lib.optionalString (stdenv.hostPlatform.isDarwin) "--ld-path=${stdenv.cc.bintools}/bin/${stdenv.cc.targetPrefix}ld";
+  };
 
   cmakeFlags =
     [
-      "-DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON"
-      "-DCMAKE_C_COMPILER_TARGET=${stdenv.hostPlatform.config}"
-      "-DCMAKE_ASM_COMPILER_TARGET=${stdenv.hostPlatform.config}"
+      (lib.cmakeBool "COMPILER_RT_DEFAULT_TARGET_ONLY" true)
+      (lib.cmakeFeature "CMAKE_C_COMPILER_TARGET" stdenv.hostPlatform.config)
+      (lib.cmakeFeature "CMAKE_ASM_COMPILER_TARGET" stdenv.hostPlatform.config)
     ]
     ++ lib.optionals (haveLibc && stdenv.hostPlatform.libc == "glibc") [
-      "-DSANITIZER_COMMON_CFLAGS=-I${libxcrypt}/include"
+      (lib.cmakeFeature "SANITIZER_COMMON_CFLAGS" "-I${libxcrypt}/include")
     ]
     ++ lib.optionals (useLLVM && haveLibc && stdenv.cc.libcxx == libcxx) [
-      "-DSANITIZER_CXX_ABI=libcxxabi"
-      "-DSANITIZER_CXX_ABI_LIBNAME=libcxxabi"
-      "-DCOMPILER_RT_USE_BUILTINS_LIBRARY=ON"
+      (lib.cmakeFeature "SANITIZER_CXX_ABI" "libcxxabi")
+      (lib.cmakeFeature "SANITIZER_CXX_ABI_LIBNAME" "libcxxabi")
+      (lib.cmakeBool "COMPILER_RT_USE_BUILTINS_LIBRARY" true)
     ]
     ++
       lib.optionals
         ((!haveLibc || bareMetal || isMusl || isAarch64) && (lib.versions.major release_version == "13"))
         [
-          "-DCOMPILER_RT_BUILD_LIBFUZZER=OFF"
+          (lib.cmakeBool "COMPILER_RT_BUILD_LIBFUZZER" false)
         ]
     ++ lib.optionals (useLLVM && haveLibc) [
-      "-DCOMPILER_RT_BUILD_SANITIZERS=ON"
+      (lib.cmakeBool "COMPILER_RT_BUILD_SANITIZERS" true)
+      (lib.cmakeBool "COMPILER_RT_BUILD_PROFILE" true)
     ]
     ++ lib.optionals (noSanitizers) [
-      "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
+      (lib.cmakeBool "COMPILER_RT_BUILD_SANITIZERS" false)
     ]
     ++ lib.optionals ((useLLVM && !haveLibcxx) || !haveLibc || bareMetal || isMusl || isDarwinStatic) [
-      "-DCOMPILER_RT_BUILD_XRAY=OFF"
-      "-DCOMPILER_RT_BUILD_LIBFUZZER=OFF"
-      "-DCOMPILER_RT_BUILD_MEMPROF=OFF"
-      "-DCOMPILER_RT_BUILD_ORC=OFF" # may be possible to build with musl if necessary
-    ]
-    ++ lib.optionals (useLLVM && haveLibc) [
-      "-DCOMPILER_RT_BUILD_PROFILE=ON"
+      (lib.cmakeBool "COMPILER_RT_BUILD_XRAY" false)
+      (lib.cmakeBool "COMPILER_RT_BUILD_LIBFUZZER" false)
+      (lib.cmakeBool "COMPILER_RT_BUILD_MEMPROF" false)
+      (lib.cmakeBool "COMPILER_RT_BUILD_ORC" false) # may be possible to build with musl if necessary
     ]
     ++ lib.optionals (!haveLibc || bareMetal) [
-      "-DCOMPILER_RT_BUILD_PROFILE=OFF"
+      (lib.cmakeBool "COMPILER_RT_BUILD_PROFILE" false)
+      (lib.cmakeBool "CMAKE_C_COMPILER_WORKS" true)
+      (lib.cmakeBool "COMPILER_RT_BAREMETAL_BUILD" true)
+      (lib.cmakeFeature "CMAKE_SIZEOF_VOID_P" (toString (stdenv.hostPlatform.parsed.cpu.bits / 8)))
     ]
     ++ lib.optionals (!haveLibc || bareMetal || isDarwinStatic) [
-      "-DCMAKE_CXX_COMPILER_WORKS=ON"
-    ]
-    ++ lib.optionals (!haveLibc || bareMetal) [
-      "-DCMAKE_C_COMPILER_WORKS=ON"
-      "-DCOMPILER_RT_BAREMETAL_BUILD=ON"
-      "-DCMAKE_SIZEOF_VOID_P=${toString (stdenv.hostPlatform.parsed.cpu.bits / 8)}"
+      (lib.cmakeBool "CMAKE_CXX_COMPILER_WORKS" true)
     ]
     ++ lib.optionals (!haveLibc) [
-      "-DCMAKE_C_FLAGS=-nodefaultlibs"
+      (lib.cmakeFeature "CMAKE_C_FLAGS" "-nodefaultlibs")
     ]
     ++ lib.optionals (useLLVM) [
-      "-DCOMPILER_RT_BUILD_BUILTINS=ON"
+      (lib.cmakeBool "COMPILER_RT_BUILD_BUILTINS" true)
       #https://stackoverflow.com/questions/53633705/cmake-the-c-compiler-is-not-able-to-compile-a-simple-test-program
-      "-DCMAKE_TRY_COMPILE_TARGET_TYPE=STATIC_LIBRARY"
+      (lib.cmakeFeature "CMAKE_TRY_COMPILE_TARGET_TYPE" "STATIC_LIBRARY")
     ]
     ++ lib.optionals (bareMetal) [
-      "-DCOMPILER_RT_OS_DIR=baremetal"
+      (lib.cmakeFeature "COMPILER_RT_OS_DIR" "baremetal")
     ]
     ++ lib.optionals (stdenv.hostPlatform.isDarwin) (
       lib.optionals (lib.versionAtLeast release_version "16") [
-        "-DCMAKE_LIPO=${lib.getBin stdenv.cc.bintools.bintools}/bin/${stdenv.cc.targetPrefix}lipo"
+        (lib.cmakeFeature "CMAKE_LIPO" "${lib.getBin stdenv.cc.bintools.bintools}/bin/${stdenv.cc.targetPrefix}lipo")
       ]
       ++ lib.optionals (!haveLibcxx) [
         # Darwin fails to detect that the compiler supports the `-g` flag when there is no libc++ during the
         # compiler-rt bootstrap, which prevents compiler-rt from building. The `-g` flag is required by the
         # Darwin support, so force it to be enabled during the first stage of the compiler-rt bootstrap.
-        "-DCOMPILER_RT_HAS_G_FLAG=ON"
+        (lib.cmakeBool "COMPILER_RT_HAS_G_FLAG" true)
       ]
       ++ [
-        "-DDARWIN_osx_ARCHS=${stdenv.hostPlatform.darwinArch}"
-        "-DDARWIN_osx_BUILTIN_ARCHS=${stdenv.hostPlatform.darwinArch}"
-        "-DSANITIZER_MIN_OSX_VERSION=${stdenv.hostPlatform.darwinMinVersion}"
+        (lib.cmakeFeature "DARWIN_osx_ARCHS" stdenv.hostPlatform.darwinArch)
+        (lib.cmakeFeature "DARWIN_osx_BUILTIN_ARCHS" stdenv.hostPlatform.darwinArch)
+        (lib.cmakeFeature "SANITIZER_MIN_OSX_VERSION" stdenv.hostPlatform.darwinMinVersion)
       ]
       ++ lib.optionals (lib.versionAtLeast release_version "15") [
         # `COMPILER_RT_DEFAULT_TARGET_ONLY` does not apply to Darwin:
         # https://github.com/llvm/llvm-project/blob/27ef42bec80b6c010b7b3729ed0528619521a690/compiler-rt/cmake/base-config-ix.cmake#L153
-        "-DCOMPILER_RT_ENABLE_IOS=OFF"
+        (lib.cmakeBool "COMPILER_RT_ENABLE_IOS" false)
       ]
     )
     ++ lib.optionals (noSanitizers && lib.versionAtLeast release_version "19") [
-      "-DCOMPILER_RT_BUILD_CTX_PROFILE=OFF"
+      (lib.cmakeBool "COMPILER_RT_BUILD_CTX_PROFILE" false)
     ]
     ++ devExtraCmakeFlags;
 
@@ -369,4 +356,4 @@ stdenv.mkDerivation {
       # `enable_execute_stack.c` Also doesn't sound like something WASM would support.
       || (stdenv.hostPlatform.isWasm && haveLibc);
   };
-}
+})
diff --git a/pkgs/development/compilers/llvm/common/libunwind/default.nix b/pkgs/development/compilers/llvm/common/libunwind/default.nix
index f8256b13776c..0695d8f2be5b 100644
--- a/pkgs/development/compilers/llvm/common/libunwind/default.nix
+++ b/pkgs/development/compilers/llvm/common/libunwind/default.nix
@@ -15,72 +15,50 @@
   devExtraCmakeFlags ? [ ],
   getVersionFile,
 }:
-let
-  pname = "libunwind";
-  src' =
-    if monorepoSrc != null then
-      runCommand "${pname}-src-${version}" { inherit (monorepoSrc) passthru; } (
-        ''
-          mkdir -p "$out"
-        ''
-        + lib.optionalString (lib.versionAtLeast release_version "14") ''
-          cp -r ${monorepoSrc}/cmake "$out"
-        ''
-        + ''
-          cp -r ${monorepoSrc}/${pname} "$out"
-          mkdir -p "$out/libcxx"
-          cp -r ${monorepoSrc}/libcxx/cmake "$out/libcxx"
-          cp -r ${monorepoSrc}/libcxx/utils "$out/libcxx"
-          mkdir -p "$out/llvm"
-          cp -r ${monorepoSrc}/llvm/cmake "$out/llvm"
-        ''
-        + lib.optionalString (lib.versionAtLeast release_version "15") ''
-          cp -r ${monorepoSrc}/llvm/utils "$out/llvm"
-          cp -r ${monorepoSrc}/runtimes "$out"
-        ''
-      )
-    else
-      src;
-
-  patches = lib.optional (lib.versionOlder release_version "17") (
-    getVersionFile "libunwind/gnu-install-dirs.patch"
-  );
-
-  hasPatches = builtins.length patches > 0;
-
-  prePatch =
-    lib.optionalString
-      (lib.versionAtLeast release_version "15" && (hasPatches || lib.versionOlder release_version "18"))
-      ''
-        cd ../${pname}
-        chmod -R u+w .
-      '';
-
-  postPatch =
-    lib.optionalString
-      (lib.versionAtLeast release_version "15" && (hasPatches || lib.versionOlder release_version "18"))
-      ''
-        cd ../runtimes
-      '';
-
-  postInstall =
-    lib.optionalString (enableShared && !stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isWindows)
-      ''
-        # libcxxabi wants to link to libunwind_shared.so (?).
-        ln -s $out/lib/libunwind.so $out/lib/libunwind_shared.so
-      ''
-    + lib.optionalString (enableShared && stdenv.hostPlatform.isWindows) ''
-      ln -s $out/lib/libunwind.dll.a $out/lib/libunwind_shared.dll.a
-    '';
-in
 stdenv.mkDerivation (
-  rec {
-    inherit pname version patches;
+  finalAttrs:
+  let
+    hasPatches = builtins.length finalAttrs.patches > 0;
+  in
+  {
+    pname = "libunwind";
 
-    src = src';
+    inherit version;
+
+    patches = lib.optional (lib.versionOlder release_version "17") (
+      getVersionFile "libunwind/gnu-install-dirs.patch"
+    );
+
+    src =
+      if monorepoSrc != null then
+        runCommand "libunwind-src-${version}" { inherit (monorepoSrc) passthru; } (
+          ''
+            mkdir -p "$out"
+          ''
+          + lib.optionalString (lib.versionAtLeast release_version "14") ''
+            cp -r ${monorepoSrc}/cmake "$out"
+          ''
+          + ''
+            cp -r ${monorepoSrc}/libunwind "$out"
+            mkdir -p "$out/libcxx"
+            cp -r ${monorepoSrc}/libcxx/cmake "$out/libcxx"
+            cp -r ${monorepoSrc}/libcxx/utils "$out/libcxx"
+            mkdir -p "$out/llvm"
+            cp -r ${monorepoSrc}/llvm/cmake "$out/llvm"
+          ''
+          + lib.optionalString (lib.versionAtLeast release_version "15") ''
+            cp -r ${monorepoSrc}/llvm/utils "$out/llvm"
+            cp -r ${monorepoSrc}/runtimes "$out"
+          ''
+        )
+      else
+        src;
 
     sourceRoot =
-      if lib.versionAtLeast release_version "15" then "${src.name}/runtimes" else "${src.name}/${pname}";
+      if lib.versionAtLeast release_version "15" then
+        "${finalAttrs.src.name}/runtimes"
+      else
+        "${finalAttrs.src.name}/libunwind";
 
     outputs = [
       "out"
@@ -95,13 +73,40 @@ stdenv.mkDerivation (
       ];
 
     cmakeFlags =
-      lib.optional (lib.versionAtLeast release_version "15") "-DLLVM_ENABLE_RUNTIMES=libunwind"
-      ++ lib.optional (!enableShared) "-DLIBUNWIND_ENABLE_SHARED=OFF"
+      [ (lib.cmakeBool "LIBUNWIND_ENABLE_SHARED" enableShared) ]
+      ++ lib.optional (lib.versionAtLeast release_version "15") (
+        lib.cmakeFeature "LLVM_ENABLE_RUNTIMES" "libunwind"
+      )
       ++ lib.optionals (lib.versions.major release_version == "12" && stdenv.hostPlatform.isDarwin) [
-        "-DCMAKE_CXX_COMPILER_WORKS=ON"
+        (lib.cmakeBool "CMAKE_CXX_COMPILER_WORKS" true)
       ]
       ++ devExtraCmakeFlags;
 
+    prePatch =
+      lib.optionalString
+        (lib.versionAtLeast release_version "15" && (hasPatches || lib.versionOlder release_version "18"))
+        ''
+          cd ../libunwind
+          chmod -R u+w .
+        '';
+
+    postPatch =
+      lib.optionalString
+        (lib.versionAtLeast release_version "15" && (hasPatches || lib.versionOlder release_version "18"))
+        ''
+          cd ../runtimes
+        '';
+
+    postInstall =
+      lib.optionalString (enableShared && !stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isWindows)
+        ''
+          # libcxxabi wants to link to libunwind_shared.so (?).
+          ln -s $out/lib/libunwind.so $out/lib/libunwind_shared.so
+        ''
+      + lib.optionalString (enableShared && stdenv.hostPlatform.isWindows) ''
+        ln -s $out/lib/libunwind.dll.a $out/lib/libunwind_shared.dll.a
+      '';
+
     meta = llvm_meta // {
       # Details: https://github.com/llvm/llvm-project/blob/main/libunwind/docs/index.rst
       homepage = "https://clang.llvm.org/docs/Toolchain.html#unwind-library";
@@ -114,7 +119,4 @@ stdenv.mkDerivation (
       '';
     };
   }
-  // (if (lib.versionAtLeast release_version "15") then { inherit postInstall; } else { })
-  // (if prePatch != "" then { inherit prePatch; } else { })
-  // (if postPatch != "" then { inherit postPatch; } else { })
 )
diff --git a/pkgs/development/compilers/lobster/default.nix b/pkgs/development/compilers/lobster/default.nix
index c8f6fdddf163..f2d705c84779 100644
--- a/pkgs/development/compilers/lobster/default.nix
+++ b/pkgs/development/compilers/lobster/default.nix
@@ -9,13 +9,6 @@
   libGL,
   xorg,
 
-  # Darwin deps
-  CoreFoundation,
-  Cocoa,
-  AudioToolbox,
-  OpenGL,
-  Foundation,
-  ForceFeedback,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -30,22 +23,11 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   nativeBuildInputs = [ cmake ];
-  buildInputs =
-    if stdenv.hostPlatform.isDarwin then
-      [
-        CoreFoundation
-        Cocoa
-        AudioToolbox
-        OpenGL
-        Foundation
-        ForceFeedback
-      ]
-    else
-      [
-        libGL
-        xorg.libX11
-        xorg.libXext
-      ];
+  buildInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) [
+    libGL
+    xorg.libX11
+    xorg.libXext
+  ];
 
   preConfigure = ''
     cd dev
diff --git a/pkgs/development/compilers/mono/4.nix b/pkgs/development/compilers/mono/4.nix
index 66d8ff8a010a..0b87dba569f9 100644
--- a/pkgs/development/compilers/mono/4.nix
+++ b/pkgs/development/compilers/mono/4.nix
@@ -1,13 +1,10 @@
 {
   callPackage,
-  Foundation,
-  libobjc,
   stdenv,
   lib,
 }:
 
-callPackage ./generic.nix ({
-  inherit Foundation libobjc;
+callPackage ./generic.nix {
   version = "4.8.1.0";
   sha256 = "1vyvp2g28ihcgxgxr8nhzyzdmzicsh5djzk8dk1hj5p5f2k3ijqq";
   enableParallelBuilding = false; # #32386, https://hydra.nixos.org/build/65600645
@@ -19,4 +16,4 @@ callPackage ./generic.nix ({
     "-Wno-error=int-conversion"
     "-Wno-error=return-mismatch"
   ];
-})
+}
diff --git a/pkgs/development/compilers/mono/5.nix b/pkgs/development/compilers/mono/5.nix
index 4cf7252dcc35..a8f1283467e0 100644
--- a/pkgs/development/compilers/mono/5.nix
+++ b/pkgs/development/compilers/mono/5.nix
@@ -1,13 +1,10 @@
 {
   callPackage,
-  Foundation,
-  libobjc,
 }:
 
-callPackage ./generic.nix ({
-  inherit Foundation libobjc;
+callPackage ./generic.nix {
   version = "5.20.1.34";
   sha256 = "12vw5dkhmp1vk9l658pil8jiqirkpdsc5z8dm5mpj595yr6d94fd";
   enableParallelBuilding = true;
   env.NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types -Wno-error=implicit-function-declaration";
-})
+}
diff --git a/pkgs/development/compilers/mono/6.nix b/pkgs/development/compilers/mono/6.nix
index 9cabf7ba4441..d8a8123b5679 100644
--- a/pkgs/development/compilers/mono/6.nix
+++ b/pkgs/development/compilers/mono/6.nix
@@ -1,13 +1,10 @@
 {
   callPackage,
-  Foundation,
-  libobjc,
 }:
 
-callPackage ./generic.nix ({
-  inherit Foundation libobjc;
+callPackage ./generic.nix {
   version = "6.12.0.182";
   srcArchiveSuffix = "tar.xz";
   sha256 = "sha256-VzZqarTztezxEdSFSAMWFbOhANuHxnn8AG6Mik79lCQ=";
   enableParallelBuilding = true;
-})
+}
diff --git a/pkgs/development/compilers/mono/generic.nix b/pkgs/development/compilers/mono/generic.nix
index 56547ece52e6..ebccbf326f03 100644
--- a/pkgs/development/compilers/mono/generic.nix
+++ b/pkgs/development/compilers/mono/generic.nix
@@ -13,8 +13,6 @@
   zlib,
   bash,
   cacert,
-  Foundation,
-  libobjc,
   python3,
   version,
   sha256,
@@ -52,20 +50,15 @@ stdenv.mkDerivation rec {
     which
     gnumake42
   ];
-  buildInputs =
-    [
-      glib
-      gettext
-      libgdiplus
-      libX11
-      ncurses
-      zlib
-      bash
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Foundation
-      libobjc
-    ];
+  buildInputs = [
+    glib
+    gettext
+    libgdiplus
+    libX11
+    ncurses
+    zlib
+    bash
+  ];
 
   configureFlags = [
     "--x-includes=${libX11.dev}/include"
diff --git a/pkgs/development/compilers/openjdk/21/source.json b/pkgs/development/compilers/openjdk/21/source.json
index 9808423ccff1..88dca693a01a 100644
--- a/pkgs/development/compilers/openjdk/21/source.json
+++ b/pkgs/development/compilers/openjdk/21/source.json
@@ -1,6 +1,6 @@
 {
-  "hash": "sha256-H28Hp1SzANkrgnC6xdkiSEcRK6bm8BcT/lbJDEUvRYY=",
+  "hash": "sha256-H2ed09+1qafIDsHYDYRIcE9nyWwQagVyE563ROlNTtk=",
   "owner": "openjdk",
   "repo": "jdk21u",
-  "rev": "refs/tags/jdk-21.0.5+11"
+  "rev": "refs/tags/jdk-21.0.7+6"
 }
diff --git a/pkgs/development/compilers/rust/binary.nix b/pkgs/development/compilers/rust/binary.nix
index 7d7f4423ccd8..e390b43341fc 100644
--- a/pkgs/development/compilers/rust/binary.nix
+++ b/pkgs/development/compilers/rust/binary.nix
@@ -5,7 +5,6 @@
   wrapRustc,
   bash,
   curl,
-  darwin,
   zlib,
   autoPatchelfHook,
   gcc,
@@ -17,7 +16,6 @@
 
 let
   inherit (lib) optionalString;
-  inherit (darwin.apple_sdk.frameworks) Security;
 
   bootstrapping = versionType == "bootstrap";
 
@@ -46,8 +44,7 @@ rec {
     buildInputs =
       [ bash ]
       ++ lib.optional (!stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isFreeBSD) gcc.cc.lib
-      ++ lib.optional (!stdenv.hostPlatform.isDarwin) zlib
-      ++ lib.optional stdenv.hostPlatform.isDarwin Security;
+      ++ lib.optional (!stdenv.hostPlatform.isDarwin) zlib;
 
     postPatch = ''
       patchShebangs .
@@ -152,10 +149,9 @@ rec {
     nativeBuildInputs = [
       makeWrapper
     ] ++ lib.optional (!stdenv.hostPlatform.isDarwin) autoPatchelfHook;
-    buildInputs =
-      [ bash ]
-      ++ lib.optional (!stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isFreeBSD) gcc.cc.lib
-      ++ lib.optional stdenv.hostPlatform.isDarwin Security;
+    buildInputs = [
+      bash
+    ] ++ lib.optional (!stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isFreeBSD) gcc.cc.lib;
 
     postPatch = ''
       patchShebangs .
diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index e64d0658a13f..263feaa61704 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -15,7 +15,6 @@
   fetchurl,
   file,
   python3,
-  darwin,
   cargo,
   cmake,
   rustc,
@@ -51,7 +50,6 @@ let
     optionalString
     concatStringsSep
     ;
-  inherit (darwin.apple_sdk.frameworks) Security;
   useLLVM = stdenv.targetPlatform.useLLVM or false;
 in
 stdenv.mkDerivation (finalAttrs: {
@@ -349,7 +347,6 @@ stdenv.mkDerivation (finalAttrs: {
     [ openssl ]
     ++ optionals stdenv.hostPlatform.isDarwin [
       libiconv
-      Security
       zlib
     ]
     ++ optional (!withBundledLLVM) llvmShared.lib
diff --git a/pkgs/development/compilers/smlnj/default.nix b/pkgs/development/compilers/smlnj/default.nix
index cbd4168b6024..41c186050e34 100644
--- a/pkgs/development/compilers/smlnj/default.nix
+++ b/pkgs/development/compilers/smlnj/default.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  Libsystem,
 }:
 let
   version = "110.99.7.1";
@@ -62,16 +61,10 @@ stdenv.mkDerivation {
     ./config/unpack $TMP runtime
   '';
 
-  patchPhase =
-    ''
-      sed -i '/^PATH=/d' config/_arch-n-opsys base/runtime/config/gen-posix-names.sh
-      echo SRCARCHIVEURL="file:/$TMP" > config/srcarchiveurl
-    ''
-    + lib.optionalString stdenv.hostPlatform.isDarwin ''
-      # Locate standard headers like <unistd.h>
-      substituteInPlace base/runtime/config/gen-posix-names.sh \
-        --replace "\$SDK_PATH/usr" "${Libsystem}"
-    '';
+  patchPhase = ''
+    sed -i '/^PATH=/d' config/_arch-n-opsys base/runtime/config/gen-posix-names.sh
+    echo SRCARCHIVEURL="file:/$TMP" > config/srcarchiveurl
+  '';
 
   buildPhase = ''
     ./config/install.sh -default ${arch}
diff --git a/pkgs/development/compilers/swi-prolog/default.nix b/pkgs/development/compilers/swi-prolog/default.nix
index 62d0a2b188e3..36ef2245c5ba 100644
--- a/pkgs/development/compilers/swi-prolog/default.nix
+++ b/pkgs/development/compilers/swi-prolog/default.nix
@@ -13,7 +13,6 @@
   readline,
   libedit,
   libarchive,
-  Security,
 
   # optional dependencies
   withDb ? true,
@@ -113,7 +112,6 @@ let
       freetype
       fontconfig
     ])
-    ++ (lib.optional stdenv.hostPlatform.isDarwin Security)
     ++ extraLibraries';
 in
 stdenv.mkDerivation {
diff --git a/pkgs/development/compilers/swift/compiler/default.nix b/pkgs/development/compilers/swift/compiler/default.nix
index cc0ddfa40e8a..fb7e4964eb86 100644
--- a/pkgs/development/compilers/swift/compiler/default.nix
+++ b/pkgs/development/compilers/swift/compiler/default.nix
@@ -72,7 +72,11 @@ let
     else
       targetPlatform.parsed.kernel.name;
 
-  swiftArch = stdenv.hostPlatform.darwinArch;
+  # This causes swiftPackages.XCTest to fail to build on aarch64-linux
+  # as I believe this is because Apple calls the architecture aarch64
+  # on Linux rather than arm64 when used with macOS.
+  swiftArch =
+    if hostPlatform.isDarwin then hostPlatform.darwinArch else targetPlatform.parsed.cpu.name;
 
   # On Darwin, a `.swiftmodule` is a subdirectory in `lib/swift/<OS>`,
   # containing binaries for supported archs. On other platforms, binaries are
diff --git a/pkgs/development/compilers/swift/default.nix b/pkgs/development/compilers/swift/default.nix
index d00ff1f4e92e..0215cd6f0ba3 100644
--- a/pkgs/development/compilers/swift/default.nix
+++ b/pkgs/development/compilers/swift/default.nix
@@ -16,14 +16,6 @@ let
 
     callPackage = newScope self;
 
-    # Current versions of Swift on Darwin require macOS SDK 10.15 at least.
-    # The Swift compiler propagates the 13.3 SDK and a 10.15 deployment target.
-    # Packages that need a newer version can add it to their build inputs
-    # to use it (as normal).
-
-    # This SDK is included for compatibility with existing packages.
-    apple_sdk = pkgs.darwin.apple_sdk_11_0;
-
     # Swift builds its own Clang for internal use. We wrap that clang with a
     # cc-wrapper derived from the clang configured below. Because cc-wrapper
     # applies a specific resource-root, the two versions are best matched, or
@@ -88,13 +80,9 @@ let
       swift = swift-unwrapped;
     };
 
-    sourcekit-lsp = callPackage ./sourcekit-lsp {
-      inherit (apple_sdk.frameworks) CryptoKit LocalAuthentication;
-    };
+    sourcekit-lsp = callPackage ./sourcekit-lsp { };
 
-    swift-docc = callPackage ./swift-docc {
-      inherit (apple_sdk.frameworks) CryptoKit LocalAuthentication;
-    };
+    swift-docc = callPackage ./swift-docc { };
 
     swift-format = callPackage ./swift-format { };
 
diff --git a/pkgs/development/compilers/swift/foundation/default.nix b/pkgs/development/compilers/swift/foundation/default.nix
index c9647c4f41e8..de20db4ce258 100644
--- a/pkgs/development/compilers/swift/foundation/default.nix
+++ b/pkgs/development/compilers/swift/foundation/default.nix
@@ -1,8 +1,3 @@
-# TODO: We already package the CoreFoundation component of Foundation in:
-#   pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix
-# This is separate because the CF build is completely different and part of
-# stdenv. Merging the two was kept outside of the scope of Swift work.
-
 {
   lib,
   stdenv,
diff --git a/pkgs/development/compilers/swift/sourcekit-lsp/default.nix b/pkgs/development/compilers/swift/sourcekit-lsp/default.nix
index 3679b42b1571..11bbf9776560 100644
--- a/pkgs/development/compilers/swift/sourcekit-lsp/default.nix
+++ b/pkgs/development/compilers/swift/sourcekit-lsp/default.nix
@@ -11,8 +11,6 @@
   XCTest,
   sqlite,
   ncurses,
-  CryptoKit,
-  LocalAuthentication,
 }:
 let
   sources = callPackage ../sources.nix { };
@@ -35,17 +33,12 @@ stdenv.mkDerivation {
     swift
     swiftpm
   ];
-  buildInputs =
-    [
-      Foundation
-      XCTest
-      sqlite
-      ncursesInput
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CryptoKit
-      LocalAuthentication
-    ];
+  buildInputs = [
+    Foundation
+    XCTest
+    sqlite
+    ncursesInput
+  ];
 
   configurePhase =
     generated.configure
diff --git a/pkgs/development/compilers/swift/swift-docc/default.nix b/pkgs/development/compilers/swift/swift-docc/default.nix
index 9522c34e9cf7..5dbcf50e83bf 100644
--- a/pkgs/development/compilers/swift/swift-docc/default.nix
+++ b/pkgs/development/compilers/swift/swift-docc/default.nix
@@ -7,8 +7,6 @@
   swiftpm2nix,
   Foundation,
   XCTest,
-  CryptoKit,
-  LocalAuthentication,
 }:
 let
   sources = callPackage ../sources.nix { };
@@ -27,15 +25,10 @@ stdenv.mkDerivation {
     swift
     swiftpm
   ];
-  buildInputs =
-    [
-      Foundation
-      XCTest
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CryptoKit
-      LocalAuthentication
-    ];
+  buildInputs = [
+    Foundation
+    XCTest
+  ];
 
   configurePhase = generated.configure;
 
diff --git a/pkgs/development/compilers/terra/default.nix b/pkgs/development/compilers/terra/default.nix
index 0a455d45ce0f..2d12834f7ce2 100644
--- a/pkgs/development/compilers/terra/default.nix
+++ b/pkgs/development/compilers/terra/default.nix
@@ -10,10 +10,7 @@
   cudaPackages,
   enableCUDA ? false,
   libffi,
-  libobjc,
   libpfm,
-  Cocoa,
-  Foundation,
 }:
 
 let
@@ -65,12 +62,7 @@ stdenv.mkDerivation rec {
       libxml2
     ]
     ++ lib.optionals enableCUDA [ cuda ]
-    ++ lib.optional (!stdenv.hostPlatform.isDarwin) libpfm
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      libobjc
-      Cocoa
-      Foundation
-    ];
+    ++ lib.optional (!stdenv.hostPlatform.isDarwin) libpfm;
 
   cmakeFlags =
     let
diff --git a/pkgs/development/embedded/blisp/default.nix b/pkgs/development/embedded/blisp/default.nix
index d7b1b6018efc..e59750000393 100644
--- a/pkgs/development/embedded/blisp/default.nix
+++ b/pkgs/development/embedded/blisp/default.nix
@@ -7,7 +7,6 @@
   libserialport,
   pkg-config,
   testers,
-  IOKit,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -29,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     argtable
     libserialport
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin IOKit;
+  ];
 
   cmakeFlags = [
     "-DBLISP_BUILD_CLI=ON"
diff --git a/pkgs/development/embedded/fpga/ecpdap/default.nix b/pkgs/development/embedded/fpga/ecpdap/default.nix
index 7babd86443a3..7b594468a732 100644
--- a/pkgs/development/embedded/fpga/ecpdap/default.nix
+++ b/pkgs/development/embedded/fpga/ecpdap/default.nix
@@ -1,11 +1,9 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
   pkg-config,
   libusb1,
-  AppKit,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -24,7 +22,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ libusb1 ] ++ lib.optional stdenv.hostPlatform.isDarwin AppKit;
+  buildInputs = [ libusb1 ];
 
   postInstall = ''
     mkdir -p $out/etc/udev/rules.d
diff --git a/pkgs/development/embedded/fpga/fujprog/default.nix b/pkgs/development/embedded/fpga/fujprog/default.nix
index fea0900ab2af..224b671f9ff6 100644
--- a/pkgs/development/embedded/fpga/fujprog/default.nix
+++ b/pkgs/development/embedded/fpga/fujprog/default.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   cmake,
   pkg-config,
-  IOKit,
   libftdi1,
   libusb-compat-0_1,
 }:
@@ -28,7 +27,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     libftdi1
     libusb-compat-0_1
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ IOKit ];
+  ];
 
   meta = with lib; {
     description = "JTAG programmer for the ULX3S and ULX2S open hardware FPGA development boards";
diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
index 76e0912a22d9..604a2bcca531 100644
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -2283,6 +2283,15 @@ self: super:
   # Overwrite the build cores
   raaz = disableParallelBuilding super.raaz;
 
+  # Test suite uses SHA as a point of comparison which doesn't
+  # succeeds its own test suite on 32bit:
+  # https://github.com/GaloisInc/SHA/issues/16
+  cryptohash-sha256 =
+    if pkgs.stdenv.hostPlatform.is32bit then
+      dontCheck super.cryptohash-sha256
+    else
+      super.cryptohash-sha256;
+
   # https://github.com/andreymulik/sdp/issues/3
   sdp = disableLibraryProfiling super.sdp;
   sdp-binary = disableLibraryProfiling super.sdp-binary;
@@ -2571,7 +2580,28 @@ self: super:
   # Overly strict bounds on tasty-quickcheck (test suite) (< 0.11)
   hashable = doJailbreak super.hashable;
   # https://github.com/well-typed/cborg/issues/340
-  cborg = doJailbreak super.cborg;
+  cborg = lib.pipe super.cborg [
+    doJailbreak
+    # Fix build on 32-bit: https://github.com/well-typed/cborg/pull/322
+    (appendPatches (
+      lib.optionals pkgs.stdenv.hostPlatform.is32bit [
+        (pkgs.fetchpatch {
+          name = "cborg-i686-1.patch";
+          url = "https://github.com/well-typed/cborg/commit/a4757c46219afe6d235652ae642786f2e2977020.patch";
+          sha256 = "01n0x2l605x7in9hriz9asmzsfb5f8d6zkwgypckfj1r18qbs2hj";
+          includes = [ "**/Codec/CBOR/**" ];
+          stripLen = 1;
+        })
+        (pkgs.fetchpatch {
+          name = "cborg-i686-2.patch";
+          url = "https://github.com/well-typed/cborg/commit/94a856e4e544a5bc7f927cfb728de385d6260af4.patch";
+          sha256 = "03iz85gsll38q5bl3m024iv7yb1k5sisly7jvgf66zic8fbvkhcn";
+          includes = [ "**/Codec/CBOR/**" ];
+          stripLen = 1;
+        })
+      ]
+    ))
+  ];
   # Doesn't compile with tasty-quickcheck == 0.11 (see issue above)
   serialise = dontCheck super.serialise;
   # https://github.com/Bodigrim/data-array-byte/issues/1
@@ -2943,6 +2973,18 @@ self: super:
       url = "https://github.com/sjakobi/bsb-http-chunked/commit/689bf9ce12b8301d0e13a68e4a515c2779b62947.patch";
       sha256 = "sha256-ZdCXMhni+RGisRODiElObW5c4hKy2giWQmWnatqeRJo=";
     }))
+
+    # blaze-builder's code is missing the following fix, causing it to produce
+    # incorrect chunking on 32 bit platforms:
+    # https://github.com/sjakobi/bsb-http-chunked/commit/dde7c9fa33bb6e55b44c5f3e3024215475f64d4c
+    (overrideCabal (drv: {
+      testFlags =
+        drv.testFlags or [ ]
+        ++ lib.optionals pkgs.stdenv.hostPlatform.is32bit [
+          "-p"
+          "!/Identical output as Blaze/"
+        ];
+    }))
   ];
 
   # jailbreak to allow deepseq >= 1.5, https://github.com/jumper149/blucontrol/issues/3
diff --git a/pkgs/development/haskell-modules/configuration-darwin.nix b/pkgs/development/haskell-modules/configuration-darwin.nix
index e155aaf8aa03..005afaa1ab85 100644
--- a/pkgs/development/haskell-modules/configuration-darwin.nix
+++ b/pkgs/development/haskell-modules/configuration-darwin.nix
@@ -28,31 +28,14 @@ self: super:
       __darwinAllowLocalNetworking = true;
     });
 
-    halive = addBuildDepend darwin.apple_sdk.frameworks.AppKit super.halive;
-
     # Hakyll's tests are broken on Darwin (3 failures); and they require util-linux
     hakyll = overrideCabal {
       testToolDepends = [ ];
       doCheck = false;
     } super.hakyll;
 
-    barbly = addBuildDepend darwin.apple_sdk.frameworks.AppKit super.barbly;
-
     double-conversion = addExtraLibrary pkgs.libcxx super.double-conversion;
 
-    streamly = addBuildDepend darwin.apple_sdk.frameworks.Cocoa super.streamly;
-
-    apecs-physics = addPkgconfigDepends [
-      darwin.apple_sdk.frameworks.ApplicationServices
-    ] super.apecs-physics;
-
-    # Framework deps are hidden behind a flag
-    hmidi = addExtraLibraries [
-      darwin.apple_sdk.frameworks.CoreFoundation
-      darwin.apple_sdk.frameworks.CoreAudio
-      darwin.apple_sdk.frameworks.CoreMIDI
-    ] super.hmidi;
-
     # "erf table" test fails on Darwin
     # https://github.com/bos/math-functions/issues/63
     math-functions = dontCheck super.math-functions;
@@ -77,16 +60,6 @@ self: super:
     gtk3 = appendConfigureFlag "-f have-quartz-gtk" super.gtk3;
     gtk = appendConfigureFlag "-f have-quartz-gtk" super.gtk;
 
-    OpenAL = addExtraLibrary darwin.apple_sdk.frameworks.OpenAL super.OpenAL;
-
-    al = overrideCabal (drv: {
-      libraryFrameworkDepends = [
-        darwin.apple_sdk.frameworks.OpenAL
-      ] ++ (drv.libraryFrameworkDepends or [ ]);
-    }) super.al;
-
-    proteaaudio = addExtraLibrary darwin.apple_sdk.frameworks.AudioToolbox super.proteaaudio;
-
     # issues finding libcharset.h without libiconv in buildInputs on darwin.
     with-utf8 = addExtraLibrary pkgs.libiconv super.with-utf8;
     with-utf8_1_1_0_0 = addExtraLibrary pkgs.libiconv super.with-utf8_1_1_0_0;
@@ -161,34 +134,18 @@ self: super:
 
     sym = markBroken super.sym;
 
-    yesod-bin = addBuildDepend darwin.apple_sdk.frameworks.Cocoa super.yesod-bin;
-
     yesod-core = super.yesod-core.overrideAttrs (drv: {
       # Allow access to local networking when the Darwin sandbox is enabled, so yesod-core can
       # run tests that access localhost.
       __darwinAllowLocalNetworking = true;
     });
 
-    hidapi = addExtraLibraries [
-      darwin.apple_sdk.frameworks.AppKit
-      darwin.apple_sdk.frameworks.IOKit
-      darwin.apple_sdk.frameworks.CoreFoundation
-    ] (super.hidapi.override { systemd = null; });
-
-    hmatrix = addBuildDepend darwin.apple_sdk.frameworks.Accelerate super.hmatrix;
-
-    blas-hs = overrideCabal (drv: {
-      libraryFrameworkDepends = [
-        darwin.apple_sdk.frameworks.Accelerate
-      ] ++ (drv.libraryFrameworkDepends or [ ]);
-    }) super.blas-hs;
+    hidapi = super.hidapi.override { systemd = null; };
 
     # Ensure the necessary frameworks are propagatedBuildInputs on darwin
     OpenGLRaw = overrideCabal (drv: {
       librarySystemDepends = [ ];
-      libraryHaskellDepends = drv.libraryHaskellDepends ++ [
-        darwin.apple_sdk.frameworks.OpenGL
-      ];
+      libraryHaskellDepends = drv.libraryHaskellDepends;
       preConfigure =
         ''
           frameworkPaths=($(for i in $nativeBuildInputs; do if [ -d "$i"/Library/Frameworks ]; then echo "-F$i/Library/Frameworks"; fi done))
@@ -197,30 +154,9 @@ self: super:
         ''
         + (drv.preConfigure or "");
     }) super.OpenGLRaw;
-    GLURaw = overrideCabal (drv: {
-      librarySystemDepends = [ ];
-      libraryHaskellDepends = drv.libraryHaskellDepends ++ [
-        darwin.apple_sdk.frameworks.OpenGL
-      ];
-    }) super.GLURaw;
     bindings-GLFW = overrideCabal (drv: {
       librarySystemDepends = [ ];
-      libraryHaskellDepends = drv.libraryHaskellDepends ++ [
-        darwin.apple_sdk.frameworks.AGL
-        darwin.apple_sdk.frameworks.Cocoa
-        darwin.apple_sdk.frameworks.OpenGL
-        darwin.apple_sdk.frameworks.IOKit
-        darwin.apple_sdk.frameworks.Kernel
-        darwin.apple_sdk.frameworks.CoreVideo
-        darwin.CF
-      ];
     }) super.bindings-GLFW;
-    OpenCL = overrideCabal (drv: {
-      librarySystemDepends = [ ];
-      libraryHaskellDepends = drv.libraryHaskellDepends ++ [
-        darwin.apple_sdk.frameworks.OpenCL
-      ];
-    }) super.OpenCL;
 
     # cabal2nix likes to generate dependencies on hinotify when hfsevents is
     # really required on darwin: https://github.com/NixOS/cabal2nix/issues/146.
@@ -228,22 +164,7 @@ self: super:
 
     # FSEvents API is very buggy and tests are unreliable. See
     # http://openradar.appspot.com/10207999 and similar issues.
-    fsnotify = addBuildDepend darwin.apple_sdk.frameworks.Cocoa (dontCheck super.fsnotify);
-
-    FractalArt = overrideCabal (drv: {
-      librarySystemDepends = [
-        darwin.libobjc
-        darwin.apple_sdk.frameworks.AppKit
-      ] ++ (drv.librarySystemDepends or [ ]);
-    }) super.FractalArt;
-
-    arbtt = overrideCabal (drv: {
-      librarySystemDepends = [
-        darwin.apple_sdk.frameworks.Foundation
-        darwin.apple_sdk.frameworks.Carbon
-        darwin.apple_sdk.frameworks.IOKit
-      ] ++ (drv.librarySystemDepends or [ ]);
-    }) super.arbtt;
+    fsnotify = dontCheck super.fsnotify;
 
     HTF = overrideCabal (drv: {
       # GNU find is not prefixed in stdenv
@@ -382,10 +303,6 @@ self: super:
     }) super.jsaddle-hello;
 
     jsaddle-wkwebview = overrideCabal (drv: {
-      libraryFrameworkDepends = with pkgs.buildPackages.darwin.apple_sdk.frameworks; [
-        Cocoa
-        WebKit
-      ];
       libraryHaskellDepends = with self; [
         aeson
         data-default
diff --git a/pkgs/development/haskell-modules/generic-builder.nix b/pkgs/development/haskell-modules/generic-builder.nix
index 18310dfd83c6..6e5cb29be5fb 100644
--- a/pkgs/development/haskell-modules/generic-builder.nix
+++ b/pkgs/development/haskell-modules/generic-builder.nix
@@ -515,6 +515,14 @@ let
 
   intermediatesDir = "share/haskell/${ghc.version}/${pname}-${version}/dist";
 
+  # On old ghcjs, the jsexe directories are the output but on the js backend they seem to be treated as intermediates
+  jsexe = rec {
+    shouldUseNode = isGhcjs;
+    shouldAdd = stdenv.hostPlatform.isGhcjs && isExecutable;
+    shouldCopy = shouldAdd && !doInstallIntermediates;
+    shouldSymlink = shouldAdd && doInstallIntermediates;
+  };
+
   # This is a script suitable for --test-wrapper of Setup.hs' test command
   # (https://cabal.readthedocs.io/en/3.12/setup-commands.html#cmdoption-runhaskell-Setup.hs-test-test-wrapper).
   # We use it to set some environment variables that the test suite may need,
@@ -821,7 +829,8 @@ lib.fix (
               find $packageConfDir -maxdepth 0 -empty -delete;
             ''
         }
-        ${optionalString isGhcjs ''
+
+        ${optionalString jsexe.shouldUseNode ''
           for exeDir in "${binDir}/"*.jsexe; do
             exe="''${exeDir%.jsexe}"
             printWords '#!${nodejs}/bin/node' > "$exe"
@@ -832,6 +841,14 @@ lib.fix (
         ''}
         ${optionalString doCoverage "mkdir -p $out/share && cp -r dist/hpc $out/share"}
 
+        ${optionalString jsexe.shouldCopy ''
+          for jsexeDir in dist/build/*/*.jsexe; do
+            bn=$(basename $jsexeDir)
+            exe="''${bn%.jsexe}"
+            cp -r dist/build/$exe/$exe.jsexe ${binDir}
+          done
+        ''}
+
         ${optionalString enableSeparateDocOutput ''
           for x in ${docdir "$doc"}"/html/src/"*.html; do
             remove-references-to -t $out $x
@@ -850,6 +867,14 @@ lib.fix (
         mkdir -p "$installIntermediatesDir"
         cp -r dist/build "$installIntermediatesDir"
         runHook postInstallIntermediates
+
+        ${optionalString jsexe.shouldSymlink ''
+          for jsexeDir in $installIntermediatesDir/build/*/*.jsexe; do
+            bn=$(basename $jsexeDir)
+            exe="''${bn%.jsexe}"
+            (cd ${binDir} && ln -s $installIntermediatesDir/build/$exe/$exe.jsexe)
+          done
+        ''}
       '';
 
       passthru = passthru // rec {
diff --git a/pkgs/development/interpreters/evcxr/default.nix b/pkgs/development/interpreters/evcxr/default.nix
index 79c291f08e02..c5c35893e00d 100644
--- a/pkgs/development/interpreters/evcxr/default.nix
+++ b/pkgs/development/interpreters/evcxr/default.nix
@@ -9,8 +9,6 @@
   gcc,
   cmake,
   libiconv,
-  CoreServices,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -36,8 +34,6 @@ rustPlatform.buildRustPackage rec {
   ];
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     libiconv
-    CoreServices
-    Security
   ];
 
   checkFlags = [
diff --git a/pkgs/development/interpreters/gauche/boot.nix b/pkgs/development/interpreters/gauche/boot.nix
index 4b3179da90c1..497ebba15557 100644
--- a/pkgs/development/interpreters/gauche/boot.nix
+++ b/pkgs/development/interpreters/gauche/boot.nix
@@ -10,7 +10,6 @@
   zlib,
   mbedtls,
   cacert,
-  darwin,
 }:
 
 stdenv.mkDerivation rec {
@@ -29,18 +28,14 @@ stdenv.mkDerivation rec {
     texinfo
   ];
 
-  buildInputs =
-    [
-      libiconv
-      gdbm
-      openssl
-      zlib
-      mbedtls
-      cacert
-    ]
-    ++ lib.optionals (stdenv.hostPlatform.isDarwin) [
-      darwin.apple_sdk_11_0.frameworks.CoreServices
-    ];
+  buildInputs = [
+    libiconv
+    gdbm
+    openssl
+    zlib
+    mbedtls
+    cacert
+  ];
 
   postPatch = ''
     patchShebangs .
diff --git a/pkgs/development/interpreters/gauche/default.nix b/pkgs/development/interpreters/gauche/default.nix
index 3fb736ff7e38..7a72e64dec9f 100644
--- a/pkgs/development/interpreters/gauche/default.nix
+++ b/pkgs/development/interpreters/gauche/default.nix
@@ -12,7 +12,6 @@
   zlib,
   mbedtls,
   cacert,
-  CoreServices,
 }:
 
 stdenv.mkDerivation rec {
@@ -40,7 +39,7 @@ stdenv.mkDerivation rec {
     zlib
     mbedtls
     cacert
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ CoreServices ];
+  ];
 
   autoreconfPhase = ''
     ./DIST gen
diff --git a/pkgs/development/interpreters/gnudatalanguage/default.nix b/pkgs/development/interpreters/gnudatalanguage/default.nix
index f7570e745d3d..891853bd83d3 100644
--- a/pkgs/development/interpreters/gnudatalanguage/default.nix
+++ b/pkgs/development/interpreters/gnudatalanguage/default.nix
@@ -60,7 +60,6 @@
   # and Darwin.
   enableWX ? (stdenv.hostPlatform.isLinux || stdenv.hostPlatform.isDarwin),
   wxGTK32,
-  Cocoa,
   # X11: OFF by default for platform consistency. Use X where WX is not available
   enableXWin ? (!stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isDarwin),
 }:
@@ -152,7 +151,6 @@ stdenv.mkDerivation rec {
     ++ lib.optional enableGRIB eccodes
     ++ lib.optional enableGLPK glpk
     ++ lib.optional enableWX wxGTK32
-    ++ lib.optional (enableWX && stdenv.hostPlatform.isDarwin) Cocoa
     ++ lib.optional enableMPI mpi
     ++ lib.optional enableLibtirpc hdf4-custom.libtirpc
     ++ lib.optional enableSzip szip;
diff --git a/pkgs/development/interpreters/kerf/default.nix b/pkgs/development/interpreters/kerf/default.nix
index 6fa17490d539..3193efaad5bc 100644
--- a/pkgs/development/interpreters/kerf/default.nix
+++ b/pkgs/development/interpreters/kerf/default.nix
@@ -7,10 +7,6 @@
   ncurses,
   expect,
 
-  # darwin only below
-  Accelerate,
-  CoreGraphics,
-  CoreVideo,
 }:
 
 stdenv.mkDerivation rec {
@@ -25,23 +21,11 @@ stdenv.mkDerivation rec {
   };
 
   sourceRoot = "${src.name}/src";
-  buildInputs =
-    [
-      libedit
-      zlib
-      ncurses
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      [
-        Accelerate
-      ]
-      ++
-        lib.optionals stdenv.hostPlatform.isx86_64 # && isDarwin
-          [
-            CoreGraphics
-            CoreVideo
-          ]
-    );
+  buildInputs = [
+    libedit
+    zlib
+    ncurses
+  ];
 
   nativeCheckInputs = [ expect ];
   doCheck = true;
diff --git a/pkgs/development/interpreters/octave/default.nix b/pkgs/development/interpreters/octave/default.nix
index 3581df8acb65..0107a5872693 100644
--- a/pkgs/development/interpreters/octave/default.nix
+++ b/pkgs/development/interpreters/octave/default.nix
@@ -56,7 +56,6 @@
   enableQt ? false,
   libsForQt5,
   libiconv,
-  darwin,
 }:
 
 let
@@ -155,8 +154,6 @@ stdenv.mkDerivation (finalAttrs: {
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       libiconv
-      darwin.apple_sdk.frameworks.Accelerate
-      darwin.apple_sdk.frameworks.Cocoa
     ];
   nativeBuildInputs =
     [
diff --git a/pkgs/development/interpreters/perl/interpreter.nix b/pkgs/development/interpreters/perl/interpreter.nix
index 0c9586fe1273..f75a504b14de 100644
--- a/pkgs/development/interpreters/perl/interpreter.nix
+++ b/pkgs/development/interpreters/perl/interpreter.nix
@@ -273,6 +273,12 @@ stdenv.mkDerivation (
           --replace "${
             if stdenv.hasCC && stdenv.cc.cc != null then stdenv.cc.cc else "/no-such-path"
           }" /no-such-path \
+          --replace "${
+            if stdenv.hasCC && stdenv.cc.fallback_sdk or null != null then
+              stdenv.cc.fallback_sdk
+            else
+              "/no-such-path"
+          }" /no-such-path \
           --replace "$man" /no-such-path
       ''
       + lib.optionalString crossCompiling ''
diff --git a/pkgs/development/interpreters/python/cpython/3.10/raise-OSError-for-ERR_LIB_SYS.patch b/pkgs/development/interpreters/python/cpython/3.10/raise-OSError-for-ERR_LIB_SYS.patch
deleted file mode 100644
index dd1fe891bf25..000000000000
--- a/pkgs/development/interpreters/python/cpython/3.10/raise-OSError-for-ERR_LIB_SYS.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-diff --git a/Modules/_ssl.c b/Modules/_ssl.c
-index e637830..80728d2 100644
---- a/Modules/_ssl.c
-+++ b/Modules/_ssl.c
-@@ -656,6 +656,11 @@ PySSL_SetError(PySSLSocket *sslsock, int ret, const char *filename, int lineno)
-                     errstr = "Some I/O error occurred";
-                 }
-             } else {
-+                if (ERR_GET_LIB(e) == ERR_LIB_SYS) {
-+                    // A system error is being reported; reason is set to errno
-+		    errno = ERR_GET_REASON(e);
-+		    return PyErr_SetFromErrno(PyExc_OSError);
-+                }
-                 p = PY_SSL_ERROR_SYSCALL;
-             }
-             break;
-@@ -681,6 +686,11 @@ PySSL_SetError(PySSLSocket *sslsock, int ret, const char *filename, int lineno)
-                 errstr = "EOF occurred in violation of protocol";
-             }
- #endif
-+            if (ERR_GET_LIB(e) == ERR_LIB_SYS) {
-+                // A system error is being reported; reason is set to errno
-+                errno = ERR_GET_REASON(e);
-+                return PyErr_SetFromErrno(PyExc_OSError);
-+            }
-             break;
-         }
-         default:
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index ec2c92a4274b..ba93166c2b66 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -27,7 +27,6 @@
 
   # platform-specific dependencies
   bashNonInteractive,
-  darwin,
   windows,
 
   # optional dependencies
@@ -231,9 +230,6 @@ let
     ++ optionals bluezSupport [
       bluez
     ]
-    ++ optionals enableFramework [
-      darwin.apple_sdk.frameworks.Cocoa
-    ]
     ++ optionals stdenv.hostPlatform.isMinGW [
       windows.dlfcn
       windows.mingw_w64_pthreads
@@ -322,10 +318,6 @@ stdenv.mkDerivation (finalAttrs: {
       # libuuid, slowing down program startup a lot).
       noldconfigPatch
     ]
-    ++ optionals (pythonOlder "3.12") [
-      # https://www.cve.org/CVERecord?id=CVE-2025-0938
-      ./CVE-2025-0938.patch
-    ]
     ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform && stdenv.hostPlatform.isFreeBSD) [
       # Cross compilation only supports a limited number of "known good"
       # configurations. If you're reading this and it's been a long time
@@ -378,15 +370,6 @@ stdenv.mkDerivation (finalAttrs: {
       # fix failing tests with openssl >= 3.4
       # https://github.com/python/cpython/pull/127361
     ]
-    ++ optionals (pythonAtLeast "3.10" && pythonOlder "3.11") [
-      ./3.10/raise-OSError-for-ERR_LIB_SYS.patch
-    ]
-    ++ optionals (pythonAtLeast "3.11" && pythonOlder "3.12") [
-      (fetchpatch {
-        url = "https://github.com/python/cpython/commit/f4b31edf2d9d72878dab1f66a36913b5bcc848ec.patch";
-        sha256 = "sha256-w7zZMp0yqyi4h5oG8sK4z9BwNEkqg4Ar+en3nlWcxh0=";
-      })
-    ]
     ++ optionals (pythonAtLeast "3.11" && pythonOlder "3.13") [
       # backport fix for https://github.com/python/cpython/issues/95855
       ./platform-triplet-detection.patch
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 580f3db89968..3d3866b9bcab 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -2,7 +2,6 @@
   __splicedPackages,
   callPackage,
   config,
-  darwin,
   db,
   lib,
   libffiBoot,
@@ -22,10 +21,10 @@
         sourceVersion = {
           major = "3";
           minor = "12";
-          patch = "9";
+          patch = "10";
           suffix = "";
         };
-        hash = "sha256-ciCDXZ+Qs3wAbphCqN/0WAqspDGGdPlHMCuNKPP4ERI=";
+        hash = "sha256-B6tpdHRZXgbwZkdBfTx/qX3tB6/Bp+RFTFY5kZtG6uo=";
       };
     };
 
@@ -49,10 +48,10 @@
       sourceVersion = {
         major = "3";
         minor = "10";
-        patch = "16";
+        patch = "17";
         suffix = "";
       };
-      hash = "sha256-v7JJYJmQIgSRobkoUKBxNe0IMeQXOM9oHWPPAbKo+9E=";
+      hash = "sha256-TGgFDwSdG0rFqt0N9fJ5QcA1DSqeerCQfuXrUiXZ1rA=";
       inherit passthruFun;
     };
 
@@ -61,10 +60,10 @@
       sourceVersion = {
         major = "3";
         minor = "11";
-        patch = "11";
+        patch = "12";
         suffix = "";
       };
-      hash = "sha256-Kpkgx6DNI23jNkTtmAoTy7whBYv9xSj+u2CBV17XO+M=";
+      hash = "sha256-hJ2oevTfE3cQwXluJ2qVX3qFyflxCBBnyPVl0Vw1Kgk=";
       inherit passthruFun;
     };
 
@@ -81,10 +80,10 @@
       sourceVersion = {
         major = "3";
         minor = "13";
-        patch = "2";
+        patch = "3";
         suffix = "";
       };
-      hash = "sha256-2YS8xXzWfKqyb33vQuUjscAVu8XcB4Ns9PC2P6FZ61Y=";
+      hash = "sha256-QPhovL3rgUmjFJWAu5v9QHszIc1I8L5jGvlVrJLA4EE=";
       inherit passthruFun;
     };
 
@@ -94,9 +93,9 @@
         major = "3";
         minor = "14";
         patch = "0";
-        suffix = "a6";
+        suffix = "a7";
       };
-      hash = "sha256-jWGB5TMdmizWykBa4SMOiFiaBD9HaOu0Q9OInUXBw1w=";
+      hash = "sha256-ca287DrJ7fkzCOVc+0GE8utLFv2iuwpaOCkp7SnIOG0=";
       inherit passthruFun;
     };
     # Minimal versions of Python (built without optional dependencies)
@@ -175,7 +174,7 @@
 
       hash =
         {
-          aarch64-linux = "sha256-DUzvpmBoUk4qyyxPn1EQSqcnIc0YvPRi7HyLo5Ekqa4=";
+          aarch64-linux = "sha256-qN9c4WUPR1aTP4eAhwyRoKQOfJhw10YpvyQTkry1wuM=";
           x86_64-linux = "sha256-nzSX+HszctF+RHNp4AFqS+yZprTSpZq6d0olv+Q1NHQ=";
           aarch64-darwin = "sha256-gCJIc5sqzIwb5tlH8Zsy/A44wI4xKzXAXMf7IvEHCeQ=";
           x86_64-darwin = "sha256-gtRgQhRmyBraSh2Z3y3xuLNTQbOXyF///lGkwwItCDM=";
diff --git a/pkgs/development/interpreters/rakudo/moarvm.nix b/pkgs/development/interpreters/rakudo/moarvm.nix
index 73ee14bd505c..b08a5e054915 100644
--- a/pkgs/development/interpreters/rakudo/moarvm.nix
+++ b/pkgs/development/interpreters/rakudo/moarvm.nix
@@ -3,8 +3,6 @@
   stdenv,
   fetchFromGitHub,
   perl,
-  CoreServices,
-  ApplicationServices,
 }:
 
 stdenv.mkDerivation rec {
@@ -33,12 +31,7 @@ stdenv.mkDerivation rec {
         --replace '`sw_vers -productVersion`' '"11.0"'
     '';
 
-  buildInputs =
-    [ perl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CoreServices
-      ApplicationServices
-    ];
+  buildInputs = [ perl ];
   doCheck = false; # MoarVM does not come with its own test suite
 
   configureScript = "${perl}/bin/perl ./Configure.pl";
diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index 8f6694ceb7ee..9461b0335ee5 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -17,9 +17,7 @@
   bison,
   autoconf,
   libiconv,
-  libobjc,
   libunwind,
-  Foundation,
   buildEnv,
   bundler,
   bundix,
@@ -121,9 +119,7 @@ let
           bundler,
           bundix,
           libiconv,
-          libobjc,
           libunwind,
-          Foundation,
           makeBinaryWrapper,
           buildRubyGem,
           defaultGemConfig,
@@ -185,9 +181,7 @@ let
             ++ op (!cursesSupport && stdenv.hostPlatform.isDarwin) readline
             ++ ops stdenv.hostPlatform.isDarwin [
               libiconv
-              libobjc
               libunwind
-              Foundation
             ];
           propagatedBuildInputs = op jemallocSupport jemalloc;
 
@@ -435,8 +429,8 @@ in
   };
 
   ruby_3_3 = generic {
-    version = rubyVersion "3" "3" "7" "";
-    hash = "sha256-nDfDsSKIx67CDKEhznaEW+W7XXdmKiSRllGq8dEshig=";
+    version = rubyVersion "3" "3" "8" "";
+    hash = "sha256-WuKKh6WaPkrWa8KTHSMturlT0KqPa687xPj4CXfInKs=";
     cargoHash = "sha256-xE7Cv+NVmOHOlXa/Mg72CTSaZRb72lOja98JBvxPvSs=";
   };
 
diff --git a/pkgs/development/interpreters/spidermonkey/common.nix b/pkgs/development/interpreters/spidermonkey/common.nix
index 5b2917393637..b500d4dea89c 100644
--- a/pkgs/development/interpreters/spidermonkey/common.nix
+++ b/pkgs/development/interpreters/spidermonkey/common.nix
@@ -27,7 +27,6 @@
   nspr,
   readline,
   zlib,
-  libobjc,
   libiconv,
 }:
 
@@ -98,7 +97,6 @@ stdenv.mkDerivation (finalAttrs: rec {
       zlib
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      libobjc
       libiconv
     ];
 
diff --git a/pkgs/development/libraries/aribb25/default.nix b/pkgs/development/libraries/aribb25/default.nix
index 2a0601a8875e..820ae89b83ca 100644
--- a/pkgs/development/libraries/aribb25/default.nix
+++ b/pkgs/development/libraries/aribb25/default.nix
@@ -6,7 +6,6 @@
   autoreconfHook,
   pkg-config,
   pcsclite,
-  PCSC,
 }:
 
 stdenv.mkDerivation rec {
@@ -28,9 +27,7 @@ stdenv.mkDerivation rec {
     pkg-config
   ];
 
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isDarwin [ PCSC ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [ pcsclite ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ pcsclite ];
 
   env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-deprecated-non-prototype";
 
diff --git a/pkgs/development/libraries/audio/cubeb/default.nix b/pkgs/development/libraries/audio/cubeb/default.nix
index 9c7e3a5c79b6..f736e87e8290 100644
--- a/pkgs/development/libraries/audio/cubeb/default.nix
+++ b/pkgs/development/libraries/audio/cubeb/default.nix
@@ -9,9 +9,6 @@
   libpulseaudio,
   sndio,
   speexdsp,
-  AudioUnit,
-  CoreAudio,
-  CoreServices,
   lazyLoad ? !stdenv.hostPlatform.isDarwin,
 }:
 
@@ -44,18 +41,7 @@ stdenv.mkDerivation {
     pkg-config
   ];
 
-  buildInputs =
-    [ speexdsp ]
-    ++ (
-      if stdenv.hostPlatform.isDarwin then
-        [
-          AudioUnit
-          CoreAudio
-          CoreServices
-        ]
-      else
-        backendLibs
-    );
+  buildInputs = [ speexdsp ] ++ lib.optionals (!stdenv.hostPlatform.isDarwin) backendLibs;
 
   cmakeFlags = [
     "-DBUILD_SHARED_LIBS=ON"
diff --git a/pkgs/development/libraries/audio/rtaudio/default.nix b/pkgs/development/libraries/audio/rtaudio/default.nix
index e289cc2c3f9f..00f98be49fe9 100644
--- a/pkgs/development/libraries/audio/rtaudio/default.nix
+++ b/pkgs/development/libraries/audio/rtaudio/default.nix
@@ -12,7 +12,6 @@
   jackSupport ? true,
   jack,
   coreaudioSupport ? stdenv.hostPlatform.isDarwin,
-  CoreAudio,
 }:
 
 stdenv.mkDerivation rec {
@@ -35,8 +34,7 @@ stdenv.mkDerivation rec {
   buildInputs =
     lib.optional alsaSupport alsa-lib
     ++ lib.optional pulseaudioSupport libpulseaudio
-    ++ lib.optional jackSupport jack
-    ++ lib.optional coreaudioSupport CoreAudio;
+    ++ lib.optional jackSupport jack;
 
   cmakeFlags = [
     "-DRTAUDIO_API_ALSA=${if alsaSupport then "ON" else "OFF"}"
diff --git a/pkgs/development/libraries/audio/rtmidi/default.nix b/pkgs/development/libraries/audio/rtmidi/default.nix
index b22849d2d54f..fb8d867d96f8 100644
--- a/pkgs/development/libraries/audio/rtmidi/default.nix
+++ b/pkgs/development/libraries/audio/rtmidi/default.nix
@@ -10,9 +10,6 @@
   jackSupport ? true,
   jack,
   coremidiSupport ? stdenv.hostPlatform.isDarwin,
-  CoreMIDI,
-  CoreAudio,
-  CoreServices,
 }:
 
 stdenv.mkDerivation rec {
@@ -31,14 +28,7 @@ stdenv.mkDerivation rec {
     pkg-config
   ];
 
-  buildInputs =
-    lib.optional alsaSupport alsa-lib
-    ++ lib.optional jackSupport jack
-    ++ lib.optionals coremidiSupport [
-      CoreMIDI
-      CoreAudio
-      CoreServices
-    ];
+  buildInputs = lib.optional alsaSupport alsa-lib ++ lib.optional jackSupport jack;
 
   cmakeFlags = [
     "-DRTMIDI_API_ALSA=${if alsaSupport then "ON" else "OFF"}"
diff --git a/pkgs/development/libraries/audiofile/default.nix b/pkgs/development/libraries/audiofile/default.nix
index 6fc237975332..de5ce22b017a 100644
--- a/pkgs/development/libraries/audiofile/default.nix
+++ b/pkgs/development/libraries/audiofile/default.nix
@@ -4,8 +4,6 @@
   fetchurl,
   fetchpatch,
   alsa-lib,
-  AudioUnit,
-  CoreServices,
 }:
 
 let
@@ -27,14 +25,9 @@ stdenv.mkDerivation rec {
   pname = "audiofile";
   version = "0.3.6";
 
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [
-      alsa-lib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CoreServices
-      AudioUnit
-    ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    alsa-lib
+  ];
 
   src = fetchurl {
     url = "https://audiofile.68k.org/audiofile-${version}.tar.gz";
diff --git a/pkgs/development/libraries/aws-c-cal/default.nix b/pkgs/development/libraries/aws-c-cal/default.nix
index 8f485a04fb2b..eceed9985693 100644
--- a/pkgs/development/libraries/aws-c-cal/default.nix
+++ b/pkgs/development/libraries/aws-c-cal/default.nix
@@ -6,7 +6,6 @@
   aws-c-common,
   nix,
   openssl,
-  Security,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -33,8 +32,6 @@ stdenv.mkDerivation (finalAttrs: {
     openssl
   ];
 
-  propagatedBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
-
   cmakeFlags = [
     "-DBUILD_SHARED_LIBS=ON"
   ];
diff --git a/pkgs/development/libraries/aws-c-io/default.nix b/pkgs/development/libraries/aws-c-io/default.nix
index ef2a51754de2..ddf698b7bb54 100644
--- a/pkgs/development/libraries/aws-c-io/default.nix
+++ b/pkgs/development/libraries/aws-c-io/default.nix
@@ -7,7 +7,6 @@
   aws-c-common,
   nix,
   s2n-tls,
-  Security,
 }:
 
 stdenv.mkDerivation rec {
@@ -29,7 +28,6 @@ stdenv.mkDerivation rec {
     aws-c-common
     s2n-tls
   ];
-  propagatedBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
 
   cmakeFlags = [
     "-DBUILD_SHARED_LIBS=ON"
diff --git a/pkgs/development/libraries/aws-sdk-cpp/default.nix b/pkgs/development/libraries/aws-sdk-cpp/default.nix
index 47ef7a371a72..a0854db31509 100644
--- a/pkgs/development/libraries/aws-sdk-cpp/default.nix
+++ b/pkgs/development/libraries/aws-sdk-cpp/default.nix
@@ -7,8 +7,6 @@
   openssl,
   zlib,
   aws-crt-cpp,
-  CoreAudio,
-  AudioToolbox,
   nix,
   arrow-cpp,
   aws-sdk-cpp,
@@ -85,20 +83,11 @@ stdenv.mkDerivation rec {
     curl
   ];
 
-  buildInputs =
-    [
-      curl
-      openssl
-      zlib
-    ]
-    ++ lib.optionals
-      (
-        stdenv.hostPlatform.isDarwin && ((builtins.elem "text-to-speech" apis) || (builtins.elem "*" apis))
-      )
-      [
-        CoreAudio
-        AudioToolbox
-      ];
+  buildInputs = [
+    curl
+    openssl
+    zlib
+  ];
 
   # propagation is needed for Security.framework to be available when linking
   propagatedBuildInputs = [ aws-crt-cpp ];
diff --git a/pkgs/development/libraries/boost/generic.nix b/pkgs/development/libraries/boost/generic.nix
index d9051e6290b4..9167e7b08c61 100644
--- a/pkgs/development/libraries/boost/generic.nix
+++ b/pkgs/development/libraries/boost/generic.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   icu,
-  expat,
   zlib,
   bzip2,
   zstd,
@@ -87,8 +86,6 @@ let
       "variant=${variant}"
       "threading=${threading}"
       "link=${link}"
-      "-sEXPAT_INCLUDE=${expat.dev}/include"
-      "-sEXPAT_LIBPATH=${expat.out}/lib"
     ]
     ++ lib.optionals (lib.versionAtLeast version "1.85") [
       (
@@ -345,7 +342,6 @@ stdenv.mkDerivation {
   ] ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
   buildInputs =
     [
-      expat
       zlib
       bzip2
       libiconv
diff --git a/pkgs/development/libraries/botan/default.nix b/pkgs/development/libraries/botan/default.nix
index 0e482049b11a..a5b22730df73 100644
--- a/pkgs/development/libraries/botan/default.nix
+++ b/pkgs/development/libraries/botan/default.nix
@@ -7,7 +7,6 @@
   bzip2,
   zlib,
   jitterentropy,
-  darwin,
   static ? stdenv.hostPlatform.isStatic, # generates static libraries *only*
 }:
 
@@ -51,13 +50,7 @@ let
           bzip2
           zlib
         ]
-        ++ lib.optionals stdenv.hostPlatform.isDarwin (
-          with darwin.apple_sdk.frameworks;
-          [
-            CoreServices
-            Security
-          ]
-        )
+
         ++ lib.optionals (lib.versionAtLeast version "3.6.0") [
           jitterentropy
         ];
diff --git a/pkgs/development/libraries/bullet/default.nix b/pkgs/development/libraries/bullet/default.nix
index 63be83763eb2..59a03c86bba0 100644
--- a/pkgs/development/libraries/bullet/default.nix
+++ b/pkgs/development/libraries/bullet/default.nix
@@ -6,8 +6,6 @@
   libGLU,
   libGL,
   libglut,
-  Cocoa,
-  OpenGL,
 }:
 
 stdenv.mkDerivation rec {
@@ -22,26 +20,16 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ cmake ];
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [
-      libGLU
-      libGL
-      libglut
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Cocoa
-      OpenGL
-    ];
+  buildInputs = [
+    libGLU
+    libGL
+    libglut
+  ];
 
-  postPatch =
-    ''
-      substituteInPlace examples/ThirdPartyLibs/Gwen/CMakeLists.txt \
-        --replace "-DGLEW_STATIC" "-DGLEW_STATIC -Wno-narrowing"
-    ''
-    + lib.optionalString stdenv.hostPlatform.isDarwin ''
-      sed -i 's/FIND_PACKAGE(OpenGL)//' CMakeLists.txt
-      sed -i 's/FIND_LIBRARY(COCOA_LIBRARY Cocoa)//' CMakeLists.txt
-    '';
+  postPatch = ''
+    substituteInPlace examples/ThirdPartyLibs/Gwen/CMakeLists.txt \
+      --replace "-DGLEW_STATIC" "-DGLEW_STATIC -Wno-narrowing"
+  '';
 
   cmakeFlags =
     [
@@ -50,11 +38,6 @@ stdenv.mkDerivation rec {
       "-DINSTALL_EXTRA_LIBS=ON"
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      "-DOPENGL_FOUND=true"
-      "-DOPENGL_LIBRARIES=${OpenGL}/Library/Frameworks/OpenGL.framework"
-      "-DOPENGL_INCLUDE_DIR=${OpenGL}/Library/Frameworks/OpenGL.framework"
-      "-DOPENGL_gl_LIBRARY=${OpenGL}/Library/Frameworks/OpenGL.framework"
-      "-DCOCOA_LIBRARY=${Cocoa}/Library/Frameworks/Cocoa.framework"
       "-DBUILD_BULLET2_DEMOS=OFF"
       "-DBUILD_UNIT_TESTS=OFF"
       "-DBUILD_BULLET_ROBOTICS_GUI_EXTRA=OFF"
diff --git a/pkgs/development/libraries/bullet/roboschool-fork.nix b/pkgs/development/libraries/bullet/roboschool-fork.nix
index 94ce4a3f865d..53b296aa82f0 100644
--- a/pkgs/development/libraries/bullet/roboschool-fork.nix
+++ b/pkgs/development/libraries/bullet/roboschool-fork.nix
@@ -6,8 +6,6 @@
   libGLU,
   libGL,
   libglut,
-  Cocoa,
-  OpenGL,
 }:
 
 stdenv.mkDerivation {
@@ -26,24 +24,14 @@ stdenv.mkDerivation {
   };
 
   nativeBuildInputs = [ cmake ];
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [
-      libGLU
-      libGL
-      libglut
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Cocoa
-      OpenGL
-    ];
+  buildInputs = [
+    libGLU
+    libGL
+    libglut
+  ];
 
   patches = [ ./gwen-narrowing.patch ];
 
-  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    sed -i 's/FIND_PACKAGE(OpenGL)//' CMakeLists.txt
-    sed -i 's/FIND_LIBRARY(COCOA_LIBRARY Cocoa)//' CMakeLists.txt
-  '';
-
   cmakeFlags =
     [
       "-DBUILD_SHARED_LIBS=ON"
@@ -51,11 +39,6 @@ stdenv.mkDerivation {
       "-DINSTALL_EXTRA_LIBS=ON"
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      "-DOPENGL_FOUND=true"
-      "-DOPENGL_LIBRARIES=${OpenGL}/Library/Frameworks/OpenGL.framework"
-      "-DOPENGL_INCLUDE_DIR=${OpenGL}/Library/Frameworks/OpenGL.framework"
-      "-DOPENGL_gl_LIBRARY=${OpenGL}/Library/Frameworks/OpenGL.framework"
-      "-DCOCOA_LIBRARY=${Cocoa}/Library/Frameworks/Cocoa.framework"
       "-DBUILD_BULLET2_DEMOS=OFF"
       "-DBUILD_UNIT_TESTS=OFF"
     ];
diff --git a/pkgs/development/libraries/c-ares/default.nix b/pkgs/development/libraries/c-ares/default.nix
index aeeda1bf5073..34f2e7bbf62a 100644
--- a/pkgs/development/libraries/c-ares/default.nix
+++ b/pkgs/development/libraries/c-ares/default.nix
@@ -18,12 +18,12 @@
 
 stdenv.mkDerivation rec {
   pname = "c-ares";
-  version = "1.34.4";
+  version = "1.34.5";
 
   src = fetchurl {
     # Note: tag name varies in some versions, e.g. v1.30.0, c-ares-1_17_0.
     url = "https://github.com/c-ares/${pname}/releases/download/v${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-+jjb7WWe5MxaMt9eJ97aV1+mhSx5pyuhr4XeNaauIi8=";
+    hash = "sha256-fZNXkOmvCBwlxJX9E8LPzaR5KYNBjpY1jvbnMg7gY0Y=";
   };
 
   outputs = [
diff --git a/pkgs/development/libraries/cairomm/1.16.nix b/pkgs/development/libraries/cairomm/1.16.nix
index 28a8eb3c687c..786e6e560964 100644
--- a/pkgs/development/libraries/cairomm/1.16.nix
+++ b/pkgs/development/libraries/cairomm/1.16.nix
@@ -9,7 +9,6 @@
   cairo,
   fontconfig,
   libsigcxx30,
-  ApplicationServices,
 }:
 
 stdenv.mkDerivation rec {
@@ -32,14 +31,10 @@ stdenv.mkDerivation rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      boost # for tests
-      fontconfig
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      ApplicationServices
-    ];
+  buildInputs = [
+    boost # for tests
+    fontconfig
+  ];
 
   propagatedBuildInputs = [
     cairo
diff --git a/pkgs/development/libraries/cairomm/default.nix b/pkgs/development/libraries/cairomm/default.nix
index 6c7046a15e53..f570ca3c4528 100644
--- a/pkgs/development/libraries/cairomm/default.nix
+++ b/pkgs/development/libraries/cairomm/default.nix
@@ -3,7 +3,6 @@
   stdenv,
   lib,
   pkg-config,
-  darwin,
   boost,
   cairo,
   fontconfig,
@@ -32,17 +31,10 @@ stdenv.mkDerivation rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      boost # for tests
-      fontconfig
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        ApplicationServices
-      ]
-    );
+  buildInputs = [
+    boost # for tests
+    fontconfig
+  ];
 
   propagatedBuildInputs = [
     cairo
diff --git a/pkgs/development/libraries/catch2/3.nix b/pkgs/development/libraries/catch2/3.nix
index 01d35a85d873..750bc12a29cb 100644
--- a/pkgs/development/libraries/catch2/3.nix
+++ b/pkgs/development/libraries/catch2/3.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "catch2";
-  version = "3.8.0";
+  version = "3.8.1";
 
   src = fetchFromGitHub {
     owner = "catchorg";
     repo = "Catch2";
     rev = "v${version}";
-    hash = "sha256-2gK+CUpml6AaHcwNoq0tHLr2NwqtMPx+jP80/LLFFr4=";
+    hash = "sha256-blhSdtNXwe4wKPVKlopsE0omgikMdl12JjwqASwJM2w=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/cctz/default.nix b/pkgs/development/libraries/cctz/default.nix
index 2786ea7b1dca..a28c22d0443f 100644
--- a/pkgs/development/libraries/cctz/default.nix
+++ b/pkgs/development/libraries/cctz/default.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  Foundation,
 }:
 
 stdenv.mkDerivation rec {
@@ -18,8 +17,6 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "PREFIX=$(out)" ];
 
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin Foundation;
-
   installTargets =
     [ "install_hdrs" ]
     ++ lib.optional (!stdenv.hostPlatform.isStatic) "install_shared_lib"
diff --git a/pkgs/development/libraries/check/default.nix b/pkgs/development/libraries/check/default.nix
index e8ea400c958b..853bc99382bb 100644
--- a/pkgs/development/libraries/check/default.nix
+++ b/pkgs/development/libraries/check/default.nix
@@ -2,7 +2,6 @@
   fetchurl,
   lib,
   stdenv,
-  CoreServices,
 }:
 
 stdenv.mkDerivation rec {
@@ -22,8 +21,6 @@ stdenv.mkDerivation rec {
   # Test can randomly fail: https://hydra.nixos.org/build/7243912
   doCheck = false;
 
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin CoreServices;
-
   meta = with lib; {
     description = "Unit testing framework for C";
 
diff --git a/pkgs/development/libraries/cogl/default.nix b/pkgs/development/libraries/cogl/default.nix
index 58164f4454a5..76bf395f125d 100644
--- a/pkgs/development/libraries/cogl/default.nix
+++ b/pkgs/development/libraries/cogl/default.nix
@@ -21,7 +21,6 @@
   gstreamerSupport ? false,
   gst_all_1,
   harfbuzz,
-  OpenGL,
 }:
 
 stdenv.mkDerivation rec {
@@ -100,13 +99,11 @@ stdenv.mkDerivation rec {
       gst_all_1.gst-plugins-base
     ];
 
-  buildInputs =
-    lib.optionals pangoSupport [
-      pango
-      cairo
-      harfbuzz
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ OpenGL ];
+  buildInputs = lib.optionals pangoSupport [
+    pango
+    cairo
+    harfbuzz
+  ];
 
   env =
     {
diff --git a/pkgs/development/libraries/ctranslate2/default.nix b/pkgs/development/libraries/ctranslate2/default.nix
index 6a31479b316d..f90b17c72c05 100644
--- a/pkgs/development/libraries/ctranslate2/default.nix
+++ b/pkgs/development/libraries/ctranslate2/default.nix
@@ -3,7 +3,6 @@
   stdenv,
   fetchFromGitHub,
   cmake,
-  darwin, # Accelerate
   llvmPackages, # openmp
   withMkl ? false,
   mkl,
@@ -80,11 +79,6 @@ stdenv.mkDerivation rec {
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       llvmPackages.openmp
-      darwin.apple_sdk.frameworks.Accelerate
-    ]
-    ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
-      darwin.apple_sdk.frameworks.CoreGraphics
-      darwin.apple_sdk.frameworks.CoreVideo
     ];
 
   passthru.tests = {
diff --git a/pkgs/development/libraries/discord-rpc/default.nix b/pkgs/development/libraries/discord-rpc/default.nix
index 7b85ec1a18d6..530e70732acf 100644
--- a/pkgs/development/libraries/discord-rpc/default.nix
+++ b/pkgs/development/libraries/discord-rpc/default.nix
@@ -5,7 +5,6 @@
   fetchpatch,
   cmake,
   rapidjson,
-  AppKit,
   buildExamples ? false,
 }:
 
@@ -26,7 +25,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     rapidjson
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin AppKit;
+  ];
 
   cmakeFlags = [
     "-DBUILD_SHARED_LIBS=true"
diff --git a/pkgs/development/libraries/enchant/2.x.nix b/pkgs/development/libraries/enchant/2.x.nix
index c5dde2033dc3..82ec5ee5e926 100644
--- a/pkgs/development/libraries/enchant/2.x.nix
+++ b/pkgs/development/libraries/enchant/2.x.nix
@@ -19,7 +19,6 @@
   withVoikko ? true,
   withAppleSpell ? stdenv.hostPlatform.isDarwin,
 
-  Cocoa,
 }:
 
 assert withAppleSpell -> stdenv.hostPlatform.isDarwin;
@@ -57,9 +56,6 @@ stdenv.mkDerivation rec {
     ]
     ++ lib.optionals withVoikko [
       libvoikko
-    ]
-    ++ lib.optionals withAppleSpell [
-      Cocoa
     ];
 
   checkInputs = [
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index a013456cc403..fd5b46846952 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -56,7 +56,7 @@
   withBzlib ? withHeadlessDeps,
   withCaca ? withFullDeps, # Textual display (ASCII art)
   withCdio ? withFullDeps && withGPL, # Audio CD grabbing
-  withCelt ? withHeadlessDeps, # CELT decoder
+  withCelt ? withFullDeps, # CELT decoder
   withChromaprint ? withFullDeps, # Audio fingerprinting
   withCodec2 ? withFullDeps, # codec2 en/decoding
   withCuda ? withFullDeps && withNvcodec,
@@ -474,6 +474,13 @@ stdenv.mkDerivation (
           hash = "sha256-sqUUSOPTPLwu2h8GbAw4SfEf+0oWioz52BcpW1n4v3Y=";
         })
       ]
+      ++ optionals (lib.versionOlder version "7.1.1") [
+        (fetchpatch2 {
+          name = "texinfo-7.1.patch";
+          url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/4d9cdf82ee36a7da4f065821c86165fe565aeac2";
+          hash = "sha256-BZsq1WI6OgtkCQE8koQu0CNcb5c8WgTu/LzQzu6ZLuo=";
+        })
+      ]
       ++ optionals (lib.versionOlder version "7" && stdenv.hostPlatform.isAarch32) [
         (fetchpatch2 {
           name = "binutils-2-43-compat.patch";
@@ -1031,6 +1038,10 @@ stdenv.mkDerivation (
   }
   // lib.optionalAttrs withCudaLLVM {
     # remove once https://github.com/NixOS/nixpkgs/issues/318674 is addressed properly
-    hardeningDisable = [ "zerocallusedregs" ];
+    hardeningDisable = [
+      "pacret"
+      "shadowstack"
+      "zerocallusedregs"
+    ];
   }
 )
diff --git a/pkgs/development/libraries/fltk/common.nix b/pkgs/development/libraries/fltk/common.nix
index 6e851c66e077..6df8c0821963 100644
--- a/pkgs/development/libraries/fltk/common.nix
+++ b/pkgs/development/libraries/fltk/common.nix
@@ -22,15 +22,11 @@
   libXcursor,
   libXft,
   libXrender,
-  ApplicationServices,
-  Carbon,
-  Cocoa,
 
   withGL ? true,
   libGL,
   libGLU,
   glew,
-  OpenGL,
 
   withCairo ? true,
   cairo,
@@ -83,11 +79,7 @@ stdenv.mkDerivation {
     ];
 
   buildInputs =
-    lib.optionals stdenv.hostPlatform.isDarwin [
-      ApplicationServices
-      Carbon
-    ]
-    ++ lib.optionals (withGL && !stdenv.hostPlatform.isDarwin) [
+    lib.optionals (withGL && !stdenv.hostPlatform.isDarwin) [
       libGL
       libGLU
     ]
@@ -114,12 +106,6 @@ stdenv.mkDerivation {
       libXft
       libXrender
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Cocoa
-    ]
-    ++ lib.optionals (withGL && stdenv.hostPlatform.isDarwin) [
-      OpenGL
-    ]
     ++ lib.optionals withCairo [
       cairo
     ]
diff --git a/pkgs/development/libraries/fontconfig/default.nix b/pkgs/development/libraries/fontconfig/default.nix
index a6763f0b66c1..59654edc479e 100644
--- a/pkgs/development/libraries/fontconfig/default.nix
+++ b/pkgs/development/libraries/fontconfig/default.nix
@@ -10,7 +10,6 @@
   gperf,
   dejavu_fonts,
   autoreconfHook,
-  CoreFoundation,
   testers,
 }:
 
@@ -42,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     expat
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin CoreFoundation;
+  ];
 
   propagatedBuildInputs = [
     freetype
diff --git a/pkgs/development/libraries/fox/fox-1.6.nix b/pkgs/development/libraries/fox/fox-1.6.nix
index cfe531ccfa7b..24b81816aeaf 100644
--- a/pkgs/development/libraries/fox/fox-1.6.nix
+++ b/pkgs/development/libraries/fox/fox-1.6.nix
@@ -16,7 +16,6 @@
   libXfixes,
   mesa,
   xinput,
-  CoreServices,
 }:
 
 stdenv.mkDerivation rec {
@@ -42,7 +41,7 @@ stdenv.mkDerivation rec {
     libGL
     libXfixes
     xinput
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin CoreServices;
+  ];
 
   doCheck = true;
 
diff --git a/pkgs/development/libraries/freenect/default.nix b/pkgs/development/libraries/freenect/default.nix
index 08c6b5a3a810..165d914c9ebd 100644
--- a/pkgs/development/libraries/freenect/default.nix
+++ b/pkgs/development/libraries/freenect/default.nix
@@ -10,8 +10,6 @@
   libGL,
   libXi,
   libXmu,
-  GLUT,
-  Cocoa,
 }:
 
 stdenv.mkDerivation rec {
@@ -25,19 +23,14 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-PpJGFWrlQ5sK7TJxQNoPujw1MxWRjphvblwOqnF+mSg=";
   };
 
-  buildInputs =
-    [
-      libusb1
-      libglut
-      libGLU
-      libGL
-      libXi
-      libXmu
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      GLUT
-      Cocoa
-    ];
+  buildInputs = [
+    libusb1
+    libglut
+    libGLU
+    libGL
+    libXi
+    libXmu
+  ];
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/development/libraries/gegl/default.nix b/pkgs/development/libraries/gegl/default.nix
index 9c429091908c..e3209c5e4f1f 100644
--- a/pkgs/development/libraries/gegl/default.nix
+++ b/pkgs/development/libraries/gegl/default.nix
@@ -30,7 +30,6 @@
   libwebp,
   luajit,
   openexr,
-  OpenCL,
   suitesparse,
   withLuaJIT ? lib.meta.availableOn stdenv.hostPlatform luajit,
   gimp,
@@ -82,9 +81,6 @@ stdenv.mkDerivation (finalAttrs: {
       openexr
       suitesparse
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      OpenCL
-    ]
     ++ lib.optionals stdenv.cc.isClang [
       llvmPackages.openmp
     ]
diff --git a/pkgs/development/libraries/getdns/default.nix b/pkgs/development/libraries/getdns/default.nix
index aa0df3aebc17..5916ca251dcf 100644
--- a/pkgs/development/libraries/getdns/default.nix
+++ b/pkgs/development/libraries/getdns/default.nix
@@ -5,7 +5,6 @@
   stdenv,
   fetchurl,
   cmake,
-  darwin,
   doxygen,
   libidn2,
   libyaml,
@@ -97,14 +96,11 @@ rec {
       yq
     ];
 
-    buildInputs =
-      [
-        getdns
-        libyaml
-        openssl
-      ]
-      ++ lib.optionals stdenv.hostPlatform.isLinux [ systemd ]
-      ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.Security ];
+    buildInputs = [
+      getdns
+      libyaml
+      openssl
+    ] ++ lib.optionals stdenv.hostPlatform.isLinux [ systemd ];
 
     postInstall = ''
       rm -r $out/share/doc
diff --git a/pkgs/development/libraries/glew/1.10.nix b/pkgs/development/libraries/glew/1.10.nix
index f6198467aeec..30dd8e2a0401 100644
--- a/pkgs/development/libraries/glew/1.10.nix
+++ b/pkgs/development/libraries/glew/1.10.nix
@@ -6,8 +6,6 @@
   libXmu,
   libXi,
   libXext,
-  AGL,
-  OpenGL,
   testers,
   mesa,
 }:
@@ -21,16 +19,12 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "01zki46dr5khzlyywr3cg615bcal32dazfazkf360s1znqh17i4r";
   };
 
-  buildInputs =
-    if stdenv.hostPlatform.isDarwin then
-      [ AGL ]
-    else
-      [
-        libXmu
-        libXi
-        libXext
-      ];
-  propagatedBuildInputs = if stdenv.hostPlatform.isDarwin then [ OpenGL ] else [ libGLU ]; # GL/glew.h includes GL/glu.h
+  buildInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) [
+    libXmu
+    libXi
+    libXext
+  ];
+  propagatedBuildInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) [ libGLU ]; # GL/glew.h includes GL/glu.h
 
   outputs = [
     "out"
diff --git a/pkgs/development/libraries/glew/default.nix b/pkgs/development/libraries/glew/default.nix
index 00a148c9df28..64b79757ccf5 100644
--- a/pkgs/development/libraries/glew/default.nix
+++ b/pkgs/development/libraries/glew/default.nix
@@ -8,7 +8,6 @@
   libXmu,
   libXi,
   libXext,
-  OpenGL,
   enableEGL ? (!stdenv.hostPlatform.isDarwin),
   testers,
   mesa,
@@ -50,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
     libXi
     libXext
   ];
-  propagatedBuildInputs = if stdenv.hostPlatform.isDarwin then [ OpenGL ] else [ libGLU ]; # GL/glew.h includes GL/glu.h
+  propagatedBuildInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) [ libGLU ]; # GL/glew.h includes GL/glu.h
 
   cmakeDir = "cmake";
   cmakeFlags = [
diff --git a/pkgs/development/libraries/glibmm/2.68.nix b/pkgs/development/libraries/glibmm/2.68.nix
index e3acad3cff17..2bea3af219c2 100644
--- a/pkgs/development/libraries/glibmm/2.68.nix
+++ b/pkgs/development/libraries/glibmm/2.68.nix
@@ -7,7 +7,6 @@
   glib,
   libsigcxx30,
   gnome,
-  Cocoa,
   meson,
   ninja,
 }:
@@ -34,10 +33,6 @@ stdenv.mkDerivation rec {
     glib # for glib-compile-schemas
   ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    Cocoa
-  ];
-
   propagatedBuildInputs = [
     glib
     libsigcxx30
diff --git a/pkgs/development/libraries/glibmm/default.nix b/pkgs/development/libraries/glibmm/default.nix
index 732c3d77c4e2..317de19f6703 100644
--- a/pkgs/development/libraries/glibmm/default.nix
+++ b/pkgs/development/libraries/glibmm/default.nix
@@ -7,7 +7,6 @@
   glib,
   libsigcxx,
   gnome,
-  darwin,
   meson,
   ninja,
 }:
@@ -33,13 +32,6 @@ stdenv.mkDerivation rec {
     gnum4
     glib # for glib-compile-schemas
   ];
-
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin (
-    with darwin.apple_sdk.frameworks;
-    [
-      Cocoa
-    ]
-  );
   propagatedBuildInputs = [
     glib
     libsigcxx
diff --git a/pkgs/development/libraries/gnutls/default.nix b/pkgs/development/libraries/gnutls/default.nix
index 1575064fd2dc..dbf8bf7b0333 100644
--- a/pkgs/development/libraries/gnutls/default.nix
+++ b/pkgs/development/libraries/gnutls/default.nix
@@ -3,11 +3,9 @@
   stdenv,
   fetchurl,
   zlib,
-  lzo,
   libtasn1,
   nettle,
   pkg-config,
-  lzip,
   perl,
   gmp,
   autoconf,
@@ -27,7 +25,6 @@
   libunistring,
   withP11-kit ? !stdenv.hostPlatform.isStatic,
   p11-kit,
-  Security, # darwin Security.framework
   # certificate compression - only zlib now, more possible: zstd, brotli
 
   # for passthru.tests
@@ -142,8 +139,6 @@ stdenv.mkDerivation rec {
 
   buildInputs =
     [
-      lzo
-      lzip
       libtasn1
       libidn2
       zlib
@@ -153,7 +148,7 @@ stdenv.mkDerivation rec {
       gettext
       libiconv
     ]
-    ++ lib.optional (withP11-kit) p11-kit
+    ++ lib.optional withP11-kit p11-kit
     ++ lib.optional (tpmSupport && stdenv.hostPlatform.isLinux) trousers;
 
   nativeBuildInputs =
@@ -172,10 +167,7 @@ stdenv.mkDerivation rec {
       util-linux
     ];
 
-  propagatedBuildInputs =
-    [ nettle ]
-    # Builds dynamically linking against gnutls seem to need the framework now.
-    ++ lib.optional isDarwin Security;
+  propagatedBuildInputs = [ nettle ];
 
   inherit doCheck;
   # stdenv's `NIX_SSL_CERT_FILE=/no-cert-file.crt` breaks tests.
@@ -212,8 +204,8 @@ stdenv.mkDerivation rec {
       samba
       openconnect
       ;
-    inherit (ocamlPackages) ocamlnet;
-    haskell-gnutls = haskellPackages.gnutls;
+    #inherit (ocamlPackages) ocamlnet;
+    #haskell-gnutls = haskellPackages.gnutls;
     python3-gnutls = python3Packages.python3-gnutls;
     rsyslog = rsyslog.override { withGnutls = true; };
     static = pkgsStatic.gnutls;
diff --git a/pkgs/development/libraries/gstreamer/bad/default.nix b/pkgs/development/libraries/gstreamer/bad/default.nix
index b7d246e64088..eab5dbffd8ca 100644
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@@ -95,14 +95,6 @@
   libfreeaptx,
   zxing-cpp,
   usrsctp,
-  VideoToolbox,
-  AudioToolbox,
-  AVFoundation,
-  Cocoa,
-  CoreMedia,
-  CoreVideo,
-  Foundation,
-  MediaToolbox,
   directoryListingUpdater,
   enableGplPlugins ? true,
   bluezSupport ? stdenv.hostPlatform.isLinux,
@@ -113,7 +105,7 @@
   hotdoc,
   guiSupport ? true,
   gst-plugins-bad,
-  apple-sdk_13,
+  apple-sdk_gstreamer,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -274,18 +266,7 @@ stdenv.mkDerivation (finalAttrs: {
       gtk3
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      # For unknown reasons the order is important, e.g. if
-      # VideoToolbox is last, we get:
-      #     fatal error: 'VideoToolbox/VideoToolbox.h' file not found
-      VideoToolbox
-      AudioToolbox
-      AVFoundation
-      Cocoa
-      CoreMedia
-      CoreVideo
-      Foundation
-      MediaToolbox
-      apple-sdk_13
+      apple-sdk_gstreamer
     ];
 
   mesonFlags =
diff --git a/pkgs/development/libraries/gstreamer/base/default.nix b/pkgs/development/libraries/gstreamer/base/default.nix
index 673aa28cb8ff..59e0054a4091 100644
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@@ -35,10 +35,7 @@
   wayland-protocols,
   enableAlsa ? stdenv.hostPlatform.isLinux,
   alsa-lib,
-  # TODO: fix once x86_64-darwin sdk updated
-  enableCocoa ? (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64),
-  Cocoa,
-  OpenGL,
+  enableCocoa ? stdenv.hostPlatform.isDarwin,
   enableGl ? (enableX11 || enableWayland || enableCocoa),
   enableCdparanoia ? (!stdenv.hostPlatform.isDarwin),
   cdparanoia,
@@ -48,6 +45,7 @@
   enableDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform,
   hotdoc,
   directoryListingUpdater,
+  apple-sdk_gstreamer,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -109,7 +107,7 @@ stdenv.mkDerivation (finalAttrs: {
       libGL
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      OpenGL
+      apple-sdk_gstreamer
     ]
     ++ lib.optionals enableAlsa [
       alsa-lib
@@ -123,7 +121,6 @@ stdenv.mkDerivation (finalAttrs: {
       wayland
       wayland-protocols
     ]
-    ++ lib.optional enableCocoa Cocoa
     ++ lib.optional enableCdparanoia cdparanoia;
 
   propagatedBuildInputs =
diff --git a/pkgs/development/libraries/gstreamer/core/default.nix b/pkgs/development/libraries/gstreamer/core/default.nix
index ad189e8892af..8b8900058d28 100644
--- a/pkgs/development/libraries/gstreamer/core/default.nix
+++ b/pkgs/development/libraries/gstreamer/core/default.nix
@@ -14,9 +14,6 @@
   elfutils, # for libdw
   bash-completion,
   lib,
-  Cocoa,
-  CoreServices,
-  xpc,
   testers,
   rustc,
   withRust ?
@@ -35,6 +32,7 @@
   enableDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform,
   hotdoc,
   directoryListingUpdater,
+  apple-sdk_gstreamer,
 }:
 
 let
@@ -102,9 +100,7 @@ stdenv.mkDerivation (finalAttrs: {
       libunwind
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Cocoa
-      CoreServices
-      xpc
+      apple-sdk_gstreamer
     ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/libraries/gstreamer/default.nix b/pkgs/development/libraries/gstreamer/default.nix
index cdc5b951cfaa..760ec0610dee 100644
--- a/pkgs/development/libraries/gstreamer/default.nix
+++ b/pkgs/development/libraries/gstreamer/default.nix
@@ -1,55 +1,31 @@
 {
   config,
   lib,
-  stdenv,
   callPackage,
-  AVFoundation,
-  AudioToolbox,
-  Cocoa,
-  CoreFoundation,
-  CoreMedia,
-  CoreServices,
-  CoreVideo,
-  DiskArbitration,
-  Foundation,
-  IOKit,
-  MediaToolbox,
-  OpenGL,
-  Security,
-  SystemConfiguration,
-  VideoToolbox,
-  xpc,
   ipu6ep-camera-hal,
   ipu6epmtl-camera-hal,
+  apple-sdk_13,
 }:
 
+let
+  apple-sdk_gstreamer = apple-sdk_13;
+in
 {
-  inherit stdenv;
+  inherit apple-sdk_gstreamer;
 
-  gstreamer = callPackage ./core { inherit Cocoa CoreServices xpc; };
+  gstreamer = callPackage ./core { };
 
   gstreamermm = callPackage ./gstreamermm { };
 
-  gst-plugins-base = callPackage ./base { inherit Cocoa OpenGL; };
+  gst-plugins-base = callPackage ./base { };
 
-  gst-plugins-good = callPackage ./good { inherit Cocoa; };
+  gst-plugins-good = callPackage ./good { };
 
-  gst-plugins-bad = callPackage ./bad {
-    inherit
-      AudioToolbox
-      AVFoundation
-      Cocoa
-      CoreMedia
-      CoreVideo
-      Foundation
-      MediaToolbox
-      VideoToolbox
-      ;
-  };
+  gst-plugins-bad = callPackage ./bad { };
 
-  gst-plugins-ugly = callPackage ./ugly { inherit CoreFoundation DiskArbitration IOKit; };
+  gst-plugins-ugly = callPackage ./ugly { };
 
-  gst-plugins-rs = callPackage ./rs { inherit Security SystemConfiguration; };
+  gst-plugins-rs = callPackage ./rs { };
 
   gst-rtsp-server = callPackage ./rtsp-server { };
 
diff --git a/pkgs/development/libraries/gstreamer/devtools/default.nix b/pkgs/development/libraries/gstreamer/devtools/default.nix
index d4427ed650ff..79f0c59b727b 100644
--- a/pkgs/development/libraries/gstreamer/devtools/default.nix
+++ b/pkgs/development/libraries/gstreamer/devtools/default.nix
@@ -23,6 +23,7 @@
   directoryListingUpdater,
   _experimental-update-script-combinators,
   common-updater-scripts,
+  apple-sdk_gstreamer,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -73,11 +74,15 @@ stdenv.mkDerivation (finalAttrs: {
       hotdoc
     ];
 
-  buildInputs = [
-    cairo
-    python3
-    json-glib
-  ];
+  buildInputs =
+    [
+      cairo
+      python3
+      json-glib
+    ]
+    ++ lib.optionals (stdenv.hostPlatform.isDarwin) [
+      apple-sdk_gstreamer
+    ];
 
   propagatedBuildInputs = [
     gstreamer
diff --git a/pkgs/development/libraries/gstreamer/ges/default.nix b/pkgs/development/libraries/gstreamer/ges/default.nix
index 40ac0d18bff4..92baa4bd66f2 100644
--- a/pkgs/development/libraries/gstreamer/ges/default.nix
+++ b/pkgs/development/libraries/gstreamer/ges/default.nix
@@ -18,6 +18,7 @@
   enableDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform,
   hotdoc,
   directoryListingUpdater,
+  apple-sdk_gstreamer,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -48,12 +49,16 @@ stdenv.mkDerivation (finalAttrs: {
       hotdoc
     ];
 
-  buildInputs = [
-    bash-completion
-    libxml2
-    gst-devtools
-    python3
-  ];
+  buildInputs =
+    [
+      bash-completion
+      libxml2
+      gst-devtools
+      python3
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      apple-sdk_gstreamer
+    ];
 
   propagatedBuildInputs = [
     gst-plugins-base
diff --git a/pkgs/development/libraries/gstreamer/good/default.nix b/pkgs/development/libraries/gstreamer/good/default.nix
index c643aed4e2d9..7fa065408604 100644
--- a/pkgs/development/libraries/gstreamer/good/default.nix
+++ b/pkgs/development/libraries/gstreamer/good/default.nix
@@ -33,7 +33,6 @@
   libpulseaudio,
   libintl,
   libxml2,
-  Cocoa,
   lame,
   mpg123,
   twolame,
@@ -62,6 +61,7 @@
   hotdoc,
   gst-plugins-good,
   directoryListingUpdater,
+  apple-sdk_gstreamer,
 }:
 
 let
@@ -194,9 +194,6 @@ stdenv.mkDerivation (finalAttrs: {
         qtwayland
       ]
     )
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Cocoa
-    ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       libdrm
       libGL
@@ -206,6 +203,9 @@ stdenv.mkDerivation (finalAttrs: {
       libiec61883
       libgudev
     ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      apple-sdk_gstreamer
+    ]
     ++ lib.optionals enableWayland [
       wayland
     ]
diff --git a/pkgs/development/libraries/gstreamer/gstreamermm/default.nix b/pkgs/development/libraries/gstreamer/gstreamermm/default.nix
index 462a75392cca..ba486d1cc772 100644
--- a/pkgs/development/libraries/gstreamer/gstreamermm/default.nix
+++ b/pkgs/development/libraries/gstreamer/gstreamermm/default.nix
@@ -8,6 +8,7 @@
   glibmm,
   gst_all_1,
   gnome,
+  apple-sdk_gstreamer,
 }:
 
 stdenv.mkDerivation rec {
@@ -32,6 +33,10 @@ stdenv.mkDerivation rec {
     "dev"
   ];
 
+  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
+    apple-sdk_gstreamer
+  ];
+
   nativeBuildInputs = [
     pkg-config
     file
diff --git a/pkgs/development/libraries/gstreamer/icamerasrc/default.nix b/pkgs/development/libraries/gstreamer/icamerasrc/default.nix
index ff33300e966c..5f6842e7e4ee 100644
--- a/pkgs/development/libraries/gstreamer/icamerasrc/default.nix
+++ b/pkgs/development/libraries/gstreamer/icamerasrc/default.nix
@@ -8,6 +8,7 @@
   ipu6-camera-hal,
   libdrm,
   libva,
+  apple-sdk_gstreamer,
 }:
 
 stdenv.mkDerivation {
@@ -33,14 +34,18 @@ stdenv.mkDerivation {
     export STRIP_VIRTUAL_CHANNEL_CAMHAL=ON
   '';
 
-  buildInputs = [
-    gst_all_1.gstreamer
-    gst_all_1.gst-plugins-base
-    gst_all_1.gst-plugins-bad
-    ipu6-camera-hal
-    libdrm
-    libva
-  ];
+  buildInputs =
+    [
+      gst_all_1.gstreamer
+      gst_all_1.gst-plugins-base
+      gst_all_1.gst-plugins-bad
+      ipu6-camera-hal
+      libdrm
+      libva
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      apple-sdk_gstreamer
+    ];
 
   NIX_CFLAGS_COMPILE = [
     "-Wno-error"
diff --git a/pkgs/development/libraries/gstreamer/libav/default.nix b/pkgs/development/libraries/gstreamer/libav/default.nix
index e0987be683b9..72dc282f70cc 100644
--- a/pkgs/development/libraries/gstreamer/libav/default.nix
+++ b/pkgs/development/libraries/gstreamer/libav/default.nix
@@ -14,6 +14,7 @@
   enableDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform,
   hotdoc,
   directoryListingUpdater,
+  apple-sdk_gstreamer,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -42,11 +43,15 @@ stdenv.mkDerivation (finalAttrs: {
       hotdoc
     ];
 
-  buildInputs = [
-    gstreamer
-    gst-plugins-base
-    ffmpeg-headless
-  ];
+  buildInputs =
+    [
+      gstreamer
+      gst-plugins-base
+      ffmpeg-headless
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      apple-sdk_gstreamer
+    ];
 
   mesonFlags = [
     (lib.mesonEnable "doc" enableDocumentation)
diff --git a/pkgs/development/libraries/gstreamer/rs/default.nix b/pkgs/development/libraries/gstreamer/rs/default.nix
index c12726115dbd..1722fc795837 100644
--- a/pkgs/development/libraries/gstreamer/rs/default.nix
+++ b/pkgs/development/libraries/gstreamer/rs/default.nix
@@ -24,8 +24,6 @@
   libwebp,
   openssl,
   pango,
-  Security,
-  SystemConfiguration,
   gst-plugins-good,
   nix-update-script,
   # specifies a limited subset of plugins to build (the default `null` means all plugins supported on the stdenv platform)
@@ -35,6 +33,7 @@
   enableDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform && plugins == null,
   hotdoc,
   mopidy,
+  apple-sdk_gstreamer,
 }:
 
 let
@@ -58,31 +57,21 @@ let
     mp4 = [ ];
 
     # net
-    aws = [ openssl ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
+    aws = [ openssl ];
     hlssink3 = [ ];
     ndi = [ ];
     onvif = [ pango ];
     raptorq = [ ];
-    reqwest = [ openssl ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
+    reqwest = [ openssl ];
     rtp = [ ];
-    webrtc =
-      [
-        gst-plugins-bad
-        openssl
-      ]
-      ++ lib.optionals stdenv.hostPlatform.isDarwin [
-        Security
-        SystemConfiguration
-      ];
-    webrtchttp =
-      [
-        gst-plugins-bad
-        openssl
-      ]
-      ++ lib.optionals stdenv.hostPlatform.isDarwin [
-        Security
-        SystemConfiguration
-      ];
+    webrtc = [
+      gst-plugins-bad
+      openssl
+    ];
+    webrtchttp = [
+      gst-plugins-bad
+      openssl
+    ];
 
     # text
     textahead = [ ];
@@ -236,10 +225,15 @@ stdenv.mkDerivation (finalAttrs: {
 
   env = lib.optionalAttrs stdenv.hostPlatform.isDarwin { NIX_CFLAGS_LINK = "-fuse-ld=lld"; };
 
-  buildInputs = [
-    gstreamer
-    gst-plugins-base
-  ] ++ lib.concatMap (plugin: lib.getAttr plugin validPlugins) selectedPlugins;
+  buildInputs =
+    [
+      gstreamer
+      gst-plugins-base
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      apple-sdk_gstreamer
+    ]
+    ++ lib.concatMap (plugin: lib.getAttr plugin validPlugins) selectedPlugins;
 
   checkInputs = [
     gst-plugins-good
diff --git a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
index 50b41ee8d28e..dade9cd11663 100644
--- a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
+++ b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
@@ -14,6 +14,7 @@
   enableDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform,
   hotdoc,
   directoryListingUpdater,
+  apple-sdk_gstreamer,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -43,10 +44,14 @@ stdenv.mkDerivation (finalAttrs: {
       hotdoc
     ];
 
-  buildInputs = [
-    gst-plugins-base
-    gst-plugins-bad
-  ];
+  buildInputs =
+    [
+      gst-plugins-base
+      gst-plugins-bad
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      apple-sdk_gstreamer
+    ];
 
   mesonFlags = [
     "-Dglib_debug=disabled" # cast checks should be disabled on stable releases
diff --git a/pkgs/development/libraries/gstreamer/ugly/default.nix b/pkgs/development/libraries/gstreamer/ugly/default.nix
index 92c3f14717f4..0329460a6e8d 100644
--- a/pkgs/development/libraries/gstreamer/ugly/default.nix
+++ b/pkgs/development/libraries/gstreamer/ugly/default.nix
@@ -16,15 +16,13 @@
   x264,
   libintl,
   lib,
-  IOKit,
-  CoreFoundation,
-  DiskArbitration,
   enableGplPlugins ? true,
   # Checks meson.is_cross_build(), so even canExecute isn't enough.
   enableDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform,
   hotdoc,
   directoryListingUpdater,
   gst-plugins-ugly,
+  apple-sdk_gstreamer,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -68,9 +66,7 @@ stdenv.mkDerivation (finalAttrs: {
       x264
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      IOKit
-      CoreFoundation
-      DiskArbitration
+      apple-sdk_gstreamer
     ];
 
   mesonFlags =
diff --git a/pkgs/development/libraries/gstreamer/vaapi/default.nix b/pkgs/development/libraries/gstreamer/vaapi/default.nix
index 9938a92ea3d5..c717fa21e725 100644
--- a/pkgs/development/libraries/gstreamer/vaapi/default.nix
+++ b/pkgs/development/libraries/gstreamer/vaapi/default.nix
@@ -25,6 +25,7 @@
   enableDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform,
   hotdoc,
   directoryListingUpdater,
+  apple-sdk_gstreamer,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -76,6 +77,9 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
       libGL
       libGLU
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      apple-sdk_gstreamer
     ];
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/gtk/2.x.nix b/pkgs/development/libraries/gtk/2.x.nix
index 87b638ad76a4..0fd2d15f83f7 100644
--- a/pkgs/development/libraries/gtk/2.x.nix
+++ b/pkgs/development/libraries/gtk/2.x.nix
@@ -24,8 +24,6 @@
   pkg-config,
   replaceVars,
   testers,
-  AppKit,
-  Cocoa,
   gdktarget ? if stdenv.hostPlatform.isDarwin then "quartz" else "x11",
   cupsSupport ? config.gtk2.cups or stdenv.hostPlatform.isLinux,
   xineramaSupport ? stdenv.hostPlatform.isLinux,
@@ -103,8 +101,6 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optional cupsSupport cups
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       libXdamage
-      AppKit
-      Cocoa
     ];
 
   preConfigure = lib.optionalString (
diff --git a/pkgs/development/libraries/gtk/3.x.nix b/pkgs/development/libraries/gtk/3.x.nix
index 56018a8c18bf..fe2efb167ccf 100644
--- a/pkgs/development/libraries/gtk/3.x.nix
+++ b/pkgs/development/libraries/gtk/3.x.nix
@@ -46,9 +46,6 @@
   xineramaSupport ? stdenv.hostPlatform.isLinux,
   cupsSupport ? stdenv.hostPlatform.isLinux,
   cups,
-  AppKit,
-  Cocoa,
-  QuartzCore,
   broadwaySupport ? true,
   wayland-scanner,
   testers,
@@ -139,9 +136,6 @@ stdenv.mkDerivation (finalAttrs: {
       (libepoxy.override { inherit x11Support; })
       isocodes
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AppKit
-    ]
     ++ lib.optionals trackerSupport [
       tinysparql
     ];
@@ -169,11 +163,6 @@ stdenv.mkDerivation (finalAttrs: {
       libXrender
       pango
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      # explicitly propagated, always needed
-      Cocoa
-      QuartzCore
-    ]
     ++ lib.optionals waylandSupport [
       libGL
       wayland
diff --git a/pkgs/development/libraries/harfbuzz/default.nix b/pkgs/development/libraries/harfbuzz/default.nix
index 243ebdae7351..2a510fbaf527 100644
--- a/pkgs/development/libraries/harfbuzz/default.nix
+++ b/pkgs/development/libraries/harfbuzz/default.nix
@@ -16,8 +16,6 @@
   icu,
   graphite2,
   harfbuzz, # The icu variant uses and propagates the non-icu one.
-  ApplicationServices,
-  CoreText,
   withCoreText ? false,
   withIcu ? false, # recommended by upstream as default, but most don't needed and it's big
   withGraphite2 ? true, # it is small and major distros do include it
@@ -91,15 +89,10 @@ stdenv.mkDerivation (finalAttrs: {
     docbook_xml_dtd_43
   ] ++ lib.optional withIntrospection gobject-introspection;
 
-  buildInputs =
-    [
-      glib
-      freetype
-    ]
-    ++ lib.optionals withCoreText [
-      ApplicationServices
-      CoreText
-    ];
+  buildInputs = [
+    glib
+    freetype
+  ];
 
   propagatedBuildInputs =
     lib.optional withGraphite2 graphite2
diff --git a/pkgs/development/libraries/hidapi/default.nix b/pkgs/development/libraries/hidapi/default.nix
index 831f3fec8b90..007e98379424 100644
--- a/pkgs/development/libraries/hidapi/default.nix
+++ b/pkgs/development/libraries/hidapi/default.nix
@@ -6,8 +6,6 @@
   pkg-config,
   libusb1,
   udev,
-  Cocoa,
-  IOKit,
   testers,
 }:
 
@@ -34,11 +32,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
-  propagatedBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    Cocoa
-    IOKit
-  ];
-
   passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/imgui/default.nix b/pkgs/development/libraries/imgui/default.nix
index 8619f3db1261..16d65969eefe 100644
--- a/pkgs/development/libraries/imgui/default.nix
+++ b/pkgs/development/libraries/imgui/default.nix
@@ -6,7 +6,6 @@
   cmake,
   fetchFromGitHub,
   fetchpatch,
-  darwin,
   glfw,
   libGL,
   SDL2,
@@ -80,12 +79,6 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.ApplicationServices
-    darwin.apple_sdk.frameworks.Cocoa
-    darwin.apple_sdk.frameworks.GameController
-  ];
-
   propagatedBuildInputs =
     lib.optionals IMGUI_LINK_GLVND [ libGL ]
     ++ lib.optionals IMGUI_BUILD_GLFW_BINDING [ glfw ]
@@ -93,8 +86,7 @@ stdenv.mkDerivation rec {
     ++ lib.optionals IMGUI_BUILD_VULKAN_BINDING [
       vulkan-headers
       vulkan-loader
-    ]
-    ++ lib.optionals IMGUI_BUILD_METAL_BINDING [ darwin.apple_sdk.frameworks.Metal ];
+    ];
 
   cmakeFlags = [
     (lib.cmakeBool "IMGUI_BUILD_GLFW_BINDING" IMGUI_BUILD_GLFW_BINDING)
diff --git a/pkgs/development/libraries/irrlicht/mac.nix b/pkgs/development/libraries/irrlicht/mac.nix
index 1625421de09d..032d788e8882 100644
--- a/pkgs/development/libraries/irrlicht/mac.nix
+++ b/pkgs/development/libraries/irrlicht/mac.nix
@@ -4,9 +4,6 @@
   fetchzip,
   fetchFromGitHub,
   cmake,
-  Cocoa,
-  OpenGL,
-  IOKit,
 }:
 
 let
@@ -41,11 +38,6 @@ stdenv.mkDerivation {
   ];
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = [
-    OpenGL
-    Cocoa
-    IOKit
-  ];
 
   meta = {
     homepage = "https://irrlicht.sourceforge.net/";
diff --git a/pkgs/development/libraries/itk/generic.nix b/pkgs/development/libraries/itk/generic.nix
index 52cc554fd044..9e0cedcedece 100644
--- a/pkgs/development/libraries/itk/generic.nix
+++ b/pkgs/development/libraries/itk/generic.nix
@@ -30,7 +30,6 @@
   vtk,
   which,
   zlib,
-  Cocoa,
   enablePython ? false,
   enableRtk ? true,
 }:
@@ -145,7 +144,6 @@ stdenv.mkDerivation {
       libuuid
     ]
     ++ lib.optionals (lib.versionAtLeast version "5.4") [ eigen ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ Cocoa ]
     ++ lib.optionals enablePython [ python ]
     ++ lib.optionals withVtk [ vtk ];
   # Due to ITKVtkGlue=ON and the additional dependencies needed to configure VTK 9
diff --git a/pkgs/development/libraries/kerberos/heimdal.nix b/pkgs/development/libraries/kerberos/heimdal.nix
index 56f8d9970997..b2b52e650295 100644
--- a/pkgs/development/libraries/kerberos/heimdal.nix
+++ b/pkgs/development/libraries/kerberos/heimdal.nix
@@ -21,10 +21,6 @@
   libmicrohttpd,
   cjson,
 
-  CoreFoundation,
-  Security,
-  SystemConfiguration,
-
   curl,
   jdk_headless,
   unzip,
@@ -82,11 +78,6 @@ stdenv.mkDerivation {
       libedit
       pam
     ]
-    ++ lib.optionals (stdenv.hostPlatform.isDarwin) [
-      CoreFoundation
-      Security
-      SystemConfiguration
-    ]
     ++ lib.optionals (withCJSON) [ cjson ]
     ++ lib.optionals (withCapNG) [ libcap_ng ]
     ++ lib.optionals (withMicroHTTPD) [ libmicrohttpd ]
diff --git a/pkgs/development/libraries/kerberos/krb5.nix b/pkgs/development/libraries/kerberos/krb5.nix
index 7a4df60f0ae5..90798e2af98c 100644
--- a/pkgs/development/libraries/kerberos/krb5.nix
+++ b/pkgs/development/libraries/kerberos/krb5.nix
@@ -4,7 +4,6 @@
   fetchurl,
   bootstrap_cmds,
   byacc, # can also use bison, but byacc has fewer dependencies
-  darwin,
   keyutils,
   openssl,
   perl,
@@ -95,14 +94,6 @@ stdenv.mkDerivation rec {
     ++ lib.optionals withLibedit [ libedit ]
     ++ lib.optionals withVerto [ libverto ];
 
-  propagatedBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin (
-    with darwin.apple_sdk;
-    [
-      libs.xpc
-      frameworks.Kerberos
-    ]
-  );
-
   sourceRoot = "krb5-${version}/src";
 
   postPatch =
diff --git a/pkgs/development/libraries/libadwaita/default.nix b/pkgs/development/libraries/libadwaita/default.nix
index 3af320095953..95bec3c79927 100644
--- a/pkgs/development/libraries/libadwaita/default.nix
+++ b/pkgs/development/libraries/libadwaita/default.nix
@@ -18,8 +18,6 @@
   gsettings-desktop-schemas,
   desktop-file-utils,
   xvfb-run,
-  AppKit,
-  Foundation,
   testers,
 }:
 
@@ -65,15 +63,10 @@ stdenv.mkDerivation (finalAttrs: {
       "-Dtests=false"
     ];
 
-  buildInputs =
-    [
-      appstream
-      fribidi
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AppKit
-      Foundation
-    ];
+  buildInputs = [
+    appstream
+    fribidi
+  ];
 
   propagatedBuildInputs = [
     gtk4
diff --git a/pkgs/development/libraries/libao/default.nix b/pkgs/development/libraries/libao/default.nix
index 25d52e369e47..88dbf48c8d51 100644
--- a/pkgs/development/libraries/libao/default.nix
+++ b/pkgs/development/libraries/libao/default.nix
@@ -8,9 +8,6 @@
   libpulseaudio,
   alsa-lib,
   libcap,
-  CoreAudio,
-  CoreServices,
-  AudioUnit,
   usePulseAudio,
 }:
 
@@ -53,11 +50,6 @@ stdenv.mkDerivation rec {
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       alsa-lib
       libcap
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CoreAudio
-      CoreServices
-      AudioUnit
     ];
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libbluray/default.nix b/pkgs/development/libraries/libbluray/default.nix
index 4771aee34807..9ab07b4dbfdb 100644
--- a/pkgs/development/libraries/libbluray/default.nix
+++ b/pkgs/development/libraries/libbluray/default.nix
@@ -5,7 +5,6 @@
   pkg-config,
   fontconfig,
   autoreconfHook,
-  DiskArbitration,
   withJava ? false,
   jdk17,
   ant,
@@ -44,10 +43,7 @@ stdenv.mkDerivation rec {
     ];
 
   buildInputs =
-    [ fontconfig ]
-    ++ lib.optional withMetadata libxml2
-    ++ lib.optional withFonts freetype
-    ++ lib.optional stdenv.hostPlatform.isDarwin DiskArbitration;
+    [ fontconfig ] ++ lib.optional withMetadata libxml2 ++ lib.optional withFonts freetype;
 
   propagatedBuildInputs = lib.optional withAACS libaacs;
 
diff --git a/pkgs/development/libraries/libbtbb/default.nix b/pkgs/development/libraries/libbtbb/default.nix
index 02175448c703..4e79116c6ab3 100644
--- a/pkgs/development/libraries/libbtbb/default.nix
+++ b/pkgs/development/libraries/libbtbb/default.nix
@@ -3,7 +3,6 @@
   lib,
   fetchFromGitHub,
   cmake,
-  CoreServices,
 }:
 
 stdenv.mkDerivation rec {
@@ -17,7 +16,7 @@ stdenv.mkDerivation rec {
     sha256 = "1byv8174xam7siakr1p0523x97wkh0fmwmq341sd3g70qr2g767d";
   };
 
-  nativeBuildInputs = [ cmake ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ CoreServices ];
+  nativeBuildInputs = [ cmake ];
 
   # https://github.com/greatscottgadgets/libbtbb/issues/63
   postPatch = ''
diff --git a/pkgs/development/libraries/libcanberra/default.nix b/pkgs/development/libraries/libcanberra/default.nix
index cdbe126abc48..524a5cb908e7 100644
--- a/pkgs/development/libraries/libcanberra/default.nix
+++ b/pkgs/development/libraries/libcanberra/default.nix
@@ -13,9 +13,6 @@
   libvorbis,
   libcap,
   systemd,
-  Carbon,
-  CoreServices,
-  AppKit,
   withAlsa ? stdenv.hostPlatform.isLinux,
   alsa-lib,
 }:
@@ -48,11 +45,6 @@ stdenv.mkDerivation rec {
     ])
     ++ lib.optional (gtkSupport == "gtk2") gtk2-x11
     ++ lib.optional (gtkSupport == "gtk3") gtk3-x11
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Carbon
-      CoreServices
-      AppKit
-    ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       libcap
       systemd
diff --git a/pkgs/development/libraries/libcdio-paranoia/default.nix b/pkgs/development/libraries/libcdio-paranoia/default.nix
index 93b3cb91ffc9..90a5782b3520 100644
--- a/pkgs/development/libraries/libcdio-paranoia/default.nix
+++ b/pkgs/development/libraries/libcdio-paranoia/default.nix
@@ -6,8 +6,6 @@
   libcdio,
   pkg-config,
   libiconv,
-  IOKit,
-  DiskArbitration,
 }:
 
 stdenv.mkDerivation rec {
@@ -29,12 +27,8 @@ stdenv.mkDerivation rec {
     [ libcdio ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       libiconv
-      IOKit
-      DiskArbitration
     ];
 
-  propagatedBuildInputs = lib.optional stdenv.hostPlatform.isDarwin DiskArbitration;
-
   configureFlags = lib.optionals stdenv.hostPlatform.isDarwin [ "--disable-ld-version-script" ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/libcdio/default.nix b/pkgs/development/libraries/libcdio/default.nix
deleted file mode 100644
index 85a3fbbcd33a..000000000000
--- a/pkgs/development/libraries/libcdio/default.nix
+++ /dev/null
@@ -1,62 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  libcddb,
-  pkg-config,
-  ncurses,
-  help2man,
-  libiconv,
-  Carbon,
-  IOKit,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "libcdio";
-  version = "2.2.0";
-
-  src = fetchurl {
-    url = "https://github.com/libcdio/libcdio/releases/download/${version}/${pname}-${version}.tar.bz2";
-    hash = "sha256-b4+99NGJz2Pyp6FUnFFs1yDHsiLHqq28kkom50WkhTk=";
-  };
-
-  env = lib.optionalAttrs stdenv.is32bit {
-    NIX_CFLAGS_COMPILE = "-D_LARGEFILE64_SOURCE";
-  };
-
-  postPatch = ''
-    patchShebangs .
-  '';
-
-  nativeBuildInputs = [
-    pkg-config
-    help2man
-  ];
-  buildInputs =
-    [
-      libcddb
-      libiconv
-      ncurses
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Carbon
-      IOKit
-    ];
-
-  enableParallelBuilding = true;
-
-  doCheck = !stdenv.hostPlatform.isDarwin;
-
-  meta = with lib; {
-    description = "Library for OS-independent CD-ROM and CD image access";
-    longDescription = ''
-      GNU libcdio is a library for OS-independent CD-ROM and
-      CD image access.  It includes a library for working with
-      ISO-9660 filesystems (libiso9660), as well as utility
-      programs such as an audio CD player and an extractor.
-    '';
-    homepage = "https://www.gnu.org/software/libcdio/";
-    license = licenses.gpl2Plus;
-    platforms = platforms.unix;
-  };
-}
diff --git a/pkgs/development/libraries/libdc1394/default.nix b/pkgs/development/libraries/libdc1394/default.nix
index c886f0d8fba7..49a4d14e63a6 100644
--- a/pkgs/development/libraries/libdc1394/default.nix
+++ b/pkgs/development/libraries/libdc1394/default.nix
@@ -4,7 +4,6 @@
   fetchurl,
   libraw1394,
   libusb1,
-  CoreServices,
 }:
 
 stdenv.mkDerivation rec {
@@ -21,10 +20,7 @@ stdenv.mkDerivation rec {
     "trivialautovarinit"
   ];
 
-  buildInputs =
-    [ libusb1 ]
-    ++ lib.optional stdenv.hostPlatform.isLinux libraw1394
-    ++ lib.optional stdenv.hostPlatform.isDarwin CoreServices;
+  buildInputs = [ libusb1 ] ++ lib.optional stdenv.hostPlatform.isLinux libraw1394;
 
   meta = with lib; {
     description = "Capture and control API for IIDC compliant cameras";
diff --git a/pkgs/development/libraries/libdevil/default.nix b/pkgs/development/libraries/libdevil/default.nix
index e36402b68b5a..58545dd08127 100644
--- a/pkgs/development/libraries/libdevil/default.nix
+++ b/pkgs/development/libraries/libdevil/default.nix
@@ -12,7 +12,6 @@
   libGL,
   libX11,
   pkg-config,
-  OpenGL,
   runtimeShell,
   withXorg ? true,
   testers,
@@ -52,8 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optionals withXorg [
       libX11
       libGL
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ OpenGL ];
+    ];
 
   configureFlags = [
     "--enable-ILU"
diff --git a/pkgs/development/libraries/libdvdcss/default.nix b/pkgs/development/libraries/libdvdcss/default.nix
index d0195e668993..bd0db914c25a 100644
--- a/pkgs/development/libraries/libdvdcss/default.nix
+++ b/pkgs/development/libraries/libdvdcss/default.nix
@@ -2,15 +2,12 @@
   lib,
   stdenv,
   fetchurl,
-  IOKit,
 }:
 
 stdenv.mkDerivation rec {
   pname = "libdvdcss";
   version = "1.4.3";
 
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin IOKit;
-
   src = fetchurl {
     url = "http://get.videolan.org/libdvdcss/${version}/${pname}-${version}.tar.bz2";
     sha256 = "sha256-IzzJL13AHF06lvWzWCvn1c7lo1pS06CBWHRdPYYHAHk=";
diff --git a/pkgs/development/libraries/libffi/default.nix b/pkgs/development/libraries/libffi/default.nix
index bd961068c09e..c2c75286a86c 100644
--- a/pkgs/development/libraries/libffi/default.nix
+++ b/pkgs/development/libraries/libffi/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libffi";
-  version = "3.4.7";
+  version = "3.4.8";
 
   src = fetchurl {
     url =
       with finalAttrs;
       "https://github.com/libffi/libffi/releases/download/v${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-E4YH3uJovezzdK35FEwA6DnjhUH3XySh/PGLeP2kiy0=";
+    hash = "sha256-vJhCoYiYv6yw7RJSxP68x+ePoTn9J/3Ho+MNnZNWEZs=";
   };
 
   # Note: this package is used for bootstrapping fetchurl, and thus
diff --git a/pkgs/development/libraries/libfilezilla/default.nix b/pkgs/development/libraries/libfilezilla/default.nix
index 64e2dbdc0892..d295921204dc 100644
--- a/pkgs/development/libraries/libfilezilla/default.nix
+++ b/pkgs/development/libraries/libfilezilla/default.nix
@@ -9,7 +9,6 @@
   pkg-config,
   libiconv,
   libxcrypt,
-  ApplicationServices,
 }:
 
 stdenv.mkDerivation {
@@ -36,7 +35,6 @@ stdenv.mkDerivation {
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       libiconv
-      ApplicationServices
     ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/libfive/default.nix b/pkgs/development/libraries/libfive/default.nix
index 141bd8f17b2c..9a21859815eb 100644
--- a/pkgs/development/libraries/libfive/default.nix
+++ b/pkgs/development/libraries/libfive/default.nix
@@ -14,7 +14,6 @@
   guile,
   python,
   qtbase,
-  darwin,
 }:
 
 stdenv.mkDerivation {
@@ -43,7 +42,7 @@ stdenv.mkDerivation {
     guile
     python
     qtbase
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk_11_0.frameworks.Cocoa ];
+  ];
 
   preConfigure = ''
     substituteInPlace studio/src/guile/interpreter.cpp \
diff --git a/pkgs/development/libraries/libftdi/default.nix b/pkgs/development/libraries/libftdi/default.nix
index 0bd3e6e14325..67e119c811be 100644
--- a/pkgs/development/libraries/libftdi/default.nix
+++ b/pkgs/development/libraries/libftdi/default.nix
@@ -3,9 +3,6 @@
   stdenv,
   fetchurl,
   libusb-compat-0_1,
-  Security,
-  IOKit,
-  libobjc,
 }:
 
 stdenv.mkDerivation rec {
@@ -17,13 +14,7 @@ stdenv.mkDerivation rec {
     sha256 = "13l39f6k6gff30hsgh0wa2z422g9pyl91rh8a8zz6f34k2sxaxii";
   };
 
-  buildInputs =
-    [ libusb-compat-0_1 ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      libobjc
-      Security
-      IOKit
-    ];
+  buildInputs = [ libusb-compat-0_1 ];
 
   propagatedBuildInputs = [ libusb-compat-0_1 ];
 
diff --git a/pkgs/development/libraries/libgdiplus/default.nix b/pkgs/development/libraries/libgdiplus/default.nix
index 58afe09e7cd4..4e98f25e1f79 100644
--- a/pkgs/development/libraries/libgdiplus/default.nix
+++ b/pkgs/development/libraries/libgdiplus/default.nix
@@ -5,7 +5,6 @@
   pkg-config,
   glib,
   cairo,
-  Carbon,
   fontconfig,
   libtiff,
   giflib,
@@ -60,7 +59,7 @@ stdenv.mkDerivation (finalAttrs: {
     libpng
     libXrender
     libexif
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin Carbon;
+  ];
 
   postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
     ln -s $out/lib/libgdiplus.0.dylib $out/lib/libgdiplus.so
diff --git a/pkgs/development/libraries/libgit2/default.nix b/pkgs/development/libraries/libgit2/default.nix
index 71cb12e6afd8..0d7ea5907062 100644
--- a/pkgs/development/libraries/libgit2/default.nix
+++ b/pkgs/development/libraries/libgit2/default.nix
@@ -11,7 +11,6 @@
   openssl,
   pcre2,
   libiconv,
-  Security,
   staticBuild ? stdenv.hostPlatform.isStatic,
   # for passthru.tests
   libgit2-glib,
@@ -72,16 +71,13 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      zlib
-      libssh2
-      openssl
-      pcre2
-      llhttp
-    ]
-    ++ lib.optional withGssapi krb5
-    ++ lib.optional stdenv.hostPlatform.isDarwin Security;
+  buildInputs = [
+    zlib
+    libssh2
+    openssl
+    pcre2
+    llhttp
+  ] ++ lib.optional withGssapi krb5;
 
   propagatedBuildInputs = lib.optional (!stdenv.hostPlatform.isLinux) libiconv;
 
diff --git a/pkgs/development/libraries/libiio/default.nix b/pkgs/development/libraries/libiio/default.nix
index ce75d6c0fe83..33e9e183c859 100644
--- a/pkgs/development/libraries/libiio/default.nix
+++ b/pkgs/development/libraries/libiio/default.nix
@@ -14,8 +14,6 @@
   runtimeShell,
   lib,
   pkg-config,
-  CFNetwork,
-  CoreServices,
 }:
 
 stdenv.mkDerivation rec {
@@ -59,11 +57,7 @@ stdenv.mkDerivation rec {
       libusb1
     ]
     ++ lib.optional avahiSupport avahi
-    ++ lib.optional stdenv.hostPlatform.isLinux libaio
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CFNetwork
-      CoreServices
-    ];
+    ++ lib.optional stdenv.hostPlatform.isLinux libaio;
 
   cmakeFlags =
     [
diff --git a/pkgs/development/libraries/libimobiledevice/default.nix b/pkgs/development/libraries/libimobiledevice/default.nix
index 416ebdb1e21a..715fb7dc6fcd 100644
--- a/pkgs/development/libraries/libimobiledevice/default.nix
+++ b/pkgs/development/libraries/libimobiledevice/default.nix
@@ -11,8 +11,6 @@
   libtasn1,
   libusbmuxd,
   libimobiledevice-glue,
-  SystemConfiguration,
-  CoreFoundation,
   unstableGitUpdater,
 }:
 
@@ -48,19 +46,14 @@ stdenv.mkDerivation rec {
     pkg-config
   ];
 
-  propagatedBuildInputs =
-    [
-      openssl
-      libgcrypt
-      libplist
-      libtasn1
-      libusbmuxd
-      libimobiledevice-glue
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      SystemConfiguration
-      CoreFoundation
-    ];
+  propagatedBuildInputs = [
+    openssl
+    libgcrypt
+    libplist
+    libtasn1
+    libusbmuxd
+    libimobiledevice-glue
+  ];
 
   outputs = [
     "out"
diff --git a/pkgs/development/libraries/libiodbc/default.nix b/pkgs/development/libraries/libiodbc/default.nix
index fcf1cdec33b3..4b5e409198ac 100644
--- a/pkgs/development/libraries/libiodbc/default.nix
+++ b/pkgs/development/libraries/libiodbc/default.nix
@@ -5,7 +5,6 @@
   fetchurl,
   pkg-config,
   gtk2,
-  Carbon,
   useGTK ? config.libiodbc.gtk or false,
 }:
 
@@ -23,7 +22,7 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = lib.optionals useGTK [ gtk2 ] ++ lib.optional stdenv.hostPlatform.isDarwin Carbon;
+  buildInputs = lib.optionals useGTK [ gtk2 ];
 
   preBuild = ''
     export NIX_LDFLAGS_BEFORE="-rpath $out/lib"
diff --git a/pkgs/development/libraries/liblastfm/default.nix b/pkgs/development/libraries/liblastfm/default.nix
index 0eb07279b716..7530d998e51e 100644
--- a/pkgs/development/libraries/liblastfm/default.nix
+++ b/pkgs/development/libraries/liblastfm/default.nix
@@ -9,7 +9,6 @@
   fftwSinglePrec,
   libsamplerate,
   qtbase,
-  darwin,
 }:
 
 stdenv.mkDerivation {
@@ -40,7 +39,7 @@ stdenv.mkDerivation {
     fftwSinglePrec
     libsamplerate
     qtbase
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.frameworks.SystemConfiguration;
+  ];
 
   env.NIX_CFLAGS_COMPILE = lib.optionalString (
     stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "11"
diff --git a/pkgs/development/libraries/liblqr-1/default.nix b/pkgs/development/libraries/liblqr-1/default.nix
index 3062a91186cc..8ab47058aef9 100644
--- a/pkgs/development/libraries/liblqr-1/default.nix
+++ b/pkgs/development/libraries/liblqr-1/default.nix
@@ -4,8 +4,6 @@
   fetchFromGitHub,
   pkg-config,
   glib,
-  Carbon,
-  AppKit,
 }:
 
 stdenv.mkDerivation rec {
@@ -25,10 +23,6 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    Carbon
-    AppKit
-  ];
   propagatedBuildInputs = [ glib ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/libmikmod/default.nix b/pkgs/development/libraries/libmikmod/default.nix
index 7d37cb623576..4193e5e65e0c 100644
--- a/pkgs/development/libraries/libmikmod/default.nix
+++ b/pkgs/development/libraries/libmikmod/default.nix
@@ -5,7 +5,6 @@
   texinfo,
   alsa-lib,
   libpulseaudio,
-  CoreAudio,
 }:
 
 let
@@ -21,10 +20,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-re9iFIY1FqSltE6/LHHvhOzf6zRElz2suscJEcm8Z+k=";
   };
 
-  buildInputs =
-    [ texinfo ]
-    ++ optional stdenv.hostPlatform.isLinux alsa-lib
-    ++ optional stdenv.hostPlatform.isDarwin CoreAudio;
+  buildInputs = [ texinfo ] ++ optional stdenv.hostPlatform.isLinux alsa-lib;
   propagatedBuildInputs = optional stdenv.hostPlatform.isLinux libpulseaudio;
 
   outputs = [
diff --git a/pkgs/development/libraries/libopenshot-audio/default.nix b/pkgs/development/libraries/libopenshot-audio/default.nix
index 4a63de87e643..8e861f455809 100644
--- a/pkgs/development/libraries/libopenshot-audio/default.nix
+++ b/pkgs/development/libraries/libopenshot-audio/default.nix
@@ -13,10 +13,6 @@
   libXrandr,
   pkg-config,
   zlib,
-  Accelerate,
-  AGL,
-  Cocoa,
-  Foundation,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -48,10 +44,6 @@ stdenv.mkDerivation (finalAttrs: {
     ++ (
       if stdenv.hostPlatform.isDarwin then
         [
-          Accelerate
-          AGL
-          Cocoa
-          Foundation
           zlib
         ]
       else
diff --git a/pkgs/development/libraries/libphonenumber/default.nix b/pkgs/development/libraries/libphonenumber/default.nix
index a552d6718a88..c54375d471fa 100644
--- a/pkgs/development/libraries/libphonenumber/default.nix
+++ b/pkgs/development/libraries/libphonenumber/default.nix
@@ -10,7 +10,6 @@
   boost,
   icu,
   protobuf,
-  Foundation,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -37,15 +36,11 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      boost
-      icu
-      protobuf
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Foundation
-    ];
+  buildInputs = [
+    boost
+    icu
+    protobuf
+  ];
 
   cmakeDir = "../cpp";
 
diff --git a/pkgs/development/libraries/librasterlite2/default.nix b/pkgs/development/libraries/librasterlite2/default.nix
index 91086083f951..25f7da35280b 100644
--- a/pkgs/development/libraries/librasterlite2/default.nix
+++ b/pkgs/development/libraries/librasterlite2/default.nix
@@ -26,7 +26,6 @@
   proj,
   sqlite,
   zstd,
-  ApplicationServices,
 }:
 
 stdenv.mkDerivation rec {
@@ -72,7 +71,7 @@ stdenv.mkDerivation rec {
     proj
     sqlite
     zstd
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin ApplicationServices;
+  ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/libre/default.nix b/pkgs/development/libraries/libre/default.nix
index 0a53591d6908..97749fc5ea0b 100644
--- a/pkgs/development/libraries/libre/default.nix
+++ b/pkgs/development/libraries/libre/default.nix
@@ -5,7 +5,6 @@
   zlib,
   openssl,
   cmake,
-  SystemConfiguration,
 }:
 
 stdenv.mkDerivation rec {
@@ -18,14 +17,10 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-OWVDuKlF7YLipDURC46s14WOLWWagUqWg20sH0kSIA4=";
   };
 
-  buildInputs =
-    [
-      openssl
-      zlib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      SystemConfiguration
-    ];
+  buildInputs = [
+    openssl
+    zlib
+  ];
 
   nativeBuildInputs = [ cmake ];
   makeFlags =
diff --git a/pkgs/development/libraries/librsvg/default.nix b/pkgs/development/libraries/librsvg/default.nix
index 14cb0e75a9d4..7fcc852066db 100644
--- a/pkgs/development/libraries/librsvg/default.nix
+++ b/pkgs/development/libraries/librsvg/default.nix
@@ -15,7 +15,6 @@
   libxml2,
   bzip2,
   dav1d,
-  Foundation,
   rustPlatform,
   rustc,
   cargo-c,
@@ -137,9 +136,6 @@ stdenv.mkDerivation (finalAttrs: {
     ]
     ++ lib.optionals withIntrospection [
       vala # for share/vala/Makefile.vapigen
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Foundation
     ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/libraries/libsamplerate/default.nix b/pkgs/development/libraries/libsamplerate/default.nix
index f50d40bf8e2f..776bd977cbb0 100644
--- a/pkgs/development/libraries/libsamplerate/default.nix
+++ b/pkgs/development/libraries/libsamplerate/default.nix
@@ -4,15 +4,8 @@
   fetchurl,
   pkg-config,
   libsndfile,
-  ApplicationServices,
-  Carbon,
-  CoreServices,
 }:
 
-let
-  inherit (lib) optionals optionalString;
-
-in
 stdenv.mkDerivation rec {
   pname = "libsamplerate";
   version = "0.2.2";
@@ -23,12 +16,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs =
-    [ libsndfile ]
-    ++ optionals stdenv.hostPlatform.isDarwin [
-      ApplicationServices
-      CoreServices
-    ];
+  buildInputs = [ libsndfile ];
 
   configureFlags = [ "--disable-fftw" ];
 
@@ -37,12 +25,6 @@ stdenv.mkDerivation rec {
     "out"
   ];
 
-  postConfigure = optionalString stdenv.hostPlatform.isDarwin ''
-    # need headers from the Carbon.framework in /System/Library/Frameworks to
-    # compile this on darwin -- not sure how to handle
-    NIX_CFLAGS_COMPILE+=" -I${Carbon}/Library/Frameworks/Carbon.framework/Headers"
-  '';
-
   meta = with lib; {
     description = "Sample Rate Converter for audio";
     homepage = "https://libsndfile.github.io/libsamplerate/";
diff --git a/pkgs/development/libraries/libsndfile/default.nix b/pkgs/development/libraries/libsndfile/default.nix
index 0c91b3e13d8b..dd7e36b7da31 100644
--- a/pkgs/development/libraries/libsndfile/default.nix
+++ b/pkgs/development/libraries/libsndfile/default.nix
@@ -13,8 +13,6 @@
   libopus,
   libvorbis,
   alsa-lib,
-  Carbon,
-  AudioToolbox,
 
   # for passthru.tests
   audacity,
@@ -43,20 +41,14 @@ stdenv.mkDerivation rec {
     pkg-config
     python3
   ];
-  buildInputs =
-    [
-      flac
-      lame
-      libmpg123
-      libogg
-      libopus
-      libvorbis
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [ alsa-lib ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Carbon
-      AudioToolbox
-    ];
+  buildInputs = [
+    flac
+    lame
+    libmpg123
+    libogg
+    libopus
+    libvorbis
+  ] ++ lib.optionals stdenv.hostPlatform.isLinux [ alsa-lib ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/libsoundio/default.nix b/pkgs/development/libraries/libsoundio/default.nix
index 6dab2ea2c6f0..4c8c5fbf49a6 100644
--- a/pkgs/development/libraries/libsoundio/default.nix
+++ b/pkgs/development/libraries/libsoundio/default.nix
@@ -6,7 +6,6 @@
   alsa-lib,
   libjack2,
   libpulseaudio,
-  AudioUnit,
 }:
 
 stdenv.mkDerivation rec {
@@ -27,8 +26,7 @@ stdenv.mkDerivation rec {
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       libpulseaudio
       alsa-lib
-    ]
-    ++ lib.optional stdenv.hostPlatform.isDarwin AudioUnit;
+    ];
 
   cmakeFlags = lib.optionals stdenv.hostPlatform.isDarwin [
     "-DBUILD_TESTS=OFF"
diff --git a/pkgs/development/libraries/libstatgrab/default.nix b/pkgs/development/libraries/libstatgrab/default.nix
index ad068d483200..f90ba95d3116 100644
--- a/pkgs/development/libraries/libstatgrab/default.nix
+++ b/pkgs/development/libraries/libstatgrab/default.nix
@@ -3,7 +3,6 @@
   stdenv,
   fetchurl,
   withSaidar ? true,
-  IOKit,
   ncurses,
 }:
 
@@ -16,8 +15,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-VoiqSmhVR9cXSoo3PqnY7pJ+dm48wwK97jRSPCxdbBE=";
   };
 
-  buildInputs =
-    (lib.optional stdenv.hostPlatform.isDarwin IOKit) ++ (lib.optional withSaidar ncurses);
+  buildInputs = lib.optional withSaidar ncurses;
 
   meta = with lib; {
     homepage = "https://www.i-scream.org/libstatgrab/";
diff --git a/pkgs/development/libraries/libticalcs2/default.nix b/pkgs/development/libraries/libticalcs2/default.nix
index 0fae58094f4a..4d488f260ef1 100644
--- a/pkgs/development/libraries/libticalcs2/default.nix
+++ b/pkgs/development/libraries/libticalcs2/default.nix
@@ -11,7 +11,6 @@
   xz,
   bzip2,
   acl,
-  libobjc,
 }:
 
 stdenv.mkDerivation rec {
@@ -38,9 +37,6 @@ stdenv.mkDerivation rec {
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       acl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      libobjc
     ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/libui/default.nix b/pkgs/development/libraries/libui/default.nix
index 46be24a05630..0ee54f7c45a1 100644
--- a/pkgs/development/libraries/libui/default.nix
+++ b/pkgs/development/libraries/libui/default.nix
@@ -5,7 +5,6 @@
   cmake,
   pkg-config,
   gtk3,
-  Cocoa,
 }:
 
 let
@@ -26,9 +25,7 @@ stdenv.mkDerivation rec {
     cmake
     pkg-config
   ];
-  propagatedBuildInputs =
-    lib.optional stdenv.hostPlatform.isLinux gtk3
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ Cocoa ];
+  propagatedBuildInputs = lib.optional stdenv.hostPlatform.isLinux gtk3;
 
   postPatch = ''
     substituteInPlace darwin/text.m unix/text.c \
diff --git a/pkgs/development/libraries/libuiohook/default.nix b/pkgs/development/libraries/libuiohook/default.nix
index e39c2addfac4..709e75bc8ec7 100644
--- a/pkgs/development/libraries/libuiohook/default.nix
+++ b/pkgs/development/libraries/libuiohook/default.nix
@@ -5,9 +5,6 @@
   nixosTests,
   cmake,
   pkg-config,
-  AppKit,
-  ApplicationServices,
-  Carbon,
   libX11,
   libxkbcommon,
   xinput,
@@ -30,29 +27,23 @@ stdenv.mkDerivation rec {
     pkg-config
   ];
 
-  buildInputs =
-    if stdenv.hostPlatform.isDarwin then
-      [
-        AppKit
-        ApplicationServices
-        Carbon
-      ]
-    else
-      [
-        libX11
-        libxkbcommon
-        xinput
-      ]
-      ++ (with xorg; [
-        libXau
-        libXdmcp
-        libXi
-        libXinerama
-        libXt
-        libXtst
-        libXext
-        libxkbfile
-      ]);
+  buildInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) (
+    [
+      libX11
+      libxkbcommon
+      xinput
+    ]
+    ++ (with xorg; [
+      libXau
+      libXdmcp
+      libXi
+      libXinerama
+      libXt
+      libXtst
+      libXext
+      libxkbfile
+    ])
+  );
 
   outputs = [
     "out"
diff --git a/pkgs/development/libraries/libusb1/default.nix b/pkgs/development/libraries/libusb1/default.nix
index f5283b623ecb..5a82af646da5 100644
--- a/pkgs/development/libraries/libusb1/default.nix
+++ b/pkgs/development/libraries/libusb1/default.nix
@@ -8,9 +8,6 @@
   enableUdev ?
     stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isStatic && !stdenv.hostPlatform.isAndroid,
   udev,
-  libobjc,
-  IOKit,
-  Security,
   withExamples ? false,
   withStatic ? false,
   withDocs ? stdenv.buildPlatform.canExecute stdenv.hostPlatform,
@@ -36,13 +33,7 @@ stdenv.mkDerivation rec {
     pkg-config
     autoreconfHook
   ] ++ lib.optionals withDocs [ doxygen ];
-  propagatedBuildInputs =
-    lib.optional enableUdev udev
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      libobjc
-      IOKit
-      Security
-    ];
+  propagatedBuildInputs = lib.optional enableUdev udev;
 
   dontDisableStatic = withStatic;
 
diff --git a/pkgs/development/libraries/libvgm/default.nix b/pkgs/development/libraries/libvgm/default.nix
index d3bd629b9e2d..e5be42b677f3 100644
--- a/pkgs/development/libraries/libvgm/default.nix
+++ b/pkgs/development/libraries/libvgm/default.nix
@@ -22,8 +22,6 @@
   withPulseAudio ? stdenv.hostPlatform.isLinux,
   libpulseaudio,
   withCoreAudio ? stdenv.hostPlatform.isDarwin,
-  CoreAudio,
-  AudioToolbox,
   withLibao ? true,
   libao,
 
@@ -63,10 +61,6 @@ stdenv.mkDerivation (finalAttrs: {
     ]
     ++ lib.optionals withALSA [ alsa-lib ]
     ++ lib.optionals withPulseAudio [ libpulseaudio ]
-    ++ lib.optionals withCoreAudio [
-      CoreAudio
-      AudioToolbox
-    ]
     ++ lib.optionals withLibao [ libao ];
 
   cmakeFlags =
diff --git a/pkgs/development/libraries/libvirt/default.nix b/pkgs/development/libraries/libvirt/default.nix
index 7d5b81ad8c24..1acf1f761392 100644
--- a/pkgs/development/libraries/libvirt/default.nix
+++ b/pkgs/development/libraries/libvirt/default.nix
@@ -62,8 +62,6 @@
   gmp,
   libiconv,
   qemu,
-  Carbon,
-  AppKit,
 
   # Options
   enableCeph ? false,
@@ -237,8 +235,6 @@ stdenv.mkDerivation rec {
       util-linux
     ]
     ++ lib.optionals isDarwin [
-      AppKit
-      Carbon
       gmp
       libiconv
     ]
diff --git a/pkgs/development/libraries/libvncserver/default.nix b/pkgs/development/libraries/libvncserver/default.nix
index 29dd62948001..b016e19af766 100644
--- a/pkgs/development/libraries/libvncserver/default.nix
+++ b/pkgs/development/libraries/libvncserver/default.nix
@@ -10,7 +10,6 @@
   libpng,
   withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
   systemd,
-  Carbon,
 }:
 
 stdenv.mkDerivation rec {
@@ -51,9 +50,6 @@ stdenv.mkDerivation rec {
     ]
     ++ lib.optionals withSystemd [
       systemd
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Carbon
     ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/libraries/libxml2/default.nix b/pkgs/development/libraries/libxml2/default.nix
index 7d17c038d16f..31e058c01048 100644
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@@ -33,7 +33,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libxml2";
-  version = "2.13.6";
+  version = "2.13.8";
 
   outputs =
     [
@@ -48,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor finalAttrs.version}/libxml2-${finalAttrs.version}.tar.xz";
-    hash = "sha256-9FNIAwdSSWj3oE7GXmTyqDqCWXO80mCi52kb6CrnDJY=";
+    hash = "sha256-J3KUyzMRmrcbK8gfL0Rem8lDW4k60VuyzSsOhZoO6Eo=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/mailcore2/default.nix b/pkgs/development/libraries/mailcore2/default.nix
index 60708ed7a4a2..e1556ba78c80 100644
--- a/pkgs/development/libraries/mailcore2/default.nix
+++ b/pkgs/development/libraries/mailcore2/default.nix
@@ -14,7 +14,6 @@
   libxml2,
   libuuid,
   openssl,
-  darwin,
 }:
 
 stdenv.mkDerivation rec {
@@ -47,9 +46,6 @@ stdenv.mkDerivation rec {
       glib
       icu
       libuuid
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Foundation
     ];
 
   postPatch =
diff --git a/pkgs/development/libraries/mbedtls/3.nix b/pkgs/development/libraries/mbedtls/3.nix
index 0722638c274b..e8c3908174ac 100644
--- a/pkgs/development/libraries/mbedtls/3.nix
+++ b/pkgs/development/libraries/mbedtls/3.nix
@@ -1,8 +1,8 @@
 { callPackage, fetchurl }:
 
 callPackage ./generic.nix {
-  version = "3.6.2";
-  hash = "sha256-tSWhF8i0Tx9QSFmyDEHdd2xveZvpyd+HXR+8xYj2Syo=";
+  version = "3.6.3";
+  hash = "sha256-FJuezgVTxzLRz0Jzk2XnSnpO5sTc8q6QgzkCwlqQ+EU=";
   patches = [
     # Fixes the build with GCC 14.
     #
diff --git a/pkgs/development/libraries/mesa/darwin.nix b/pkgs/development/libraries/mesa/darwin.nix
index de57c2178568..9f14b5d79300 100644
--- a/pkgs/development/libraries/mesa/darwin.nix
+++ b/pkgs/development/libraries/mesa/darwin.nix
@@ -11,7 +11,6 @@
   ninja,
   pkg-config,
   python3Packages,
-  Xplugin,
   xorg,
   zlib,
 }:
@@ -46,7 +45,6 @@ stdenv.mkDerivation {
   buildInputs = [
     libxml2 # should be propagated from libllvm
     llvmPackages.libllvm
-    Xplugin
     xorg.libX11
     xorg.libXext
     xorg.libXfixes
diff --git a/pkgs/development/libraries/mlt/default.nix b/pkgs/development/libraries/mlt/default.nix
index 5053e998158c..9997857befc4 100644
--- a/pkgs/development/libraries/mlt/default.nix
+++ b/pkgs/development/libraries/mlt/default.nix
@@ -22,7 +22,6 @@
   rubberband,
   sox,
   vid-stab,
-  darwin,
   cudaSupport ? config.cudaSupport,
   cudaPackages ? { },
   enableJackrack ? stdenv.hostPlatform.isLinux,
@@ -91,9 +90,6 @@ stdenv.mkDerivation rec {
       sox
       vid-stab
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk_11_0.frameworks.Accelerate
-    ]
     ++ lib.optionals cudaSupport [
       cudaPackages.cuda_cudart
     ]
diff --git a/pkgs/development/libraries/mongocxx/default.nix b/pkgs/development/libraries/mongocxx/default.nix
index f63cbaaf255f..947da3423261 100644
--- a/pkgs/development/libraries/mongocxx/default.nix
+++ b/pkgs/development/libraries/mongocxx/default.nix
@@ -8,7 +8,6 @@
   cmake,
   validatePkgConfig,
   testers,
-  darwin,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -37,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
     mongoc
     openssl
     cyrus_sasl
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.frameworks.Security;
+  ];
 
   cmakeFlags = [
     "-DCMAKE_CXX_STANDARD=20"
diff --git a/pkgs/development/libraries/mpich/default.nix b/pkgs/development/libraries/mpich/default.nix
index fdc2f1f7b7ed..a1b153b5dfed 100644
--- a/pkgs/development/libraries/mpich/default.nix
+++ b/pkgs/development/libraries/mpich/default.nix
@@ -9,7 +9,6 @@
   openssh,
   hwloc,
   python3,
-  darwin,
   # either libfabric or ucx work for ch4backend on linux. On darwin, neither of
   # these libraries currently build so this argument is ignored on Darwin.
   ch4backend,
@@ -82,8 +81,7 @@ stdenv.mkDerivation rec {
       hwloc
     ]
     ++ lib.optional (!stdenv.hostPlatform.isDarwin) ch4backend
-    ++ lib.optional pmixSupport pmix
-    ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.frameworks.Foundation;
+    ++ lib.optional pmixSupport pmix;
 
   # test_double_serializer.test fails on darwin
   doCheck = !stdenv.hostPlatform.isDarwin;
diff --git a/pkgs/development/libraries/mygui/default.nix b/pkgs/development/libraries/mygui/default.nix
index e7d326e446ac..d574bbc73e1f 100644
--- a/pkgs/development/libraries/mygui/default.nix
+++ b/pkgs/development/libraries/mygui/default.nix
@@ -13,7 +13,6 @@
   libGL,
   libGLU,
   libX11,
-  Cocoa,
 }:
 
 let
@@ -55,9 +54,6 @@ stdenv.mkDerivation rec {
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       libX11
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Cocoa
     ];
 
   # Tools are disabled due to compilation failures.
diff --git a/pkgs/development/libraries/netcdf-fortran/default.nix b/pkgs/development/libraries/netcdf-fortran/default.nix
index aacafb1e674f..363a85402eae 100644
--- a/pkgs/development/libraries/netcdf-fortran/default.nix
+++ b/pkgs/development/libraries/netcdf-fortran/default.nix
@@ -6,9 +6,6 @@
   hdf5,
   curl,
   gfortran,
-  CoreFoundation,
-  CoreServices,
-  SystemConfiguration,
 }:
 stdenv.mkDerivation rec {
   pname = "netcdf-fortran";
@@ -22,23 +19,12 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ gfortran ];
-  buildInputs =
-    [
-      netcdf
-      hdf5
-      curl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CoreFoundation
-      CoreServices
-      SystemConfiguration
-    ];
-  env.NIX_LDFLAGS = toString (
-    lib.optionals stdenv.hostPlatform.isDarwin [
-      "-F${CoreServices}/Library/Frameworks"
-      "-F${SystemConfiguration}/Library/Frameworks"
-    ]
-  );
+  buildInputs = [
+    netcdf
+    hdf5
+    curl
+  ];
+
   doCheck = true;
 
   FFLAGS = [ "-std=legacy" ];
diff --git a/pkgs/development/libraries/nghttp3/default.nix b/pkgs/development/libraries/nghttp3/default.nix
index 57ab0df4df86..0b7e8b830d5f 100644
--- a/pkgs/development/libraries/nghttp3/default.nix
+++ b/pkgs/development/libraries/nghttp3/default.nix
@@ -3,7 +3,6 @@
   stdenv,
   fetchFromGitHub,
   cmake,
-  CoreServices,
   curlHTTP3,
 }:
 
@@ -26,9 +25,6 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    CoreServices
-  ];
 
   cmakeFlags = [
     (lib.cmakeBool "ENABLE_STATIC_LIB" false)
diff --git a/pkgs/development/libraries/nspr/default.nix b/pkgs/development/libraries/nspr/default.nix
index 61d69acc6077..236cdff3d954 100644
--- a/pkgs/development/libraries/nspr/default.nix
+++ b/pkgs/development/libraries/nspr/default.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  CoreServices,
   buildPackages,
   nixosTests,
 }:
@@ -47,8 +46,6 @@ stdenv.mkDerivation rec {
     moveToOutput share "$dev" # just aclocal
   '';
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ CoreServices ];
-
   enableParallelBuilding = true;
 
   passthru.tests = {
diff --git a/pkgs/development/libraries/ogre/default.nix b/pkgs/development/libraries/ogre/default.nix
index 9ec54c3828da..6b473fcf1b85 100644
--- a/pkgs/development/libraries/ogre/default.nix
+++ b/pkgs/development/libraries/ogre/default.nix
@@ -26,8 +26,6 @@
   libXt,
   libXxf86vm,
   xorgproto,
-  # darwin
-  darwin,
   # optional
   withNvidiaCg ? false,
   nvidia_cg_toolkit,
@@ -98,9 +96,6 @@ let
           libXxf86vm
           xorgproto
         ]
-        ++ lib.optionals stdenv.hostPlatform.isDarwin [
-          darwin.apple_sdk.frameworks.Cocoa
-        ]
         ++ lib.optionals withNvidiaCg [
           nvidia_cg_toolkit
         ];
diff --git a/pkgs/development/libraries/ois/default.nix b/pkgs/development/libraries/ois/default.nix
index b6ddc5ebbf63..6b5d4c32b663 100644
--- a/pkgs/development/libraries/ois/default.nix
+++ b/pkgs/development/libraries/ois/default.nix
@@ -4,9 +4,6 @@
   fetchFromGitHub,
   cmake,
   libX11,
-  Cocoa,
-  IOKit,
-  Kernel,
 }:
 
 stdenv.mkDerivation rec {
@@ -22,13 +19,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [ libX11 ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Cocoa
-      IOKit
-      Kernel
-    ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ libX11 ];
 
   cmakeFlags = [
     "-DCMAKE_INSTALL_LIBDIR=lib"
diff --git a/pkgs/development/libraries/okapi/default.nix b/pkgs/development/libraries/okapi/default.nix
index e3a71e97f55f..427a95123084 100644
--- a/pkgs/development/libraries/okapi/default.nix
+++ b/pkgs/development/libraries/okapi/default.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchurl,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -18,8 +16,6 @@ rustPlatform.buildRustPackage rec {
   cargoVendorDir = "vendor";
   doCheck = false;
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
-
   postInstall = ''
     cp -r include $out
   '';
diff --git a/pkgs/development/libraries/onnxruntime/default.nix b/pkgs/development/libraries/onnxruntime/default.nix
index f4099522edf9..5c8830ee24fc 100644
--- a/pkgs/development/libraries/onnxruntime/default.nix
+++ b/pkgs/development/libraries/onnxruntime/default.nix
@@ -4,7 +4,6 @@
   lib,
   fetchFromGitHub,
   fetchpatch,
-  Foundation,
   abseil-cpp_202407,
   cmake,
   cpuinfo,
@@ -166,7 +165,6 @@ effectiveStdenv.mkDerivation rec {
       ]
     )
     ++ lib.optionals effectiveStdenv.hostPlatform.isDarwin [
-      Foundation
       libiconv
     ]
     ++ lib.optionals cudaSupport (
diff --git a/pkgs/development/libraries/openal-soft/default.nix b/pkgs/development/libraries/openal-soft/default.nix
index b41d1d70e17f..c51300ebfb79 100644
--- a/pkgs/development/libraries/openal-soft/default.nix
+++ b/pkgs/development/libraries/openal-soft/default.nix
@@ -13,9 +13,6 @@
   pipewire,
   pulseSupport ? !stdenv.hostPlatform.isDarwin,
   libpulseaudio,
-  CoreServices,
-  AudioUnit,
-  AudioToolbox,
   nix-update-script,
 }:
 
@@ -42,12 +39,7 @@ stdenv.mkDerivation rec {
     lib.optional alsaSupport alsa-lib
     ++ lib.optional dbusSupport dbus
     ++ lib.optional pipewireSupport pipewire
-    ++ lib.optional pulseSupport libpulseaudio
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CoreServices
-      AudioUnit
-      AudioToolbox
-    ];
+    ++ lib.optional pulseSupport libpulseaudio;
 
   cmakeFlags =
     [
diff --git a/pkgs/development/libraries/opencolorio/default.nix b/pkgs/development/libraries/opencolorio/default.nix
index 00e041aafb0a..61e1d24ab3dc 100644
--- a/pkgs/development/libraries/opencolorio/default.nix
+++ b/pkgs/development/libraries/opencolorio/default.nix
@@ -12,10 +12,6 @@
   # Only required on Linux
   glew,
   libglut,
-  # Only required on Darwin
-  Carbon,
-  GLUT,
-  Cocoa,
   # Python bindings
   pythonBindings ? true, # Python bindings
   python3Packages,
@@ -63,11 +59,6 @@ stdenv.mkDerivation rec {
       glew
       libglut
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Carbon
-      GLUT
-      Cocoa
-    ]
     ++ lib.optionals pythonBindings [
       python3Packages.python
       python3Packages.pybind11
diff --git a/pkgs/development/libraries/opencsg/default.nix b/pkgs/development/libraries/opencsg/default.nix
index 3a73ea8c7850..df7ef53e02f5 100644
--- a/pkgs/development/libraries/opencsg/default.nix
+++ b/pkgs/development/libraries/opencsg/default.nix
@@ -10,7 +10,6 @@
   libXext,
   libX11,
   qmake,
-  GLUT,
   fixDarwinDylibNames,
 }:
 
@@ -33,8 +32,7 @@ stdenv.mkDerivation rec {
       libXmu
       libXext
       libX11
-    ]
-    ++ lib.optional stdenv.hostPlatform.isDarwin GLUT;
+    ];
 
   doCheck = false;
 
diff --git a/pkgs/development/libraries/opencv/4.x.nix b/pkgs/development/libraries/opencv/4.x.nix
index 67658bb843a0..070285bd473a 100644
--- a/pkgs/development/libraries/opencv/4.x.nix
+++ b/pkgs/development/libraries/opencv/4.x.nix
@@ -87,7 +87,6 @@
   enabledModules ? [ ],
 
   bzip2,
-  apple-sdk_14, # earlier SDKs cause linking issues on x86_64
   callPackage,
 }@inputs:
 
@@ -415,7 +414,6 @@ effectiveStdenv.mkDerivation {
     ]
     ++ optionals effectiveStdenv.hostPlatform.isDarwin [
       bzip2
-      apple-sdk_14
     ]
     ++ optionals enableDocs [
       doxygen
diff --git a/pkgs/development/libraries/opendht/default.nix b/pkgs/development/libraries/opendht/default.nix
index 39478e3e92b2..cecc8ee47b0b 100644
--- a/pkgs/development/libraries/opendht/default.nix
+++ b/pkgs/development/libraries/opendht/default.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  Security,
   cmake,
   pkg-config,
   asio,
@@ -51,9 +50,6 @@ stdenv.mkDerivation {
       restinio
       llhttp
       openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Security
     ];
 
   cmakeFlags =
diff --git a/pkgs/development/libraries/openscenegraph/default.nix b/pkgs/development/libraries/openscenegraph/default.nix
index df568d649494..ef95cbcdb125 100644
--- a/pkgs/development/libraries/openscenegraph/default.nix
+++ b/pkgs/development/libraries/openscenegraph/default.nix
@@ -16,11 +16,6 @@
   libxml2,
   pcre,
   zlib,
-  AGL,
-  Accelerate,
-  Carbon,
-  Cocoa,
-  Foundation,
   boost,
   jpegSupport ? true,
   libjpeg,
@@ -116,14 +111,6 @@ stdenv.mkDerivation rec {
     ++ lib.optional sdlSupport SDL2
     ++ lib.optional restSupport asio
     ++ lib.optionals withExamples [ fltk ]
-    ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [ ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AGL
-      Accelerate
-      Carbon
-      Cocoa
-      Foundation
-    ]
     ++ lib.optional (restSupport || colladaSupport) boost;
 
   patches = [
diff --git a/pkgs/development/libraries/pango/default.nix b/pkgs/development/libraries/pango/default.nix
index 2ef9fb2e1cac..3b2bf4c6191b 100644
--- a/pkgs/development/libraries/pango/default.nix
+++ b/pkgs/development/libraries/pango/default.nix
@@ -7,7 +7,6 @@
   harfbuzz,
   libintl,
   libthai,
-  darwin,
   fribidi,
   gnome,
   gi-docgen,
@@ -61,20 +60,10 @@ stdenv.mkDerivation (finalAttrs: {
       gobject-introspection
     ];
 
-  buildInputs =
-    [
-      fribidi
-      libthai
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        ApplicationServices
-        Carbon
-        CoreGraphics
-        CoreText
-      ]
-    );
+  buildInputs = [
+    fribidi
+    libthai
+  ];
 
   propagatedBuildInputs =
     [
diff --git a/pkgs/development/libraries/pangolin/default.nix b/pkgs/development/libraries/pangolin/default.nix
index bb9116110454..30cbbedeb70c 100644
--- a/pkgs/development/libraries/pangolin/default.nix
+++ b/pkgs/development/libraries/pangolin/default.nix
@@ -13,8 +13,6 @@
   libpng,
   libtiff,
   eigen,
-  Carbon,
-  Cocoa,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -34,21 +32,16 @@ stdenv.mkDerivation (finalAttrs: {
     doxygen
   ];
 
-  buildInputs =
-    [
-      libGL
-      glew
-      xorg.libX11
-      ffmpeg
-      libjpeg
-      libpng
-      libtiff.out
-      eigen
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Carbon
-      Cocoa
-    ];
+  buildInputs = [
+    libGL
+    glew
+    xorg.libX11
+    ffmpeg
+    libjpeg
+    libpng
+    libtiff.out
+    eigen
+  ];
 
   # The tests use cmake's findPackage to find the installed version of
   # pangolin, which isn't what we want (or available).
diff --git a/pkgs/development/libraries/pangomm/2.42.nix b/pkgs/development/libraries/pangomm/2.42.nix
index e855aeb3659b..2530dda54013 100644
--- a/pkgs/development/libraries/pangomm/2.42.nix
+++ b/pkgs/development/libraries/pangomm/2.42.nix
@@ -10,7 +10,6 @@
   glibmm,
   cairomm,
   gnome,
-  ApplicationServices,
 }:
 
 stdenv.mkDerivation rec {
@@ -36,16 +35,12 @@ stdenv.mkDerivation rec {
     "dev"
   ];
 
-  nativeBuildInputs =
-    [
-      pkg-config
-      meson
-      ninja
-      python3
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      ApplicationServices
-    ];
+  nativeBuildInputs = [
+    pkg-config
+    meson
+    ninja
+    python3
+  ];
   propagatedBuildInputs = [
     pango
     glibmm
diff --git a/pkgs/development/libraries/pangomm/2.48.nix b/pkgs/development/libraries/pangomm/2.48.nix
index fed1004cd70e..cff51fbb8d92 100644
--- a/pkgs/development/libraries/pangomm/2.48.nix
+++ b/pkgs/development/libraries/pangomm/2.48.nix
@@ -10,7 +10,6 @@
   glibmm_2_68,
   cairomm_1_16,
   gnome,
-  ApplicationServices,
 }:
 
 stdenv.mkDerivation rec {
@@ -27,16 +26,12 @@ stdenv.mkDerivation rec {
     hash = "sha256-U59apg6b3GuVW7RI4qYswUVidE32kCWAQPu3S/iFdV0=";
   };
 
-  nativeBuildInputs =
-    [
-      pkg-config
-      meson
-      ninja
-      python3
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      ApplicationServices
-    ];
+  nativeBuildInputs = [
+    pkg-config
+    meson
+    ninja
+    python3
+  ];
 
   propagatedBuildInputs = [
     pango
diff --git a/pkgs/development/libraries/pangomm/default.nix b/pkgs/development/libraries/pangomm/default.nix
index 9504a5ba9d19..3b4dcc9f0a7f 100644
--- a/pkgs/development/libraries/pangomm/default.nix
+++ b/pkgs/development/libraries/pangomm/default.nix
@@ -10,7 +10,6 @@
   glibmm,
   cairomm,
   gnome,
-  ApplicationServices,
 }:
 
 stdenv.mkDerivation rec {
@@ -27,16 +26,12 @@ stdenv.mkDerivation rec {
     "dev"
   ];
 
-  nativeBuildInputs =
-    [
-      pkg-config
-      meson
-      ninja
-      python3
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      ApplicationServices
-    ];
+  nativeBuildInputs = [
+    pkg-config
+    meson
+    ninja
+    python3
+  ];
   propagatedBuildInputs = [
     pango
     glibmm
diff --git a/pkgs/development/libraries/pc-ble-driver/default.nix b/pkgs/development/libraries/pc-ble-driver/default.nix
index fd298709181e..e7bce66d8175 100644
--- a/pkgs/development/libraries/pc-ble-driver/default.nix
+++ b/pkgs/development/libraries/pc-ble-driver/default.nix
@@ -8,7 +8,6 @@
   asio,
   catch2,
   spdlog,
-  IOKit,
   udev,
 }:
 
@@ -57,9 +56,6 @@ stdenv.mkDerivation rec {
   propagatedBuildInputs =
     [
 
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      IOKit
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       udev
diff --git a/pkgs/development/libraries/physfs/default.nix b/pkgs/development/libraries/physfs/default.nix
index b23e6bbafd72..ee526bffeb26 100644
--- a/pkgs/development/libraries/physfs/default.nix
+++ b/pkgs/development/libraries/physfs/default.nix
@@ -5,7 +5,6 @@
   cmake,
   doxygen,
   zlib,
-  Foundation,
 }:
 
 let
@@ -31,7 +30,7 @@ let
         doxygen
       ];
 
-      buildInputs = [ zlib ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Foundation ];
+      buildInputs = [ zlib ];
 
       doInstallCheck = true;
 
diff --git a/pkgs/development/libraries/physics/applgrid/default.nix b/pkgs/development/libraries/physics/applgrid/default.nix
index 7a0ae2cbdf12..f5ebcf89d724 100644
--- a/pkgs/development/libraries/physics/applgrid/default.nix
+++ b/pkgs/development/libraries/physics/applgrid/default.nix
@@ -7,7 +7,6 @@
   lhapdf,
   root5,
   zlib,
-  Cocoa,
 }:
 
 stdenv.mkDerivation rec {
@@ -27,7 +26,7 @@ stdenv.mkDerivation rec {
     lhapdf
     root5
     zlib
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Cocoa ];
+  ];
 
   patches = [
     ./bad_code.patch
diff --git a/pkgs/development/libraries/pipewire/default.nix b/pkgs/development/libraries/pipewire/default.nix
index 5cfb939d8afb..97d05c5ab0fa 100644
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@@ -82,7 +82,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pipewire";
-  version = "1.4.1";
+  version = "1.4.2";
 
   outputs = [
     "out"
@@ -98,7 +98,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "pipewire";
     repo = "pipewire";
     rev = finalAttrs.version;
-    sha256 = "sha256-TnGn6EVjjpEybslLEvBb66uqOiLg5ngpNV9LYO6TfvA=";
+    sha256 = "sha256-uxTzdvmazLNmWqc1v1LGiq34zV9IT0y1vTGc/+JiEU8=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/plplot/default.nix b/pkgs/development/libraries/plplot/default.nix
index d49b8da211d8..dcc8ca518051 100644
--- a/pkgs/development/libraries/plplot/default.nix
+++ b/pkgs/development/libraries/plplot/default.nix
@@ -6,7 +6,6 @@
   pkg-config,
   enableWX ? false,
   wxGTK32,
-  Cocoa,
   enableXWin ? false,
   xorg,
   enablePNG ? false,
@@ -30,7 +29,6 @@ stdenv.mkDerivation rec {
 
   buildInputs =
     lib.optional enableWX wxGTK32
-    ++ lib.optional (enableWX && stdenv.hostPlatform.isDarwin) Cocoa
     ++ lib.optional enableXWin xorg.libX11
     ++ lib.optionals enablePNG [
       cairo
diff --git a/pkgs/development/libraries/portmidi/default.nix b/pkgs/development/libraries/portmidi/default.nix
index 9afbb6018aeb..3806a1be2d52 100644
--- a/pkgs/development/libraries/portmidi/default.nix
+++ b/pkgs/development/libraries/portmidi/default.nix
@@ -5,11 +5,6 @@
   unzip,
   cmake,
   alsa-lib,
-  Carbon,
-  CoreAudio,
-  CoreFoundation,
-  CoreMIDI,
-  CoreServices,
 }:
 
 stdenv.mkDerivation rec {
@@ -46,17 +41,9 @@ stdenv.mkDerivation rec {
     unzip
     cmake
   ];
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [
-      alsa-lib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Carbon
-      CoreAudio
-      CoreFoundation
-      CoreMIDI
-      CoreServices
-    ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    alsa-lib
+  ];
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/development/libraries/protobuf/30.nix b/pkgs/development/libraries/protobuf/30.nix
new file mode 100644
index 000000000000..dae2a2cec6cc
--- /dev/null
+++ b/pkgs/development/libraries/protobuf/30.nix
@@ -0,0 +1,9 @@
+{ callPackage, ... }@args:
+
+callPackage ./generic.nix (
+  {
+    version = "30.2";
+    hash = "sha256-kkQQQPU6wk1/UMRwEMLVIR6JB29Fm6L3OrsvaeI6VAA=";
+  }
+  // args
+)
diff --git a/pkgs/development/libraries/qmltermwidget/default.nix b/pkgs/development/libraries/qmltermwidget/default.nix
index e496a537c926..01e3168b30c9 100644
--- a/pkgs/development/libraries/qmltermwidget/default.nix
+++ b/pkgs/development/libraries/qmltermwidget/default.nix
@@ -6,7 +6,6 @@
   qmake,
   qtbase,
   qtmultimedia,
-  utmp,
 }:
 
 stdenv.mkDerivation {
@@ -27,7 +26,7 @@ stdenv.mkDerivation {
   buildInputs = [
     qtbase
     qtmultimedia
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin utmp;
+  ];
 
   patches = [
     # Changes required to make it compatible with lomiri-terminal-app
diff --git a/pkgs/development/libraries/qrencode/default.nix b/pkgs/development/libraries/qrencode/default.nix
index a5e5c2042323..246499eba9ce 100644
--- a/pkgs/development/libraries/qrencode/default.nix
+++ b/pkgs/development/libraries/qrencode/default.nix
@@ -6,7 +6,6 @@
   SDL2,
   libpng,
   libiconv,
-  libobjc,
 }:
 
 stdenv.mkDerivation (finalAttrs: rec {
@@ -30,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: rec {
   buildInputs = [
     libiconv
     libpng
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ libobjc ];
+  ];
 
   nativeCheckInputs = [ SDL2 ];
 
diff --git a/pkgs/development/libraries/qt-5/5.15/default.nix b/pkgs/development/libraries/qt-5/5.15/default.nix
index f0896ae775b9..296a4aa1bb9f 100644
--- a/pkgs/development/libraries/qt-5/5.15/default.nix
+++ b/pkgs/development/libraries/qt-5/5.15/default.nix
@@ -27,7 +27,6 @@
   gtk3,
   dconf,
   llvmPackages_15,
-  overrideSDK,
   overrideLibcxx,
   darwin,
 
diff --git a/pkgs/development/libraries/qt-5/modules/qtbase.nix b/pkgs/development/libraries/qt-5/modules/qtbase.nix
index 0e55f0944cee..e9be662ab6d4 100644
--- a/pkgs/development/libraries/qt-5/modules/qtbase.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtbase.nix
@@ -88,7 +88,6 @@ let
       throw "Please add a qtPlatformCross entry for ${plat.config}";
 
   # Per https://doc.qt.io/qt-5/macos.html#supported-versions: build SDK = 13.x or 14.x.
-  # SDK 13.x causes weird linking errors on x86_64-darwin, so use 14.x
   darwinVersionInputs = [
     apple-sdk_14
   ];
diff --git a/pkgs/development/libraries/qt-6/modules/qtbase/default.nix b/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
index 9329008e29a6..7410132dd38f 100644
--- a/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
@@ -263,6 +263,9 @@ stdenv.mkDerivation rec {
       "-DQT_FEATURE_system_sqlite=ON"
       "-DQT_FEATURE_openssl_linked=ON"
       "-DQT_FEATURE_vulkan=ON"
+      # don't leak OS version into the final output
+      # https://bugreports.qt.io/browse/QTBUG-136060
+      "-DCMAKE_SYSTEM_VERSION="
     ]
     ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
       "-DQT_FEATURE_sctp=ON"
diff --git a/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix b/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
index fed828ae7b0d..f28a180b5876 100644
--- a/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
@@ -29,24 +29,30 @@ qtModule {
     darwin.sigtool
   ];
 
-  patches =
-    [
-      # invalidates qml caches created from nix applications at different
-      # store paths and disallows saving caches of bare qml files in the store.
-      (replaceVars ./invalidate-caches-from-mismatched-store-paths.patch {
-        nixStore = builtins.storeDir;
-        nixStoreLength = builtins.toString ((builtins.stringLength builtins.storeDir) + 1); # trailing /
-      })
-      # add version specific QML import path
-      ./use-versioned-import-path.patch
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      # The build attempts to sign qmltestrunner, which may already be signed, causing it to fail unless forced.
-      (fetchpatch2 {
-        url = "https://invent.kde.org/qt/qt/qtdeclarative/-/commit/8effbbcefd8cae27cd5da07b4ffe3aa86dad83bf.diff";
-        hash = "sha256-wKrKXdr1ddshpRVIZZ/dsn87wjPXSaoUvXT9edlPtzA=";
-      })
-    ];
+  patches = [
+    # invalidates qml caches created from nix applications at different
+    # store paths and disallows saving caches of bare qml files in the store.
+    (replaceVars ./invalidate-caches-from-mismatched-store-paths.patch {
+      nixStore = builtins.storeDir;
+      nixStoreLength = builtins.toString ((builtins.stringLength builtins.storeDir) + 1); # trailing /
+    })
+    # add version specific QML import path
+    ./use-versioned-import-path.patch
+
+    # The build attempts to sign qmltestrunner, which may already be signed, causing it to fail unless forced.
+    # FIXME: remove for 6.9.1
+    (fetchpatch2 {
+      url = "https://invent.kde.org/qt/qt/qtdeclarative/-/commit/8effbbcefd8cae27cd5da07b4ffe3aa86dad83bf.diff";
+      hash = "sha256-wKrKXdr1ddshpRVIZZ/dsn87wjPXSaoUvXT9edlPtzA=";
+    })
+
+    # Backport patch to fix qmlsc crash on "if + for"
+    # FIXME: remove for 6.9.1
+    (fetchpatch2 {
+      url = "https://github.com/qt/qtdeclarative/commit/d1aa2e8466bab73c3e4d120356238b482b55f02a.patch?full_index=1";
+      hash = "sha256-8W1xpULqESP81S4UbQugoU/D6KFy7DoTbJ3xfK9Q5PI=";
+    })
+  ];
 
   preConfigure =
     let
diff --git a/pkgs/development/libraries/qt-6/modules/qtgrpc.nix b/pkgs/development/libraries/qt-6/modules/qtgrpc.nix
index b344321d11db..016f72f3074a 100644
--- a/pkgs/development/libraries/qt-6/modules/qtgrpc.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtgrpc.nix
@@ -1,5 +1,6 @@
 {
   qtModule,
+  fetchpatch,
   qtbase,
   qtdeclarative,
   protobuf,
@@ -8,6 +9,15 @@
 
 qtModule {
   pname = "qtgrpc";
+
+  patches = [
+    (fetchpatch {
+      name = "new-protobuf.patch";
+      url = "https://github.com/qt/qtgrpc/commit/514769d1bd595d0e54bbe34c0bd167636d4825dc.diff";
+      hash = "sha256-juNSijNlR6PHxiEVx72vMBSvcWYfR/T/yvpxAF+ZAKE=";
+    })
+  ];
+
   propagatedBuildInputs = [
     qtbase
     qtdeclarative
diff --git a/pkgs/development/libraries/qt-6/qtModule.nix b/pkgs/development/libraries/qt-6/qtModule.nix
index d21056419477..e5089813c39a 100644
--- a/pkgs/development/libraries/qt-6/qtModule.nix
+++ b/pkgs/development/libraries/qt-6/qtModule.nix
@@ -39,8 +39,11 @@ stdenv.mkDerivation (
       ++ (args.propagatedBuildInputs or [ ]);
 
     cmakeFlags =
-      args.cmakeFlags or [ ]
-      ++ lib.optional stdenv.hostPlatform.isDarwin "-DQT_NO_XCODE_MIN_VERSION_CHECK=ON";
+      # don't leak OS version into the final output
+      # https://bugreports.qt.io/browse/QTBUG-136060
+      [ "-DCMAKE_SYSTEM_VERSION=" ]
+      ++ lib.optional stdenv.hostPlatform.isDarwin "-DQT_NO_XCODE_MIN_VERSION_CHECK=ON"
+      ++ args.cmakeFlags or [ ];
 
     moveToDev = false;
 
diff --git a/pkgs/development/libraries/qtkeychain/default.nix b/pkgs/development/libraries/qtkeychain/default.nix
index 5ad105a64bac..fde3c71b4564 100644
--- a/pkgs/development/libraries/qtkeychain/default.nix
+++ b/pkgs/development/libraries/qtkeychain/default.nix
@@ -6,8 +6,6 @@
   pkg-config,
   qtbase,
   qttools,
-  CoreFoundation,
-  Security,
   libsecret,
 }:
 
@@ -32,16 +30,10 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake ] ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [ pkg-config ] # for finding libsecret
   ;
 
-  buildInputs =
-    lib.optionals (!stdenv.hostPlatform.isDarwin) [ libsecret ]
-    ++ [
-      qtbase
-      qttools
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CoreFoundation
-      Security
-    ];
+  buildInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) [ libsecret ] ++ [
+    qtbase
+    qttools
+  ];
 
   doInstallCheck = true;
 
diff --git a/pkgs/development/libraries/readline/8.2.nix b/pkgs/development/libraries/readline/8.2.nix
index 40f0f05887e5..0434a749390e 100644
--- a/pkgs/development/libraries/readline/8.2.nix
+++ b/pkgs/development/libraries/readline/8.2.nix
@@ -9,121 +9,114 @@
   curses-library ? if stdenv.hostPlatform.isWindows then termcap else ncurses,
 }:
 
-stdenv.mkDerivation (
-  finalAttrs:
-  let
-    inherit (finalAttrs) upstreamPatches meta;
-  in
-  {
-    pname = "readline";
-    version = "8.2p${toString (builtins.length upstreamPatches)}";
+stdenv.mkDerivation (finalAttrs: {
+  pname = "readline";
+  version = "8.2p${toString (builtins.length finalAttrs.upstreamPatches)}";
 
-    src = fetchurl {
-      url = "mirror://gnu/readline/readline-${meta.branch}.tar.gz";
-      sha256 = "sha256-P+txcfFqhO6CyhijbXub4QmlLAT0kqBTMx19EJUAfDU=";
-    };
+  src = fetchurl {
+    url = "mirror://gnu/readline/readline-${finalAttrs.meta.branch}.tar.gz";
+    sha256 = "sha256-P+txcfFqhO6CyhijbXub4QmlLAT0kqBTMx19EJUAfDU=";
+  };
 
-    outputs = [
-      "out"
-      "dev"
-      "man"
-      "doc"
-      "info"
+  outputs = [
+    "out"
+    "dev"
+    "man"
+    "doc"
+    "info"
+  ];
+
+  strictDeps = true;
+  propagatedBuildInputs = [ curses-library ];
+  nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ];
+
+  patchFlags = [ "-p0" ];
+
+  upstreamPatches = (
+    let
+      patch =
+        nr: sha256:
+        fetchurl {
+          url = "mirror://gnu/readline/readline-${finalAttrs.meta.branch}-patches/readline82-${nr}";
+          inherit sha256;
+        };
+    in
+    import ./readline-8.2-patches.nix patch
+  );
+
+  patches =
+    lib.optionals (curses-library.pname == "ncurses") [
+      ./link-against-ncurses.patch
+    ]
+    ++ [
+      ./no-arch_only-8.2.patch
+    ]
+    ++ finalAttrs.upstreamPatches
+    ++ lib.optionals stdenv.hostPlatform.isWindows [
+      (fetchpatch {
+        name = "0001-sigwinch.patch";
+        url = "https://github.com/msys2/MINGW-packages/raw/90e7536e3b9c3af55c336d929cfcc32468b2f135/mingw-w64-readline/0001-sigwinch.patch";
+        stripLen = 1;
+        hash = "sha256-sFK6EJrSNl0KLWqFv5zBXaQRuiQoYIZVoZfa8BZqfKA=";
+      })
+      (fetchpatch {
+        name = "0002-event-hook.patch";
+        url = "https://github.com/msys2/MINGW-packages/raw/3476319d2751a676b911f3de9e1ec675081c03b8/mingw-w64-readline/0002-event-hook.patch";
+        stripLen = 1;
+        hash = "sha256-F8ytYuIjBtH83ZCJdf622qjwSw+wZEVyu53E/mPsoAo=";
+      })
+      (fetchpatch {
+        name = "0003-fd_set.patch";
+        url = "https://github.com/msys2/MINGW-packages/raw/35830ab27e5ed35c2a8d486961ab607109f5af50/mingw-w64-readline/0003-fd_set.patch";
+        stripLen = 1;
+        hash = "sha256-UiaXZRPjKecpSaflBMCphI2kqOlcz1JkymlCrtpMng4=";
+      })
+      (fetchpatch {
+        name = "0004-locale.patch";
+        url = "https://github.com/msys2/MINGW-packages/raw/f768c4b74708bb397a77e3374cc1e9e6ef647f20/mingw-w64-readline/0004-locale.patch";
+        stripLen = 1;
+        hash = "sha256-dk4343KP4EWXdRRCs8GRQlBgJFgu1rd79RfjwFD/nJc=";
+      })
     ];
 
-    strictDeps = true;
-    propagatedBuildInputs = [ curses-library ];
-    nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ];
+  # Make mingw-w64 provide a dummy alarm() function
+  #
+  # Method borrowed from
+  # https://github.com/msys2/MINGW-packages/commit/35830ab27e5ed35c2a8d486961ab607109f5af50
+  CFLAGS = lib.optionalString stdenv.hostPlatform.isMinGW "-D__USE_MINGW_ALARM -D_POSIX";
 
-    patchFlags = [ "-p0" ];
+  # This install error is caused by a very old libtool. We can't autoreconfHook this package,
+  # so this is the best we've got!
+  postInstall = lib.optionalString stdenv.hostPlatform.isOpenBSD ''
+    ln -s $out/lib/libhistory.so* $out/lib/libhistory.so
+    ln -s $out/lib/libreadline.so* $out/lib/libreadline.so
+  '';
 
-    upstreamPatches = (
-      let
-        patch =
-          nr: sha256:
-          fetchurl {
-            url = "mirror://gnu/readline/readline-${meta.branch}-patches/readline82-${nr}";
-            inherit sha256;
-          };
-      in
-      import ./readline-8.2-patches.nix patch
-    );
+  meta = with lib; {
+    description = "Library for interactive line editing";
 
-    patches =
-      lib.optionals (curses-library.pname == "ncurses") [
-        ./link-against-ncurses.patch
-      ]
-      ++ [
-        ./no-arch_only-8.2.patch
-      ]
-      ++ upstreamPatches
-      ++ lib.optionals stdenv.hostPlatform.isWindows [
-        (fetchpatch {
-          name = "0001-sigwinch.patch";
-          url = "https://github.com/msys2/MINGW-packages/raw/90e7536e3b9c3af55c336d929cfcc32468b2f135/mingw-w64-readline/0001-sigwinch.patch";
-          stripLen = 1;
-          hash = "sha256-sFK6EJrSNl0KLWqFv5zBXaQRuiQoYIZVoZfa8BZqfKA=";
-        })
-        (fetchpatch {
-          name = "0002-event-hook.patch";
-          url = "https://github.com/msys2/MINGW-packages/raw/3476319d2751a676b911f3de9e1ec675081c03b8/mingw-w64-readline/0002-event-hook.patch";
-          stripLen = 1;
-          hash = "sha256-F8ytYuIjBtH83ZCJdf622qjwSw+wZEVyu53E/mPsoAo=";
-        })
-        (fetchpatch {
-          name = "0003-fd_set.patch";
-          url = "https://github.com/msys2/MINGW-packages/raw/35830ab27e5ed35c2a8d486961ab607109f5af50/mingw-w64-readline/0003-fd_set.patch";
-          stripLen = 1;
-          hash = "sha256-UiaXZRPjKecpSaflBMCphI2kqOlcz1JkymlCrtpMng4=";
-        })
-        (fetchpatch {
-          name = "0004-locale.patch";
-          url = "https://github.com/msys2/MINGW-packages/raw/f768c4b74708bb397a77e3374cc1e9e6ef647f20/mingw-w64-readline/0004-locale.patch";
-          stripLen = 1;
-          hash = "sha256-dk4343KP4EWXdRRCs8GRQlBgJFgu1rd79RfjwFD/nJc=";
-        })
-      ];
+    longDescription = ''
+      The GNU Readline library provides a set of functions for use by
+      applications that allow users to edit command lines as they are
+      typed in.  Both Emacs and vi editing modes are available.  The
+      Readline library includes additional functions to maintain a
+      list of previously-entered command lines, to recall and perhaps
+      reedit those lines, and perform csh-like history expansion on
+      previous commands.
 
-    # This install error is caused by a very old libtool. We can't autoreconfHook this package,
-    # so this is the best we've got!
-    postInstall = lib.optionalString stdenv.hostPlatform.isOpenBSD ''
-      ln -s $out/lib/libhistory.so* $out/lib/libhistory.so
-      ln -s $out/lib/libreadline.so* $out/lib/libreadline.so
+      The history facilities are also placed into a separate library,
+      the History library, as part of the build process.  The History
+      library may be used without Readline in applications which
+      desire its capabilities.
     '';
 
-    meta = with lib; {
-      description = "Library for interactive line editing";
+    homepage = "https://savannah.gnu.org/projects/readline/";
 
-      longDescription = ''
-        The GNU Readline library provides a set of functions for use by
-        applications that allow users to edit command lines as they are
-        typed in.  Both Emacs and vi editing modes are available.  The
-        Readline library includes additional functions to maintain a
-        list of previously-entered command lines, to recall and perhaps
-        reedit those lines, and perform csh-like history expansion on
-        previous commands.
+    license = licenses.gpl3Plus;
 
-        The history facilities are also placed into a separate library,
-        the History library, as part of the build process.  The History
-        library may be used without Readline in applications which
-        desire its capabilities.
-      '';
+    maintainers = with maintainers; [ dtzWill ];
 
-      homepage = "https://savannah.gnu.org/projects/readline/";
-
-      license = licenses.gpl3Plus;
-
-      maintainers = with maintainers; [ dtzWill ];
-
-      platforms = platforms.unix ++ platforms.windows;
-      branch = "8.2";
-    };
-  }
-  // lib.optionalAttrs stdenv.hostPlatform.isMinGW {
-    # Make mingw-w64 provide a dummy alarm() function
-    #
-    # Method borrowed from
-    # https://github.com/msys2/MINGW-packages/commit/35830ab27e5ed35c2a8d486961ab607109f5af50
-    CFLAGS = "-D__USE_MINGW_ALARM -D_POSIX";
-  }
-)
+    platforms = platforms.unix ++ platforms.windows;
+    branch = "8.2";
+  };
+})
diff --git a/pkgs/development/libraries/rnnoise-plugin/default.nix b/pkgs/development/libraries/rnnoise-plugin/default.nix
index 98cf154ec1e6..af7cf9108cac 100644
--- a/pkgs/development/libraries/rnnoise-plugin/default.nix
+++ b/pkgs/development/libraries/rnnoise-plugin/default.nix
@@ -9,10 +9,6 @@
   pkg-config,
   webkitgtk_4_0,
   xorg,
-  WebKit,
-  MetalKit,
-  CoreAudioKit,
-  simd,
 }:
 stdenv.mkDerivation rec {
   pname = "rnnoise-plugin";
@@ -45,12 +41,6 @@ stdenv.mkDerivation rec {
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       webkitgtk_4_0
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      WebKit
-      MetalKit
-      CoreAudioKit
-      simd
     ];
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/science/biology/elastix/default.nix b/pkgs/development/libraries/science/biology/elastix/default.nix
index efc6eee5c463..eb758bc1541a 100644
--- a/pkgs/development/libraries/science/biology/elastix/default.nix
+++ b/pkgs/development/libraries/science/biology/elastix/default.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   cmake,
   itk,
-  Cocoa,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -19,7 +18,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = [ itk ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Cocoa ];
+  buildInputs = [ itk ];
 
   doCheck = !stdenv.hostPlatform.isDarwin; # usual dynamic linker issues
 
diff --git a/pkgs/development/libraries/science/math/clblas/default.nix b/pkgs/development/libraries/science/math/clblas/default.nix
index 8bd4297fb95b..463f36deca47 100644
--- a/pkgs/development/libraries/science/math/clblas/default.nix
+++ b/pkgs/development/libraries/science/math/clblas/default.nix
@@ -10,10 +10,6 @@
   python3,
   ocl-icd,
   opencl-headers,
-  Accelerate,
-  CoreGraphics,
-  CoreVideo,
-  OpenCL,
 }:
 
 stdenv.mkDerivation rec {
@@ -60,15 +56,7 @@ stdenv.mkDerivation rec {
     ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
       ocl-icd
       opencl-headers
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Accelerate
-      CoreGraphics
-      CoreVideo
     ];
-  propagatedBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    OpenCL
-  ];
 
   strictDeps = true;
 
diff --git a/pkgs/development/libraries/silgraphite/graphite2.nix b/pkgs/development/libraries/silgraphite/graphite2.nix
index 7289820b60df..cef47a396da7 100644
--- a/pkgs/development/libraries/silgraphite/graphite2.nix
+++ b/pkgs/development/libraries/silgraphite/graphite2.nix
@@ -48,6 +48,10 @@ stdenv.mkDerivation (finalAttrs: {
     # support cross-compilation by using target readelf binary:
     substituteInPlace Graphite.cmake \
       --replace 'readelf' "${stdenv.cc.targetPrefix}readelf"
+
+    # headers are located in the dev output:
+    substituteInPlace CMakeLists.txt \
+      --replace-fail ' ''${CMAKE_INSTALL_PREFIX}/include' " ${placeholder "dev"}/include"
   '';
 
   cmakeFlags = lib.optionals static [
diff --git a/pkgs/development/libraries/soci/default.nix b/pkgs/development/libraries/soci/default.nix
index bb9a91be24d9..5c649e913491 100644
--- a/pkgs/development/libraries/soci/default.nix
+++ b/pkgs/development/libraries/soci/default.nix
@@ -5,13 +5,9 @@
   sqlite,
   libpq,
   boost,
-  darwin,
   lib,
   stdenv,
 }:
-let
-  inherit (darwin.apple_sdk_11_0.frameworks) Kerberos;
-in
 stdenv.mkDerivation rec {
   pname = "soci";
   version = "4.0.2";
@@ -39,15 +35,11 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [ cmake ];
-  buildInputs =
-    [
-      sqlite
-      libpq
-      boost
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Kerberos
-    ];
+  buildInputs = [
+    sqlite
+    libpq
+    boost
+  ];
 
   meta = with lib; {
     description = "Database access library for C++";
diff --git a/pkgs/development/libraries/sofia-sip/default.nix b/pkgs/development/libraries/sofia-sip/default.nix
index d70bd95bef04..0042c50b1dce 100644
--- a/pkgs/development/libraries/sofia-sip/default.nix
+++ b/pkgs/development/libraries/sofia-sip/default.nix
@@ -7,7 +7,6 @@
   openssl,
   pkg-config,
   autoreconfHook,
-  SystemConfiguration,
 }:
 
 stdenv.mkDerivation rec {
@@ -33,7 +32,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     glib
     openssl
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin SystemConfiguration;
+  ];
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
diff --git a/pkgs/development/libraries/soil/default.nix b/pkgs/development/libraries/soil/default.nix
index e8f8e75f8fd8..bed06c618693 100644
--- a/pkgs/development/libraries/soil/default.nix
+++ b/pkgs/development/libraries/soil/default.nix
@@ -1,7 +1,6 @@
 {
   stdenv,
   lib,
-  Carbon,
   fetchzip,
   libGL,
   libX11,
@@ -16,16 +15,10 @@ stdenv.mkDerivation {
     sha256 = "1c05nwbnfdgwaz8ywn7kg2xrcvrcbpdyhcfkkiiwk69zvil0pbgd";
   };
 
-  buildInputs =
-    if stdenv.hostPlatform.isDarwin then
-      [
-        Carbon
-      ]
-    else
-      [
-        libGL
-        libX11
-      ];
+  buildInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) [
+    libGL
+    libX11
+  ];
 
   buildPhase = ''
     cd src
diff --git a/pkgs/development/libraries/speech-tools/default.nix b/pkgs/development/libraries/speech-tools/default.nix
index 6ee5391451c7..dfdfa5ee4985 100644
--- a/pkgs/development/libraries/speech-tools/default.nix
+++ b/pkgs/development/libraries/speech-tools/default.nix
@@ -5,9 +5,6 @@
   fetchpatch,
   ncurses,
   alsa-lib,
-  CoreServices,
-  AudioUnit,
-  Cocoa,
 }:
 
 stdenv.mkDerivation rec {
@@ -33,11 +30,6 @@ stdenv.mkDerivation rec {
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       alsa-lib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CoreServices
-      AudioUnit
-      Cocoa
     ];
 
   makeFlags = [
diff --git a/pkgs/development/libraries/sqlite/tools.nix b/pkgs/development/libraries/sqlite/tools.nix
index 91ebe63bebe7..64c9708594e8 100644
--- a/pkgs/development/libraries/sqlite/tools.nix
+++ b/pkgs/development/libraries/sqlite/tools.nix
@@ -5,7 +5,6 @@
   unzip,
   sqlite,
   tcl,
-  Foundation,
 }:
 
 let
@@ -31,7 +30,7 @@ let
         };
 
       nativeBuildInputs = [ unzip ];
-      buildInputs = [ tcl ] ++ lib.optional stdenv.hostPlatform.isDarwin Foundation;
+      buildInputs = [ tcl ];
 
       makeFlags = [ makeTarget ];
 
diff --git a/pkgs/development/libraries/tachyon/default.nix b/pkgs/development/libraries/tachyon/default.nix
index 9fb40ddb259d..0cf61be8d384 100644
--- a/pkgs/development/libraries/tachyon/default.nix
+++ b/pkgs/development/libraries/tachyon/default.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  Carbon,
   libjpeg,
   libpng,
   withJpegSupport ? true, # support jpeg output
@@ -17,10 +16,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-CSA8ECMRFJ9d9cw2dAn5bHJXQmZtGcJNtbqZTVqBpvU=";
   };
   buildInputs =
-    lib.optionals stdenv.hostPlatform.isDarwin [
-      Carbon
-    ]
-    ++ lib.optionals withJpegSupport [
+    lib.optionals withJpegSupport [
       libjpeg
     ]
     ++ lib.optionals withPngSupport [
diff --git a/pkgs/development/libraries/unicorn/default.nix b/pkgs/development/libraries/unicorn/default.nix
index e9977ff75160..39edf55b76e9 100644
--- a/pkgs/development/libraries/unicorn/default.nix
+++ b/pkgs/development/libraries/unicorn/default.nix
@@ -4,7 +4,6 @@
   cctools,
   cmake,
   fetchFromGitHub,
-  IOKit,
   pkg-config,
 }:
 
@@ -28,8 +27,6 @@ stdenv.mkDerivation rec {
       cctools
     ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ IOKit ];
-
   # Ensure the linker is using atomic when compiling for RISC-V, otherwise fails
   NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isRiscV "-latomic";
 
diff --git a/pkgs/development/libraries/vmmlib/default.nix b/pkgs/development/libraries/vmmlib/default.nix
index 8283a89095c5..3a15b69d453a 100644
--- a/pkgs/development/libraries/vmmlib/default.nix
+++ b/pkgs/development/libraries/vmmlib/default.nix
@@ -6,9 +6,6 @@
   pkg-config,
   boost,
   lapack,
-  Accelerate,
-  CoreGraphics,
-  CoreVideo,
 }:
 
 stdenv.mkDerivation rec {
@@ -30,16 +27,10 @@ stdenv.mkDerivation rec {
     pkg-config
     cmake
   ];
-  buildInputs =
-    [
-      boost
-      lapack
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Accelerate
-      CoreGraphics
-      CoreVideo
-    ];
+  buildInputs = [
+    boost
+    lapack
+  ];
 
   doCheck = !stdenv.hostPlatform.isDarwin;
 
diff --git a/pkgs/development/libraries/webrtc-audio-processing/0.3.nix b/pkgs/development/libraries/webrtc-audio-processing/0.3.nix
index 6647f4250444..b64d19521905 100644
--- a/pkgs/development/libraries/webrtc-audio-processing/0.3.nix
+++ b/pkgs/development/libraries/webrtc-audio-processing/0.3.nix
@@ -3,7 +3,6 @@
   stdenv,
   fetchurl,
   fetchpatch,
-  darwin,
   autoreconfHook,
   pkg-config,
 }:
@@ -53,10 +52,6 @@ stdenv.mkDerivation rec {
     pkg-config
   ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin (
-    with darwin.apple_sdk.frameworks; [ ApplicationServices ]
-  );
-
   patchPhase = lib.optionalString stdenv.hostPlatform.isMusl ''
     substituteInPlace webrtc/base/checks.cc --replace 'defined(__UCLIBC__)' 1
   '';
diff --git a/pkgs/development/libraries/webrtc-audio-processing/default.nix b/pkgs/development/libraries/webrtc-audio-processing/default.nix
index a7ed8c8ea0a2..e2d51a9e6606 100644
--- a/pkgs/development/libraries/webrtc-audio-processing/default.nix
+++ b/pkgs/development/libraries/webrtc-audio-processing/default.nix
@@ -3,7 +3,6 @@
   stdenv,
   fetchFromGitLab,
   fetchurl,
-  darwin,
   abseil-cpp,
   meson,
   ninja,
@@ -46,14 +45,6 @@ stdenv.mkDerivation rec {
     abseil-cpp
   ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin (
-    with darwin.apple_sdk.frameworks;
-    [
-      ApplicationServices
-      Foundation
-    ]
-  );
-
   env = lib.optionalAttrs stdenv.hostPlatform.isx86_32 {
     # https://gitlab.freedesktop.org/pulseaudio/webrtc-audio-processing/-/issues/5
     NIX_CFLAGS_COMPILE = "-msse2";
diff --git a/pkgs/development/libraries/wiiuse/default.nix b/pkgs/development/libraries/wiiuse/default.nix
index 606dd201f324..bdc91158d28e 100644
--- a/pkgs/development/libraries/wiiuse/default.nix
+++ b/pkgs/development/libraries/wiiuse/default.nix
@@ -5,9 +5,6 @@
   fetchpatch,
   cmake,
   bluez,
-  libobjc,
-  Foundation,
-  IOBluetooth,
 }:
 stdenv.mkDerivation rec {
 
@@ -40,13 +37,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [ bluez ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      libobjc
-      Foundation
-      IOBluetooth
-    ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ bluez ];
 
   propagatedBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ bluez ];
 
diff --git a/pkgs/development/libraries/wildmidi/default.nix b/pkgs/development/libraries/wildmidi/default.nix
index 5433a09dc955..4f5c7f90bcf4 100644
--- a/pkgs/development/libraries/wildmidi/default.nix
+++ b/pkgs/development/libraries/wildmidi/default.nix
@@ -5,8 +5,6 @@
   writeTextFile,
   cmake,
   alsa-lib,
-  OpenAL,
-  CoreAudioKit,
   freepats,
 }:
 
@@ -26,15 +24,10 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
-  buildInputs =
-    lib.optionals stdenv.buildPlatform.isLinux [
-      alsa-lib
-      stdenv.cc.libc # couldn't find libm
-    ]
-    ++ lib.optionals stdenv.buildPlatform.isDarwin [
-      OpenAL
-      CoreAudioKit
-    ];
+  buildInputs = lib.optionals stdenv.buildPlatform.isLinux [
+    alsa-lib
+    stdenv.cc.libc # couldn't find libm
+  ];
 
   preConfigure = ''
     # https://github.com/Mindwerks/wildmidi/issues/236
diff --git a/pkgs/development/libraries/wolfssl/default.nix b/pkgs/development/libraries/wolfssl/default.nix
index db808f96f1ed..bccd65d015f9 100644
--- a/pkgs/development/libraries/wolfssl/default.nix
+++ b/pkgs/development/libraries/wolfssl/default.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  Security,
   autoreconfHook,
   util-linux,
   openssl,
@@ -88,10 +87,6 @@ stdenv.mkDerivation (finalAttrs: {
     "out"
   ];
 
-  propagatedBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    Security
-  ];
-
   nativeBuildInputs = [
     autoreconfHook
     util-linux
diff --git a/pkgs/development/libraries/yubico-pam/default.nix b/pkgs/development/libraries/yubico-pam/default.nix
index 646188c4c694..1b3b79256ed1 100644
--- a/pkgs/development/libraries/yubico-pam/default.nix
+++ b/pkgs/development/libraries/yubico-pam/default.nix
@@ -11,8 +11,6 @@
   yubikey-personalization,
   libyubikey,
   libykclient,
-  CoreServices,
-  SystemConfiguration,
 }:
 
 stdenv.mkDerivation rec {
@@ -32,17 +30,12 @@ stdenv.mkDerivation rec {
     libxslt
     docbook_xsl
   ];
-  buildInputs =
-    [
-      pam
-      yubikey-personalization
-      libyubikey
-      libykclient
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CoreServices
-      SystemConfiguration
-    ];
+  buildInputs = [
+    pam
+    yubikey-personalization
+    libyubikey
+    libykclient
+  ];
 
   meta = with lib; {
     description = "Yubico PAM module";
diff --git a/pkgs/development/lua-modules/nfd/default.nix b/pkgs/development/lua-modules/nfd/default.nix
index a9b7aaef9e77..c216e235a1a5 100644
--- a/pkgs/development/lua-modules/nfd/default.nix
+++ b/pkgs/development/lua-modules/nfd/default.nix
@@ -1,5 +1,4 @@
 {
-  stdenv,
   fetchFromGitHub,
   buildLuarocksPackage,
   lua,
@@ -7,7 +6,6 @@
   lib,
   replaceVars,
   zenity,
-  AppKit,
 }:
 
 buildLuarocksPackage {
@@ -33,8 +31,6 @@ buildLuarocksPackage {
   luarocksConfig.variables.LUA_LIBDIR = "${lua}/lib";
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ AppKit ];
-
   postInstall = ''
     find $out -name nfd_zenity.so -execdir mv {} nfd.so \;
   '';
diff --git a/pkgs/development/node-packages/overrides.nix b/pkgs/development/node-packages/overrides.nix
index dfa3dc4c2460..6609200b9aef 100644
--- a/pkgs/development/node-packages/overrides.nix
+++ b/pkgs/development/node-packages/overrides.nix
@@ -64,25 +64,19 @@ final: prev: {
       ++ lib.optionals stdenv.hostPlatform.isDarwin [
         pkgs.xcbuild
       ];
-    buildInputs =
-      with pkgs;
-      [
-        # required by sharp
-        # https://sharp.pixelplumbing.com/install
-        vips
+    buildInputs = with pkgs; [
+      # required by sharp
+      # https://sharp.pixelplumbing.com/install
+      vips
 
-        libsecret
-        final.node-gyp-build
-        node-pre-gyp
+      libsecret
+      final.node-gyp-build
+      node-pre-gyp
 
-        pixman
-        cairo
-        pango
-      ]
-      ++ lib.optionals stdenv.hostPlatform.isDarwin [
-        darwin.apple_sdk.frameworks.AppKit
-        darwin.apple_sdk.frameworks.Security
-      ];
+      pixman
+      cairo
+      pango
+    ];
 
     # add newer node-addon-api to build sharp
     # https://github.com/lovell/sharp/issues/3920
@@ -119,16 +113,11 @@ final: prev: {
 
   keyoxide = prev.keyoxide.override {
     nativeBuildInputs = [ pkgs.pkg-config ];
-    buildInputs =
-      with pkgs;
-      [
-        pixman
-        cairo
-        pango
-      ]
-      ++ lib.optionals stdenv.hostPlatform.isDarwin [
-        darwin.apple_sdk.frameworks.CoreText
-      ];
+    buildInputs = with pkgs; [
+      pixman
+      cairo
+      pango
+    ];
   };
 
   makam = prev.makam.override {
@@ -217,18 +206,13 @@ final: prev: {
 
   vega-cli = prev.vega-cli.override {
     nativeBuildInputs = [ pkgs.pkg-config ];
-    buildInputs =
-      with pkgs;
-      [
-        node-pre-gyp
-        pixman
-        cairo
-        pango
-        libjpeg
-      ]
-      ++ lib.optionals stdenv.hostPlatform.isDarwin [
-        darwin.apple_sdk.frameworks.CoreText
-      ];
+    buildInputs = with pkgs; [
+      node-pre-gyp
+      pixman
+      cairo
+      pango
+      libjpeg
+    ];
   };
 
   vega-lite = prev.vega-lite.override {
@@ -254,16 +238,11 @@ final: prev: {
     ];
     # These dependencies are required by
     # https://github.com/Automattic/node-canvas.
-    buildInputs =
-      with pkgs;
-      [
-        giflib
-        pixman
-        cairo
-        pango
-      ]
-      ++ lib.optionals stdenv.hostPlatform.isDarwin [
-        darwin.apple_sdk.frameworks.CoreText
-      ];
+    buildInputs = with pkgs; [
+      giflib
+      pixman
+      cairo
+      pango
+    ];
   };
 }
diff --git a/pkgs/development/ocaml-modules/bjack/default.nix b/pkgs/development/ocaml-modules/bjack/default.nix
index 1ee6783162b7..208671eb58ef 100644
--- a/pkgs/development/ocaml-modules/bjack/default.nix
+++ b/pkgs/development/ocaml-modules/bjack/default.nix
@@ -1,10 +1,7 @@
 {
   lib,
-  stdenv,
   buildDunePackage,
   fetchFromGitHub,
-  Accelerate,
-  CoreAudio,
   dune-configurator,
   libsamplerate,
   libjack2,
@@ -21,12 +18,7 @@ buildDunePackage rec {
     hash = "sha256-jIxxqBVWphWYyLh+24rTxk4WWfPPdGCvNdevFJEKw70=";
   };
 
-  buildInputs =
-    [ dune-configurator ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Accelerate
-      CoreAudio
-    ];
+  buildInputs = [ dune-configurator ];
   propagatedBuildInputs = [
     libsamplerate
     libjack2
diff --git a/pkgs/development/ocaml-modules/cairo2/default.nix b/pkgs/development/ocaml-modules/cairo2/default.nix
index baed712e9ac6..9c1073346ff0 100644
--- a/pkgs/development/ocaml-modules/cairo2/default.nix
+++ b/pkgs/development/ocaml-modules/cairo2/default.nix
@@ -7,7 +7,6 @@
   dune-configurator,
   pkg-config,
   cairo,
-  ApplicationServices,
 }:
 
 buildDunePackage rec {
@@ -26,7 +25,7 @@ buildDunePackage rec {
   buildInputs = [
     cairo
     dune-configurator
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ ApplicationServices ];
+  ];
 
   doCheck =
     !(
diff --git a/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-av.nix b/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-av.nix
index 70c981ad11cb..7e59b6402605 100644
--- a/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-av.nix
+++ b/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-av.nix
@@ -1,16 +1,12 @@
 {
-  lib,
   buildDunePackage,
   dune-configurator,
   pkg-config,
   callPackage,
-  AudioToolbox,
   ffmpeg-base ? callPackage ./base.nix { },
   ffmpeg-avutil,
   ffmpeg-avcodec,
   ffmpeg,
-  stdenv,
-  VideoToolbox,
 }:
 
 buildDunePackage {
@@ -21,12 +17,7 @@ buildDunePackage {
   inherit (ffmpeg-base) version src;
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs =
-    [ dune-configurator ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AudioToolbox
-      VideoToolbox
-    ];
+  buildInputs = [ dune-configurator ];
   propagatedBuildInputs = [
     ffmpeg-avutil
     ffmpeg-avcodec
diff --git a/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-avcodec.nix b/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-avcodec.nix
index 76eaea775669..88d0d8fb1dae 100644
--- a/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-avcodec.nix
+++ b/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-avcodec.nix
@@ -1,15 +1,11 @@
 {
-  lib,
   buildDunePackage,
   dune-configurator,
   pkg-config,
   callPackage,
-  AudioToolbox,
   ffmpeg-base ? callPackage ./base.nix { },
   ffmpeg-avutil,
   ffmpeg,
-  stdenv,
-  VideoToolbox,
 }:
 
 buildDunePackage {
@@ -20,12 +16,7 @@ buildDunePackage {
   inherit (ffmpeg-base) version src;
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs =
-    [ dune-configurator ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AudioToolbox
-      VideoToolbox
-    ];
+  buildInputs = [ dune-configurator ];
   propagatedBuildInputs = [
     ffmpeg-avutil
     ffmpeg.dev
diff --git a/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-avdevice.nix b/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-avdevice.nix
index 97bab8f5d38f..dca995a11932 100644
--- a/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-avdevice.nix
+++ b/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-avdevice.nix
@@ -1,21 +1,11 @@
 {
-  lib,
   buildDunePackage,
   dune-configurator,
   pkg-config,
   callPackage,
-  AppKit,
-  AudioToolbox,
-  AVFoundation,
-  Cocoa,
-  CoreImage,
-  ForceFeedback,
   ffmpeg-base ? callPackage ./base.nix { },
   ffmpeg-av,
   ffmpeg,
-  OpenGL,
-  stdenv,
-  VideoToolbox,
 }:
 
 buildDunePackage {
@@ -26,18 +16,7 @@ buildDunePackage {
   inherit (ffmpeg-base) version src;
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs =
-    [ dune-configurator ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AppKit
-      AudioToolbox
-      AVFoundation
-      Cocoa
-      CoreImage
-      ForceFeedback
-      OpenGL
-      VideoToolbox
-    ];
+  buildInputs = [ dune-configurator ];
 
   propagatedBuildInputs = [
     ffmpeg-av
diff --git a/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-avfilter.nix b/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-avfilter.nix
index 0af5d888d025..547c45286b12 100644
--- a/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-avfilter.nix
+++ b/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-avfilter.nix
@@ -1,17 +1,11 @@
 {
-  lib,
   buildDunePackage,
   dune-configurator,
   pkg-config,
   callPackage,
-  AppKit,
-  CoreImage,
   ffmpeg-base ? callPackage ./base.nix { },
   ffmpeg-avutil,
   ffmpeg,
-  OpenGL,
-  stdenv,
-  VideoToolbox,
 }:
 
 buildDunePackage {
@@ -22,14 +16,7 @@ buildDunePackage {
   inherit (ffmpeg-base) version src;
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs =
-    [ dune-configurator ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AppKit
-      CoreImage
-      OpenGL
-      VideoToolbox
-    ];
+  buildInputs = [ dune-configurator ];
   propagatedBuildInputs = [
     ffmpeg-avutil
     ffmpeg.dev
diff --git a/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-avutil.nix b/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-avutil.nix
index 213920a6a110..c3620bfcdf4e 100644
--- a/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-avutil.nix
+++ b/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-avutil.nix
@@ -1,12 +1,9 @@
 {
   lib,
-  stdenv,
   buildDunePackage,
   dune-configurator,
   pkg-config,
   callPackage,
-  AudioToolbox,
-  VideoToolbox,
   ffmpeg-base ? callPackage ./base.nix { },
   ffmpeg,
 }:
@@ -19,12 +16,7 @@ buildDunePackage {
   inherit (ffmpeg-base) version src;
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs =
-    [ dune-configurator ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AudioToolbox
-      VideoToolbox
-    ];
+  buildInputs = [ dune-configurator ];
   propagatedBuildInputs = [ ffmpeg.dev ];
 
   doCheck = true;
diff --git a/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-swresample.nix b/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-swresample.nix
index bc4eb6900976..46acde6eeedb 100644
--- a/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-swresample.nix
+++ b/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-swresample.nix
@@ -1,5 +1,4 @@
 {
-  lib,
   buildDunePackage,
   dune-configurator,
   pkg-config,
@@ -8,8 +7,6 @@
   ffmpeg-avutil,
   ffmpeg-avcodec,
   ffmpeg,
-  stdenv,
-  VideoToolbox,
 }:
 
 buildDunePackage {
@@ -20,7 +17,7 @@ buildDunePackage {
   inherit (ffmpeg-base) version src;
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ dune-configurator ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ VideoToolbox ];
+  buildInputs = [ dune-configurator ];
   propagatedBuildInputs = [
     ffmpeg-avutil
     ffmpeg-avcodec
diff --git a/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-swscale.nix b/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-swscale.nix
index a5f07a13d967..a52132475082 100644
--- a/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-swscale.nix
+++ b/pkgs/development/ocaml-modules/ffmpeg/ffmpeg-swscale.nix
@@ -1,5 +1,4 @@
 {
-  lib,
   buildDunePackage,
   dune-configurator,
   pkg-config,
@@ -7,8 +6,6 @@
   ffmpeg-base ? callPackage ./base.nix { },
   ffmpeg-avutil,
   ffmpeg,
-  stdenv,
-  VideoToolbox,
 }:
 
 buildDunePackage {
@@ -19,7 +16,7 @@ buildDunePackage {
   inherit (ffmpeg-base) version src;
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ dune-configurator ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ VideoToolbox ];
+  buildInputs = [ dune-configurator ];
   propagatedBuildInputs = [
     ffmpeg-avutil
     ffmpeg.dev
diff --git a/pkgs/development/ocaml-modules/gsl/default.nix b/pkgs/development/ocaml-modules/gsl/default.nix
index 5ab096a5a99c..387cf4bd63c4 100644
--- a/pkgs/development/ocaml-modules/gsl/default.nix
+++ b/pkgs/development/ocaml-modules/gsl/default.nix
@@ -1,11 +1,9 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   buildDunePackage,
   pkg-config,
   gsl,
-  darwin,
   dune-configurator,
 }:
 
@@ -27,9 +25,6 @@ buildDunePackage rec {
     dune-configurator
     gsl
   ];
-  propagatedBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Accelerate
-  ];
 
   meta = with lib; {
     homepage = "https://mmottl.github.io/gsl-ocaml/";
diff --git a/pkgs/development/ocaml-modules/gstreamer/default.nix b/pkgs/development/ocaml-modules/gstreamer/default.nix
index cbe55294443d..d23241088976 100644
--- a/pkgs/development/ocaml-modules/gstreamer/default.nix
+++ b/pkgs/development/ocaml-modules/gstreamer/default.nix
@@ -1,11 +1,8 @@
 {
   lib,
-  stdenv,
   buildDunePackage,
   fetchFromGitHub,
   dune-configurator,
-  AppKit,
-  Foundation,
   pkg-config,
   glib,
   gst_all_1,
@@ -23,12 +20,7 @@ buildDunePackage rec {
   };
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs =
-    [ dune-configurator ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AppKit
-      Foundation
-    ];
+  buildInputs = [ dune-configurator ];
   propagatedBuildInputs = [
     glib.dev
     gst_all_1.gstreamer.dev
diff --git a/pkgs/development/ocaml-modules/jose/default.nix b/pkgs/development/ocaml-modules/jose/default.nix
new file mode 100644
index 000000000000..6e6a59e0dbe5
--- /dev/null
+++ b/pkgs/development/ocaml-modules/jose/default.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  buildDunePackage,
+  fetchurl,
+  containers,
+  junit_alcotest,
+  astring,
+  base64,
+  x509,
+  yojson,
+  zarith,
+}:
+
+buildDunePackage rec {
+  pname = "jose";
+  version = "0.10.0";
+
+  src = fetchurl {
+    url = "https://github.com/ulrikstrid/ocaml-jose/releases/download/v${version}/${pname}-${version}.tbz";
+    hash = "sha256-F6Odq5JXTkAxdqV3HQusoF+9rvt4BZytslKnsIjJLI8=";
+  };
+
+  propagatedBuildInputs = [
+    astring
+    base64
+    x509
+    yojson
+    zarith
+  ];
+
+  doCheck = true;
+  checkInputs = [
+    containers
+    junit_alcotest
+  ];
+
+  meta = {
+    description = "JOSE specification implementation in OCaml";
+    homepage = "https://github.com/ulrikstrid/ocaml-jose";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      ulrikstrid
+      toastal
+      marijanp
+    ];
+  };
+}
diff --git a/pkgs/development/ocaml-modules/labltk/default.nix b/pkgs/development/ocaml-modules/labltk/default.nix
index 7593ce4858ea..2a15aecfe0c9 100644
--- a/pkgs/development/ocaml-modules/labltk/default.nix
+++ b/pkgs/development/ocaml-modules/labltk/default.nix
@@ -4,7 +4,6 @@
   lib,
   makeWrapper,
   fetchzip,
-  Cocoa,
   ocaml,
   findlib,
   tcl,
@@ -102,7 +101,7 @@ param.stdenv.mkDerivation {
   buildInputs = [
     tcl
     tk
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Cocoa ];
+  ];
 
   configureFlags = [
     "--use-findlib"
diff --git a/pkgs/development/ocaml-modules/lacaml/default.nix b/pkgs/development/ocaml-modules/lacaml/default.nix
index db9853a60f03..d82525956943 100644
--- a/pkgs/development/ocaml-modules/lacaml/default.nix
+++ b/pkgs/development/ocaml-modules/lacaml/default.nix
@@ -1,8 +1,6 @@
 {
   lib,
-  stdenv,
   fetchurl,
-  darwin,
   buildDunePackage,
   dune-configurator,
   lapack,
@@ -28,7 +26,7 @@ buildDunePackage rec {
   propagatedBuildInputs = [
     lapack
     blas
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.Accelerate ];
+  ];
 
   meta = with lib; {
     homepage = "https://mmottl.github.io/lacaml";
diff --git a/pkgs/development/ocaml-modules/ocaml-libvirt/default.nix b/pkgs/development/ocaml-modules/ocaml-libvirt/default.nix
index 20737655bd21..43fead8c172e 100644
--- a/pkgs/development/ocaml-modules/ocaml-libvirt/default.nix
+++ b/pkgs/development/ocaml-modules/ocaml-libvirt/default.nix
@@ -3,8 +3,6 @@
   stdenv,
   fetchFromGitLab,
   libvirt,
-  AppKit,
-  Foundation,
   autoreconfHook,
   pkg-config,
   ocaml,
@@ -37,11 +35,6 @@ lib.throwIfNot (lib.versionAtLeast ocaml.version "4.02")
       ocaml
     ];
 
-    buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-      Foundation
-      AppKit
-    ];
-
     strictDeps = true;
 
     buildFlags = [
diff --git a/pkgs/development/ocaml-modules/oidc/default.nix b/pkgs/development/ocaml-modules/oidc/default.nix
new file mode 100644
index 000000000000..90984824ff40
--- /dev/null
+++ b/pkgs/development/ocaml-modules/oidc/default.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  buildDunePackage,
+  fetchurl,
+  jose,
+  uri,
+  junit_alcotest,
+}:
+
+buildDunePackage rec {
+  pname = "oidc";
+  version = "0.2.0";
+
+  src = fetchurl {
+    url = "https://github.com/ulrikstrid/ocaml-oidc/releases/download/v${version}/${pname}-v${version}.tbz";
+    hash = "sha256-NE/OW5BesVWhYfTmh3jP+A0TGML7m/Nw+tnafjMCIFo=";
+  };
+
+  propagatedBuildInputs = [
+    jose
+    uri
+  ];
+
+  doCheck = true;
+  checkInputs = [
+    junit_alcotest
+  ];
+
+  meta = {
+    description = "OpenID Connect implementation in OCaml.";
+    homepage = "https://github.com/ulrikstrid/ocaml-oidc";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [
+      ulrikstrid
+      toastal
+      marijanp
+    ];
+  };
+}
diff --git a/pkgs/development/ocaml-modules/tsdl/default.nix b/pkgs/development/ocaml-modules/tsdl/default.nix
index e57ebcb84479..092d3973db90 100644
--- a/pkgs/development/ocaml-modules/tsdl/default.nix
+++ b/pkgs/development/ocaml-modules/tsdl/default.nix
@@ -11,11 +11,6 @@
   result,
   SDL2,
   pkg-config,
-  AudioToolbox,
-  Cocoa,
-  CoreAudio,
-  CoreVideo,
-  ForceFeedback,
 }:
 
 if lib.versionOlder ocaml.version "4.03" then
@@ -47,19 +42,11 @@ else
       topkg
     ];
     buildInputs = [ topkg ];
-    propagatedBuildInputs =
-      [
-        SDL2
-        ctypes
-        ctypes-foreign
-      ]
-      ++ lib.optionals stdenv.hostPlatform.isDarwin [
-        AudioToolbox
-        Cocoa
-        CoreAudio
-        CoreVideo
-        ForceFeedback
-      ];
+    propagatedBuildInputs = [
+      SDL2
+      ctypes
+      ctypes-foreign
+    ];
 
     preConfigure = ''
       # The following is done to avoid an additional dependency (ncurses)
diff --git a/pkgs/development/ocaml-modules/tsort/default.nix b/pkgs/development/ocaml-modules/tsort/default.nix
index e026ecb27ffc..d23c4473e480 100644
--- a/pkgs/development/ocaml-modules/tsort/default.nix
+++ b/pkgs/development/ocaml-modules/tsort/default.nix
@@ -7,12 +7,12 @@
 
 buildDunePackage rec {
   pname = "tsort";
-  version = "2.1.0";
+  version = "2.2.0";
   src = fetchFromGitHub {
     owner = "dmbaturin";
     repo = "ocaml-tsort";
     rev = version;
-    sha256 = "sha256-SCd0R8iGwMeRhhSxMid9lzqj5fm+owCJ2dzwtLpFqB4=";
+    sha256 = "sha256-/gxjXDRhQdbt0ZBdCNk/j1oWhAbm2UOfye2D9QvPr3o=";
   };
 
   propagatedBuildInputs = [ containers ];
diff --git a/pkgs/development/php-packages/datadog_trace/default.nix b/pkgs/development/php-packages/datadog_trace/default.nix
index 5d9f1ac96ed5..81e75eabee1d 100644
--- a/pkgs/development/php-packages/datadog_trace/default.nix
+++ b/pkgs/development/php-packages/datadog_trace/default.nix
@@ -9,7 +9,6 @@
   curl,
   pcre2,
   libiconv,
-  darwin,
   php,
 }:
 
@@ -32,19 +31,12 @@ buildPecl rec {
 
   env.NIX_CFLAGS_COMPILE = "-O2";
 
-  nativeBuildInputs =
-    [
-      cargo
-      rustc
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [
-      rustPlatform.bindgenHook
-      rustPlatform.cargoSetupHook
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk_11_0.rustPlatform.bindgenHook
-      darwin.apple_sdk_11_0.rustPlatform.cargoSetupHook
-    ];
+  nativeBuildInputs = [
+    cargo
+    rustc
+    rustPlatform.bindgenHook
+    rustPlatform.cargoSetupHook
+  ];
 
   buildInputs =
     [
@@ -52,8 +44,6 @@ buildPecl rec {
       pcre2
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.CoreFoundation
-      darwin.apple_sdk.frameworks.Security
       libiconv
     ];
 
diff --git a/pkgs/development/php-packages/mongodb/default.nix b/pkgs/development/php-packages/mongodb/default.nix
index 819a88d2fa5a..93fa1969b4c0 100644
--- a/pkgs/development/php-packages/mongodb/default.nix
+++ b/pkgs/development/php-packages/mongodb/default.nix
@@ -11,7 +11,6 @@
   openssl,
   snappy,
   zlib,
-  darwin,
 }:
 
 buildPecl rec {
@@ -37,8 +36,6 @@ buildPecl rec {
       pcre2
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk_11_0.frameworks.Security
-      darwin.apple_sdk_11_0.Libsystem
       libiconv
     ];
 
diff --git a/pkgs/development/php-packages/phpstan/default.nix b/pkgs/development/php-packages/phpstan/default.nix
index 540abfc07124..070b60c37ff8 100644
--- a/pkgs/development/php-packages/phpstan/default.nix
+++ b/pkgs/development/php-packages/phpstan/default.nix
@@ -7,16 +7,16 @@
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "phpstan";
-  version = "2.1.13";
+  version = "2.1.14";
 
   src = fetchFromGitHub {
     owner = "phpstan";
     repo = "phpstan-src";
     tag = finalAttrs.version;
-    hash = "sha256-/danRcl5yTJNtJFhuIRMvNuii7SZc/e9B+gM6MB6Avc=";
+    hash = "sha256-Bo+jjTJ0EoU09z/lWl1ZyD639lz/C8v7OwPspSFNNp8=";
   };
 
-  vendorHash = "sha256-IYcpPaXrML+YM3kcU527RMQjluczsISSyHGzsQFZuuc=";
+  vendorHash = "sha256-exm2AofvmRqRF+TZ3hI5lsacMn+AvceNMWQvRrMTjsU=";
   composerStrictValidation = false;
 
   doInstallCheck = true;
diff --git a/pkgs/development/php-packages/snuffleupagus/default.nix b/pkgs/development/php-packages/snuffleupagus/default.nix
index cd994c4a223a..3b088a5ab5c0 100644
--- a/pkgs/development/php-packages/snuffleupagus/default.nix
+++ b/pkgs/development/php-packages/snuffleupagus/default.nix
@@ -6,7 +6,6 @@
   php,
   fetchFromGitHub,
   pcre2,
-  darwin,
 }:
 
 buildPecl rec {
@@ -23,8 +22,6 @@ buildPecl rec {
   buildInputs =
     [ pcre2 ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk_11_0.frameworks.CoreFoundation
-      darwin.apple_sdk_11_0.Libsystem
       libiconv
     ];
 
diff --git a/pkgs/development/python-modules/adblock/default.nix b/pkgs/development/python-modules/adblock/default.nix
index 011c47f6c286..66e6f1377943 100644
--- a/pkgs/development/python-modules/adblock/default.nix
+++ b/pkgs/development/python-modules/adblock/default.nix
@@ -10,8 +10,6 @@
   publicsuffix-list,
   pythonOlder,
   libiconv,
-  CoreFoundation,
-  Security,
   pytestCheckHook,
   toml,
 }:
@@ -62,8 +60,6 @@ buildPythonPackage rec {
     [ openssl ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       libiconv
-      CoreFoundation
-      Security
     ];
 
   PSL_PATH = "${publicsuffix-list}/share/publicsuffix/public_suffix_list.dat";
diff --git a/pkgs/development/python-modules/apache-beam/default.nix b/pkgs/development/python-modules/apache-beam/default.nix
index b38ad2e8ee05..3bcf99a4abf5 100644
--- a/pkgs/development/python-modules/apache-beam/default.nix
+++ b/pkgs/development/python-modules/apache-beam/default.nix
@@ -84,6 +84,8 @@ buildPythonPackage rec {
     # See https://github.com/NixOS/nixpkgs/issues/156957
     "dill"
 
+    "protobuf"
+
     # As of apache-beam v2.45.0, the requirement is pyarrow<10.0.0,>=0.15.1, but
     # the current (2023-02-22) nixpkgs's pyarrow version is 11.0.0.
     "pyarrow"
diff --git a/pkgs/development/python-modules/asyncpg/default.nix b/pkgs/development/python-modules/asyncpg/default.nix
index afd0c609cb3f..9800efe325b9 100644
--- a/pkgs/development/python-modules/asyncpg/default.nix
+++ b/pkgs/development/python-modules/asyncpg/default.nix
@@ -39,6 +39,7 @@ buildPythonPackage rec {
     libpq.pg_config
     uvloop
     postgresql
+    postgresql.pg_config
     pytest-xdist
     pytestCheckHook
     distro
diff --git a/pkgs/development/python-modules/audiotools/default.nix b/pkgs/development/python-modules/audiotools/default.nix
index ea89adb37e19..dcde1697e26b 100644
--- a/pkgs/development/python-modules/audiotools/default.nix
+++ b/pkgs/development/python-modules/audiotools/default.nix
@@ -3,10 +3,6 @@
   buildPythonPackage,
   fetchFromGitHub,
   setuptools,
-  stdenv,
-  AudioToolbox,
-  AudioUnit,
-  CoreServices,
   pkg-config,
   libmpg123,
   lame,
@@ -31,22 +27,16 @@ buildPythonPackage {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      libmpg123 # MP2/MP3 decoding
-      lame # MP3 encoding
-      twolame # MP2 encoding
-      opusfile # opus decoding
-      libopus # opus encoding
-      libvorbis # ogg encoding/decoding
-      libcdio # CD reading
-      libcdio-paranoia # CD reading
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AudioToolbox
-      AudioUnit
-      CoreServices
-    ];
+  buildInputs = [
+    libmpg123 # MP2/MP3 decoding
+    lame # MP3 encoding
+    twolame # MP2 encoding
+    opusfile # opus decoding
+    libopus # opus encoding
+    libvorbis # ogg encoding/decoding
+    libcdio # CD reading
+    libcdio-paranoia # CD reading
+  ];
 
   preConfigure = ''
     # need to change probe to yes because mp3lame is not reported in pkg-config
diff --git a/pkgs/development/python-modules/blockbuster/default.nix b/pkgs/development/python-modules/blockbuster/default.nix
index 2fee3087da58..0560a02915a6 100644
--- a/pkgs/development/python-modules/blockbuster/default.nix
+++ b/pkgs/development/python-modules/blockbuster/default.nix
@@ -36,6 +36,8 @@ buildPythonPackage rec {
     "test_ssl_socket"
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   pythonImportsCheck = [ "blockbuster" ];
 
   meta = {
diff --git a/pkgs/development/python-modules/chromadb/default.nix b/pkgs/development/python-modules/chromadb/default.nix
index 7de70db2f22c..9e298088ab37 100644
--- a/pkgs/development/python-modules/chromadb/default.nix
+++ b/pkgs/development/python-modules/chromadb/default.nix
@@ -6,7 +6,6 @@
   buildPythonPackage,
   cargo,
   chroma-hnswlib,
-  darwin,
   fastapi,
   fetchFromGitHub,
   grpcio,
@@ -91,7 +90,7 @@ buildPythonPackage rec {
   buildInputs = [
     openssl
     zstd
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.Security ];
+  ];
 
   dependencies = [
     bcrypt
diff --git a/pkgs/development/python-modules/cltk/default.nix b/pkgs/development/python-modules/cltk/default.nix
index 7635ace28648..c1eda9c2af6a 100644
--- a/pkgs/development/python-modules/cltk/default.nix
+++ b/pkgs/development/python-modules/cltk/default.nix
@@ -19,24 +19,23 @@
   scipy,
   spacy,
   stanza,
-  stringcase,
   torch,
   tqdm,
 
   # tests
   pytestCheckHook,
+  writableTmpDirAsHomeHook,
 }:
 buildPythonPackage rec {
   pname = "cltk";
-  version = "1.3.0";
-
+  version = "1.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cltk";
     repo = "cltk";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-/rdv96lnSGN+aJJmPSIan79zoXxnStokFEAjBtCLKy4=";
+    tag = "v${version}";
+    hash = "sha256-aeWbfDVNn6DwW+KFh62n5RBgWp5uSWDv2RHmB27/xI4=";
   };
 
   postPatch = ''
@@ -66,19 +65,15 @@ buildPythonPackage rec {
     scipy
     spacy
     stanza
-    stringcase
     torch
     tqdm
   ];
 
   nativeCheckInputs = [
     pytestCheckHook
+    writableTmpDirAsHomeHook
   ];
 
-  preCheck = ''
-    export HOME=$(mktemp -d)
-  '';
-
   # Most of tests fail as they require local files to be present and also internet access
   doCheck = false;
 
diff --git a/pkgs/development/python-modules/cmsis-pack-manager/default.nix b/pkgs/development/python-modules/cmsis-pack-manager/default.nix
index 29e2664034f6..69eb6c9bc925 100644
--- a/pkgs/development/python-modules/cmsis-pack-manager/default.nix
+++ b/pkgs/development/python-modules/cmsis-pack-manager/default.nix
@@ -4,8 +4,6 @@
   rustPlatform,
   cffi,
   libiconv,
-  stdenv,
-  darwin,
   buildPythonPackage,
   appdirs,
   pyyaml,
@@ -39,7 +37,7 @@ buildPythonPackage rec {
   propagatedNativeBuildInputs = [ cffi ];
   buildInputs = [
     libiconv
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.frameworks.Security;
+  ];
   propagatedBuildInputs = [
     appdirs
     pyyaml
diff --git a/pkgs/development/python-modules/cryptography/default.nix b/pkgs/development/python-modules/cryptography/default.nix
index 24041f83ea99..c358750961a4 100644
--- a/pkgs/development/python-modules/cryptography/default.nix
+++ b/pkgs/development/python-modules/cryptography/default.nix
@@ -19,7 +19,6 @@
   pytestCheckHook,
   pythonOlder,
   rustPlatform,
-  Security,
 }:
 
 buildPythonPackage rec {
@@ -57,7 +56,6 @@ buildPythonPackage rec {
   buildInputs =
     [ openssl ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Security
       libiconv
     ]
     ++ lib.optionals (pythonOlder "3.9") [ libxcrypt ];
diff --git a/pkgs/development/python-modules/css-inline/default.nix b/pkgs/development/python-modules/css-inline/default.nix
index ad5a3150b064..dffc8a82ca19 100644
--- a/pkgs/development/python-modules/css-inline/default.nix
+++ b/pkgs/development/python-modules/css-inline/default.nix
@@ -9,8 +9,6 @@
 
   # native darwin dependencies
   libiconv,
-  Security,
-  SystemConfiguration,
 
   # tests
   pytestCheckHook,
@@ -53,8 +51,6 @@ buildPythonPackage rec {
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     libiconv
-    Security
-    SystemConfiguration
   ];
 
   pythonImportsCheck = [ "css_inline" ];
diff --git a/pkgs/development/python-modules/datafusion/default.nix b/pkgs/development/python-modules/datafusion/default.nix
index 3584e4be235f..07961a2e2075 100644
--- a/pkgs/development/python-modules/datafusion/default.nix
+++ b/pkgs/development/python-modules/datafusion/default.nix
@@ -10,8 +10,6 @@
   protobuf,
   protoc,
   pyarrow,
-  Security,
-  SystemConfiguration,
   typing-extensions,
   pythonOlder,
 }:
@@ -63,8 +61,6 @@ buildPythonPackage rec {
     [ protobuf ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       libiconv
-      Security
-      SystemConfiguration
     ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/datalad-gooey/default.nix b/pkgs/development/python-modules/datalad-gooey/default.nix
index fcc3fa376330..15942af641e5 100644
--- a/pkgs/development/python-modules/datalad-gooey/default.nix
+++ b/pkgs/development/python-modules/datalad-gooey/default.nix
@@ -3,9 +3,7 @@
   lib,
   git,
   fetchFromGitHub,
-  darwin,
   setuptools,
-  stdenv,
   git-annex,
   pyside6,
   pyqtdarktheme,
@@ -37,7 +35,7 @@ buildPythonPackage {
     datalad-next
     outdated
     datalad
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.AppleScriptKit ];
+  ];
 
   pythonRemoveDeps = [ "applescript" ];
 
diff --git a/pkgs/development/python-modules/deltalake/default.nix b/pkgs/development/python-modules/deltalake/default.nix
index c072a5c82098..93b592d465d4 100644
--- a/pkgs/development/python-modules/deltalake/default.nix
+++ b/pkgs/development/python-modules/deltalake/default.nix
@@ -7,7 +7,6 @@
   pyarrow-hotfix,
   openssl,
   stdenv,
-  darwin,
   libiconv,
   pkg-config,
   pytestCheckHook,
@@ -45,8 +44,6 @@ buildPythonPackage rec {
       openssl
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
       libiconv
     ];
 
diff --git a/pkgs/development/python-modules/dissect-cstruct/default.nix b/pkgs/development/python-modules/dissect-cstruct/default.nix
index da34c5f7a879..c438acfab79d 100644
--- a/pkgs/development/python-modules/dissect-cstruct/default.nix
+++ b/pkgs/development/python-modules/dissect-cstruct/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch,
   setuptools,
   setuptools-scm,
   pytestCheckHook,
@@ -22,6 +23,14 @@ buildPythonPackage rec {
     hash = "sha256-Y6maLjugnso3cc9zyiZ/6AdrftYAAImYNBDXPJdTuWc=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "fix-test_types_enum.patch";
+      url = "https://github.com/fox-it/dissect.cstruct/commit/b6c73136828fc2ae59b51d1f68529002d7c37131.diff";
+      hash = "sha256-hicMolFu/qAw9QkOyug4PNm2Do2PxuXNXPB+/JHOaFg=";
+    })
+  ];
+
   build-system = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/django/4.nix b/pkgs/development/python-modules/django/4.nix
index f1e54fc8dd9a..7489f40c4ea9 100644
--- a/pkgs/development/python-modules/django/4.nix
+++ b/pkgs/development/python-modules/django/4.nix
@@ -72,6 +72,14 @@ buildPythonPackage rec {
         url = "https://github.com/django/django/commit/12f4f95405c7857cbf2f4bf4d0261154aac31676.patch";
         hash = "sha256-+K20/V8sh036Ox9U7CSPgfxue7f28Sdhr3MsB7erVOk=";
       })
+
+      # backport fix for https://code.djangoproject.com/ticket/36056
+      # FIXME: remove if ever backported upstream
+      (fetchpatch {
+        url = "https://github.com/django/django/commit/ec0e784f91b551c654f0962431cc31091926792d.patch";
+        includes = [ "django/*" ]; # tests don't apply
+        hash = "sha256-8YwdOBNJq6+GNoxzdLyN9HEEIWRXGQk9YbyfPwYVkwU=";
+      })
     ]
     ++ lib.optionals withGdal [
       (replaceVars ./django_4_set_geos_gdal_lib.patch {
diff --git a/pkgs/development/python-modules/dnspython/default.nix b/pkgs/development/python-modules/dnspython/default.nix
index f817d78437d4..469838fe4f2b 100644
--- a/pkgs/development/python-modules/dnspython/default.nix
+++ b/pkgs/development/python-modules/dnspython/default.nix
@@ -2,9 +2,7 @@
   lib,
   aioquic,
   buildPythonPackage,
-  cacert,
   cryptography,
-  curio,
   fetchPypi,
   h2,
   httpcore,
@@ -12,49 +10,35 @@
   idna,
   hatchling,
   pytestCheckHook,
-  pythonOlder,
-  requests,
-  requests-toolbelt,
-  sniffio,
   trio,
 }:
 
 buildPythonPackage rec {
   pname = "dnspython";
   version = "2.7.0";
-  format = "pyproject";
-
-  disabled = pythonOlder "3.9";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-zpxDLtoNyRz2GKXO3xpOFCZRGWu80sgOie1akH5c+vE=";
   };
 
-  nativeBuildInputs = [ hatchling ];
+  build-system = [ hatchling ];
 
   optional-dependencies = {
-    DOH = [
+    doh = [
       httpx
       h2
-      requests
-      requests-toolbelt
       httpcore
     ];
-    IDNA = [ idna ];
-    DNSSEC = [ cryptography ];
+    idna = [ idna ];
+    dnssec = [ cryptography ];
     trio = [ trio ];
-    curio = [
-      curio
-      sniffio
-    ];
-    DOQ = [ aioquic ];
+    doq = [ aioquic ];
   };
 
   nativeCheckInputs = [ pytestCheckHook ];
 
-  checkInputs = [ cacert ] ++ optional-dependencies.DNSSEC;
-
   disabledTests = [
     # dns.exception.SyntaxError: protocol not found
     "test_misc_good_WKS_text"
@@ -68,11 +52,11 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "dns" ];
 
-  meta = with lib; {
+  meta = {
     description = "DNS toolkit for Python";
     homepage = "https://www.dnspython.org";
     changelog = "https://github.com/rthalley/dnspython/blob/v${version}/doc/whatsnew.rst";
-    license = with licenses; [ isc ];
-    maintainers = with maintainers; [ gador ];
+    license = lib.licenses.isc;
+    maintainers = with lib.maintainers; [ gador ];
   };
 }
diff --git a/pkgs/development/python-modules/etebase/default.nix b/pkgs/development/python-modules/etebase/default.nix
index 10e71d28cb2f..420f6186b36e 100644
--- a/pkgs/development/python-modules/etebase/default.nix
+++ b/pkgs/development/python-modules/etebase/default.nix
@@ -10,7 +10,6 @@
   rustfmt,
   setuptools-rust,
   openssl,
-  Security,
   msgpack,
   fetchpatch,
   nixosTests,
@@ -59,7 +58,7 @@ buildPythonPackage rec {
     rustc
   ];
 
-  buildInputs = [ openssl ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
+  buildInputs = [ openssl ];
 
   propagatedBuildInputs = [ msgpack ];
 
diff --git a/pkgs/development/python-modules/google-api-core/default.nix b/pkgs/development/python-modules/google-api-core/default.nix
index 5254ba230cda..76b7f78528eb 100644
--- a/pkgs/development/python-modules/google-api-core/default.nix
+++ b/pkgs/development/python-modules/google-api-core/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "google-api-core";
-  version = "2.24.0";
+  version = "2.24.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "googleapis";
     repo = "python-api-core";
     tag = "v${version}";
-    hash = "sha256-6U5rNhF4AYWae50pNIqDdlMzRhW4iV9vPlMPXN11DqQ=";
+    hash = "sha256-7/9oU8KqwvL7DIDKDIUlGxfJZp7kGp1W6/tsEp6zcuc=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-firestore/default.nix b/pkgs/development/python-modules/google-cloud-firestore/default.nix
index cc8c54f109dd..7f11a1982b96 100644
--- a/pkgs/development/python-modules/google-cloud-firestore/default.nix
+++ b/pkgs/development/python-modules/google-cloud-firestore/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-firestore";
-  version = "2.20.1";
+  version = "2.20.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "google_cloud_firestore";
     inherit version;
-    hash = "sha256-WXDh5rn9HCZh+pHUu2FgEQaZokVuxNCMMxmaykqrKKA=";
+    hash = "sha256-CtLjP6faC6j7fMwyT5HT9Xhmt3DiSEC9YvaicvdHxfk=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/grpc-google-iam-v1/default.nix b/pkgs/development/python-modules/grpc-google-iam-v1/default.nix
index d8a5d20b97dd..15e398c0a778 100644
--- a/pkgs/development/python-modules/grpc-google-iam-v1/default.nix
+++ b/pkgs/development/python-modules/grpc-google-iam-v1/default.nix
@@ -10,16 +10,18 @@
 
 buildPythonPackage rec {
   pname = "grpc-google-iam-v1";
-  version = "0.14.0";
+  version = "0.14.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "googleapis";
-    repo = "python-grpc-google-iam-v1";
-    tag = "v${version}";
-    hash = "sha256-CkzXh7psXQvAbAduRR6+Bihv6RlaOAWdFDX7xaqWO8M=";
+    repo = "google-cloud-python";
+    tag = "grpc-google-iam-v1-v${version}";
+    hash = "sha256-5PzidE1CWN+pt7+gcAtbuXyL/pq6cnn0MCRkBfmeUSw=";
   };
 
+  sourceRoot = "${src.name}/packages/grpc-google-iam-v1";
+
   nativeBuildInputs = [ setuptools ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/gssapi/default.nix b/pkgs/development/python-modules/gssapi/default.nix
index 1e5cf2bfe1b5..1684577b011d 100644
--- a/pkgs/development/python-modules/gssapi/default.nix
+++ b/pkgs/development/python-modules/gssapi/default.nix
@@ -13,7 +13,6 @@
   decorator,
 
   # native dependencies
-  GSS,
   krb5-c, # C krb5 library, not PyPI krb5
 
   # tests
@@ -53,8 +52,6 @@ buildPythonPackage rec {
 
   dependencies = [ decorator ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ GSS ];
-
   # k5test is marked as broken on darwin
   doCheck = !stdenv.hostPlatform.isDarwin;
 
diff --git a/pkgs/development/python-modules/hf-transfer/default.nix b/pkgs/development/python-modules/hf-transfer/default.nix
index f7b0bcf8d5d9..1683c9958e35 100644
--- a/pkgs/development/python-modules/hf-transfer/default.nix
+++ b/pkgs/development/python-modules/hf-transfer/default.nix
@@ -12,7 +12,6 @@
   # buildInputs
   openssl,
   stdenv,
-  darwin,
   libiconv,
 }:
 
@@ -47,8 +46,6 @@ buildPythonPackage rec {
       openssl
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.SystemConfiguration
       libiconv
     ];
 
diff --git a/pkgs/development/python-modules/hidapi/default.nix b/pkgs/development/python-modules/hidapi/default.nix
index 059ca697011c..e38280b67f6d 100644
--- a/pkgs/development/python-modules/hidapi/default.nix
+++ b/pkgs/development/python-modules/hidapi/default.nix
@@ -10,7 +10,6 @@
   hidapi,
   libusb1,
   udev,
-  darwin,
 }:
 
 buildPythonPackage rec {
@@ -39,16 +38,7 @@ buildPythonPackage rec {
     HIDAPI_SYSTEM_HIDAPI = true;
   };
 
-  propagatedBuildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [ udev ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        AppKit
-        CoreFoundation
-        IOKit
-      ]
-    );
+  propagatedBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ udev ];
 
   pythonImportsCheck = [ "hid" ];
 
diff --git a/pkgs/development/python-modules/hypothesis/default.nix b/pkgs/development/python-modules/hypothesis/default.nix
index ec1789335fab..1bf8fa98be5e 100644
--- a/pkgs/development/python-modules/hypothesis/default.nix
+++ b/pkgs/development/python-modules/hypothesis/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "hypothesis";
-  version = "6.130.5";
+  version = "6.130.12";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     owner = "HypothesisWorks";
     repo = "hypothesis";
     rev = "hypothesis-python-${version}";
-    hash = "sha256-PJx8Mf+OUmZ6GgLBKesKdFs09avxtGtU96ejAVznFNQ=";
+    hash = "sha256-6p7OCjeZKZJ+3MDfdi+9XffET95pXGC6nzhTiMiEVQA=";
   };
 
   # I tried to package sphinx-selective-exclude, but it throws
@@ -80,6 +80,8 @@ buildPythonPackage rec {
       "test_uses_cached_charmap"
       # fails if builder is too slow
       "test_can_run_with_no_db"
+      # calls script with the naked interpreter
+      "test_constants_from_running_file"
     ]
     ++ lib.optionals (pythonOlder "3.10") [
       # not sure why these tests fail with only 3.9
@@ -88,7 +90,9 @@ buildPythonPackage rec {
       "test_assume_has_status_reason"
       "test_observability_captures_stateful_reprs"
     ]
-    ++ lib.optionals (pythonAtLeast "3.13") [
+    ++ lib.optionals (pythonAtLeast "3.12") [
+      # AssertionError: assert [b'def      \...   f(): pass'] == [b'def\\', b'    f(): pass']
+      # https://github.com/HypothesisWorks/hypothesis/issues/4355
       "test_clean_source"
     ];
 
diff --git a/pkgs/development/python-modules/inline-snapshot/default.nix b/pkgs/development/python-modules/inline-snapshot/default.nix
index 82f9f6ef8990..ed97e48bc1db 100644
--- a/pkgs/development/python-modules/inline-snapshot/default.nix
+++ b/pkgs/development/python-modules/inline-snapshot/default.nix
@@ -76,6 +76,11 @@ buildPythonPackage rec {
     "tests/test_typing.py"
   ];
 
+  disabledTests = [
+    # Tests for precise formatting
+    "test_empty_sub_snapshot"
+  ];
+
   meta = with lib; {
     description = "Create and update inline snapshots in Python tests";
     homepage = "https://github.com/15r10nk/inline-snapshot/";
diff --git a/pkgs/development/python-modules/jaxlib/default.nix b/pkgs/development/python-modules/jaxlib/default.nix
index 137d9b39e510..c2c06e7385bc 100644
--- a/pkgs/development/python-modules/jaxlib/default.nix
+++ b/pkgs/development/python-modules/jaxlib/default.nix
@@ -15,7 +15,6 @@
   cython,
   fetchFromGitHub,
   git,
-  darwin,
   jsoncpp,
   nsync,
   openssl,
@@ -409,10 +408,8 @@ let
       );
 
       # Note: we cannot do most of this patching at `patch` phase as the deps
-      # are not available yet. Framework search paths aren't added by bintools
-      # hook. See https://github.com/NixOS/nixpkgs/pull/41914.
+      # are not available yet.
       preBuild = lib.optionalString effectiveStdenv.hostPlatform.isDarwin ''
-        export NIX_LDFLAGS+=" -F${darwin.apple_sdk.frameworks.IOKit}/Library/Frameworks"
         substituteInPlace ../output/external/rules_cc/cc/private/toolchain/osx_cc_wrapper.sh.tpl \
           --replace "/usr/bin/install_name_tool" "${cctools}/bin/install_name_tool"
         substituteInPlace ../output/external/rules_cc/cc/private/toolchain/unix_cc_configure.bzl \
diff --git a/pkgs/development/python-modules/johnnycanencrypt/default.nix b/pkgs/development/python-modules/johnnycanencrypt/default.nix
index 0d9523fce9af..796d074481be 100644
--- a/pkgs/development/python-modules/johnnycanencrypt/default.nix
+++ b/pkgs/development/python-modules/johnnycanencrypt/default.nix
@@ -6,7 +6,6 @@
   httpx,
   libiconv,
   nettle,
-  PCSC,
   pcsclite,
   pkg-config,
   pytestCheckHook,
@@ -53,7 +52,6 @@ buildPythonPackage rec {
     [ nettle ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [ pcsclite ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      PCSC
       libiconv
     ];
 
diff --git a/pkgs/development/python-modules/lcov-cobertura/default.nix b/pkgs/development/python-modules/lcov-cobertura/default.nix
index 739e4e1ae74e..07c5f4aa4325 100644
--- a/pkgs/development/python-modules/lcov-cobertura/default.nix
+++ b/pkgs/development/python-modules/lcov-cobertura/default.nix
@@ -4,6 +4,7 @@
   fetchPypi,
   pythonOlder,
   setuptools,
+  setuptools-scm,
   distutils,
 }:
 
@@ -19,7 +20,16 @@ buildPythonPackage rec {
     hash = "sha256-76jiZPK93rt/UCTkrOErYz2dWQSLxkdCfR4blojItY8=";
   };
 
-  build-system = [ setuptools ];
+  # https://github.com/eriwen/lcov-to-cobertura-xml/issues/63
+  postPatch = ''
+    substituteInPlace setup.cfg \
+      --replace-fail 'License :: OSI Approved :: Apache Software License' ""
+  '';
+
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
   dependencies = [ distutils ];
 
   pythonImportsCheck = [ "lcov_cobertura" ];
diff --git a/pkgs/development/python-modules/ledgerwallet/default.nix b/pkgs/development/python-modules/ledgerwallet/default.nix
index 0cbc048ee670..a6e87f00f8c7 100644
--- a/pkgs/development/python-modules/ledgerwallet/default.nix
+++ b/pkgs/development/python-modules/ledgerwallet/default.nix
@@ -1,6 +1,5 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   buildPythonPackage,
   cryptography,
@@ -16,7 +15,6 @@
   setuptools-scm,
   tabulate,
   toml,
-  AppKit,
 }:
 
 buildPythonPackage rec {
@@ -34,7 +32,7 @@ buildPythonPackage rec {
   buildInputs = [
     setuptools
     setuptools-scm
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ AppKit ];
+  ];
   propagatedBuildInputs = [
     cryptography
     click
diff --git a/pkgs/development/python-modules/libuuu/default.nix b/pkgs/development/python-modules/libuuu/default.nix
index 05396c577018..8090627199f1 100644
--- a/pkgs/development/python-modules/libuuu/default.nix
+++ b/pkgs/development/python-modules/libuuu/default.nix
@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "libuuu";
-  version = "1.5.182.post1";
+  version = "1.5.202";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Hf0GwhrzKQL5w+OXQ39yuG4xmbk/1HgCCdCulIORSU8=";
+    hash = "sha256-bwAFApnfu0p1qHZWcSrJmXPZTkpw9HFhbG7BnASbeBI=";
   };
 
   build-system = [
@@ -33,6 +33,10 @@ buildPythonPackage rec {
     udev
   ];
 
+  pythonRelaxDeps = [
+    "setuptools-scm"
+  ];
+
   dependencies = [
     setuptools-scm
   ];
diff --git a/pkgs/development/python-modules/linien-client/default.nix b/pkgs/development/python-modules/linien-client/default.nix
index ad1882af8182..0772433ffa82 100644
--- a/pkgs/development/python-modules/linien-client/default.nix
+++ b/pkgs/development/python-modules/linien-client/default.nix
@@ -21,9 +21,9 @@ buildPythonPackage rec {
     export HOME=$(mktemp -d)
   '';
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     fabric
     typing-extensions
     numpy
@@ -33,14 +33,16 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "linien_client" ];
 
-  meta = with lib; {
+  meta = {
     description = "Client components of the Linien spectroscopy lock application";
     homepage = "https://github.com/linien-org/linien/tree/develop/linien-client";
     changelog = "https://github.com/linien-org/linien/blob/v${version}/CHANGELOG.md";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [
       fsagbuya
       doronbehar
     ];
+    # See comment near linien-common.meta.broken
+    broken = lib.versionAtLeast numpy.version "2";
   };
 }
diff --git a/pkgs/development/python-modules/linien-common/default.nix b/pkgs/development/python-modules/linien-common/default.nix
index 8220badafc79..b599340e0a5a 100644
--- a/pkgs/development/python-modules/linien-common/default.nix
+++ b/pkgs/development/python-modules/linien-common/default.nix
@@ -50,14 +50,44 @@ buildPythonPackage rec {
     pytest = callPackage ./tests.nix { };
   };
 
-  meta = with lib; {
+  meta = {
     description = "Shared components of the Linien spectroscopy lock application";
     homepage = "https://github.com/linien-org/linien/tree/develop/linien-common";
     changelog = "https://github.com/linien-org/linien/blob/v${version}/CHANGELOG.md";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [
       fsagbuya
       doronbehar
     ];
+    # Numpy 2 is not supported yet, because the server linien, (installed on the
+    # RedPitaya) must use the same Numpy version as the client (installed with
+    # Nix). The server linien is bound to use Numpy 1 because Numpy maintainers
+    # don't distribute pre-built wheels for the armv7l architecture of
+    # RedPitaya, and it is unfeasible to build it natively there - something
+    # that `pip install numpy` naively tries to do. Hence, we are bound to use
+    # on the server the preinstalled Numpy 1 sourced in the .deb package that
+    # comes with the RedPitaya OS. See also:
+    #
+    # - https://github.com/linien-org/linien/commit/ebbb2276b500a18826d11893bb43699b65692c5e
+    # - https://github.com/linien-org/linien/issues/377
+    #
+    # To evaluate this package with python3.withPackages, use:
+    #
+    # pythonEnv = pkgs.linien-gui.passthru.python.withPackages(ps: {
+    #   ps.linien-common
+    #   # Other packages...
+    # });
+    #
+    # NOTE that the above Python environment will use Numpy 1 throughout all
+    # packages wrapped there (see expression in linien-gui), and this may
+    # trigger rebuilds for dependencies that depend on Numpy too. Be ready to
+    # also add more `packageOverrides` to make sure these other dependencies do
+    # build with numpy_1.
+    #
+    # Last NOTE: If you need more packageOverrides besides those provided in
+    # the `linien-gui` expression, beware of:
+    #
+    # - https://github.com/NixOS/nixpkgs/issues/44426
+    broken = lib.versionAtLeast numpy.version "2";
   };
 }
diff --git a/pkgs/development/python-modules/manimpango/default.nix b/pkgs/development/python-modules/manimpango/default.nix
index a70c1930fc20..3137d1e594bb 100644
--- a/pkgs/development/python-modules/manimpango/default.nix
+++ b/pkgs/development/python-modules/manimpango/default.nix
@@ -1,13 +1,11 @@
 {
   lib,
-  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
   pkg-config,
   setuptools,
   pango,
   cython,
-  AppKit,
   pytest-cov-stub,
   pytestCheckHook,
   pythonOlder,
@@ -29,7 +27,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ pango ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ AppKit ];
+  buildInputs = [ pango ];
 
   build-system = [
     setuptools
diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index 735e13d74142..6ef74d0c3d3a 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -53,14 +53,8 @@
   # Tk
   # Darwin has its own "MacOSX" backend, PyPy has tkagg backend and does not support tkinter
   enableTk ? (!stdenv.hostPlatform.isDarwin && !isPyPy),
-  tcl,
-  tk,
   tkinter,
 
-  # Ghostscript
-  enableGhostscript ? true,
-  ghostscript,
-
   # Qt
   enableQt ? false,
   pyqt5,
@@ -73,9 +67,6 @@
   enableNbagg ? false,
   ipykernel,
 
-  # darwin
-  Cocoa,
-
   # required for headless detection
   libX11,
   wayland,
@@ -130,17 +121,10 @@ buildPythonPackage rec {
       freetype
       qhull
     ]
-    ++ lib.optionals enableGhostscript [ ghostscript ]
     ++ lib.optionals enableGtk3 [
       cairo
       gtk3
-    ]
-    ++ lib.optionals enableTk [
-      libX11
-      tcl
-      tk
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ Cocoa ];
+    ];
 
   # clang-11: error: argument unused during compilation: '-fno-strict-overflow' [-Werror,-Wunused-command-line-argument]
   hardeningDisable = lib.optionals stdenv.hostPlatform.isDarwin [ "strictoverflow" ];
diff --git a/pkgs/development/python-modules/miniaudio/default.nix b/pkgs/development/python-modules/miniaudio/default.nix
index 0f86ee525000..c8bf9d91a1a7 100644
--- a/pkgs/development/python-modules/miniaudio/default.nix
+++ b/pkgs/development/python-modules/miniaudio/default.nix
@@ -1,14 +1,11 @@
 {
   lib,
-  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
   setuptools,
   miniaudio,
   cffi,
   pytestCheckHook,
-  AudioToolbox,
-  CoreAudio,
 }:
 
 let
@@ -45,11 +42,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    AudioToolbox
-    CoreAudio
-  ];
-
   propagatedNativeBuildInputs = [ cffi ];
   dependencies = [ cffi ];
 
diff --git a/pkgs/development/python-modules/moto/default.nix b/pkgs/development/python-modules/moto/default.nix
index 366004b12cdb..ec8898371c8f 100644
--- a/pkgs/development/python-modules/moto/default.nix
+++ b/pkgs/development/python-modules/moto/default.nix
@@ -354,6 +354,11 @@ buildPythonPackage rec {
 
     # Requires newer botocore version
     "test_dynamodb_with_account_id_routing"
+
+    # Assumes too much about threading.Timer() behavior (that it honors the
+    # timeout precisely and that the thread handler will complete in just 0.1s
+    # from the requested timeout)
+    "test_start_and_fire_timer_decision"
   ];
 
   disabledTestPaths = [
diff --git a/pkgs/development/python-modules/nh3/default.nix b/pkgs/development/python-modules/nh3/default.nix
index c0df2af0b81a..cd0725bc5eb6 100644
--- a/pkgs/development/python-modules/nh3/default.nix
+++ b/pkgs/development/python-modules/nh3/default.nix
@@ -6,7 +6,6 @@
   rustPlatform,
   libiconv,
   fetchFromGitHub,
-  darwin,
 }:
 let
   pname = "nh3";
@@ -36,7 +35,6 @@ buildPythonPackage {
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     libiconv
-    darwin.apple_sdk.frameworks.Security
   ];
 
   pythonImportsCheck = [ "nh3" ];
diff --git a/pkgs/development/python-modules/numpy/2.nix b/pkgs/development/python-modules/numpy/2.nix
index 54f42f13af80..4de83e48979d 100644
--- a/pkgs/development/python-modules/numpy/2.nix
+++ b/pkgs/development/python-modules/numpy/2.nix
@@ -59,7 +59,7 @@ let
 in
 buildPythonPackage rec {
   pname = "numpy";
-  version = "2.2.4";
+  version = "2.2.5";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -67,7 +67,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit pname version;
     extension = "tar.gz";
-    hash = "sha256-m6A2kqRdPu9mVZ7+HRCWxLm3XAmGtd/1Uww3j7gzHU8=";
+    hash = "sha256-qcDZlGgM2ZGxy3cuiylzQAhUZqb+lkvJ1OgPXi9DwpE=";
   };
 
   patches = lib.optionals python.hasDistutilsCxxPatch [
@@ -159,6 +159,10 @@ buildPythonPackage rec {
     ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
       # AssertionError: (np.int64(0), np.longdouble('9.9999999999999994515e-21'), np.longdouble('3.9696755572509052902e+20'), 'arctanh')
       "test_loss_of_precision"
+    ]
+    ++ lib.optionals (stdenv.hostPlatform ? gcc.arch) [
+      # remove if https://github.com/numpy/numpy/issues/27460 is resolved
+      "test_validate_transcendentals"
     ];
 
   passthru = {
diff --git a/pkgs/development/python-modules/pandas/default.nix b/pkgs/development/python-modules/pandas/default.nix
index 122d5d1b538d..f08952fe98e9 100644
--- a/pkgs/development/python-modules/pandas/default.nix
+++ b/pkgs/development/python-modules/pandas/default.nix
@@ -84,10 +84,22 @@ let
       })
     ];
 
+    # A NOTE regarding the Numpy version relaxing: Both Numpy versions 1.x &
+    # 2.x are supported. However upstream wants to always build with Numpy 2,
+    # and with it to still be able to run with a Numpy 1 or 2. We insist to
+    # perform this substitution even though python3.pkgs.numpy is of version 2
+    # nowadays, because our ecosystem unfortunately doesn't allow easily
+    # separating runtime and build-system dependencies. See also:
+    #
+    # https://discourse.nixos.org/t/several-comments-about-priorities-and-new-policies-in-the-python-ecosystem/51790
+    #
+    # Being able to build (& run) with Numpy 1 helps for python environments
+    # that override globally the `numpy` attribute to point to `numpy_1`.
     postPatch = ''
       substituteInPlace pyproject.toml \
+        --replace-fail "numpy>=2.0" numpy \
         --replace-fail "meson-python==0.13.1" "meson-python>=0.13.1" \
-        --replace-fail "meson==1.2.1" "meson>=1.2.1" \
+        --replace-fail "meson==1.2.1" "meson>=1.2.1"
     '';
 
     nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/parfive/default.nix b/pkgs/development/python-modules/parfive/default.nix
index 58cea24e1438..09114198ceab 100644
--- a/pkgs/development/python-modules/parfive/default.nix
+++ b/pkgs/development/python-modules/parfive/default.nix
@@ -58,6 +58,9 @@ buildPythonPackage rec {
     "test_ftp"
     "test_ftp_pasv_command"
     "test_ftp_http"
+
+    # flaky comparison between runtime types
+    "test_http_callback_fail"
   ];
 
   # Tests require local network access
diff --git a/pkgs/development/python-modules/pdm-backend/default.nix b/pkgs/development/python-modules/pdm-backend/default.nix
index d6b18382a726..669c60249e35 100644
--- a/pkgs/development/python-modules/pdm-backend/default.nix
+++ b/pkgs/development/python-modules/pdm-backend/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "pdm-backend";
-  version = "2.4.3";
+  version = "2.4.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pdm-project";
     repo = "pdm-backend";
     tag = version;
-    hash = "sha256-XbHlzt00R0kB8I6nRvteAgpFlUTAvBcF5iaQD5V30ok=";
+    hash = "sha256-OeS1PqcWXJdvSEZwkBEHGJSYM6bX7QSPdfs9u06g760=";
   };
 
   env.PDM_BUILD_SCM_VERSION = version;
diff --git a/pkgs/development/python-modules/pillow/default.nix b/pkgs/development/python-modules/pillow/default.nix
index 509b868c2485..bf907f6209f5 100644
--- a/pkgs/development/python-modules/pillow/default.nix
+++ b/pkgs/development/python-modules/pillow/default.nix
@@ -20,7 +20,6 @@
   libwebp,
   libxcb,
   openjpeg,
-  tkinter,
   zlib-ng,
 
   # optional dependencies
@@ -70,7 +69,6 @@ buildPythonPackage rec {
     libwebp
     libxcb
     openjpeg
-    tkinter
     zlib-ng
   ];
 
diff --git a/pkgs/development/python-modules/primp/default.nix b/pkgs/development/python-modules/primp/default.nix
index 7c75393cbd45..1bbedf13c469 100644
--- a/pkgs/development/python-modules/primp/default.nix
+++ b/pkgs/development/python-modules/primp/default.nix
@@ -8,7 +8,6 @@
   runCommand,
   boringssl,
   libiconv,
-  SystemConfiguration,
   gcc-unwrapped,
   python,
   fetchpatch,
@@ -91,7 +90,6 @@ buildPythonPackage rec {
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     libiconv
-    SystemConfiguration
   ];
 
   env.BORING_BSSL_PATH = boringssl-wrapper;
diff --git a/pkgs/development/python-modules/prometheus-fastapi-instrumentator/default.nix b/pkgs/development/python-modules/prometheus-fastapi-instrumentator/default.nix
index c4befb300c48..d60c4c658ad1 100644
--- a/pkgs/development/python-modules/prometheus-fastapi-instrumentator/default.nix
+++ b/pkgs/development/python-modules/prometheus-fastapi-instrumentator/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
   pythonOlder,
@@ -44,6 +45,9 @@ buildPythonPackage rec {
     requests
   ];
 
+  # numerous test failures on Darwin
+  doCheck = stdenv.isLinux;
+
   pythonImportsCheck = [ "prometheus_fastapi_instrumentator" ];
 
   meta = {
@@ -55,6 +59,6 @@ buildPythonPackage rec {
       bsd3
     ];
     maintainers = with lib.maintainers; [ bcdarwin ];
-    platforms = lib.platforms.linux; # numerous test failures on Darwin
+    platforms = lib.platforms.unix;
   };
 }
diff --git a/pkgs/development/python-modules/protobuf/default.nix b/pkgs/development/python-modules/protobuf/5.nix
similarity index 100%
rename from pkgs/development/python-modules/protobuf/default.nix
rename to pkgs/development/python-modules/protobuf/5.nix
diff --git a/pkgs/development/python-modules/protobuf/6.nix b/pkgs/development/python-modules/protobuf/6.nix
new file mode 100644
index 000000000000..d5bfe615a6e3
--- /dev/null
+++ b/pkgs/development/python-modules/protobuf/6.nix
@@ -0,0 +1,52 @@
+{
+  buildPythonPackage,
+  fetchPypi,
+  lib,
+  python,
+  setuptools,
+  protobuf,
+}:
+
+buildPythonPackage rec {
+  pname = "protobuf";
+  version = "6.30.2";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-NchZrgdtjFYFTCW1nl5ZY42GVF7W4rbvrGvgtuo7oEg=";
+  };
+
+  build-system = [ setuptools ];
+
+  propagatedNativeBuildInputs = [
+    protobuf
+  ];
+
+  # the pypi source archive does not ship tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "google.protobuf"
+    "google.protobuf.compiler"
+    "google.protobuf.internal"
+    "google.protobuf.pyext"
+    "google.protobuf.testdata"
+    "google.protobuf.util"
+    "google._upb._message"
+  ];
+
+  # Tries to explicitly create a namespace package with pkg_resources,
+  # which breaks everything with our PYTHONPATH setup.
+  postInstall = ''
+    rm $out/${python.sitePackages}/google/__init__.py
+  '';
+
+  meta = {
+    description = "Protocol Buffers are Google's data interchange format";
+    homepage = "https://developers.google.com/protocol-buffers/";
+    changelog = "https://github.com/protocolbuffers/protobuf/releases/v${version}";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+}
diff --git a/pkgs/development/python-modules/psutil/default.nix b/pkgs/development/python-modules/psutil/default.nix
index 84a994cc2d61..28e1a646b2a6 100644
--- a/pkgs/development/python-modules/psutil/default.nix
+++ b/pkgs/development/python-modules/psutil/default.nix
@@ -2,10 +2,8 @@
   lib,
   stdenv,
   buildPythonPackage,
-  CoreFoundation,
   fetchPypi,
   setuptools,
-  IOKit,
   pytestCheckHook,
   python,
   pythonOlder,
@@ -35,11 +33,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  buildInputs =
-    # workaround for https://github.com/NixOS/nixpkgs/issues/146760
-    lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [ CoreFoundation ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ IOKit ];
-
   nativeCheckInputs = [ pytestCheckHook ];
 
   # Segfaults on darwin:
diff --git a/pkgs/development/python-modules/pyfakefs/default.nix b/pkgs/development/python-modules/pyfakefs/default.nix
index e453a787ac13..a1427188b22d 100644
--- a/pkgs/development/python-modules/pyfakefs/default.nix
+++ b/pkgs/development/python-modules/pyfakefs/default.nix
@@ -11,7 +11,6 @@
   # tests
   pandas,
   pytestCheckHook,
-  undefined,
 }:
 
 buildPythonPackage rec {
@@ -33,7 +32,6 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     pandas
     pytestCheckHook
-    undefined
   ];
 
   pytestFlagsArray = [
diff --git a/pkgs/development/python-modules/pygame-ce/default.nix b/pkgs/development/python-modules/pygame-ce/default.nix
index 40cb2ca28a5b..5af23c4c2491 100644
--- a/pkgs/development/python-modules/pygame-ce/default.nix
+++ b/pkgs/development/python-modules/pygame-ce/default.nix
@@ -12,7 +12,6 @@
   ninja,
   meson-python,
 
-  AppKit,
   fontconfig,
   freetype,
   libjpeg,
@@ -20,9 +19,9 @@
   libX11,
   portmidi,
   SDL2_classic,
-  SDL2_classic_image,
-  SDL2_classic_mixer,
-  SDL2_classic_ttf,
+  SDL2_image,
+  SDL2_mixer,
+  SDL2_ttf,
   numpy,
 
   pygame-gui,
@@ -100,10 +99,10 @@ buildPythonPackage rec {
     libpng
     portmidi
     SDL2_classic
-    (SDL2_classic_image.override { enableSTB = false; })
-    SDL2_classic_mixer
-    SDL2_classic_ttf
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ AppKit ];
+    (SDL2_image.override { enableSTB = false; })
+    SDL2_mixer
+    SDL2_ttf
+  ];
 
   nativeCheckInputs = [
     numpy
diff --git a/pkgs/development/python-modules/pygeocodio/default.nix b/pkgs/development/python-modules/pygeocodio/default.nix
index f3fd671ed513..6f23fa579352 100644
--- a/pkgs/development/python-modules/pygeocodio/default.nix
+++ b/pkgs/development/python-modules/pygeocodio/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
   setuptools,
@@ -31,6 +32,10 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "geocodio" ];
 
+  disabledTests = lib.optionals stdenv.hostPlatform.isDarwin [
+    "test_timeout"
+  ];
+
   nativeCheckInputs = [
     pytestCheckHook
   ];
diff --git a/pkgs/development/python-modules/pyglet/default.nix b/pkgs/development/python-modules/pyglet/default.nix
index 663d6db5fb4d..57456fc256cd 100644
--- a/pkgs/development/python-modules/pyglet/default.nix
+++ b/pkgs/development/python-modules/pyglet/default.nix
@@ -110,6 +110,7 @@ buildPythonPackage rec {
     homepage = "http://www.pyglet.org/";
     description = "Cross-platform windowing and multimedia library";
     license = licenses.bsd3;
-    inherit (mesa.meta) platforms;
+    # The patch needs adjusting for non‐Linux platforms.
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/development/python-modules/pymunk/default.nix b/pkgs/development/python-modules/pymunk/default.nix
index ae16a5f5dd54..7e0ccf74f6c9 100644
--- a/pkgs/development/python-modules/pymunk/default.nix
+++ b/pkgs/development/python-modules/pymunk/default.nix
@@ -1,5 +1,4 @@
 {
-  stdenv,
   lib,
   buildPythonPackage,
   fetchPypi,
@@ -8,7 +7,6 @@
   cffi,
   pytestCheckHook,
   pythonOlder,
-  ApplicationServices,
 }:
 
 buildPythonPackage rec {
@@ -29,8 +27,6 @@ buildPythonPackage rec {
 
   dependencies = [ cffi ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ ApplicationServices ];
-
   preBuild = ''
     ${python.pythonOnBuildForHost.interpreter} setup.py build_ext --inplace
   '';
diff --git a/pkgs/development/python-modules/pynput/default.nix b/pkgs/development/python-modules/pynput/default.nix
index 4bd3f66f7d26..ca7a16e7d070 100644
--- a/pkgs/development/python-modules/pynput/default.nix
+++ b/pkgs/development/python-modules/pynput/default.nix
@@ -13,7 +13,6 @@
   # dependencies
   xlib,
   evdev,
-  darwin,
   six,
 
   # tests
@@ -52,14 +51,7 @@ buildPythonPackage rec {
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       evdev
       xlib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        ApplicationServices
-        Quartz
-      ]
-    );
+    ];
 
   doCheck = false; # requires running X server
 
diff --git a/pkgs/development/python-modules/pyopencl/default.nix b/pkgs/development/python-modules/pyopencl/default.nix
index 189102d67931..ce5a284b3017 100644
--- a/pkgs/development/python-modules/pyopencl/default.nix
+++ b/pkgs/development/python-modules/pyopencl/default.nix
@@ -14,7 +14,6 @@
   # buildInputs
   opencl-headers,
   pybind11,
-  darwin,
   ocl-icd,
 
   # dependencies
diff --git a/pkgs/development/python-modules/pyscard/default.nix b/pkgs/development/python-modules/pyscard/default.nix
index 8186c89b7b27..859bd2d17b18 100644
--- a/pkgs/development/python-modules/pyscard/default.nix
+++ b/pkgs/development/python-modules/pyscard/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  PCSC,
   pcsclite,
   pkg-config,
   pytestCheckHook,
@@ -11,11 +10,6 @@
   swig,
 }:
 
-let
-  # Package does not support configuring the pcsc library.
-  withApplePCSC = stdenv.hostPlatform.isDarwin;
-in
-
 buildPythonPackage rec {
   pname = "pyscard";
   version = "2.2.1";
@@ -30,9 +24,9 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  nativeBuildInputs = [ swig ] ++ lib.optionals (!withApplePCSC) [ pkg-config ];
+  nativeBuildInputs = [ swig ] ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [ pkg-config ];
 
-  buildInputs = if withApplePCSC then [ PCSC ] else [ pcsclite ];
+  buildInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) [ pcsclite ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
@@ -41,21 +35,12 @@ buildPythonPackage rec {
       substituteInPlace pyproject.toml \
         --replace-fail 'requires = ["setuptools","swig"]' 'requires = ["setuptools"]'
     ''
-    + (
-      if withApplePCSC then
-        ''
-          substituteInPlace src/smartcard/scard/winscarddll.c \
-            --replace-fail "/System/Library/Frameworks/PCSC.framework/PCSC" \
-                      "${PCSC}/Library/Frameworks/PCSC.framework/PCSC"
-        ''
-      else
-        ''
-          substituteInPlace setup.py --replace-fail "pkg-config" "$PKG_CONFIG"
-          substituteInPlace src/smartcard/scard/winscarddll.c \
-            --replace-fail "libpcsclite.so.1" \
-                      "${lib.getLib pcsclite}/lib/libpcsclite${stdenv.hostPlatform.extensions.sharedLibrary}"
-        ''
-    );
+    + lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
+      substituteInPlace setup.py --replace-fail "pkg-config" "$PKG_CONFIG"
+      substituteInPlace src/smartcard/scard/winscarddll.c \
+        --replace-fail "libpcsclite.so.1" \
+                  "${lib.getLib pcsclite}/lib/libpcsclite${stdenv.hostPlatform.extensions.sharedLibrary}"
+    '';
 
   meta = {
     description = "Smartcard library for python";
diff --git a/pkgs/development/python-modules/pysequoia/default.nix b/pkgs/development/python-modules/pysequoia/default.nix
index 8a53416c5fa5..aa1256a89d9e 100644
--- a/pkgs/development/python-modules/pysequoia/default.nix
+++ b/pkgs/development/python-modules/pysequoia/default.nix
@@ -11,7 +11,6 @@
   openssl,
   pcsclite,
   stdenv,
-  darwin,
   libiconv,
 }:
 
@@ -48,8 +47,6 @@ buildPythonPackage rec {
       pcsclite
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.CoreFoundation
-      darwin.apple_sdk.frameworks.Security
       libiconv
     ];
 
diff --git a/pkgs/development/python-modules/pystatgrab/default.nix b/pkgs/development/python-modules/pystatgrab/default.nix
index 942fe48d95b5..620552507729 100644
--- a/pkgs/development/python-modules/pystatgrab/default.nix
+++ b/pkgs/development/python-modules/pystatgrab/default.nix
@@ -1,6 +1,5 @@
 {
   lib,
-  stdenv,
   buildPythonPackage,
   cython,
   fetchFromGitHub,
@@ -10,7 +9,6 @@
   setuptools,
   unittestCheckHook,
   wheel,
-  darwin,
 }:
 
 buildPythonPackage rec {
@@ -39,7 +37,7 @@ buildPythonPackage rec {
 
   buildInputs = [
     libstatgrab
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin (with darwin.apple_sdk.frameworks; [ IOKit ]);
+  ];
 
   nativeCheckInputs = [ unittestCheckHook ];
 
diff --git a/pkgs/development/python-modules/python-rtmidi/default.nix b/pkgs/development/python-modules/python-rtmidi/default.nix
index 818eeb919b29..c1766b27c5bf 100644
--- a/pkgs/development/python-modules/python-rtmidi/default.nix
+++ b/pkgs/development/python-modules/python-rtmidi/default.nix
@@ -4,10 +4,6 @@
   alabaster,
   alsa-lib,
   buildPythonPackage,
-  CoreAudio,
-  CoreMIDI,
-  CoreServices,
-  Foundation,
   cython,
   fetchPypi,
   flake8,
@@ -46,12 +42,6 @@ buildPythonPackage rec {
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       libjack2
       alsa-lib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CoreAudio
-      CoreMIDI
-      CoreServices
-      Foundation
     ];
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/pythonocc-core/default.nix b/pkgs/development/python-modules/pythonocc-core/default.nix
index fd4f0e8047ec..8a589a36f726 100644
--- a/pkgs/development/python-modules/pythonocc-core/default.nix
+++ b/pkgs/development/python-modules/pythonocc-core/default.nix
@@ -4,7 +4,6 @@
   python,
   fetchFromGitHub,
   cmake,
-  Cocoa,
   fontconfig,
   freetype,
   libGL,
@@ -30,12 +29,6 @@ stdenv.mkDerivation rec {
     hash = "sha256-0o2PQEN0/Z7FUPZEo2HxFFa+mN2bZnYI++HVu4ONpNA=";
   };
 
-  postPatch = ''
-    substituteInPlace CMakeLists.txt \
-    --replace "/usr/X11R6/lib/libGL.dylib" "${libGL}/lib/libGL.dylib" \
-    --replace "/usr/X11R6/lib/libGLU.dylib" "${libGLU}/lib/libGLU.dylib"
-  '';
-
   nativeBuildInputs = [
     cmake
     swig
@@ -53,7 +46,7 @@ stdenv.mkDerivation rec {
     fontconfig
     numpy
     rapidjson
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Cocoa ];
+  ];
 
   cmakeFlags = [
     "-Wno-dev"
diff --git a/pkgs/development/python-modules/qcs-sdk-python/default.nix b/pkgs/development/python-modules/qcs-sdk-python/default.nix
index ba6a6a2a397e..bded61ec97cd 100644
--- a/pkgs/development/python-modules/qcs-sdk-python/default.nix
+++ b/pkgs/development/python-modules/qcs-sdk-python/default.nix
@@ -11,7 +11,6 @@
   qcs-api-client-common,
   quil,
   rustPlatform,
-  darwin,
   libiconv,
   syrupy,
 }:
@@ -50,8 +49,6 @@ buildPythonPackage rec {
   };
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk.frameworks.Security
-    darwin.apple_sdk.frameworks.SystemConfiguration
     libiconv
   ];
 
diff --git a/pkgs/development/python-modules/raylib-python-cffi/default.nix b/pkgs/development/python-modules/raylib-python-cffi/default.nix
index 72c501168091..b4b3fb195e6c 100644
--- a/pkgs/development/python-modules/raylib-python-cffi/default.nix
+++ b/pkgs/development/python-modules/raylib-python-cffi/default.nix
@@ -1,5 +1,4 @@
 {
-  stdenv,
   gcc,
   buildPythonPackage,
   fetchFromGitHub,
@@ -11,21 +10,11 @@
   raylib,
   physac,
   raygui,
-  darwin,
   lib,
   writers,
   raylib-python-cffi,
 }:
 
-let
-  inherit (darwin.apple_sdk.frameworks)
-    OpenGL
-    Cocoa
-    IOKit
-    CoreFoundation
-    CoreVideo
-    ;
-in
 buildPythonPackage rec {
   pname = "raylib-python-cffi";
   version = "5.5.0.2";
@@ -60,21 +49,13 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "pyray" ];
 
-  buildInputs =
-    [
-      glfw
-      libffi
-      raylib
-      physac
-      raygui
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      OpenGL
-      Cocoa
-      IOKit
-      CoreFoundation
-      CoreVideo
-    ];
+  buildInputs = [
+    glfw
+    libffi
+    raylib
+    physac
+    raygui
+  ];
 
   passthru.tests = import ./passthru-tests.nix {
     inherit src raylib-python-cffi writers;
diff --git a/pkgs/development/python-modules/rtmidi-python/default.nix b/pkgs/development/python-modules/rtmidi-python/default.nix
index cdb87a0c8657..5f7d980de4ef 100644
--- a/pkgs/development/python-modules/rtmidi-python/default.nix
+++ b/pkgs/development/python-modules/rtmidi-python/default.nix
@@ -5,9 +5,6 @@
   fetchPypi,
   cython_0,
   alsa-lib,
-  CoreAudio,
-  CoreMIDI,
-  CoreServices,
 }:
 
 buildPythonPackage rec {
@@ -25,13 +22,7 @@ buildPythonPackage rec {
   '';
 
   nativeBuildInputs = [ cython_0 ];
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [ alsa-lib ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CoreAudio
-      CoreMIDI
-      CoreServices
-    ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ alsa-lib ];
 
   setupPyBuildFlags = [ "--from-cython" ];
 
diff --git a/pkgs/development/python-modules/sabyenc/default.nix b/pkgs/development/python-modules/sabyenc/default.nix
deleted file mode 100644
index 9dd7e040ca88..000000000000
--- a/pkgs/development/python-modules/sabyenc/default.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchPypi,
-}:
-
-buildPythonPackage rec {
-  pname = "sabyenc";
-  version = "3.3.6";
-  format = "setuptools";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "1qbymi1626mmcxnsqdwnz2krxg7jvl4qbh8nwjj54z2p681wvjm4";
-  };
-
-  # tests are not included in pypi distribution
-  doCheck = false;
-
-  meta = {
-    description = "Python yEnc package optimized for use within SABnzbd";
-    homepage = "https://github.com/sabnzbd/sabyenc/";
-    license = lib.licenses.lgpl3;
-    maintainers = [ lib.maintainers.georgewhewell ];
-  };
-}
diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index 6b1249783a22..52ad3e6429f4 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -91,6 +91,21 @@ buildPythonPackage {
       excludes = [ "doc/source/dev/contributor/meson_advanced.rst" ];
     })
   ];
+  # A NOTE regarding the Numpy version relaxing: Both Numpy versions 1.x &
+  # 2.x are supported. However upstream wants to always build with Numpy 2,
+  # and with it to still be able to run with a Numpy 1 or 2. We insist to
+  # perform this substitution even though python3.pkgs.numpy is of version 2
+  # nowadays, because our ecosystem unfortunately doesn't allow easily
+  # separating runtime and build-system dependencies. See also:
+  #
+  # https://discourse.nixos.org/t/several-comments-about-priorities-and-new-policies-in-the-python-ecosystem/51790
+  #
+  # Being able to build (& run) with Numpy 1 helps for python environments
+  # that override globally the `numpy` attribute to point to `numpy_1`.
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "numpy>=2.0.0,<2.5" numpy
+  '';
 
   build-system =
     [
diff --git a/pkgs/development/python-modules/scs/default.nix b/pkgs/development/python-modules/scs/default.nix
index 855457eb0195..5e53e2c793af 100644
--- a/pkgs/development/python-modules/scs/default.nix
+++ b/pkgs/development/python-modules/scs/default.nix
@@ -9,8 +9,6 @@
   numpy,
   pkg-config,
 
-  # buildInputs
-  Accelerate,
   blas,
   lapack,
 
@@ -45,14 +43,10 @@ buildPythonPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    if stdenv.hostPlatform.isDarwin then
-      [ Accelerate ]
-    else
-      [
-        blas
-        lapack
-      ];
+  buildInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) [
+    blas
+    lapack
+  ];
 
   dependencies = [
     numpy
diff --git a/pkgs/development/python-modules/skia-pathops/default.nix b/pkgs/development/python-modules/skia-pathops/default.nix
index 147303c49881..f04f62056a83 100644
--- a/pkgs/development/python-modules/skia-pathops/default.nix
+++ b/pkgs/development/python-modules/skia-pathops/default.nix
@@ -12,8 +12,6 @@
   pytestCheckHook,
   cctools,
   xcodebuild,
-  ApplicationServices,
-  OpenGL,
 }:
 
 buildPythonPackage rec {
@@ -69,11 +67,6 @@ buildPythonPackage rec {
       xcodebuild
     ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    ApplicationServices
-    OpenGL
-  ];
-
   nativeCheckInputs = [ pytestCheckHook ];
 
   pythonImportsCheck = [ "pathops" ];
diff --git a/pkgs/development/python-modules/skytemple-rust/default.nix b/pkgs/development/python-modules/skytemple-rust/default.nix
index ed5fdb5e71ea..df0cb72737f9 100644
--- a/pkgs/development/python-modules/skytemple-rust/default.nix
+++ b/pkgs/development/python-modules/skytemple-rust/default.nix
@@ -5,7 +5,6 @@
   cargo,
   fetchFromGitHub,
   libiconv,
-  Foundation,
   rustPlatform,
   rustc,
   setuptools-rust,
@@ -32,7 +31,6 @@ buildPythonPackage rec {
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     libiconv
-    Foundation
   ];
   nativeBuildInputs = [
     setuptools-rust
diff --git a/pkgs/development/python-modules/sourmash/default.nix b/pkgs/development/python-modules/sourmash/default.nix
index 374ed68641ec..be3d84103383 100644
--- a/pkgs/development/python-modules/sourmash/default.nix
+++ b/pkgs/development/python-modules/sourmash/default.nix
@@ -4,7 +4,6 @@
   buildPythonPackage,
   stdenv,
   pythonOlder,
-  overrideSDK,
   rustPlatform,
   bitstring,
   cachetools,
@@ -20,18 +19,12 @@
   pyyaml,
   pytestCheckHook,
 }:
-let
-  stdenv' =
-    if stdenv.hostPlatform.isDarwin then overrideSDK stdenv { darwinMinVersion = "10.14"; } else stdenv;
-in
 buildPythonPackage rec {
   pname = "sourmash";
   version = "4.8.14";
   pyproject = true;
   disabled = pythonOlder "3.9";
 
-  stdenv = stdenv';
-
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-no99VjO1KVE+/JUOJcl0xOz3yZtMr70A8vE1rQVjMH8=";
diff --git a/pkgs/development/python-modules/tensorflow-metadata/default.nix b/pkgs/development/python-modules/tensorflow-metadata/default.nix
index c1ccd3c3befd..d18f450d4d42 100644
--- a/pkgs/development/python-modules/tensorflow-metadata/default.nix
+++ b/pkgs/development/python-modules/tensorflow-metadata/default.nix
@@ -36,6 +36,10 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
+  pythonRelaxDeps = [
+    "protobuf"
+  ];
+
   dependencies = [
     absl-py
     googleapis-common-protos
diff --git a/pkgs/development/python-modules/tensorflow/default.nix b/pkgs/development/python-modules/tensorflow/default.nix
index 96ed0b178f3d..f378389fc45f 100644
--- a/pkgs/development/python-modules/tensorflow/default.nix
+++ b/pkgs/development/python-modules/tensorflow/default.nix
@@ -79,9 +79,6 @@
   sse42Support ? stdenv.hostPlatform.sse4_2Support,
   avx2Support ? stdenv.hostPlatform.avx2Support,
   fmaSupport ? stdenv.hostPlatform.fmaSupport,
-  # Darwin deps
-  Foundation,
-  Security,
   cctools,
   llvmPackages,
 }:
@@ -339,10 +336,6 @@ let
         cudnnMerged
       ]
       ++ lib.optionals mklSupport [ mkl ]
-      ++ lib.optionals stdenv.hostPlatform.isDarwin [
-        Foundation
-        Security
-      ]
       ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [ nsync ];
 
     # arbitrarily set to the current latest bazel version, overly careful
diff --git a/pkgs/development/python-modules/torch/bin.nix b/pkgs/development/python-modules/torch/bin.nix
index 15daafba6f71..26f48307621b 100644
--- a/pkgs/development/python-modules/torch/bin.nix
+++ b/pkgs/development/python-modules/torch/bin.nix
@@ -35,7 +35,7 @@ let
   pyVerNoDot = builtins.replaceStrings [ "." ] [ "" ] python.pythonVersion;
   srcs = import ./binary-hashes.nix version;
   unsupported = throw "Unsupported system";
-  version = "2.5.1";
+  version = "2.6.0";
 in
 buildPythonPackage {
   inherit version;
@@ -45,7 +45,7 @@ buildPythonPackage {
 
   format = "wheel";
 
-  disabled = (pythonOlder "3.9") || (pythonAtLeast "3.13");
+  disabled = (pythonOlder "3.9") || (pythonAtLeast "3.14");
 
   src = fetchurl srcs."${stdenv.system}-${pyVerNoDot}" or unsupported;
 
@@ -66,6 +66,7 @@ buildPythonPackage {
       cuda_cupti
       cuda_nvrtc
       cudnn
+      cusparselt
       libcublas
       libcufft
       libcurand
diff --git a/pkgs/development/python-modules/torch/binary-hashes.nix b/pkgs/development/python-modules/torch/binary-hashes.nix
index cd936d54ad72..d3afcf155318 100644
--- a/pkgs/development/python-modules/torch/binary-hashes.nix
+++ b/pkgs/development/python-modules/torch/binary-hashes.nix
@@ -7,66 +7,81 @@
 
 version:
 builtins.getAttr version {
-  "2.5.1" = {
+  "2.6.0" = {
     x86_64-linux-39 = {
-      name = "torch-2.5.1-cp39-cp39-linux_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cu124/torch-2.5.1%2Bcu124-cp39-cp39-linux_x86_64.whl";
-      hash = "sha256-1oG4vj/cLNQREjENs8OQT3xqCaeuKNBCrgrzrwHI/No=";
+      name = "torch-2.6.0-cp39-cp39-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cu124/torch-2.6.0%2Bcu124-cp39-cp39-linux_x86_64.whl";
+      hash = "sha256-5mEmfNAkJGKrEAvdZ/ZRmIqp9n6zFgnWkJr8rIkd9hI=";
     };
     x86_64-linux-310 = {
-      name = "torch-2.5.1-cp310-cp310-linux_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cu124/torch-2.5.1%2Bcu124-cp310-cp310-linux_x86_64.whl";
-      hash = "sha256-nd4w85nKIhN0Vcyk1HFA37f0F24tFqlyn8BE7r+tsTo=";
+      name = "torch-2.6.0-cp310-cp310-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cu124/torch-2.6.0%2Bcu124-cp310-cp310-linux_x86_64.whl";
+      hash = "sha256-fyun98BFkyClIWlva1vMwYf1mJCyPJ37bEmwuHxr/Jc=";
     };
     x86_64-linux-311 = {
-      name = "torch-2.5.1-cp311-cp311-linux_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cu124/torch-2.5.1%2Bcu124-cp311-cp311-linux_x86_64.whl";
-      hash = "sha256-aylm7emv/i/WngdlaRynI+yHDgw0x3YfTVuOMYOD/a8=";
+      name = "torch-2.6.0-cp311-cp311-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cu124/torch-2.6.0%2Bcu124-cp311-cp311-linux_x86_64.whl";
+      hash = "sha256-1MPpqNMafA/LudoXwxoZF+H6wmxWakz72MlWitfK3nk=";
     };
     x86_64-linux-312 = {
-      name = "torch-2.5.1-cp312-cp312-linux_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cu124/torch-2.5.1%2Bcu124-cp312-cp312-linux_x86_64.whl";
-      hash = "sha256-v2SEv+W8T5KkoaG/VTBBUF4ZqRH3FwZTMOsGGv4OFNc=";
+      name = "torch-2.6.0-cp312-cp312-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cu124/torch-2.6.0%2Bcu124-cp312-cp312-linux_x86_64.whl";
+      hash = "sha256-o5O1BoRANcDawvMOqEeMNDuOlaQp8G87PK38f1OttZc=";
+    };
+    x86_64-linux-313 = {
+      name = "torch-2.6.0-cp313-cp313-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cu124/torch-2.6.0%2Bcu124-cp313-cp313-linux_x86_64.whl";
+      hash = "sha256-DzvFPJiM6VaM2HaipTFnYehKhwQTXsgGj1+BtEF5ecs=";
     };
     aarch64-darwin-39 = {
-      name = "torch-2.5.1-cp39-none-macosx_11_0_arm64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torch-2.5.1-cp39-none-macosx_11_0_arm64.whl";
-      hash = "sha256-gEZ2i39tNbhdEBtLOMuoqi881RlSvEwGpJWA8s5oIpE=";
+      name = "torch-2.6.0-cp39-none-macosx_11_0_arm64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torch-2.6.0-cp39-none-macosx_11_0_arm64.whl";
+      hash = "sha256-Jl9w3l/UW4ZNkktkvheX+G52yOSKAsKjpvx+wkfSImw=";
     };
     aarch64-darwin-310 = {
-      name = "torch-2.5.1-cp310-none-macosx_11_0_arm64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torch-2.5.1-cp310-none-macosx_11_0_arm64.whl";
-      hash = "sha256-I9Biv3B3aj0E2+dNuVDbKlJF4bpPJyCKh/DXQ7DQboY=";
+      name = "torch-2.6.0-cp310-none-macosx_11_0_arm64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torch-2.6.0-cp310-none-macosx_11_0_arm64.whl";
+      hash = "sha256-CeBvmUnhoFGMWwn+lSlbyWYfIZ2ey2+Yk+USPhBpZig=";
     };
     aarch64-darwin-311 = {
-      name = "torch-2.5.1-cp311-none-macosx_11_0_arm64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torch-2.5.1-cp311-none-macosx_11_0_arm64.whl";
-      hash = "sha256-MfjDlmCWL5rk7uyZXjBJtUkutzYN1PBzd2WO9Nco+kw=";
+      name = "torch-2.6.0-cp311-none-macosx_11_0_arm64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torch-2.6.0-cp311-none-macosx_11_0_arm64.whl";
+      hash = "sha256-lPxjs7S+3TJ69YhpZVn2jCZEQOJQPMnmlUAZRz10riE=";
     };
     aarch64-darwin-312 = {
-      name = "torch-2.5.1-cp312-none-macosx_11_0_arm64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torch-2.5.1-cp312-none-macosx_11_0_arm64.whl";
-      hash = "sha256-jHEt9hEBlk6xGRCoRlFAEfC29ZIMVdv1Z7/4o0Fj1bE=";
+      name = "torch-2.6.0-cp312-none-macosx_11_0_arm64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torch-2.6.0-cp312-none-macosx_11_0_arm64.whl";
+      hash = "sha256-mmEK/iFqhai5vJ+DZe1WFTXJPoBMKjF+9/q8xd7aCYk=";
+    };
+    aarch64-darwin-313 = {
+      name = "torch-2.6.0-cp313-none-macosx_11_0_arm64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torch-2.6.0-cp313-none-macosx_11_0_arm64.whl";
+      hash = "sha256-/5b0A4+K+ffsQjFxDtRUnaG9662VkjlTolBF3Pb9h+I=";
     };
     aarch64-linux-39 = {
-      name = "torch-2.5.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torch-2.5.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl";
-      hash = "sha256-x09z2hefp+qiFnqwtJPyZ65IGmwAckniZ0y9C69KXME=";
+      name = "torch-2.6.0-cp39-cp39-manylinux_2_28_aarch64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torch-2.6.0%2Bcpu-cp39-cp39-manylinux_2_28_aarch64.whl";
+      hash = "sha256-KrnGs9bupQa9qbgqAVXpdNjvjji0F1idFEVotPpZr+E=";
     };
     aarch64-linux-310 = {
-      name = "torch-2.5.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torch-2.5.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl";
-      hash = "sha256-JpsQw0Qwqo6WQ9vgNdxSXEqbHWcc09vI7Lyu0oCuMi0=";
+      name = "torch-2.6.0-cp310-cp310-manylinux_2_28_aarch64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torch-2.6.0%2Bcpu-cp310-cp310-manylinux_2_28_aarch64.whl";
+      hash = "sha256-kIMvTRGMVmuGUqIZasaV/B8Uz0INsntaG0HH6q8hQek=";
     };
     aarch64-linux-311 = {
-      name = "torch-2.5.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torch-2.5.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl";
-      hash = "sha256-1bMgPxkbxAeDyZSI0ud23Pk6xDGllJHWJ6HKWzriCyI=";
+      name = "torch-2.6.0-cp311-cp311-manylinux_2_28_aarch64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torch-2.6.0%2Bcpu-cp311-cp311-manylinux_2_28_aarch64.whl";
+      hash = "sha256-09q5+wKU8miuwo6Kq6g06dAGuQpQ21vC/iGRqdSMYIQ=";
     };
     aarch64-linux-312 = {
-      name = "torch-2.5.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torch-2.5.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl";
-      hash = "sha256-NtG+mSgbb2Atljm9CvPuAAbnqrFvZxjYb3CdOVtvJiw=";
+      name = "torch-2.6.0-cp312-cp312-manylinux_2_28_aarch64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torch-2.6.0%2Bcpu-cp312-cp312-manylinux_2_28_aarch64.whl";
+      hash = "sha256-MYKQ6JJDU8YbElzch2jRUghwTieed1fBE7liB0Deypg=";
+    };
+    aarch64-linux-313 = {
+      name = "torch-2.6.0-cp313-cp313-manylinux_2_28_aarch64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torch-2.6.0%2Bcpu-cp313-cp313-manylinux_2_28_aarch64.whl";
+      hash = "sha256-tefo1WGyY7WtgElzYoHNEseOUee8GpE/1AmP0OC5Y0c=";
     };
   };
 }
diff --git a/pkgs/development/python-modules/torch/default.nix b/pkgs/development/python-modules/torch/default.nix
index 72c086d557f3..35500312a9e7 100644
--- a/pkgs/development/python-modules/torch/default.nix
+++ b/pkgs/development/python-modules/torch/default.nix
@@ -120,7 +120,7 @@ let
 
   setBool = v: if v then "1" else "0";
 
-  # https://github.com/pytorch/pytorch/blob/v2.4.0/torch/utils/cpp_extension.py#L1953
+  # https://github.com/pytorch/pytorch/blob/v2.6.0/torch/utils/cpp_extension.py#L2046-L2048
   supportedTorchCudaCapabilities =
     let
       real = [
@@ -141,6 +141,7 @@ let
         "8.9"
         "9.0"
         "9.0a"
+        "10.0"
       ];
       ptx = lists.map (x: "${x}+PTX") real;
     in
@@ -246,13 +247,17 @@ let
     echo
     echo "# Update using: unroll-src [version]"
   '';
+
+  stdenv' = if cudaSupport then cudaPackages.backendStdenv else stdenv;
 in
 buildPythonPackage rec {
   pname = "torch";
   # Don't forget to update torch-bin to the same version.
-  version = "2.5.1";
+  version = "2.6.0";
   pyproject = true;
 
+  stdenv = stdenv';
+
   outputs = [
     "out" # output standard python package
     "dev" # output libtorch headers
@@ -271,7 +276,12 @@ buildPythonPackage rec {
   };
 
   patches =
-    [ ./clang19-template-warning.patch ]
+    [
+      ./clang19-template-warning.patch
+      # fix invalid static cast in XNNPACK
+      # https://github.com/google/XNNPACK/issues/7489
+      ./xnnpack-bfloat16.patch
+    ]
     ++ lib.optionals cudaSupport [ ./fix-cmake-cuda-toolkit.patch ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       # Propagate CUPTI to Kineto by overriding the search path with environment variables.
@@ -308,19 +318,19 @@ buildPythonPackage rec {
     + lib.optionalString rocmSupport ''
       # https://github.com/facebookincubator/gloo/pull/297
       substituteInPlace third_party/gloo/cmake/Hipify.cmake \
-        --replace "\''${HIPIFY_COMMAND}" "python \''${HIPIFY_COMMAND}"
+        --replace-fail "\''${HIPIFY_COMMAND}" "python \''${HIPIFY_COMMAND}"
 
       # Replace hard-coded rocm paths
       substituteInPlace caffe2/CMakeLists.txt \
-        --replace "/opt/rocm" "${rocmtoolkit_joined}" \
-        --replace "hcc/include" "hip/include" \
-        --replace "rocblas/include" "include/rocblas" \
-        --replace "hipsparse/include" "include/hipsparse"
+        --replace-fail "/opt/rocm" "${rocmtoolkit_joined}" \
+        --replace-fail "hcc/include" "hip/include" \
+        --replace-fail "rocblas/include" "include/rocblas" \
+        --replace-fail "hipsparse/include" "include/hipsparse"
 
       # Doesn't pick up the environment variable?
       substituteInPlace third_party/kineto/libkineto/CMakeLists.txt \
-        --replace "\''$ENV{ROCM_SOURCE_DIR}" "${rocmtoolkit_joined}" \
-        --replace "/opt/rocm" "${rocmtoolkit_joined}"
+        --replace-fail "\''$ENV{ROCM_SOURCE_DIR}" "${rocmtoolkit_joined}" \
+        --replace-fail "/opt/rocm" "${rocmtoolkit_joined}"
 
       # Strangely, this is never set in cmake
       substituteInPlace cmake/public/LoadHIP.cmake \
@@ -330,7 +340,7 @@ buildPythonPackage rec {
     # Detection of NCCL version doesn't work particularly well when using the static binary.
     + lib.optionalString cudaSupport ''
       substituteInPlace cmake/Modules/FindNCCL.cmake \
-        --replace \
+        --replace-fail \
           'message(FATAL_ERROR "Found NCCL header version and library version' \
           'message(WARNING "Found NCCL header version and library version'
     ''
@@ -455,7 +465,15 @@ buildPythonPackage rec {
       # bump, among other things.
       # Also of interest: pytorch ignores CXXFLAGS uses CFLAGS for both C and C++:
       # https://github.com/pytorch/pytorch/blob/v1.11.0/setup.py#L17
-      NIX_CFLAGS_COMPILE = "-Wno-error";
+      NIX_CFLAGS_COMPILE = toString (
+        [
+          "-Wno-error"
+        ]
+        # fix build aarch64-linux build failure with GCC14
+        ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
+          "-Wno-error=incompatible-pointer-types"
+        ]
+      );
       USE_VULKAN = setBool vulkanSupport;
     }
     // lib.optionalAttrs vulkanSupport {
@@ -499,6 +517,7 @@ buildPythonPackage rec {
         cuda_nvml_dev # <nvml.h>
         cuda_nvrtc
         cuda_nvtx # -llibNVToolsExt
+        cusparselt
         libcublas
         libcufft
         libcurand
@@ -622,11 +641,11 @@ buildPythonPackage rec {
       # Fix up library paths for split outputs
       substituteInPlace \
         $dev/share/cmake/Torch/TorchConfig.cmake \
-        --replace \''${TORCH_INSTALL_PREFIX}/lib "$lib/lib"
+        --replace-fail \''${TORCH_INSTALL_PREFIX}/lib "$lib/lib"
 
       substituteInPlace \
         $dev/share/cmake/Caffe2/Caffe2Targets-release.cmake \
-        --replace \''${_IMPORT_PREFIX}/lib "$lib/lib"
+        --replace-fail \''${_IMPORT_PREFIX}/lib "$lib/lib"
 
       mkdir $lib
       mv $out/${python.sitePackages}/torch/lib $lib/lib
@@ -634,10 +653,10 @@ buildPythonPackage rec {
     ''
     + lib.optionalString rocmSupport ''
       substituteInPlace $dev/share/cmake/Tensorpipe/TensorpipeTargets-release.cmake \
-        --replace "\''${_IMPORT_PREFIX}/lib64" "$lib/lib"
+        --replace-fail "\''${_IMPORT_PREFIX}/lib64" "$lib/lib"
 
       substituteInPlace $dev/share/cmake/ATen/ATenConfig.cmake \
-        --replace "/build/source/torch/include" "$dev/include"
+        --replace-fail "/build/source/torch/include" "$dev/include"
     '';
 
   postFixup =
diff --git a/pkgs/development/python-modules/torch/prefetch.sh b/pkgs/development/python-modules/torch/prefetch.sh
index 712edbddb52e..f1457a2ac25e 100755
--- a/pkgs/development/python-modules/torch/prefetch.sh
+++ b/pkgs/development/python-modules/torch/prefetch.sh
@@ -15,14 +15,17 @@ url_and_key_list=(
   "x86_64-linux-310 $linux_cuda_bucket/torch-${version}%2B${linux_cuda_version}-cp310-cp310-linux_x86_64.whl torch-${version}-cp310-cp310-linux_x86_64.whl"
   "x86_64-linux-311 $linux_cuda_bucket/torch-${version}%2B${linux_cuda_version}-cp311-cp311-linux_x86_64.whl torch-${version}-cp311-cp311-linux_x86_64.whl"
   "x86_64-linux-312 $linux_cuda_bucket/torch-${version}%2B${linux_cuda_version}-cp312-cp312-linux_x86_64.whl torch-${version}-cp312-cp312-linux_x86_64.whl"
+  "x86_64-linux-313 $linux_cuda_bucket/torch-${version}%2B${linux_cuda_version}-cp313-cp313-linux_x86_64.whl torch-${version}-cp313-cp313-linux_x86_64.whl"
   "aarch64-darwin-39 $darwin_bucket/torch-${version}-cp39-none-macosx_11_0_arm64.whl torch-${version}-cp39-none-macosx_11_0_arm64.whl"
   "aarch64-darwin-310 $darwin_bucket/torch-${version}-cp310-none-macosx_11_0_arm64.whl torch-${version}-cp310-none-macosx_11_0_arm64.whl"
   "aarch64-darwin-311 $darwin_bucket/torch-${version}-cp311-none-macosx_11_0_arm64.whl torch-${version}-cp311-none-macosx_11_0_arm64.whl"
   "aarch64-darwin-312 $darwin_bucket/torch-${version}-cp312-none-macosx_11_0_arm64.whl torch-${version}-cp312-none-macosx_11_0_arm64.whl"
-  "aarch64-linux-39 $linux_cpu_bucket/torch-${version}-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl torch-${version}-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
-  "aarch64-linux-310 $linux_cpu_bucket/torch-${version}-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl torch-${version}-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
-  "aarch64-linux-311 $linux_cpu_bucket/torch-${version}-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl torch-${version}-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
-  "aarch64-linux-312 $linux_cpu_bucket/torch-${version}-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl torch-${version}-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl"
+  "aarch64-darwin-313 $darwin_bucket/torch-${version}-cp313-none-macosx_11_0_arm64.whl torch-${version}-cp313-none-macosx_11_0_arm64.whl"
+  "aarch64-linux-39 $linux_cpu_bucket/torch-${version}%2Bcpu-cp39-cp39-manylinux_2_28_aarch64.whl torch-${version}-cp39-cp39-manylinux_2_28_aarch64.whl"
+  "aarch64-linux-310 $linux_cpu_bucket/torch-${version}%2Bcpu-cp310-cp310-manylinux_2_28_aarch64.whl torch-${version}-cp310-cp310-manylinux_2_28_aarch64.whl"
+  "aarch64-linux-311 $linux_cpu_bucket/torch-${version}%2Bcpu-cp311-cp311-manylinux_2_28_aarch64.whl torch-${version}-cp311-cp311-manylinux_2_28_aarch64.whl"
+  "aarch64-linux-312 $linux_cpu_bucket/torch-${version}%2Bcpu-cp312-cp312-manylinux_2_28_aarch64.whl torch-${version}-cp312-cp312-manylinux_2_28_aarch64.whl"
+  "aarch64-linux-313 $linux_cpu_bucket/torch-${version}%2Bcpu-cp313-cp313-manylinux_2_28_aarch64.whl torch-${version}-cp313-cp313-manylinux_2_28_aarch64.whl"
 )
 
 hashfile="binary-hashes-$version.nix"
diff --git a/pkgs/development/python-modules/torch/src.nix b/pkgs/development/python-modules/torch/src.nix
index 1bfb797e0693..24c39ff9e375 100644
--- a/pkgs/development/python-modules/torch/src.nix
+++ b/pkgs/development/python-modules/torch/src.nix
@@ -4,62 +4,8 @@
   fetchFromGitHub,
   runCommand,
 }:
-assert version == "2.5.1";
+assert version == "2.6.0";
 (rec {
-  src_DCGM = fetchFromGitHub {
-    owner = "NVIDIA";
-    repo = "DCGM";
-    rev = "ffde4e54bc7249a6039a5e6b45b395141e1217f9";
-    hash = "sha256-jlnq25byEep7wRF3luOIGaiaYjqSVaTBx02N6gE/ox8=";
-  };
-  src_FP16 = fetchFromGitHub {
-    owner = "Maratyszcza";
-    repo = "FP16";
-    rev = "4dfe081cf6bcd15db339cf2680b9281b8451eeb3";
-    hash = "sha256-B27LtVnL52niaFgPW0pp5Uulub/Q3NvtSDkJNahrSBk=";
-  };
-  src_FXdiv = fetchFromGitHub {
-    owner = "Maratyszcza";
-    repo = "FXdiv";
-    rev = "b408327ac2a15ec3e43352421954f5b1967701d1";
-    hash = "sha256-BEjscsejYVhRxDAmah5DT3+bglp8G5wUTTYL7+HjWds=";
-  };
-  src_GSL = fetchFromGitHub {
-    owner = "microsoft";
-    repo = "GSL";
-    rev = "6f4529395c5b7c2d661812257cd6780c67e54afa";
-    hash = "sha256-sNTDH1ohz+rcnBvA5KkarHKdRMQPW0c2LeSVPdEYx6Q=";
-  };
-  src_NNPACK = fetchFromGitHub {
-    owner = "Maratyszcza";
-    repo = "NNPACK";
-    rev = "c07e3a0400713d546e0dea2d5466dd22ea389c73";
-    hash = "sha256-GzF53u1ELtmEH3WbBzGBemlQhjj3EIKB+37wMtSYE2g=";
-  };
-  src_NVTX = fetchFromGitHub {
-    owner = "NVIDIA";
-    repo = "NVTX";
-    rev = "e170594ac7cf1dac584da473d4ca9301087090c1";
-    hash = "sha256-n34BPxRnAW301ba1lXqSlGh7jaPqNjpp45GnJ+yDapI=";
-  };
-  src_PeachPy = fetchFromGitHub {
-    owner = "malfet";
-    repo = "PeachPy";
-    rev = "f45429b087dd7d5bc78bb40dc7cf06425c252d67";
-    hash = "sha256-eyhfnOOZPtsJwjkF6ybv3F77fyjaV6wzgu+LxadZVw0=";
-  };
-  src_VulkanMemoryAllocator = fetchFromGitHub {
-    owner = "GPUOpen-LibrariesAndSDKs";
-    repo = "VulkanMemoryAllocator";
-    rev = "a6bfc237255a6bac1513f7c1ebde6d8aed6b5191";
-    hash = "sha256-urUebQaPTgCECmm4Espri1HqYGy0ueAqTBu/VSiX/8I=";
-  };
-  src_XNNPACK = fetchFromGitHub {
-    owner = "google";
-    repo = "XNNPACK";
-    rev = "fcbf55af6cf28a4627bcd1f703ab7ad843f0f3a2";
-    hash = "sha256-lnycZPoswZQwRWJjR4if4qp8O9KhgYNbtwjNuoem48w=";
-  };
   src_asmjit = fetchFromGitHub {
     owner = "asmjit";
     repo = "asmjit";
@@ -72,12 +18,6 @@ assert version == "2.5.1";
     rev = "0d98dba29d66e93259db7daa53a9327df767a415";
     hash = "sha256-yUiFxi80FWBmTZgqmqTMf9oqcBeg3o4I4vKd4djyRWY=";
   };
-  src_benchmark_onnx = fetchFromGitHub {
-    owner = "google";
-    repo = "benchmark";
-    rev = "2dd015dfef425c866d9a43f2c67d8b52d709acb6";
-    hash = "sha256-pUW9YVaujs/y00/SiPqDgK4wvVsaM7QUp/65k0t7Yr0=";
-  };
   src_benchmark_opentelemetry-cpp = fetchFromGitHub {
     owner = "google";
     repo = "benchmark";
@@ -102,6 +42,12 @@ assert version == "2.5.1";
     rev = "6a00cbc4a9b8e68b71caf7f774b3f9c753ae84d5";
     hash = "sha256-IDUIuAvgCzWaHoTJUZrH15bqoVcP8bZk+Gs1Ae6/CpY=";
   };
+  src_composable_kernel = fetchFromGitHub {
+    owner = "ROCm";
+    repo = "composable_kernel";
+    rev = "50ee4267e27b875d149e642f4cebd47be1dc3b57";
+    hash = "sha256-COkyf+FZzX6OdOPCHkP2bXsVvSXK9UR9s7RHWRtIXUE=";
+  };
   src_cpp-httplib = fetchFromGitHub {
     owner = "yhirose";
     repo = "cpp-httplib";
@@ -117,8 +63,8 @@ assert version == "2.5.1";
   src_cpuinfo = fetchFromGitHub {
     owner = "pytorch";
     repo = "cpuinfo";
-    rev = "094fc30b9256f54dad5ad23bcbfb5de74781422f";
-    hash = "sha256-JbIEQ6jFprbMpeH8IBhuRo3VXxo8a32lmT4yfxSIEj0=";
+    rev = "1e83a2fdd3102f65c6f1fb602c1b320486218a99";
+    hash = "sha256-28cFACca+NYE8oKlP5aWXNCLeEjhWqJ6gRnFI+VxDvg=";
   };
   src_cpuinfo_fbgemm = fetchFromGitHub {
     owner = "pytorch";
@@ -129,8 +75,8 @@ assert version == "2.5.1";
   src_cudnn-frontend = fetchFromGitHub {
     owner = "NVIDIA";
     repo = "cudnn-frontend";
-    rev = "2533f5e5c1877fd76266133c1479ef1643ce3a8b";
-    hash = "sha256-z9HH/ZEPv+Nf0eB0npjJiakjXx6cwoesKKnYNS1r9TE=";
+    rev = "936021bfed8c91dc416af1588b2c4eca631a9e45";
+    hash = "sha256-hKqIWGxVco1qkKxDZjc+pUisIcYJwFjZobJZg1WgDvY=";
   };
   src_cutlass = fetchFromGitHub {
     owner = "NVIDIA";
@@ -144,6 +90,12 @@ assert version == "2.5.1";
     rev = "fc9ebc645b63f3a6bc80aaefde5c063fb72110d6";
     hash = "sha256-e2SwXNNwjl/1fV64b+mOJvwGDYeO1LFcqZGbNten37U=";
   };
+  src_DCGM = fetchFromGitHub {
+    owner = "NVIDIA";
+    repo = "DCGM";
+    rev = "ffde4e54bc7249a6039a5e6b45b395141e1217f9";
+    hash = "sha256-jlnq25byEep7wRF3luOIGaiaYjqSVaTBx02N6gE/ox8=";
+  };
   src_dynolog = fetchFromGitHub {
     owner = "facebookincubator";
     repo = "dynolog";
@@ -193,6 +145,18 @@ assert version == "2.5.1";
     rev = "0041a40c1350ba702d475b9c4ad62da77caea164";
     hash = "sha256-PtzSB2mekUT7bjhXC/+F5UpSUvcdIkXTWnIz+jkAUuU=";
   };
+  src_FP16 = fetchFromGitHub {
+    owner = "Maratyszcza";
+    repo = "FP16";
+    rev = "4dfe081cf6bcd15db339cf2680b9281b8451eeb3";
+    hash = "sha256-B27LtVnL52niaFgPW0pp5Uulub/Q3NvtSDkJNahrSBk=";
+  };
+  src_FXdiv = fetchFromGitHub {
+    owner = "Maratyszcza";
+    repo = "FXdiv";
+    rev = "b408327ac2a15ec3e43352421954f5b1967701d1";
+    hash = "sha256-BEjscsejYVhRxDAmah5DT3+bglp8G5wUTTYL7+HjWds=";
+  };
   src_gemmlowp = fetchFromGitHub {
     owner = "google";
     repo = "gemmlowp";
@@ -226,8 +190,8 @@ assert version == "2.5.1";
   src_googletest = fetchFromGitHub {
     owner = "google";
     repo = "googletest";
-    rev = "e2239ee6043f73722e7aa812a459f54a28552929";
-    hash = "sha256-SjlJxushfry13RGA7BCjYC9oZqV4z6x8dOiHfl/wpF0=";
+    rev = "b514bdc898e2951020cbdca1304b75f5950d1f59";
+    hash = "sha256-1OJ2SeSscRBNr7zZ/a8bJGIqAnhkg45re0j3DtPfcXM=";
   };
   src_googletest_dynolog = fetchFromGitHub {
     owner = "google";
@@ -253,6 +217,12 @@ assert version == "2.5.1";
     rev = "b796f7d44681514f58a683a3a71ff17c94edb0c1";
     hash = "sha256-LVLEn+e7c8013pwiLzJiiIObyrlbBHYaioO/SWbItPQ=";
   };
+  src_googletest_prometheus-cpp = fetchFromGitHub {
+    owner = "google";
+    repo = "googletest";
+    rev = "e2239ee6043f73722e7aa812a459f54a28552929";
+    hash = "sha256-SjlJxushfry13RGA7BCjYC9oZqV4z6x8dOiHfl/wpF0=";
+  };
   src_googletest_protobuf = fetchFromGitHub {
     owner = "google";
     repo = "googletest";
@@ -265,6 +235,12 @@ assert version == "2.5.1";
     rev = "aee0f9d9b5b87796ee8a0ab26b7587ec30e8858e";
     hash = "sha256-L2HR+QTQmagk92JiuW3TRx47so33xQvewdeYL1ipUPs=";
   };
+  src_GSL = fetchFromGitHub {
+    owner = "microsoft";
+    repo = "GSL";
+    rev = "6f4529395c5b7c2d661812257cd6780c67e54afa";
+    hash = "sha256-sNTDH1ohz+rcnBvA5KkarHKdRMQPW0c2LeSVPdEYx6Q=";
+  };
   src_hipify_torch = fetchFromGitHub {
     owner = "ROCmSoftwarePlatform";
     repo = "hipify_torch";
@@ -274,8 +250,8 @@ assert version == "2.5.1";
   src_ideep = fetchFromGitHub {
     owner = "intel";
     repo = "ideep";
-    rev = "41d636c2bbcea6bff0faf97cdb65a48cdde987af";
-    hash = "sha256-i4MK6zTScB0healwSoTNBP+UY2dHUfyyDUfBhDDSBCc=";
+    rev = "c7ccd5bdbe5434ba156f4e856dcef0601637334b";
+    hash = "sha256-/u3wJQl49tBw/QNVDBXL+eNSRCuvltso7g1+siIhlXM=";
   };
   src_ittapi = fetchFromGitHub {
     owner = "intel";
@@ -304,8 +280,8 @@ assert version == "2.5.1";
   src_kineto = fetchFromGitHub {
     owner = "pytorch";
     repo = "kineto";
-    rev = "d9753139d181b9ff42872465aac0e5d3018be415";
-    hash = "sha256-m1Uul9HKZLAiST7GQmvd9+9ziJSU+9Hjq8D24KiAyto=";
+    rev = "338140f58a28d599da3434ced4fd2d75dd1a213d";
+    hash = "sha256-ydHUYB2m7dbbqBtLordZUCraewU0Q4m/ohBXNKtqHnw=";
   };
   src_libnop = fetchFromGitHub {
     owner = "google";
@@ -337,11 +313,23 @@ assert version == "2.5.1";
     rev = "ab2b89c4c339bd7f816fbc114a4b05d386b66290";
     hash = "sha256-IF2tILwW8XnzSmfn7N1CO7jXL95gUp02guIW5n1eaig=";
   };
+  src_NNPACK = fetchFromGitHub {
+    owner = "Maratyszcza";
+    repo = "NNPACK";
+    rev = "c07e3a0400713d546e0dea2d5466dd22ea389c73";
+    hash = "sha256-GzF53u1ELtmEH3WbBzGBemlQhjj3EIKB+37wMtSYE2g=";
+  };
+  src_NVTX = fetchFromGitHub {
+    owner = "NVIDIA";
+    repo = "NVTX";
+    rev = "e170594ac7cf1dac584da473d4ca9301087090c1";
+    hash = "sha256-n34BPxRnAW301ba1lXqSlGh7jaPqNjpp45GnJ+yDapI=";
+  };
   src_onnx = fetchFromGitHub {
     owner = "onnx";
     repo = "onnx";
-    rev = "3bf92c03a9f27eba3bda1e5b9e63ea20ec213557";
-    hash = "sha256-JmxnsHRrzj2QzPz3Yndw0MmgZJ8MDYxHjuQ7PQkQsDg=";
+    rev = "b8baa8446686496da4cc8fda09f2b6fe65c2a02c";
+    hash = "sha256-9oORW0YlQ6SphqfbjcYb0dTlHc+1gzy9quH/Lj6By8Q=";
   };
   src_opentelemetry-cpp = fetchFromGitHub {
     owner = "open-telemetry";
@@ -361,6 +349,12 @@ assert version == "2.5.1";
     rev = "06b57f48ded1fa3bdd3d4346f6ef29e40e08eaf5";
     hash = "sha256-XlQi26ynXKDwA86DwsDw+hhKR8bcdnrtFH1CpAzVlLs=";
   };
+  src_PeachPy = fetchFromGitHub {
+    owner = "malfet";
+    repo = "PeachPy";
+    rev = "f45429b087dd7d5bc78bb40dc7cf06425c252d67";
+    hash = "sha256-eyhfnOOZPtsJwjkF6ybv3F77fyjaV6wzgu+LxadZVw0=";
+  };
   src_pfs = fetchFromGitHub {
     owner = "dtrugman";
     repo = "pfs";
@@ -392,22 +386,22 @@ assert version == "2.5.1";
     hash = "sha256-lV+VZi2b4SQlRYrhKx9Dxc6HlDEFz3newvcBjTekupo=";
   };
   src_pthreadpool = fetchFromGitHub {
-    owner = "Maratyszcza";
+    owner = "google";
     repo = "pthreadpool";
-    rev = "4fe0e1e183925bf8cfa6aae24237e724a96479b8";
-    hash = "sha256-R4YmNzWEELSkAws/ejmNVxqXDTJwcqjLU/o/HvgRn2E=";
+    rev = "b92447772365661680f486e39a91dfe6675adafc";
+    hash = "sha256-lRY+5sYv/KOuVngsrODRa4/yj1CDmZBW2HuKEbjsY+0=";
   };
   src_pybind11 = fetchFromGitHub {
     owner = "pybind";
     repo = "pybind11";
-    rev = "7c33cdc2d39c7b99a122579f53bc94c8eb3332ff";
-    hash = "sha256-cpxhrTFihA+gWmX62a+EQF3lccUyvu+d1MU2IC/CN6Q=";
+    rev = "a2e59f0e7065404b44dfe92a28aca47ba1378dc4";
+    hash = "sha256-SNLdtrOjaC3lGHN9MAqTf51U9EzNKQLyTMNPe0GcdrU=";
   };
   src_pybind11_onnx = fetchFromGitHub {
     owner = "pybind";
     repo = "pybind11";
-    rev = "5b0a6fc2017fcc176545afe3e09c9f9885283242";
-    hash = "sha256-n7nLEG2+sSR9wnxM+C8FWc2B+Mx74Pan1+IQf+h2bGU=";
+    rev = "3e9dfa2866941655c56877882565e7577de6fc7b";
+    hash = "sha256-DVkI5NxM5uME9m3PFYVpJOOa2j+yjL6AJn76fCTv2nE=";
   };
   src_pybind11_tensorpipe = fetchFromGitHub {
     owner = "pybind";
@@ -418,8 +412,8 @@ assert version == "2.5.1";
   src_pytorch = fetchFromGitHub {
     owner = "pytorch";
     repo = "pytorch";
-    rev = "v2.5.1";
-    hash = "sha256-GknW0DZAx2at+SwjKm2HrjCPuvaeXXm1PD7Vep/aTBQ=";
+    rev = "v2.6.0";
+    hash = "sha256-X58OPtnPplEFtzOrQzyYRwdTmaoWEOGWWF5v6y+vaWo=";
   };
   src_sleef = fetchFromGitHub {
     owner = "shibatch";
@@ -439,22 +433,25 @@ assert version == "2.5.1";
     rev = "8eb57355a4ffb410a2e94c07b4dca2dffbee8e50";
     hash = "sha256-u+4vyOphnowoaZgfkCbzF7Q4tuz2GN1bHylaKw352Lc=";
   };
-  src_DCGM_recursive = src_DCGM;
-  src_FP16_recursive = src_FP16;
-  src_FXdiv_recursive = src_FXdiv;
-  src_GSL_recursive = src_GSL;
-  src_NNPACK_recursive = src_NNPACK;
-  src_NVTX_recursive = src_NVTX;
-  src_PeachPy_recursive = src_PeachPy;
-  src_VulkanMemoryAllocator_recursive = src_VulkanMemoryAllocator;
-  src_XNNPACK_recursive = src_XNNPACK;
+  src_VulkanMemoryAllocator = fetchFromGitHub {
+    owner = "GPUOpen-LibrariesAndSDKs";
+    repo = "VulkanMemoryAllocator";
+    rev = "a6bfc237255a6bac1513f7c1ebde6d8aed6b5191";
+    hash = "sha256-urUebQaPTgCECmm4Espri1HqYGy0ueAqTBu/VSiX/8I=";
+  };
+  src_XNNPACK = fetchFromGitHub {
+    owner = "google";
+    repo = "XNNPACK";
+    rev = "4ea82e595b36106653175dcb04b2aa532660d0d8";
+    hash = "sha256-5IubxhCW5E6xzrOLfJzWPrPeftaxXApTx09p6B3NPgo=";
+  };
   src_asmjit_recursive = src_asmjit;
   src_benchmark_recursive = src_benchmark;
-  src_benchmark_onnx_recursive = src_benchmark_onnx;
   src_benchmark_opentelemetry-cpp_recursive = src_benchmark_opentelemetry-cpp;
   src_benchmark_protobuf_recursive = src_benchmark_protobuf;
   src_civetweb_recursive = src_civetweb;
   src_clang-cindex-python3_recursive = src_clang-cindex-python3;
+  src_composable_kernel_recursive = src_composable_kernel;
   src_cpp-httplib_recursive = src_cpp-httplib;
   src_cpr_recursive = src_cpr;
   src_cpuinfo_recursive = src_cpuinfo;
@@ -462,12 +459,13 @@ assert version == "2.5.1";
   src_cudnn-frontend_recursive = src_cudnn-frontend;
   src_cutlass_recursive = src_cutlass;
   src_cutlass_fbgemm_recursive = src_cutlass_fbgemm;
+  src_DCGM_recursive = src_DCGM;
   src_dynolog_recursive = runCommand "dynolog" { } ''
     cp -r ${src_dynolog} $out
-    chmod u+w $out/third_party/DCGM
-    cp -r ${src_DCGM_recursive}/* $out/third_party/DCGM
     chmod u+w $out/third_party/cpr
     cp -r ${src_cpr_recursive}/* $out/third_party/cpr
+    chmod u+w $out/third_party/DCGM
+    cp -r ${src_DCGM_recursive}/* $out/third_party/DCGM
     chmod u+w $out/third_party/fmt
     cp -r ${src_fmt_dynolog_recursive}/* $out/third_party/fmt
     chmod u+w $out/third_party/gflags
@@ -500,6 +498,8 @@ assert version == "2.5.1";
   src_fmt_recursive = src_fmt;
   src_fmt_dynolog_recursive = src_fmt_dynolog;
   src_fmt_kineto_recursive = src_fmt_kineto;
+  src_FP16_recursive = src_FP16;
+  src_FXdiv_recursive = src_FXdiv;
   src_gemmlowp_recursive = src_gemmlowp;
   src_gflags_recursive = runCommand "gflags" { } ''
     cp -r ${src_gflags} $out
@@ -514,8 +514,10 @@ assert version == "2.5.1";
   src_googletest_fbgemm_recursive = src_googletest_fbgemm;
   src_googletest_kineto_recursive = src_googletest_kineto;
   src_googletest_opentelemetry-cpp_recursive = src_googletest_opentelemetry-cpp;
+  src_googletest_prometheus-cpp_recursive = src_googletest_prometheus-cpp;
   src_googletest_protobuf_recursive = src_googletest_protobuf;
   src_googletest_tensorpipe_recursive = src_googletest_tensorpipe;
+  src_GSL_recursive = src_GSL;
   src_hipify_torch_recursive = src_hipify_torch;
   src_ideep_recursive = runCommand "ideep" { } ''
     cp -r ${src_ideep} $out
@@ -540,10 +542,10 @@ assert version == "2.5.1";
   src_mimalloc_recursive = src_mimalloc;
   src_mkl-dnn_recursive = src_mkl-dnn;
   src_nccl_recursive = src_nccl;
+  src_NNPACK_recursive = src_NNPACK;
+  src_NVTX_recursive = src_NVTX;
   src_onnx_recursive = runCommand "onnx" { } ''
     cp -r ${src_onnx} $out
-    chmod u+w $out/third_party/benchmark
-    cp -r ${src_benchmark_onnx_recursive}/* $out/third_party/benchmark
     chmod u+w $out/third_party/pybind11
     cp -r ${src_pybind11_onnx_recursive}/* $out/third_party/pybind11
   '';
@@ -568,6 +570,7 @@ assert version == "2.5.1";
   '';
   src_opentelemetry-proto_recursive = src_opentelemetry-proto;
   src_opentracing-cpp_recursive = src_opentracing-cpp;
+  src_PeachPy_recursive = src_PeachPy;
   src_pfs_recursive = src_pfs;
   src_pocketfft_recursive = src_pocketfft;
   src_prometheus-cpp_recursive = runCommand "prometheus-cpp" { } ''
@@ -575,7 +578,7 @@ assert version == "2.5.1";
     chmod u+w $out/3rdparty/civetweb
     cp -r ${src_civetweb_recursive}/* $out/3rdparty/civetweb
     chmod u+w $out/3rdparty/googletest
-    cp -r ${src_googletest_recursive}/* $out/3rdparty/googletest
+    cp -r ${src_googletest_prometheus-cpp_recursive}/* $out/3rdparty/googletest
   '';
   src_protobuf_recursive = runCommand "protobuf" { } ''
     cp -r ${src_protobuf} $out
@@ -597,20 +600,10 @@ assert version == "2.5.1";
     cp -r ${src_pytorch} $out
     chmod u+w $out/android/libs/fbjni
     cp -r ${src_fbjni_recursive}/* $out/android/libs/fbjni
-    chmod u+w $out/third_party/FP16
-    cp -r ${src_FP16_recursive}/* $out/third_party/FP16
-    chmod u+w $out/third_party/FXdiv
-    cp -r ${src_FXdiv_recursive}/* $out/third_party/FXdiv
-    chmod u+w $out/third_party/NNPACK
-    cp -r ${src_NNPACK_recursive}/* $out/third_party/NNPACK
-    chmod u+w $out/third_party/NVTX
-    cp -r ${src_NVTX_recursive}/* $out/third_party/NVTX
-    chmod u+w $out/third_party/VulkanMemoryAllocator
-    cp -r ${src_VulkanMemoryAllocator_recursive}/* $out/third_party/VulkanMemoryAllocator
-    chmod u+w $out/third_party/XNNPACK
-    cp -r ${src_XNNPACK_recursive}/* $out/third_party/XNNPACK
     chmod u+w $out/third_party/benchmark
     cp -r ${src_benchmark_recursive}/* $out/third_party/benchmark
+    chmod u+w $out/third_party/composable_kernel
+    cp -r ${src_composable_kernel_recursive}/* $out/third_party/composable_kernel
     chmod u+w $out/third_party/cpp-httplib
     cp -r ${src_cpp-httplib_recursive}/* $out/third_party/cpp-httplib
     chmod u+w $out/third_party/cpuinfo
@@ -627,6 +620,10 @@ assert version == "2.5.1";
     cp -r ${src_flatbuffers_recursive}/* $out/third_party/flatbuffers
     chmod u+w $out/third_party/fmt
     cp -r ${src_fmt_recursive}/* $out/third_party/fmt
+    chmod u+w $out/third_party/FP16
+    cp -r ${src_FP16_recursive}/* $out/third_party/FP16
+    chmod u+w $out/third_party/FXdiv
+    cp -r ${src_FXdiv_recursive}/* $out/third_party/FXdiv
     chmod u+w $out/third_party/gemmlowp/gemmlowp
     cp -r ${src_gemmlowp_recursive}/* $out/third_party/gemmlowp/gemmlowp
     chmod u+w $out/third_party/gloo
@@ -645,6 +642,10 @@ assert version == "2.5.1";
     cp -r ${src_nccl_recursive}/* $out/third_party/nccl/nccl
     chmod u+w $out/third_party/nlohmann
     cp -r ${src_json_recursive}/* $out/third_party/nlohmann
+    chmod u+w $out/third_party/NNPACK
+    cp -r ${src_NNPACK_recursive}/* $out/third_party/NNPACK
+    chmod u+w $out/third_party/NVTX
+    cp -r ${src_NVTX_recursive}/* $out/third_party/NVTX
     chmod u+w $out/third_party/onnx
     cp -r ${src_onnx_recursive}/* $out/third_party/onnx
     chmod u+w $out/third_party/opentelemetry-cpp
@@ -665,6 +666,10 @@ assert version == "2.5.1";
     cp -r ${src_sleef_recursive}/* $out/third_party/sleef
     chmod u+w $out/third_party/tensorpipe
     cp -r ${src_tensorpipe_recursive}/* $out/third_party/tensorpipe
+    chmod u+w $out/third_party/VulkanMemoryAllocator
+    cp -r ${src_VulkanMemoryAllocator_recursive}/* $out/third_party/VulkanMemoryAllocator
+    chmod u+w $out/third_party/XNNPACK
+    cp -r ${src_XNNPACK_recursive}/* $out/third_party/XNNPACK
   '';
   src_sleef_recursive = src_sleef;
   src_tensorpipe_recursive = runCommand "tensorpipe" { } ''
@@ -679,5 +684,7 @@ assert version == "2.5.1";
     cp -r ${src_pybind11_tensorpipe_recursive}/* $out/third_party/pybind11
   '';
   src_vcpkg_recursive = src_vcpkg;
+  src_VulkanMemoryAllocator_recursive = src_VulkanMemoryAllocator;
+  src_XNNPACK_recursive = src_XNNPACK;
 }).src_pytorch_recursive
 # Update using: unroll-src [version]
diff --git a/pkgs/development/python-modules/torch/xnnpack-bfloat16.patch b/pkgs/development/python-modules/torch/xnnpack-bfloat16.patch
new file mode 100644
index 000000000000..7788b7723c9d
--- /dev/null
+++ b/pkgs/development/python-modules/torch/xnnpack-bfloat16.patch
@@ -0,0 +1,21 @@
+diff --git a/third_party/XNNPACK/src/reference/unary-elementwise.cc b/third_party/XNNPACK/src/reference/unary-elementwise.cc
+index bd95ded6c..da892d8be 100644
+--- a/third_party/XNNPACK/src/reference/unary-elementwise.cc
++++ b/third_party/XNNPACK/src/reference/unary-elementwise.cc
+@@ -127,6 +127,16 @@ struct ConvertOp {
+   }
+ };
+ 
++#ifdef XNN_HAVE_FLOAT16
++template <>
++struct ConvertOp<xnn_bfloat16, _Float16> {
++  explicit ConvertOp(const xnn_unary_uparams*) {}
++  _Float16 operator()(xnn_bfloat16 x) const {
++    return static_cast<_Float16>(static_cast<float>(x));
++  }
++};
++#endif
++
+ template <typename TIn, typename TOut>
+ const xnn_unary_elementwise_config* get_convert_config(
+     std::true_type /*input_quantized*/, std::true_type /*output_quantized*/) {
diff --git a/pkgs/development/python-modules/torchaudio/bin.nix b/pkgs/development/python-modules/torchaudio/bin.nix
index 297be21cf59d..0271a1325424 100644
--- a/pkgs/development/python-modules/torchaudio/bin.nix
+++ b/pkgs/development/python-modules/torchaudio/bin.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "torchaudio";
-  version = "2.5.1";
+  version = "2.6.0";
   format = "wheel";
 
   src =
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     in
     fetchurl srcs;
 
-  disabled = (pythonOlder "3.9") || (pythonAtLeast "3.13");
+  disabled = (pythonOlder "3.9") || (pythonAtLeast "3.14");
 
   buildInputs =
     [
diff --git a/pkgs/development/python-modules/torchaudio/binary-hashes.nix b/pkgs/development/python-modules/torchaudio/binary-hashes.nix
index 7ae70136b171..d306f5205c2f 100644
--- a/pkgs/development/python-modules/torchaudio/binary-hashes.nix
+++ b/pkgs/development/python-modules/torchaudio/binary-hashes.nix
@@ -7,66 +7,81 @@
 
 version:
 builtins.getAttr version {
-  "2.5.1" = {
+  "2.6.0" = {
     x86_64-linux-39 = {
-      name = "torchaudio-2.5.1-cp39-cp39-linux_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cu124/torchaudio-2.5.1%2Bcu124-cp39-cp39-linux_x86_64.whl";
-      hash = "sha256-rHPCnEhWhGO+vGC0srILAdLt3bH1E15mFT8a+F458/0=";
+      name = "torchaudio-2.6.0-cp39-cp39-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cu124/torchaudio-2.6.0%2Bcu124-cp39-cp39-linux_x86_64.whl";
+      hash = "sha256-EYTNqjrjUTXZGDw+ionYOeQU6ioUu8qrDIgzNpq7WvY=";
     };
     x86_64-linux-310 = {
-      name = "torchaudio-2.5.1-cp310-cp310-linux_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cu124/torchaudio-2.5.1%2Bcu124-cp310-cp310-linux_x86_64.whl";
-      hash = "sha256-CXWT7fMvCoRQq6eCK4CX0vJHb+lsCrmTMdEsNHADGAs=";
+      name = "torchaudio-2.6.0-cp310-cp310-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cu124/torchaudio-2.6.0%2Bcu124-cp310-cp310-linux_x86_64.whl";
+      hash = "sha256-a1T5f/+WtLo9pEtrP1ByfCUSLRR5EHsRnRJ1lE7IPqE=";
     };
     x86_64-linux-311 = {
-      name = "torchaudio-2.5.1-cp311-cp311-linux_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cu124/torchaudio-2.5.1%2Bcu124-cp311-cp311-linux_x86_64.whl";
-      hash = "sha256-6Yk43MROuquL2DeVRXhM/d/COuF3hziUSLf/mRjcPfk=";
+      name = "torchaudio-2.6.0-cp311-cp311-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cu124/torchaudio-2.6.0%2Bcu124-cp311-cp311-linux_x86_64.whl";
+      hash = "sha256-uMFdfg6BojYwot5VLrrP5mQ5kNyJD4P0JuQ/9i7+hlE=";
     };
     x86_64-linux-312 = {
-      name = "torchaudio-2.5.1-cp312-cp312-linux_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cu124/torchaudio-2.5.1%2Bcu124-cp312-cp312-linux_x86_64.whl";
-      hash = "sha256-mQJZjgMwrurQvBVFg3gE6yaFSbm0zkGuPKUbI4SQTok=";
+      name = "torchaudio-2.6.0-cp312-cp312-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cu124/torchaudio-2.6.0%2Bcu124-cp312-cp312-linux_x86_64.whl";
+      hash = "sha256-Pl/6aWBhccdPPiuWl4Xq1Qt4LKZX50aq7h7nzIjc/Ag=";
+    };
+    x86_64-linux-313 = {
+      name = "torchaudio-2.6.0-cp313-cp313-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cu124/torchaudio-2.6.0%2Bcu124-cp313-cp313-linux_x86_64.whl";
+      hash = "sha256-G8I5Y/RHyRCgBgsTCwS0B9LqIYsqVT5nTIKdXxfrjI4=";
     };
     aarch64-darwin-39 = {
-      name = "torchaudio-2.5.1-cp39-cp39-macosx_11_0_arm64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torchaudio-2.5.1-cp39-cp39-macosx_11_0_arm64.whl";
-      hash = "sha256-pAoOSyOFZKGb8TjGTVk8e1LZfIc3hD2F1soJIWJBrmY=";
+      name = "torchaudio-2.6.0-cp39-cp39-macosx_11_0_arm64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torchaudio-2.6.0-cp39-cp39-macosx_11_0_arm64.whl";
+      hash = "sha256-BIA6lpcQvbd6Td/bhaMvqbngMQ3JH3635U1gg91pv6s=";
     };
     aarch64-darwin-310 = {
-      name = "torchaudio-2.5.1-cp310-cp310-macosx_11_0_arm64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torchaudio-2.5.1-cp310-cp310-macosx_11_0_arm64.whl";
-      hash = "sha256-kBKR13Cu6x9Rkgu1qnP/gum38mNUo8e5DYD/C06aUEQ=";
+      name = "torchaudio-2.6.0-cp310-cp310-macosx_11_0_arm64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torchaudio-2.6.0-cp310-cp310-macosx_11_0_arm64.whl";
+      hash = "sha256-Dtoc2Hb0T8AU3ASqaA2y+jVag99dg0OY223V9c2RH0w=";
     };
     aarch64-darwin-311 = {
-      name = "torchaudio-2.5.1-cp311-cp311-macosx_11_0_arm64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torchaudio-2.5.1-cp311-cp311-macosx_11_0_arm64.whl";
-      hash = "sha256-cAU1Sqfdqe+QjhPCVm7h/gvW1/W64Fg7XlMBbNIp/DQ=";
+      name = "torchaudio-2.6.0-cp311-cp311-macosx_11_0_arm64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torchaudio-2.6.0-cp311-cp311-macosx_11_0_arm64.whl";
+      hash = "sha256-wS/EEkG43848zBkX8cgaD5L1MtmRdwZgAEbx6yHS12U=";
     };
     aarch64-darwin-312 = {
-      name = "torchaudio-2.5.1-cp312-cp312-macosx_11_0_arm64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torchaudio-2.5.1-cp312-cp312-macosx_11_0_arm64.whl";
-      hash = "sha256-8cv9/Ru9++conUenTzb/bF2HwyBWBiAv71p/tpP2HPA=";
+      name = "torchaudio-2.6.0-cp312-cp312-macosx_11_0_arm64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torchaudio-2.6.0-cp312-cp312-macosx_11_0_arm64.whl";
+      hash = "sha256-fQ5LCMQjJb9LiH3polxE7YgplwAXQOG9fZAfZVgc8as=";
+    };
+    aarch64-darwin-313 = {
+      name = "torchaudio-2.6.0-cp313-cp313-macosx_11_0_arm64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torchaudio-2.6.0-cp313-cp313-macosx_11_0_arm64.whl";
+      hash = "sha256-ZvLgvVq1b9gUGdL1r7dKmnAUFohZRkZEF1bIwk9CSnM=";
     };
     aarch64-linux-39 = {
-      name = "torchaudio-2.5.1-cp39-cp39-manylinux2014_aarch64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torchaudio-2.5.1-cp39-cp39-linux_aarch64.whl";
-      hash = "sha256-0pNJlElV6wYed0/k2e6kaBxbyf9C6jmod/jxTeHk7QA=";
+      name = "torchaudio-2.6.0-cp39-cp39-manylinux2014_aarch64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torchaudio-2.6.0-cp39-cp39-linux_aarch64.whl";
+      hash = "sha256-cudwVdjnQkdcbfrPWfqwmx/JTUQj4UiX4Yi2fK04UcY=";
     };
     aarch64-linux-310 = {
-      name = "torchaudio-2.5.1-cp310-cp310-manylinux2014_aarch64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torchaudio-2.5.1-cp310-cp310-linux_aarch64.whl";
-      hash = "sha256-mzhyxd1QgL5jIpCNYjZVgaHdklDj3W1HurP1sIVKXR8=";
+      name = "torchaudio-2.6.0-cp310-cp310-manylinux2014_aarch64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torchaudio-2.6.0-cp310-cp310-linux_aarch64.whl";
+      hash = "sha256-nY4HeJRS79uBMtYq/iHyKTpygF8mwokcbFPk5N843fY=";
     };
     aarch64-linux-311 = {
-      name = "torchaudio-2.5.1-cp311-cp311-manylinux2014_aarch64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torchaudio-2.5.1-cp311-cp311-linux_aarch64.whl";
-      hash = "sha256-S6JHaacr1oaQP+rxBAyJXXEK8v+80l7nqXlO4oVWGyY=";
+      name = "torchaudio-2.6.0-cp311-cp311-manylinux2014_aarch64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torchaudio-2.6.0-cp311-cp311-linux_aarch64.whl";
+      hash = "sha256-Dw21yZfQMcNAZti+HAzn0qHytsAWqSiFsgsAv+sXt1M=";
     };
     aarch64-linux-312 = {
-      name = "torchaudio-2.5.1-cp312-cp312-manylinux2014_aarch64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torchaudio-2.5.1-cp312-cp312-linux_aarch64.whl";
-      hash = "sha256-a7ZUFkBfQOALIHASV8FudJO/3XGI4C6HzFs4nDHBDCw=";
+      name = "torchaudio-2.6.0-cp312-cp312-manylinux2014_aarch64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torchaudio-2.6.0-cp312-cp312-linux_aarch64.whl";
+      hash = "sha256-YpHZUH3B1rT/6IQ/v7IB5sgnDdjEKtcLt2ImwOvcrVY=";
+    };
+    aarch64-linux-313 = {
+      name = "torchaudio-2.6.0-cp313-cp313-manylinux2014_aarch64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torchaudio-2.6.0-cp313-cp313-linux_aarch64.whl";
+      hash = "sha256-tSHqlhj7TCmm+AcWKBcMIiKR9GpIo79CTP60iPVK9xQ=";
     };
   };
 }
diff --git a/pkgs/development/python-modules/torchaudio/default.nix b/pkgs/development/python-modules/torchaudio/default.nix
index a217b02f0cf5..cf815f685435 100644
--- a/pkgs/development/python-modules/torchaudio/default.nix
+++ b/pkgs/development/python-modules/torchaudio/default.nix
@@ -76,39 +76,27 @@ let
 in
 buildPythonPackage rec {
   pname = "torchaudio";
-  version = "2.5.1";
+  version = "2.6.0";
   pyproject = true;
 
+  stdenv = torch.stdenv;
+
   src = fetchFromGitHub {
     owner = "pytorch";
     repo = "audio";
     tag = "v${version}";
-    hash = "sha256-BRn4EZ7bIujGA6b/tdMu9yDqJNEaf/f1Kj45aLHC/JI=";
+    hash = "sha256-WNdDBB2nShbPPW7GU5cMij00u5PUdN+j5pm41yrKnCA=";
   };
 
   patches = [
     ./0001-setup.py-propagate-cmakeFlags.patch
-
-    # fix missing FLT_MAX symbol (dropped in CUDA 12.5)
-    # https://github.com/pytorch/audio/pull/3811
-    # drop after update to torchaudio 2.6.0
-    (fetchpatch {
-      url = "https://github.com/pytorch/audio/commit/7797f83e1d66ff78872763e1da3a5fb2f0534c40.patch";
-      hash = "sha256-mHFCWuHhveyUP9cN0Kn6GXZsC3njTcM2ONVaB/qK1zU=";
-    })
   ];
 
-  postPatch =
-    ''
-      substituteInPlace setup.py \
-        --replace 'print(" --- Initializing submodules")' "return" \
-        --replace "_fetch_archives(_parse_sources())" "pass"
-    ''
-    + lib.optionalString rocmSupport ''
-      # There is no .info/version-dev, only .info/version
-      substituteInPlace cmake/LoadHIP.cmake \
-        --replace "/.info/version-dev" "/.info/version"
-    '';
+  postPatch = lib.optionalString rocmSupport ''
+    # There is no .info/version-dev, only .info/version
+    substituteInPlace cmake/LoadHIP.cmake \
+      --replace-fail "/.info/version-dev" "/.info/version"
+  '';
 
   env = {
     TORCH_CUDA_ARCH_LIST = "${lib.concatStringsSep ";" torch.cudaCapabilities}";
@@ -163,16 +151,16 @@ buildPythonPackage rec {
 
   doCheck = false; # requires sox backend
 
+  pythonImportsCheck = [ "torchaudio" ];
+
   meta = {
     description = "PyTorch audio library";
     homepage = "https://pytorch.org/";
     changelog = "https://github.com/pytorch/audio/releases/tag/v${version}";
     license = lib.licenses.bsd2;
-    platforms = [
-      "aarch64-darwin"
-      "aarch64-linux"
-      "x86_64-linux"
-    ];
+    platforms =
+      lib.platforms.linux
+      ++ lib.optionals (!cudaSupport && !rocmSupport) lib.platforms.darwin;
     maintainers = with lib.maintainers; [ junjihashimoto ];
   };
 }
diff --git a/pkgs/development/python-modules/torchaudio/prefetch.sh b/pkgs/development/python-modules/torchaudio/prefetch.sh
index 64b5011773b1..eae765e5f434 100755
--- a/pkgs/development/python-modules/torchaudio/prefetch.sh
+++ b/pkgs/development/python-modules/torchaudio/prefetch.sh
@@ -15,14 +15,17 @@ url_and_key_list=(
     "x86_64-linux-310 $linux_cuda_bucket/torchaudio-${version}%2B${linux_cuda_version}-cp310-cp310-linux_x86_64.whl torchaudio-${version}-cp310-cp310-linux_x86_64.whl"
     "x86_64-linux-311 $linux_cuda_bucket/torchaudio-${version}%2B${linux_cuda_version}-cp311-cp311-linux_x86_64.whl torchaudio-${version}-cp311-cp311-linux_x86_64.whl"
     "x86_64-linux-312 $linux_cuda_bucket/torchaudio-${version}%2B${linux_cuda_version}-cp312-cp312-linux_x86_64.whl torchaudio-${version}-cp312-cp312-linux_x86_64.whl"
+    "x86_64-linux-313 $linux_cuda_bucket/torchaudio-${version}%2B${linux_cuda_version}-cp313-cp313-linux_x86_64.whl torchaudio-${version}-cp313-cp313-linux_x86_64.whl"
     "aarch64-darwin-39 $darwin_bucket/torchaudio-${version}-cp39-cp39-macosx_11_0_arm64.whl torchaudio-${version}-cp39-cp39-macosx_11_0_arm64.whl"
     "aarch64-darwin-310 $darwin_bucket/torchaudio-${version}-cp310-cp310-macosx_11_0_arm64.whl torchaudio-${version}-cp310-cp310-macosx_11_0_arm64.whl"
     "aarch64-darwin-311 $darwin_bucket/torchaudio-${version}-cp311-cp311-macosx_11_0_arm64.whl torchaudio-${version}-cp311-cp311-macosx_11_0_arm64.whl"
     "aarch64-darwin-312 $darwin_bucket/torchaudio-${version}-cp312-cp312-macosx_11_0_arm64.whl torchaudio-${version}-cp312-cp312-macosx_11_0_arm64.whl"
+    "aarch64-darwin-313 $darwin_bucket/torchaudio-${version}-cp313-cp313-macosx_11_0_arm64.whl torchaudio-${version}-cp313-cp313-macosx_11_0_arm64.whl"
     "aarch64-linux-39 $linux_cpu_bucket/torchaudio-${version}-cp39-cp39-linux_aarch64.whl torchaudio-${version}-cp39-cp39-manylinux2014_aarch64.whl"
     "aarch64-linux-310 $linux_cpu_bucket/torchaudio-${version}-cp310-cp310-linux_aarch64.whl torchaudio-${version}-cp310-cp310-manylinux2014_aarch64.whl"
     "aarch64-linux-311 $linux_cpu_bucket/torchaudio-${version}-cp311-cp311-linux_aarch64.whl torchaudio-${version}-cp311-cp311-manylinux2014_aarch64.whl"
     "aarch64-linux-312 $linux_cpu_bucket/torchaudio-${version}-cp312-cp312-linux_aarch64.whl torchaudio-${version}-cp312-cp312-manylinux2014_aarch64.whl"
+    "aarch64-linux-313 $linux_cpu_bucket/torchaudio-${version}-cp313-cp313-linux_aarch64.whl torchaudio-${version}-cp313-cp313-manylinux2014_aarch64.whl"
 )
 
 hashfile=binary-hashes-"$version".nix
diff --git a/pkgs/development/python-modules/torchvision/bin.nix b/pkgs/development/python-modules/torchvision/bin.nix
index 68b48711de37..8c29192ea609 100644
--- a/pkgs/development/python-modules/torchvision/bin.nix
+++ b/pkgs/development/python-modules/torchvision/bin.nix
@@ -23,7 +23,7 @@ let
   pyVerNoDot = builtins.replaceStrings [ "." ] [ "" ] python.pythonVersion;
   srcs = import ./binary-hashes.nix version;
   unsupported = throw "Unsupported system";
-  version = "0.20.1";
+  version = "0.21.0";
 in
 buildPythonPackage {
   inherit version;
@@ -34,7 +34,7 @@ buildPythonPackage {
 
   src = fetchurl srcs."${stdenv.system}-${pyVerNoDot}" or unsupported;
 
-  disabled = (pythonOlder "3.9") || (pythonAtLeast "3.13");
+  disabled = (pythonOlder "3.9") || (pythonAtLeast "3.14");
 
   # Note that we don't rely on config.cudaSupport here, because the Linux wheels all come built with CUDA support.
   buildInputs =
diff --git a/pkgs/development/python-modules/torchvision/binary-hashes.nix b/pkgs/development/python-modules/torchvision/binary-hashes.nix
index ae7b3b798517..2efff98c9c3f 100644
--- a/pkgs/development/python-modules/torchvision/binary-hashes.nix
+++ b/pkgs/development/python-modules/torchvision/binary-hashes.nix
@@ -7,66 +7,81 @@
 
 version:
 builtins.getAttr version {
-  "0.20.1" = {
+  "0.21.0" = {
     x86_64-linux-39 = {
-      name = "torchvision-0.20.1-cp39-cp39-linux_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cu124/torchvision-0.20.1%2Bcu124-cp39-cp39-linux_x86_64.whl";
-      hash = "sha256-C/Tizgi8dJVzTcVAlTxlmQ5C67fJ7Sfi/3lRVLrvXMA=";
+      name = "torchvision-0.21.0-cp39-cp39-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cu124/torchvision-0.21.0%2Bcu124-cp39-cp39-linux_x86_64.whl";
+      hash = "sha256-avshoi9Ul+COpNvUVERyMw2CSb8J2v0jkwJVLK1pBrI=";
     };
     x86_64-linux-310 = {
-      name = "torchvision-0.20.1-cp310-cp310-linux_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cu124/torchvision-0.20.1%2Bcu124-cp310-cp310-linux_x86_64.whl";
-      hash = "sha256-OgVeTpBAsSmHjVfDnbVfEX+XWJn/MN1wyPJiHZEXDb4=";
+      name = "torchvision-0.21.0-cp310-cp310-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cu124/torchvision-0.21.0%2Bcu124-cp310-cp310-linux_x86_64.whl";
+      hash = "sha256-PT50AY6qeDfHPjdk2tO3eSt1REAcJaQpd+l0QwNzG9M=";
     };
     x86_64-linux-311 = {
-      name = "torchvision-0.20.1-cp311-cp311-linux_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cu124/torchvision-0.20.1%2Bcu124-cp311-cp311-linux_x86_64.whl";
-      hash = "sha256-pffrXvIvNKfRj8vCe2wB993lzVMN8xHNvdMRafkcvZg=";
+      name = "torchvision-0.21.0-cp311-cp311-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cu124/torchvision-0.21.0%2Bcu124-cp311-cp311-linux_x86_64.whl";
+      hash = "sha256-E3N2gFrKW6V70sej7LhWnflh2+grEoqsmzsKcSXvk4U=";
     };
     x86_64-linux-312 = {
-      name = "torchvision-0.20.1-cp312-cp312-linux_x86_64.whl";
-      url = "https://download.pytorch.org/whl/cu124/torchvision-0.20.1%2Bcu124-cp312-cp312-linux_x86_64.whl";
-      hash = "sha256-0QU+xQVFSefawmE7FRv/4yPzySSTnSlt9NfTSSWq860=";
+      name = "torchvision-0.21.0-cp312-cp312-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cu124/torchvision-0.21.0%2Bcu124-cp312-cp312-linux_x86_64.whl";
+      hash = "sha256-77U+oK978Jt7U+Khi5vm0kX31GqQtR1c+X836bkpqZE=";
+    };
+    x86_64-linux-313 = {
+      name = "torchvision-0.21.0-cp313-cp313-linux_x86_64.whl";
+      url = "https://download.pytorch.org/whl/cu124/torchvision-0.21.0%2Bcu124-cp313-cp313-linux_x86_64.whl";
+      hash = "sha256-S3Cs87S5agzrE3QRZibJvvnovgFrV7EoTkgiYMoYltY=";
     };
     aarch64-darwin-39 = {
-      name = "torchvision-0.20.1-cp39-cp39-macosx_11_0_arm64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torchvision-0.20.1-cp39-cp39-macosx_11_0_arm64.whl";
-      hash = "sha256-LNWEBpeLgTGIz06RNbIYd1tX4LuG1KiPAzmHS4oiSBk=";
+      name = "torchvision-0.21.0-cp39-cp39-macosx_11_0_arm64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torchvision-0.21.0-cp39-cp39-macosx_11_0_arm64.whl";
+      hash = "sha256-XCLK6q6LPDbZNFnxpSlOb0MwbP+FbtJDGJoikzGkBLQ=";
     };
     aarch64-darwin-310 = {
-      name = "torchvision-0.20.1-cp310-cp310-macosx_11_0_arm64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torchvision-0.20.1-cp310-cp310-macosx_11_0_arm64.whl";
-      hash = "sha256-SHj++5bvKT0GwnIQkYrcg8OZ2fqvNM2lpj4Sn3cjKPE=";
+      name = "torchvision-0.21.0-cp310-cp310-macosx_11_0_arm64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torchvision-0.21.0-cp310-cp310-macosx_11_0_arm64.whl";
+      hash = "sha256-BE6kILjGwxYqI0ytqOICW5B2+oJQR1jNEexdD4zZ+jc=";
     };
     aarch64-darwin-311 = {
-      name = "torchvision-0.20.1-cp311-cp311-macosx_11_0_arm64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torchvision-0.20.1-cp311-cp311-macosx_11_0_arm64.whl";
-      hash = "sha256-NEsznhXmu7We4HAHcmFtCv79IJkgx2KxYENo2MNFgyI=";
+      name = "torchvision-0.21.0-cp311-cp311-macosx_11_0_arm64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torchvision-0.21.0-cp311-cp311-macosx_11_0_arm64.whl";
+      hash = "sha256-EQ0RUzNSTWDp5HTVPH0g8Jbb2KCAIy+I3duQVm+QBkw=";
     };
     aarch64-darwin-312 = {
-      name = "torchvision-0.20.1-cp312-cp312-macosx_11_0_arm64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torchvision-0.20.1-cp312-cp312-macosx_11_0_arm64.whl";
-      hash = "sha256-GjElb/lF1k8Aa7MGgTp8laUx/ha/slNcg33UwQRTPXo=";
+      name = "torchvision-0.21.0-cp312-cp312-macosx_11_0_arm64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torchvision-0.21.0-cp312-cp312-macosx_11_0_arm64.whl";
+      hash = "sha256-l6WBSpPHk6rwF5z8f5FgJPS2MhiSmu6Xe2RWM9B0pJ8=";
+    };
+    aarch64-darwin-313 = {
+      name = "torchvision-0.21.0-cp313-cp313-macosx_11_0_arm64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torchvision-0.21.0-cp313-cp313-macosx_11_0_arm64.whl";
+      hash = "sha256-ZZt2yGdXyy7kyi2yReB0DPwwgf70bw8QZNEa20qM7jE=";
     };
     aarch64-linux-39 = {
-      name = "torchvision-0.20.1-cp39-cp39-linux_aarch64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torchvision-0.20.1-cp39-cp39-linux_aarch64.whl";
-      hash = "sha256-q8uABd6Nw5Pb0TEOy2adxoq2ZLkQevbWmKY0HR0/LDw=";
+      name = "torchvision-0.21.0-cp39-cp39-linux_aarch64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torchvision-0.21.0-cp39-cp39-linux_aarch64.whl";
+      hash = "sha256-a9zjiQ+pSSGd4SnoXk9tVEWYrzwHOv5cROFK7RW9y7I=";
     };
     aarch64-linux-310 = {
-      name = "torchvision-0.20.1-cp310-cp310-linux_aarch64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torchvision-0.20.1-cp310-cp310-linux_aarch64.whl";
-      hash = "sha256-dfik1RpZPEurbJv311vdiGkbAKU7B2VmeLxVo6dT3XM=";
+      name = "torchvision-0.21.0-cp310-cp310-linux_aarch64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torchvision-0.21.0-cp310-cp310-linux_aarch64.whl";
+      hash = "sha256-VIFeClbd6VzG7JUld/Z+DcFR6t2Sjo2fan+CHWmkpzQ=";
     };
     aarch64-linux-311 = {
-      name = "torchvision-0.20.1-cp311-cp311-linux_aarch64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torchvision-0.20.1-cp311-cp311-linux_aarch64.whl";
-      hash = "sha256-pA12Y0WSdjnaMixpOTTl+RsboiGIRscQS4aN6iMUzo4=";
+      name = "torchvision-0.21.0-cp311-cp311-linux_aarch64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torchvision-0.21.0-cp311-cp311-linux_aarch64.whl";
+      hash = "sha256-VEVJI6UBBMZqmra9i3OhHC/CGMlksQBtXR/ltELD3LY=";
     };
     aarch64-linux-312 = {
-      name = "torchvision-0.20.1-cp312-cp312-linux_aarch64.whl";
-      url = "https://download.pytorch.org/whl/cpu/torchvision-0.20.1-cp312-cp312-linux_aarch64.whl";
-      hash = "sha256-n4U7pEl6xGkYFa1BtSPuI89bpPh7HOhp1wQFLiM8qLc=";
+      name = "torchvision-0.21.0-cp312-cp312-linux_aarch64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torchvision-0.21.0-cp312-cp312-linux_aarch64.whl";
+      hash = "sha256-UIOlsf7CNRv16pkAp0HVQIbbdbrsSx0h45RR4Al38bE=";
+    };
+    aarch64-linux-313 = {
+      name = "torchvision-0.21.0-cp313-cp313-linux_aarch64.whl";
+      url = "https://download.pytorch.org/whl/cpu/torchvision-0.21.0-cp313-cp313-linux_aarch64.whl";
+      hash = "sha256-UEWjpfIew+6mli+l8votQoP4VMrsJa2kk/z0qrKSVGc=";
     };
   };
 }
diff --git a/pkgs/development/python-modules/torchvision/default.nix b/pkgs/development/python-modules/torchvision/default.nix
index 99aa4418cc42..2167be82381f 100644
--- a/pkgs/development/python-modules/torchvision/default.nix
+++ b/pkgs/development/python-modules/torchvision/default.nix
@@ -22,23 +22,25 @@
 
   # tests
   pytest,
+  writableTmpDirAsHomeHook,
 }:
 
 let
   inherit (torch) cudaCapabilities cudaPackages cudaSupport;
-  inherit (cudaPackages) backendStdenv;
 
   pname = "torchvision";
-  version = "0.20.1";
+  version = "0.21.0";
 in
 buildPythonPackage {
   inherit pname version;
 
+  stdenv = torch.stdenv;
+
   src = fetchFromGitHub {
     owner = "pytorch";
     repo = "vision";
     tag = "v${version}";
-    hash = "sha256-BXvi4LoO2LZtNSE8lvFzcN4H2nN2fRg5/s7KRci7rMM=";
+    hash = "sha256-eDWw1Lt/sUc2Xt6cqOM5xaOfmsm+NEL5lZO+cIJKMtU=";
   };
 
   nativeBuildInputs = [
@@ -74,24 +76,24 @@ buildPythonPackage {
       export TORCHVISION_INCLUDE="${libjpeg_turbo.dev}/include/"
       export TORCHVISION_LIBRARY="${libjpeg_turbo}/lib/"
     ''
-    # NOTE: We essentially override the compilers provided by stdenv because we don't have a hook
-    #   for cudaPackages to swap in compilers supported by NVCC.
     + lib.optionalString cudaSupport ''
-      export CC=${backendStdenv.cc}/bin/cc
-      export CXX=${backendStdenv.cc}/bin/c++
       export TORCH_CUDA_ARCH_LIST="${lib.concatStringsSep ";" cudaCapabilities}"
       export FORCE_CUDA=1
     '';
 
-  # tries to download many datasets for tests
+  # tests download big datasets, models, require internet connection, etc.
   doCheck = false;
 
   pythonImportsCheck = [ "torchvision" ];
-  checkPhase = ''
-    HOME=$TMPDIR py.test test --ignore=test/test_datasets_download.py
-  '';
 
-  nativeCheckInputs = [ pytest ];
+  nativeCheckInputs = [
+    pytest
+    writableTmpDirAsHomeHook
+  ];
+
+  checkPhase = ''
+    py.test test --ignore=test/test_datasets_download.py
+  '';
 
   meta = {
     description = "PyTorch vision library";
diff --git a/pkgs/development/python-modules/torchvision/prefetch.sh b/pkgs/development/python-modules/torchvision/prefetch.sh
index 4e5acf3a7a67..bd6d92cf6578 100755
--- a/pkgs/development/python-modules/torchvision/prefetch.sh
+++ b/pkgs/development/python-modules/torchvision/prefetch.sh
@@ -14,14 +14,17 @@ url_and_key_list=(
   "x86_64-linux-310 $linux_bucket/torchvision-${version}%2B${linux_cuda_version}-cp310-cp310-linux_x86_64.whl torchvision-${version}-cp310-cp310-linux_x86_64.whl"
   "x86_64-linux-311 $linux_bucket/torchvision-${version}%2B${linux_cuda_version}-cp311-cp311-linux_x86_64.whl torchvision-${version}-cp311-cp311-linux_x86_64.whl"
   "x86_64-linux-312 $linux_bucket/torchvision-${version}%2B${linux_cuda_version}-cp312-cp312-linux_x86_64.whl torchvision-${version}-cp312-cp312-linux_x86_64.whl"
+  "x86_64-linux-313 $linux_bucket/torchvision-${version}%2B${linux_cuda_version}-cp313-cp313-linux_x86_64.whl torchvision-${version}-cp313-cp313-linux_x86_64.whl"
   "aarch64-darwin-39 $darwin_bucket/torchvision-${version}-cp39-cp39-macosx_11_0_arm64.whl torchvision-${version}-cp39-cp39-macosx_11_0_arm64.whl"
   "aarch64-darwin-310 $darwin_bucket/torchvision-${version}-cp310-cp310-macosx_11_0_arm64.whl torchvision-${version}-cp310-cp310-macosx_11_0_arm64.whl"
   "aarch64-darwin-311 $darwin_bucket/torchvision-${version}-cp311-cp311-macosx_11_0_arm64.whl torchvision-${version}-cp311-cp311-macosx_11_0_arm64.whl"
   "aarch64-darwin-312 $darwin_bucket/torchvision-${version}-cp312-cp312-macosx_11_0_arm64.whl torchvision-${version}-cp312-cp312-macosx_11_0_arm64.whl"
+  "aarch64-darwin-313 $darwin_bucket/torchvision-${version}-cp313-cp313-macosx_11_0_arm64.whl torchvision-${version}-cp313-cp313-macosx_11_0_arm64.whl"
   "aarch64-linux-39 $darwin_bucket/torchvision-${version}-cp39-cp39-linux_aarch64.whl torchvision-${version}-cp39-cp39-linux_aarch64.whl"
   "aarch64-linux-310 $darwin_bucket/torchvision-${version}-cp310-cp310-linux_aarch64.whl torchvision-${version}-cp310-cp310-linux_aarch64.whl"
   "aarch64-linux-311 $darwin_bucket/torchvision-${version}-cp311-cp311-linux_aarch64.whl torchvision-${version}-cp311-cp311-linux_aarch64.whl"
   "aarch64-linux-312 $darwin_bucket/torchvision-${version}-cp312-cp312-linux_aarch64.whl torchvision-${version}-cp312-cp312-linux_aarch64.whl"
+  "aarch64-linux-313 $darwin_bucket/torchvision-${version}-cp313-cp313-linux_aarch64.whl torchvision-${version}-cp313-cp313-linux_aarch64.whl"
 )
 
 hashfile="binary-hashes-$version.nix"
diff --git a/pkgs/development/python-modules/uamqp/default.nix b/pkgs/development/python-modules/uamqp/default.nix
index 46decc51d931..89769859cdf7 100644
--- a/pkgs/development/python-modules/uamqp/default.nix
+++ b/pkgs/development/python-modules/uamqp/default.nix
@@ -7,11 +7,8 @@
   setuptools,
   cython,
   certifi,
-  CFNetwork,
   cmake,
-  CoreFoundation,
   openssl,
-  Security,
   pytestCheckHook,
   pytest-asyncio,
 }:
@@ -61,13 +58,7 @@ buildPythonPackage rec {
     cmake
   ];
 
-  buildInputs =
-    [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CoreFoundation
-      CFNetwork
-      Security
-    ];
+  buildInputs = [ openssl ];
 
   dependencies = [ certifi ];
 
diff --git a/pkgs/development/python-modules/uharfbuzz/default.nix b/pkgs/development/python-modules/uharfbuzz/default.nix
index fb53613cf789..b04167f1e6db 100644
--- a/pkgs/development/python-modules/uharfbuzz/default.nix
+++ b/pkgs/development/python-modules/uharfbuzz/default.nix
@@ -1,6 +1,5 @@
 {
   lib,
-  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
   pythonOlder,
@@ -9,7 +8,6 @@
   setuptools,
   setuptools-scm,
   pytestCheckHook,
-  ApplicationServices,
 }:
 
 buildPythonPackage rec {
@@ -39,8 +37,6 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ ApplicationServices ];
-
   nativeCheckInputs = [ pytestCheckHook ];
 
   pythonImportsCheck = [ "uharfbuzz" ];
diff --git a/pkgs/development/python-modules/uvloop/default.nix b/pkgs/development/python-modules/uvloop/default.nix
index 5976e3249e2e..4814c6bbcd34 100644
--- a/pkgs/development/python-modules/uvloop/default.nix
+++ b/pkgs/development/python-modules/uvloop/default.nix
@@ -4,6 +4,7 @@
   buildPythonPackage,
   pythonOlder,
   fetchPypi,
+  fetchpatch,
 
   # build-system
   cython,
@@ -11,8 +12,6 @@
 
   # native dependencies
   libuv,
-  CoreServices,
-  ApplicationServices,
 
   # tests
   psutil,
@@ -32,6 +31,20 @@ buildPythonPackage rec {
     hash = "sha256-O/ErD9poRHgGp62Ee/pZFhMXcnXTW2ckse5XP6o3BOM=";
   };
 
+  patches = [
+    # fix test failures on Python 3.13
+    # (remove on next update)
+    (fetchpatch {
+      url = "https://github.com/MagicStack/uvloop/commit/96b7ed31afaf02800d779a395591da6a2c8c50e1.patch";
+      hash = "sha256-Nbe3BuIuwlylll5fIYij+OiP90ZeFNI0GKHK9SwWRk8=";
+      excludes = [ ".github/workflows/tests.yml" ];
+    })
+    (fetchpatch {
+      url = "https://github.com/MagicStack/uvloop/commit/56807922f847ddac231a53d5b03eef70092b987c.patch";
+      hash = "sha256-X5Ob1t/CRy9csw2JrWvwS55G6qTqZhIuGLTy83O03GU=";
+    })
+  ];
+
   postPatch = ''
     rm -rf vendor
 
@@ -46,12 +59,7 @@ buildPythonPackage rec {
 
   env.LIBUV_CONFIGURE_HOST = stdenv.hostPlatform.config;
 
-  buildInputs =
-    [ libuv ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CoreServices
-      ApplicationServices
-    ];
+  buildInputs = [ libuv ];
 
   nativeCheckInputs = [
     pyopenssl
diff --git a/pkgs/development/python-modules/vllm/default.nix b/pkgs/development/python-modules/vllm/default.nix
index 9261ba0ef101..0c14e61f4b87 100644
--- a/pkgs/development/python-modules/vllm/default.nix
+++ b/pkgs/development/python-modules/vllm/default.nix
@@ -57,15 +57,18 @@
   blake3,
   depyf,
   opencv-python-headless,
+  cachetools,
+  llguidance,
+  python-json-logger,
+  python-multipart,
+  llvmPackages,
 
-  config,
-
-  cudaSupport ? config.cudaSupport,
+  cudaSupport ? torch.cudaSupport,
   cudaPackages ? { },
-  rocmSupport ? config.rocmSupport,
+  rocmSupport ? torch.rocmSupport,
   rocmPackages ? { },
   gpuTargets ? [ ],
-}@args:
+}:
 
 let
   inherit (lib)
@@ -80,12 +83,39 @@ let
     pkg: if pkg != null && lib.meta.availableOn stdenv.hostPlatform pkg then pkg else null;
 
   # see CMakeLists.txt, grepping for GIT_TAG near cutlass
-  # https://github.com/vllm-project/vllm/blob/${version}/CMakeLists.txt
+  # https://github.com/vllm-project/vllm/blob/v${version}/CMakeLists.txt
   cutlass = fetchFromGitHub {
     owner = "NVIDIA";
     repo = "cutlass";
-    tag = "v3.7.0";
-    hash = "sha256-GUTRXmv3DiM/GN5Bvv2LYovMLKZMlMhoKv4O0g627gs=";
+    tag = "v3.8.0";
+    hash = "sha256-oIzlbKRdOh6gp6nRZ8udLSqleBFoFtgM7liCBlHZLOk=";
+  };
+
+  flashmla = stdenv.mkDerivation {
+    pname = "flashmla";
+    # https://github.com/vllm-project/FlashMLA/blob/${src.rev}/setup.py
+    version = "1.0.0";
+
+    # grep for GIT_TAG in the following file
+    # https://github.com/vllm-project/vllm/blob/v${version}/cmake/external_projects/flashmla.cmake
+    src = fetchFromGitHub {
+      owner = "vllm-project";
+      repo = "FlashMLA";
+      rev = "575f7724b9762f265bbee5889df9c7d630801845";
+      hash = "sha256-8WrKMl0olr0nYV4FRJfwSaJ0F5gWQpssoFMjr9tbHBk=";
+    };
+
+    dontConfigure = true;
+
+    # flashmla normally relies on `git submodule update` to fetch cutlass
+    buildPhase = ''
+      rm -rf csrc/cutlass
+      ln -sf ${cutlass} csrc/cutlass
+    '';
+
+    installPhase = ''
+      cp -rva . $out
+    '';
   };
 
   vllm-flash-attn = stdenv.mkDerivation {
@@ -93,13 +123,13 @@ let
     # https://github.com/vllm-project/flash-attention/blob/${src.rev}/vllm_flash_attn/__init__.py
     version = "2.7.2.post1";
 
-    # see CMakeLists.txt, grepping for GIT_TAG near vllm-flash-attn
-    # https://github.com/vllm-project/vllm/blob/${version}/CMakeLists.txt
+    # grep for GIT_TAG in the following file
+    # https://github.com/vllm-project/vllm/blob/v${version}/cmake/external_projects/vllm_flash_attn.cmake
     src = fetchFromGitHub {
       owner = "vllm-project";
       repo = "flash-attention";
-      rev = "720c94869cf2e0ff5a706e9c7f1dce0939686ade";
-      hash = "sha256-UXbBfzBCOBjRRAAOhIzt0E27VjC6xu4G1CkZfu9LKRs=";
+      rev = "dc9d410b3e2d6534a4c70724c2515f4def670a22";
+      hash = "sha256-ZQ0bOBIb+8IMmya8dmimKQ17KTBplX81IirdnBJpX5M=";
     };
 
     dontConfigure = true;
@@ -117,7 +147,7 @@ let
 
   cpuSupport = !cudaSupport && !rocmSupport;
 
-  # https://github.com/pytorch/pytorch/blob/v2.4.0/torch/utils/cpp_extension.py#L1953
+  # https://github.com/pytorch/pytorch/blob/v2.6.0/torch/utils/cpp_extension.py#L2046-L2048
   supportedTorchCudaCapabilities =
     let
       real = [
@@ -138,6 +168,7 @@ let
         "8.9"
         "9.0"
         "9.0a"
+        "10.0"
       ];
       ptx = lists.map (x: "${x}+PTX") real;
     in
@@ -197,16 +228,16 @@ in
 
 buildPythonPackage rec {
   pname = "vllm";
-  version = "0.7.3";
+  version = "0.8.3";
   pyproject = true;
 
-  stdenv = if cudaSupport then cudaPackages.backendStdenv else args.stdenv;
+  stdenv = torch.stdenv;
 
   src = fetchFromGitHub {
     owner = "vllm-project";
     repo = pname;
     tag = "v${version}";
-    hash = "sha256-gudlikAjwZNkniKRPJYm7beoti8eHp5LaRV2/UNEibo=";
+    hash = "sha256-LiEBkVwJTT4WoCTk9pI0ykTjmv1pDMzksmFwVktoxMY=";
   };
 
   patches = [
@@ -223,12 +254,6 @@ buildPythonPackage rec {
         --replace-fail \
           'set(PYTHON_SUPPORTED_VERSIONS' \
           'set(PYTHON_SUPPORTED_VERSIONS "${lib.versions.majorMinor python.version}"'
-
-      # Relax torch dependency manually because the nonstandard requirements format
-      # is not caught by pythonRelaxDeps
-      substituteInPlace requirements*.txt pyproject.toml \
-        --replace-warn 'torch==2.5.1' 'torch==${lib.getVersion torch}' \
-        --replace-warn 'torch == 2.5.1' 'torch == ${lib.getVersion torch}'
     ''
     + lib.optionalString (nccl == null) ''
       # On platforms where NCCL is not supported (e.g. Jetson), substitute Gloo (provided by Torch)
@@ -265,19 +290,21 @@ buildPythonPackage rec {
       setuptools-scm
       torch
     ]
-    ++ (lib.optionals cpuSupport ([
-      numactl
+    ++ lib.optionals cpuSupport [
       oneDNN
-    ]))
-    ++ (
-      lib.optionals cudaSupport mergedCudaLibraries
+    ]
+    ++ lib.optionals (cpuSupport && stdenv.isLinux) [
+      numactl
+    ]
+    ++ lib.optionals cudaSupport (
+      mergedCudaLibraries
       ++ (with cudaPackages; [
         nccl
         cudnn
         libcufile
       ])
     )
-    ++ (lib.optionals rocmSupport (
+    ++ lib.optionals rocmSupport (
       with rocmPackages;
       [
         clr
@@ -286,14 +313,19 @@ buildPythonPackage rec {
         hipsparse
         hipblas
       ]
-    ));
+    )
+    ++ lib.optionals stdenv.cc.isClang [
+      llvmPackages.openmp
+    ];
 
   dependencies =
     [
       aioprometheus
       blake3
+      cachetools
       depyf
       fastapi
+      llguidance
       lm-format-enforcer
       numpy
       openai
@@ -305,6 +337,8 @@ buildPythonPackage rec {
       py-cpuinfo
       pyarrow
       pydantic
+      python-json-logger
+      python-multipart
       pyzmq
       ray
       sentencepiece
@@ -337,6 +371,7 @@ buildPythonPackage rec {
   cmakeFlags =
     [
       (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_CUTLASS" "${lib.getDev cutlass}")
+      (lib.cmakeFeature "FLASH_MLA_SRC_DIR" "${lib.getDev flashmla}")
       (lib.cmakeFeature "VLLM_FLASH_ATTN_SRC_DIR" "${lib.getDev vllm-flash-attn}")
     ]
     ++ lib.optionals cudaSupport [
@@ -392,8 +427,5 @@ buildPythonPackage rec {
       happysalada
       lach
     ];
-
-    # CPU support relies on unpackaged dependency `intel_extension_for_pytorch`
-    broken = cpuSupport;
   };
 }
diff --git a/pkgs/development/python-modules/watchfiles/Cargo.lock b/pkgs/development/python-modules/watchfiles/Cargo.lock
deleted file mode 100644
index 6ea51faff769..000000000000
--- a/pkgs/development/python-modules/watchfiles/Cargo.lock
+++ /dev/null
@@ -1,468 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 3
-
-[[package]]
-name = "autocfg"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c4b4d0bd25bd0b74681c0ad21497610ce1b7c91b1022cd21c80c6fbdd9476b0"
-
-[[package]]
-name = "bitflags"
-version = "1.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
-
-[[package]]
-name = "bitflags"
-version = "2.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b048fb63fd8b5923fc5aa7b340d8e156aec7ec02f0c78fa8a6ddc2613f6f71de"
-
-[[package]]
-name = "cc"
-version = "1.0.96"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "065a29261d53ba54260972629f9ca6bffa69bac13cd1fed61420f7fa68b9f8bd"
-
-[[package]]
-name = "cfg-if"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
-
-[[package]]
-name = "crossbeam-channel"
-version = "0.5.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab3db02a9c5b5121e1e42fbdb1aeb65f5e02624cc58c43f2884c6ccac0b82f95"
-dependencies = [
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-utils"
-version = "0.8.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "248e3bacc7dc6baa3b21e405ee045c3047101a49145e7e9eca583ab4c2ca5345"
-
-[[package]]
-name = "filetime"
-version = "0.2.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf401df4a4e3872c4fe8151134cf483738e74b67fc934d6532c882b3d24a4550"
-dependencies = [
- "cfg-if",
- "libc",
- "libredox",
- "windows-sys 0.59.0",
-]
-
-[[package]]
-name = "fsevent-sys"
-version = "4.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76ee7a02da4d231650c7cea31349b889be2f45ddb3ef3032d2ec8185f6313fd2"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "heck"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
-
-[[package]]
-name = "indoc"
-version = "2.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b248f5224d1d606005e02c97f5aa4e88eeb230488bcc03bc9ca4d7991399f2b5"
-
-[[package]]
-name = "inotify"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fdd168d97690d0b8c412d6b6c10360277f4d7ee495c5d0d5d5fe0854923255cc"
-dependencies = [
- "bitflags 1.3.2",
- "inotify-sys",
- "libc",
-]
-
-[[package]]
-name = "inotify-sys"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e05c02b5e89bff3b946cedeca278abc628fe811e604f027c45a8aa3cf793d0eb"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "instant"
-version = "0.1.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e0242819d153cba4b4b05a5a8f2a7e9bbf97b6055b2a002b395c96b5ff3c0222"
-dependencies = [
- "cfg-if",
-]
-
-[[package]]
-name = "kqueue"
-version = "1.0.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7447f1ca1b7b563588a205fe93dea8df60fd981423a768bc1c0ded35ed147d0c"
-dependencies = [
- "kqueue-sys",
- "libc",
-]
-
-[[package]]
-name = "kqueue-sys"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed9625ffda8729b85e45cf04090035ac368927b8cebc34898e7c120f52e4838b"
-dependencies = [
- "bitflags 1.3.2",
- "libc",
-]
-
-[[package]]
-name = "libc"
-version = "0.2.169"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5aba8db14291edd000dfcc4d620c7ebfb122c613afb886ca8803fa4e128a20a"
-
-[[package]]
-name = "libredox"
-version = "0.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0ff37bd590ca25063e35af745c343cb7a0271906fb7b37e4813e8f79f00268d"
-dependencies = [
- "bitflags 2.6.0",
- "libc",
- "redox_syscall",
-]
-
-[[package]]
-name = "log"
-version = "0.4.22"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7a70ba024b9dc04c27ea2f0c0548feb474ec5c54bba33a7f72f873a39d07b24"
-
-[[package]]
-name = "memoffset"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
-dependencies = [
- "autocfg",
-]
-
-[[package]]
-name = "mio"
-version = "1.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2886843bf800fba2e3377cff24abf6379b4c4d5c6681eaf9ea5b0d15090450bd"
-dependencies = [
- "libc",
- "log",
- "wasi",
- "windows-sys 0.52.0",
-]
-
-[[package]]
-name = "notify"
-version = "7.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c533b4c39709f9ba5005d8002048266593c1cfaf3c5f0739d5b8ab0c6c504009"
-dependencies = [
- "bitflags 2.6.0",
- "filetime",
- "fsevent-sys",
- "inotify",
- "kqueue",
- "libc",
- "log",
- "mio",
- "notify-types",
- "walkdir",
- "windows-sys 0.52.0",
-]
-
-[[package]]
-name = "notify-types"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "585d3cb5e12e01aed9e8a1f70d5c6b5e86fe2a6e48fc8cd0b3e0b8df6f6eb174"
-dependencies = [
- "instant",
-]
-
-[[package]]
-name = "once_cell"
-version = "1.19.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
-
-[[package]]
-name = "portable-atomic"
-version = "1.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7170ef9988bc169ba16dd36a7fa041e5c4cbeb6a35b76d4c03daded371eae7c0"
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.81"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d1597b0c024618f09a9c3b8655b7e430397a36d23fdafec26d6965e9eec3eba"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "pyo3"
-version = "0.23.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e484fd2c8b4cb67ab05a318f1fd6fa8f199fcc30819f08f07d200809dba26c15"
-dependencies = [
- "cfg-if",
- "indoc",
- "libc",
- "memoffset",
- "once_cell",
- "portable-atomic",
- "pyo3-build-config",
- "pyo3-ffi",
- "pyo3-macros",
- "unindent",
-]
-
-[[package]]
-name = "pyo3-build-config"
-version = "0.23.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc0e0469a84f208e20044b98965e1561028180219e35352a2afaf2b942beff3b"
-dependencies = [
- "once_cell",
- "python3-dll-a",
- "target-lexicon",
-]
-
-[[package]]
-name = "pyo3-ffi"
-version = "0.23.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb1547a7f9966f6f1a0f0227564a9945fe36b90da5a93b3933fc3dc03fae372d"
-dependencies = [
- "libc",
- "pyo3-build-config",
-]
-
-[[package]]
-name = "pyo3-macros"
-version = "0.23.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fdb6da8ec6fa5cedd1626c886fc8749bdcbb09424a86461eb8cdf096b7c33257"
-dependencies = [
- "proc-macro2",
- "pyo3-macros-backend",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "pyo3-macros-backend"
-version = "0.23.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38a385202ff5a92791168b1136afae5059d3ac118457bb7bc304c197c2d33e7d"
-dependencies = [
- "heck",
- "proc-macro2",
- "pyo3-build-config",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "python3-dll-a"
-version = "0.2.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b9e268ee1be609e93a13eb06839f68f67e5fe0fb4049834d261c2d5091c1b6d"
-dependencies = [
- "cc",
-]
-
-[[package]]
-name = "quote"
-version = "1.0.36"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fa76aaf39101c457836aec0ce2316dbdc3ab723cdda1c6bd4e6ad4208acaca7"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "redox_syscall"
-version = "0.5.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a908a6e00f1fdd0dfd9c0eb08ce85126f6d8bbda50017e74bc4a4b7d4a926a4"
-dependencies = [
- "bitflags 2.6.0",
-]
-
-[[package]]
-name = "same-file"
-version = "1.0.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
-dependencies = [
- "winapi-util",
-]
-
-[[package]]
-name = "syn"
-version = "2.0.60"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "909518bc7b1c9b779f1bbf07f2929d35af9f0f37e47c6e9ef7f9dddc1e1821f3"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "target-lexicon"
-version = "0.12.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e1fc403891a21bcfb7c37834ba66a547a8f402146eba7265b5a6d88059c9ff2f"
-
-[[package]]
-name = "unicode-ident"
-version = "1.0.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
-
-[[package]]
-name = "unindent"
-version = "0.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7de7d73e1754487cb58364ee906a499937a0dfabd86bcb980fa99ec8c8fa2ce"
-
-[[package]]
-name = "walkdir"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
-dependencies = [
- "same-file",
- "winapi-util",
-]
-
-[[package]]
-name = "wasi"
-version = "0.11.0+wasi-snapshot-preview1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
-
-[[package]]
-name = "watchfiles_rust_notify"
-version = "1.0.4"
-dependencies = [
- "crossbeam-channel",
- "notify",
- "pyo3",
-]
-
-[[package]]
-name = "winapi-util"
-version = "0.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf221c93e13a30d793f7645a0e7762c55d169dbb0a49671918a2319d289b10bb"
-dependencies = [
- "windows-sys 0.59.0",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.52.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
-dependencies = [
- "windows-targets",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.59.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
-dependencies = [
- "windows-targets",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
-dependencies = [
- "windows_aarch64_gnullvm",
- "windows_aarch64_msvc",
- "windows_i686_gnu",
- "windows_i686_gnullvm",
- "windows_i686_msvc",
- "windows_x86_64_gnu",
- "windows_x86_64_gnullvm",
- "windows_x86_64_msvc",
-]
-
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
-
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
-
-[[package]]
-name = "windows_i686_gnu"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
-
-[[package]]
-name = "windows_i686_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
-
-[[package]]
-name = "windows_i686_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
-
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
-
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
diff --git a/pkgs/development/python-modules/watchfiles/default.nix b/pkgs/development/python-modules/watchfiles/default.nix
index 89b8e2bb0267..b6dcbfd889e6 100644
--- a/pkgs/development/python-modules/watchfiles/default.nix
+++ b/pkgs/development/python-modules/watchfiles/default.nix
@@ -1,54 +1,43 @@
 {
   lib,
-  stdenv,
-  anyio,
   buildPythonPackage,
-  cargo,
   fetchFromGitHub,
   rustPlatform,
-  rustc,
-  pythonOlder,
+  anyio,
+
+  # tests
   dirty-equals,
   pytest-mock,
   pytest-timeout,
   pytestCheckHook,
-  typing-extensions,
-  CoreServices,
-  libiconv,
+  versionCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "watchfiles";
-  version = "1.0.4";
+  version = "1.0.5";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
-
   src = fetchFromGitHub {
     owner = "samuelcolvin";
-    repo = pname;
+    repo = "watchfiles";
     tag = "v${version}";
-    hash = "sha256-0JBnUi/aRM9UFTkb8OkP9UkJV+BF2EieZptymRvAXc0=";
+    hash = "sha256-a6SHqYRNMGXNkVvwj9RpLj449dAQtWXO44v1ko5suaw=";
   };
 
-  cargoDeps = rustPlatform.importCargoLock {
-    lockFile = ./Cargo.lock;
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit pname src version;
+    hash = "sha256-2RMWxeOjitbEqer9+ETpMX9WxHEiPzVmEv7LpSiaRVg=";
   };
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    CoreServices
-    libiconv
-  ];
-
   nativeBuildInputs = [
     rustPlatform.cargoSetupHook
-    cargo
-    rustc
+    rustPlatform.maturinBuildHook
   ];
 
-  build-system = [ rustPlatform.maturinBuildHook ];
-
-  dependencies = [ anyio ];
+  dependencies = [
+    anyio
+  ];
 
   # Tests need these permissions in order to use the FSEvents API on macOS.
   sandboxProfile = ''
@@ -60,11 +49,9 @@ buildPythonPackage rec {
     pytest-mock
     pytest-timeout
     pytestCheckHook
+    versionCheckHook
   ];
-
-  postPatch = ''
-    sed -i "/^requires-python =.*/a version = '${version}'" pyproject.toml
-  '';
+  versionCheckProgramArg = "--version";
 
   preCheck = ''
     rm -rf watchfiles
@@ -77,11 +64,12 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "watchfiles" ];
 
-  meta = with lib; {
+  meta = {
     description = "File watching and code reload";
-    mainProgram = "watchfiles";
     homepage = "https://watchfiles.helpmanual.io/";
-    license = licenses.mit;
-    maintainers = with maintainers; [ fab ];
+    changelog = "https://github.com/samuelcolvin/watchfiles/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "watchfiles";
   };
 }
diff --git a/pkgs/development/python-modules/webrtc-noise-gain/default.nix b/pkgs/development/python-modules/webrtc-noise-gain/default.nix
index c258cc774af1..2ca4717e7e6e 100644
--- a/pkgs/development/python-modules/webrtc-noise-gain/default.nix
+++ b/pkgs/development/python-modules/webrtc-noise-gain/default.nix
@@ -10,7 +10,6 @@
 
   # native dependencies
   abseil-cpp,
-  darwin,
 
   # tests
   pytestCheckHook,
@@ -43,9 +42,7 @@ buildPythonPackage rec {
     setuptools
   ];
 
-  buildInputs = [
-    abseil-cpp
-  ] ++ lib.optionals (stdenv.hostPlatform.isDarwin) [ darwin.apple_sdk.frameworks.CoreServices ];
+  buildInputs = [ abseil-cpp ];
 
   pythonImportsCheck = [ "webrtc_noise_gain" ];
 
diff --git a/pkgs/development/python-modules/zenoh/default.nix b/pkgs/development/python-modules/zenoh/default.nix
index 56dde703451e..dc4fa38e9961 100644
--- a/pkgs/development/python-modules/zenoh/default.nix
+++ b/pkgs/development/python-modules/zenoh/default.nix
@@ -5,8 +5,6 @@
   cargo,
   rustPlatform,
   rustc,
-  stdenv,
-  darwin,
 }:
 
 buildPythonPackage rec {
@@ -33,8 +31,6 @@ buildPythonPackage rec {
     rustc
   ];
 
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.frameworks.Security;
-
   pythonImportsCheck = [
     "zenoh"
   ];
diff --git a/pkgs/development/python-modules/zxing-cpp/default.nix b/pkgs/development/python-modules/zxing-cpp/default.nix
index 42372a283f39..0f900b55b7c2 100644
--- a/pkgs/development/python-modules/zxing-cpp/default.nix
+++ b/pkgs/development/python-modules/zxing-cpp/default.nix
@@ -7,6 +7,7 @@
   pybind11,
   libzxing-cpp,
   pytestCheckHook,
+  zint,
 }:
 
 buildPythonPackage rec {
@@ -20,20 +21,28 @@ buildPythonPackage rec {
   # https://pybind11.readthedocs.io/en/stable/installing.html#include-with-pypi
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace "pybind11[global]" "pybind11"
+      --replace-fail "pybind11[global]" "pybind11"
+
+    substituteInPlace setup.py \
+      --replace-fail "cfg = 'Debug' if self.debug else 'Release'" "cfg = 'Release'" \
+      --replace-fail " '-DVERSION_INFO=' + self.distribution.get_version()]" " '-DVERSION_INFO=' + self.distribution.get_version(), '-DZXING_DEPENDENCIES=LOCAL', '-DZXING_USE_BUNDLED_ZINT=OFF']"
   '';
 
   dontUseCmakeConfigure = true;
 
-  propagatedBuildInputs = [ numpy ];
+  build-system = [
+    setuptools-scm
+    pybind11
+  ];
 
-  buildInputs = [ pybind11 ];
+  dependencies = [ numpy ];
 
   nativeBuildInputs = [
     cmake
-    setuptools-scm
   ];
 
+  buildInputs = [ zint ];
+
   nativeCheckInputs = [
     pillow
     pytestCheckHook
diff --git a/pkgs/development/r-modules/default.nix b/pkgs/development/r-modules/default.nix
index f8ab40aa3f1e..cb7bf4399fbc 100644
--- a/pkgs/development/r-modules/default.nix
+++ b/pkgs/development/r-modules/default.nix
@@ -25,7 +25,6 @@ let
 
   buildRPackage = pkgs.callPackage ./generic-builder.nix {
     inherit R;
-    inherit (pkgs.darwin.apple_sdk.frameworks) Cocoa Foundation;
     inherit (pkgs) gettext gfortran;
   };
 
diff --git a/pkgs/development/r-modules/generic-builder.nix b/pkgs/development/r-modules/generic-builder.nix
index bac4f53212b8..e66342c19b24 100644
--- a/pkgs/development/r-modules/generic-builder.nix
+++ b/pkgs/development/r-modules/generic-builder.nix
@@ -4,8 +4,6 @@
   R,
   xvfb-run,
   util-linux,
-  Cocoa,
-  Foundation,
   gettext,
   gfortran,
   libiconv,
@@ -31,8 +29,6 @@ stdenv.mkDerivation (
         xvfb-run
       ]
       ++ lib.optionals stdenv.hostPlatform.isDarwin [
-        Cocoa
-        Foundation
         gfortran
         libiconv
       ];
diff --git a/pkgs/development/ruby-modules/gem-config/default.nix b/pkgs/development/ruby-modules/gem-config/default.nix
index 41cc80bc34e2..c1cd72394c8a 100644
--- a/pkgs/development/ruby-modules/gem-config/default.nix
+++ b/pkgs/development/ruby-modules/gem-config/default.nix
@@ -104,7 +104,6 @@
   shared-mime-info,
   libthai,
   libdatrie,
-  CoreServices,
   DarwinTools,
   cctools,
   libtool,
@@ -629,10 +628,6 @@ in
       '';
   };
 
-  hitimes = attrs: {
-    buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ CoreServices ];
-  };
-
   hpricot = attrs: {
     dontBuild = false;
     patches = [
diff --git a/pkgs/development/ruby-modules/gem/default.nix b/pkgs/development/ruby-modules/gem/default.nix
index dd517b2a5d6b..2f677f860f87 100644
--- a/pkgs/development/ruby-modules/gem/default.nix
+++ b/pkgs/development/ruby-modules/gem/default.nix
@@ -24,7 +24,6 @@
   fetchgit,
   makeWrapper,
   gitMinimal,
-  libobjc,
   ruby,
   bundler,
 }@defs:
@@ -125,12 +124,9 @@ lib.makeOverridable (
         ++ lib.optionals (type != "gem") [ bundler ]
         ++ nativeBuildInputs;
 
-      buildInputs =
-        [
-          ruby
-        ]
-        ++ lib.optionals stdenv.hostPlatform.isDarwin [ libobjc ]
-        ++ buildInputs;
+      buildInputs = [
+        ruby
+      ] ++ buildInputs;
 
       #name = builtins.trace (attrs.name or "no attr.name" ) "${namePrefix}${gemName}-${version}";
       name = attrs.name or "${namePrefix}${gemName}-${suffix}";
diff --git a/pkgs/development/tcl-modules/by-name/tk/tkimg/package.nix b/pkgs/development/tcl-modules/by-name/tk/tkimg/package.nix
index ad737f13a355..f072975cb5a6 100644
--- a/pkgs/development/tcl-modules/by-name/tk/tkimg/package.nix
+++ b/pkgs/development/tcl-modules/by-name/tk/tkimg/package.nix
@@ -1,12 +1,10 @@
 {
-  stdenv,
   lib,
   fetchsvn,
   tcl,
   tcllib,
   tk,
   xorg,
-  darwin,
 }:
 
 tcl.mkTclDerivation rec {
@@ -25,17 +23,10 @@ tcl.mkTclDerivation rec {
     "--with-tkinclude=${tk.dev}/include"
   ];
 
-  buildInputs =
-    [
-      xorg.libX11
-      tcllib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        Cocoa
-      ]
-    );
+  buildInputs = [
+    xorg.libX11
+    tcllib
+  ];
 
   meta = {
     homepage = "https://sourceforge.net/projects/tkimg/";
diff --git a/pkgs/development/tools/amazon-qldb-shell/default.nix b/pkgs/development/tools/amazon-qldb-shell/default.nix
index 6cd0c01ad20a..61a942bb021c 100644
--- a/pkgs/development/tools/amazon-qldb-shell/default.nix
+++ b/pkgs/development/tools/amazon-qldb-shell/default.nix
@@ -1,11 +1,9 @@
 {
-  stdenv,
   lib,
   cmake,
   fetchFromGitHub,
   rustPlatform,
   testers,
-  Security,
 }:
 
 let
@@ -25,7 +23,6 @@ let
       cmake
       rustPlatform.bindgenHook
     ];
-    buildInputs = lib.optional stdenv.hostPlatform.isDarwin Security;
 
     cargoLock = {
       lockFile = ./Cargo.lock;
diff --git a/pkgs/development/tools/analysis/cargo-tarpaulin/default.nix b/pkgs/development/tools/analysis/cargo-tarpaulin/default.nix
index bf51057d1786..b2b1e69d1baa 100644
--- a/pkgs/development/tools/analysis/cargo-tarpaulin/default.nix
+++ b/pkgs/development/tools/analysis/cargo-tarpaulin/default.nix
@@ -6,7 +6,6 @@
   openssl,
   stdenv,
   curl,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -30,7 +29,6 @@ rustPlatform.buildRustPackage rec {
     [ openssl ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       curl
-      Security
     ];
 
   doCheck = false;
diff --git a/pkgs/development/tools/analysis/dotenv-linter/default.nix b/pkgs/development/tools/analysis/dotenv-linter/default.nix
index 04be4a79ca19..8c8f6d425d72 100644
--- a/pkgs/development/tools/analysis/dotenv-linter/default.nix
+++ b/pkgs/development/tools/analysis/dotenv-linter/default.nix
@@ -1,9 +1,7 @@
 {
-  stdenv,
   lib,
   rustPlatform,
   fetchFromGitHub,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,8 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-lBHqvwZrnkSfmMXBmnhovbDn+pf5iLJepJjO/FKT1wY=";
 
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin Security;
-
   meta = with lib; {
     description = "Lightning-fast linter for .env files. Written in Rust";
     mainProgram = "dotenv-linter";
diff --git a/pkgs/development/tools/analysis/flow/default.nix b/pkgs/development/tools/analysis/flow/default.nix
index 50c839d12ba1..d11ea977b5af 100644
--- a/pkgs/development/tools/analysis/flow/default.nix
+++ b/pkgs/development/tools/analysis/flow/default.nix
@@ -3,7 +3,6 @@
   stdenv,
   fetchFromGitHub,
   ocamlPackages,
-  CoreServices,
 }:
 
 stdenv.mkDerivation rec {
@@ -37,26 +36,24 @@ stdenv.mkDerivation rec {
     ocamlbuild
   ];
 
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isDarwin [ CoreServices ]
-    ++ (
-      with ocamlPackages;
-      [
-        core_kernel
-        dtoa
-        fileutils
-        lwt_log
-        lwt_ppx
-        ocaml_lwt
-        ppx_deriving
-        ppx_gen_rec
-        ppx_let
-        sedlex
-        visitors
-        wtf8
-      ]
-      ++ lib.optionals stdenv.hostPlatform.isLinux [ inotify ]
-    );
+  buildInputs = (
+    with ocamlPackages;
+    [
+      core_kernel
+      dtoa
+      fileutils
+      lwt_log
+      lwt_ppx
+      ocaml_lwt
+      ppx_deriving
+      ppx_gen_rec
+      ppx_let
+      sedlex
+      visitors
+      wtf8
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [ inotify ]
+  );
 
   meta = with lib; {
     description = "Static type checker for JavaScript";
diff --git a/pkgs/development/tools/analysis/valgrind/default.nix b/pkgs/development/tools/analysis/valgrind/default.nix
index 3f2d2d38e757..c180de124d6b 100644
--- a/pkgs/development/tools/analysis/valgrind/default.nix
+++ b/pkgs/development/tools/analysis/valgrind/default.nix
@@ -6,9 +6,6 @@
   autoreconfHook,
   perl,
   gdb,
-  cctools,
-  xnu,
-  bootstrap_cmds,
   writeScript,
 }:
 
@@ -56,15 +53,10 @@ stdenv.mkDerivation rec {
 
   # GDB is needed to provide a sane default for `--db-command'.
   # Perl is needed for `callgrind_{annotate,control}'.
-  buildInputs =
-    [
-      gdb
-      perl
-    ]
-    ++ lib.optionals (stdenv.hostPlatform.isDarwin) [
-      bootstrap_cmds
-      xnu
-    ];
+  buildInputs = [
+    gdb
+    perl
+  ];
 
   # Perl is also a native build input.
   nativeBuildInputs = [
@@ -75,40 +67,11 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
   separateDebugInfo = stdenv.hostPlatform.isLinux;
 
-  preConfigure =
-    lib.optionalString stdenv.hostPlatform.isFreeBSD ''
-      substituteInPlace configure --replace-fail '`uname -r`' ${stdenv.cc.libc.version}-
-    ''
-    + lib.optionalString stdenv.hostPlatform.isDarwin (
-      let
-        OSRELEASE = ''
-          $(awk -F '"' '/#define OSRELEASE/{ print $2 }' \
-          <${xnu}/Library/Frameworks/Kernel.framework/Headers/libkern/version.h)'';
-      in
-      ''
-        echo "Don't derive our xnu version using uname -r."
-        substituteInPlace configure --replace "uname -r" "echo ${OSRELEASE}"
+  preConfigure = lib.optionalString stdenv.hostPlatform.isFreeBSD ''
+    substituteInPlace configure --replace-fail '`uname -r`' ${stdenv.cc.libc.version}-
+  '';
 
-        # Apple's GCC doesn't recognize `-arch' (as of version 4.2.1, build 5666).
-        echo "getting rid of the \`-arch' GCC option..."
-        find -name Makefile\* -exec \
-          sed -i {} -e's/DARWIN\(.*\)-arch [^ ]\+/DARWIN\1/g' \;
-
-        sed -i coregrind/link_tool_exe_darwin.in \
-            -e 's/^my \$archstr = .*/my $archstr = "x86_64";/g'
-
-        substituteInPlace coregrind/m_debuginfo/readmacho.c \
-           --replace /usr/bin/dsymutil ${stdenv.cc.bintools.bintools}/bin/dsymutil
-
-        echo "substitute hardcoded /usr/bin/ld with ${cctools}/bin/ld"
-        substituteInPlace coregrind/link_tool_exe_darwin.in \
-          --replace /usr/bin/ld ${cctools}/bin/ld
-      ''
-    );
-
-  configureFlags =
-    lib.optional stdenv.hostPlatform.isx86_64 "--enable-only64bit"
-    ++ lib.optional stdenv.hostPlatform.isDarwin "--with-xcodedir=${xnu}/include";
+  configureFlags = lib.optional stdenv.hostPlatform.isx86_64 "--enable-only64bit";
 
   doCheck = true;
 
@@ -157,6 +120,10 @@ stdenv.mkDerivation rec {
         darwin ++ freebsd ++ illumos ++ linux
       );
     badPlatforms = [ lib.systems.inspect.platformPatterns.isStatic ];
-    broken = stdenv.hostPlatform.isDarwin; # https://hydra.nixos.org/build/128521440/nixlog/2
+    # See: <https://hydra.nixos.org/build/128521440/nixlog/2>
+    #
+    # Darwin‐specific derivation logic has been removed, check the
+    # history if you want to fix this.
+    broken = stdenv.hostPlatform.isDarwin;
   };
 }
diff --git a/pkgs/development/tools/build-managers/bazel/cpp-test.nix b/pkgs/development/tools/build-managers/bazel/cpp-test.nix
index e1748042d137..e5ad6bc2a41c 100644
--- a/pkgs/development/tools/build-managers/bazel/cpp-test.nix
+++ b/pkgs/development/tools/build-managers/bazel/cpp-test.nix
@@ -10,9 +10,7 @@
   runLocal,
   runtimeShell,
   writeScript,
-  writeText,
   distDir,
-  Foundation ? null,
 }:
 
 let
@@ -58,10 +56,6 @@ let
       + lib.optionalString (stdenv.hostPlatform.isDarwin) ''
         --cxxopt=-x --cxxopt=c++ --host_cxxopt=-x --host_cxxopt=c++ \
         --linkopt=-stdlib=libc++ --host_linkopt=-stdlib=libc++ \
-      ''
-      + lib.optionalString (stdenv.hostPlatform.isDarwin && Foundation != null) ''
-        --linkopt=-Wl,-F${Foundation}/Library/Frameworks \
-        --linkopt=-L${darwin.libobjc}/lib \
       '';
   };
 
diff --git a/pkgs/development/tools/build-managers/fac/default.nix b/pkgs/development/tools/build-managers/fac/default.nix
index c889f7994c59..affbe921db9f 100644
--- a/pkgs/development/tools/build-managers/fac/default.nix
+++ b/pkgs/development/tools/build-managers/fac/default.nix
@@ -4,7 +4,6 @@
   rustPlatform,
   fetchCrate,
   git,
-  CoreServices,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -16,8 +15,6 @@ rustPlatform.buildRustPackage rec {
     crateName = "fac";
     hash = "sha256-+JJVuKUdnjJoQJ4a2EE0O6jZdVoFxPwbPgfD2LfiDPI=";
   };
-
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ CoreServices ];
   useFetchCargoVendor = true;
   cargoHash = "sha256-+2j6xH1Ww1WOLfbjknUPvCmYLAl4W3Zp/mQTaL0qnv0=";
 
diff --git a/pkgs/development/tools/build-managers/xmake/default.nix b/pkgs/development/tools/build-managers/xmake/default.nix
index 8131dc5eb8a9..f641be01c91f 100644
--- a/pkgs/development/tools/build-managers/xmake/default.nix
+++ b/pkgs/development/tools/build-managers/xmake/default.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  CoreServices,
   nix-update-script,
 }:
 stdenv.mkDerivation rec {
@@ -13,8 +12,6 @@ stdenv.mkDerivation rec {
     hash = "sha256-6SUFuDvJd2KG6ucZ1YvOp/8ld6/hLLXMsnnIHn28cC0=";
   };
 
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin CoreServices;
-
   passthru = {
     updateScript = nix-update-script { };
   };
diff --git a/pkgs/development/tools/continuous-integration/buildkite-test-collector-rust/default.nix b/pkgs/development/tools/continuous-integration/buildkite-test-collector-rust/default.nix
index fae399658a30..3877c2d3a3f0 100644
--- a/pkgs/development/tools/continuous-integration/buildkite-test-collector-rust/default.nix
+++ b/pkgs/development/tools/continuous-integration/buildkite-test-collector-rust/default.nix
@@ -2,8 +2,6 @@
   lib,
   fetchFromGitHub,
   rustPlatform,
-  stdenv,
-  Security,
   nix-update-script,
 }:
 
@@ -18,10 +16,6 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-PF2TFfzWmHXLgTopzJ04dfnzd3Sc/A6Hduffz2guxmU=";
   };
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    Security
-  ];
-
   useFetchCargoVendor = true;
   cargoHash = "sha256-jymWM0DCR6jUE1Kyhbx6HHf6YlrGu1THKTyDHaPG+Vs=";
 
diff --git a/pkgs/development/tools/cotton/default.nix b/pkgs/development/tools/cotton/default.nix
index eb8d9277c807..87f20b1acff4 100644
--- a/pkgs/development/tools/cotton/default.nix
+++ b/pkgs/development/tools/cotton/default.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  CoreServices,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,8 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-y162tjxPGZQiYBJxFk4QN9ZqSH8jrqa5Y961Sx2zrRs=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ CoreServices ];
-
   meta = with lib; {
     description = "Package manager for JavaScript projects";
     mainProgram = "cotton";
diff --git a/pkgs/development/tools/database/replibyte/default.nix b/pkgs/development/tools/database/replibyte/default.nix
index a71e14136239..02c7ce30822d 100644
--- a/pkgs/development/tools/database/replibyte/default.nix
+++ b/pkgs/development/tools/database/replibyte/default.nix
@@ -1,12 +1,9 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitHub,
   pkg-config,
   openssl,
-  Security,
-  SystemConfiguration,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -33,12 +30,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Security
-      SystemConfiguration
-    ];
+  buildInputs = [ openssl ];
 
   cargoBuildFlags = [ "--all-features" ];
 
diff --git a/pkgs/development/tools/database/surrealdb-migrations/default.nix b/pkgs/development/tools/database/surrealdb-migrations/default.nix
index ac8e2f1f705f..3a70f4be5c70 100644
--- a/pkgs/development/tools/database/surrealdb-migrations/default.nix
+++ b/pkgs/development/tools/database/surrealdb-migrations/default.nix
@@ -1,10 +1,8 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitHub,
   testers,
-  Security,
   surrealdb-migrations,
   nix-update-script,
 }:
@@ -26,8 +24,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-l59RbKohfPsAp/70UaT/bhy5Z4orVf7fuJgU+0fuyk4=";
 
-  buildInputs = [ ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
-
   # Error: No such file or directory (os error 2)
   # failures:
   #   cli::apply::apply_initial_migrations
diff --git a/pkgs/development/tools/documentation/doxygen/default.nix b/pkgs/development/tools/documentation/doxygen/default.nix
index 194b614a12d5..395fb218f93c 100644
--- a/pkgs/development/tools/documentation/doxygen/default.nix
+++ b/pkgs/development/tools/documentation/doxygen/default.nix
@@ -7,7 +7,6 @@
   flex,
   bison,
   qt5,
-  CoreServices,
   libiconv,
   spdlog,
   sqlite,
@@ -51,8 +50,7 @@ stdenv.mkDerivation rec {
         qtbase
         wrapQtAppsHook
       ]
-    )
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ CoreServices ];
+    );
 
   cmakeFlags = [
     "-DICONV_INCLUDE_DIR=${libiconv}/include"
diff --git a/pkgs/development/tools/dump_syms/default.nix b/pkgs/development/tools/dump_syms/default.nix
index 88f1f2bcf251..ba113aed246e 100644
--- a/pkgs/development/tools/dump_syms/default.nix
+++ b/pkgs/development/tools/dump_syms/default.nix
@@ -6,10 +6,6 @@
   pkg-config,
   openssl,
 
-  # darwin
-  Security,
-  SystemConfiguration,
-
   # tests
   firefox-esr-unwrapped,
   firefox-unwrapped,
@@ -37,14 +33,9 @@ rustPlatform.buildRustPackage {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals (stdenv.hostPlatform.isDarwin) [
-      Security
-      SystemConfiguration
-    ];
+  buildInputs = [
+    openssl
+  ];
 
   checkFlags = [
     # Disable tests that require network access
diff --git a/pkgs/development/tools/geckodriver/default.nix b/pkgs/development/tools/geckodriver/default.nix
index 069e9ad24da8..216def2f4ff0 100644
--- a/pkgs/development/tools/geckodriver/default.nix
+++ b/pkgs/development/tools/geckodriver/default.nix
@@ -3,7 +3,6 @@
   fetchFromGitHub,
   rustPlatform,
   stdenv,
-  Security,
   libiconv,
 }:
 
@@ -23,7 +22,6 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     libiconv
-    Security
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/tools/git-ps-rs/default.nix b/pkgs/development/tools/git-ps-rs/default.nix
index 6053aaae41f7..9fc49832be9c 100644
--- a/pkgs/development/tools/git-ps-rs/default.nix
+++ b/pkgs/development/tools/git-ps-rs/default.nix
@@ -2,11 +2,9 @@
   lib,
   fetchFromGitHub,
   rustPlatform,
-  stdenv,
   pkg-config,
   dbus,
   openssl,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -28,7 +26,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [
     openssl
     dbus
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
+  ];
 
   meta = with lib; {
     description = "Tool for working with a stack of patches";
diff --git a/pkgs/development/tools/glslviewer/default.nix b/pkgs/development/tools/glslviewer/default.nix
index dc2dc3f7c457..35d4a06a2d87 100644
--- a/pkgs/development/tools/glslviewer/default.nix
+++ b/pkgs/development/tools/glslviewer/default.nix
@@ -14,7 +14,6 @@
   libGLU,
   ffmpeg,
   ncurses,
-  Cocoa,
 }:
 stdenv.mkDerivation rec {
   pname = "glslviewer";
@@ -41,7 +40,7 @@ stdenv.mkDerivation rec {
     libGLU
     ncurses
     ffmpeg
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin Cocoa;
+  ];
 
   meta = with lib; {
     description = "Live GLSL coding renderer";
diff --git a/pkgs/development/tools/gptcommit/default.nix b/pkgs/development/tools/gptcommit/default.nix
index a3f07bf00f50..56e8c8fb0491 100644
--- a/pkgs/development/tools/gptcommit/default.nix
+++ b/pkgs/development/tools/gptcommit/default.nix
@@ -5,8 +5,6 @@
   rustPlatform,
   pkg-config,
   nix-update-script,
-  Security,
-  SystemConfiguration,
   openssl,
 }:
 
@@ -32,12 +30,7 @@ rustPlatform.buildRustPackage {
   # 0.5.6 release has failing tests
   doCheck = false;
 
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isDarwin [
-      Security
-      SystemConfiguration
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [ openssl ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ openssl ];
 
   passthru = {
     updateScript = nix-update-script { };
diff --git a/pkgs/development/tools/graphql-client/default.nix b/pkgs/development/tools/graphql-client/default.nix
index 0b6623ca1846..818e27aadeba 100644
--- a/pkgs/development/tools/graphql-client/default.nix
+++ b/pkgs/development/tools/graphql-client/default.nix
@@ -1,11 +1,9 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchCrate,
   pkg-config,
   openssl,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -26,7 +24,7 @@ rustPlatform.buildRustPackage rec {
   ];
   buildInputs = [
     openssl
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
+  ];
 
   meta = with lib; {
     description = "GraphQL tool for Rust projects";
diff --git a/pkgs/development/tools/hors/default.nix b/pkgs/development/tools/hors/default.nix
index 09bf6b2ec98a..df6adfb63088 100644
--- a/pkgs/development/tools/hors/default.nix
+++ b/pkgs/development/tools/hors/default.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,8 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-JTHgOEBpGXPO3C7YUbBF0LFeSUQK+R2w1LugwMV5xyU=";
 
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin Security;
-
   # requires network access
   doCheck = false;
 
diff --git a/pkgs/development/tools/htmlq/default.nix b/pkgs/development/tools/htmlq/default.nix
index 76f7bb443aa2..a4f68c8a285a 100644
--- a/pkgs/development/tools/htmlq/default.nix
+++ b/pkgs/development/tools/htmlq/default.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,8 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-QUlR6PuOLbeAHzARtTo7Zn7fmjs2ET6TdXT4VgCYEVg=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
-
   doCheck = false;
 
   meta = with lib; {
diff --git a/pkgs/development/tools/jless/default.nix b/pkgs/development/tools/jless/default.nix
index a3a26c4eae2c..8667d7762f6c 100644
--- a/pkgs/development/tools/jless/default.nix
+++ b/pkgs/development/tools/jless/default.nix
@@ -4,7 +4,6 @@
   rustPlatform,
   stdenv,
   python3,
-  AppKit,
   libxcb,
 }:
 
@@ -24,10 +23,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ python3 ];
 
-  buildInputs =
-    [ ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ AppKit ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [ libxcb ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ libxcb ];
 
   meta = with lib; {
     description = "Command-line pager for JSON data";
diff --git a/pkgs/development/tools/kdash/default.nix b/pkgs/development/tools/kdash/default.nix
index c01d074e7079..6648c35bf91d 100644
--- a/pkgs/development/tools/kdash/default.nix
+++ b/pkgs/development/tools/kdash/default.nix
@@ -1,6 +1,5 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
   pkg-config,
@@ -8,7 +7,6 @@
   python3,
   openssl,
   xorg,
-  AppKit,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -31,7 +29,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [
     openssl
     xorg.xcbutil
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin AppKit;
+  ];
 
   useFetchCargoVendor = true;
   cargoHash = "sha256-72DuM64wj8WW6soagodOFIeHvVn1CPpb1T3Y7GQYsbs=";
diff --git a/pkgs/development/tools/kubie/default.nix b/pkgs/development/tools/kubie/default.nix
index 0cc07789a927..db9baac735bb 100644
--- a/pkgs/development/tools/kubie/default.nix
+++ b/pkgs/development/tools/kubie/default.nix
@@ -1,10 +1,8 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitHub,
   installShellFiles,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -23,8 +21,6 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
-
   postInstall = ''
     installShellCompletion completion/kubie.bash
   '';
diff --git a/pkgs/development/tools/minizinc/ide.nix b/pkgs/development/tools/minizinc/ide.nix
index 6e297e0c075e..1ab12a5e082d 100644
--- a/pkgs/development/tools/minizinc/ide.nix
+++ b/pkgs/development/tools/minizinc/ide.nix
@@ -7,7 +7,6 @@
   qtwebsockets,
   minizinc,
   makeWrapper,
-  Cocoa,
 }:
 
 let
@@ -36,7 +35,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     qtbase
     qtwebsockets
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Cocoa ];
+  ];
 
   sourceRoot = "${src.name}/MiniZincIDE";
 
diff --git a/pkgs/development/tools/misc/binutils/default.nix b/pkgs/development/tools/misc/binutils/default.nix
index fa02f280b6a5..dd0fe97d9ff4 100644
--- a/pkgs/development/tools/misc/binutils/default.nix
+++ b/pkgs/development/tools/misc/binutils/default.nix
@@ -16,7 +16,6 @@ in
   perl,
   runCommand,
   zlib,
-  CoreServices,
 
   enableGold ? withGold stdenv.targetPlatform,
   enableGoldDefault ? false,
@@ -122,7 +121,7 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     zlib
     gettext
-  ] ++ lib.optionals hostPlatform.isDarwin [ CoreServices ];
+  ];
 
   inherit noSysDirs;
 
diff --git a/pkgs/development/tools/misc/dura/default.nix b/pkgs/development/tools/misc/dura/default.nix
index 390c9661ef80..eb2e035423eb 100644
--- a/pkgs/development/tools/misc/dura/default.nix
+++ b/pkgs/development/tools/misc/dura/default.nix
@@ -1,11 +1,9 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
   openssl,
   pkg-config,
-  Security,
   zlib,
 }:
 
@@ -29,14 +27,10 @@ rustPlatform.buildRustPackage rec {
 
   doCheck = false;
 
-  buildInputs =
-    [
-      openssl
-      zlib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Security
-    ];
+  buildInputs = [
+    openssl
+    zlib
+  ];
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/development/tools/misc/fswatch/default.nix b/pkgs/development/tools/misc/fswatch/default.nix
index eb13e9d9b738..05d132e44ab6 100644
--- a/pkgs/development/tools/misc/fswatch/default.nix
+++ b/pkgs/development/tools/misc/fswatch/default.nix
@@ -8,7 +8,6 @@
   libtool,
   makeWrapper,
   texinfo,
-  CoreServices,
 }:
 
 stdenv.mkDerivation rec {
@@ -25,7 +24,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     autoreconfHook
     makeWrapper
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ CoreServices ];
+  ];
   buildInputs = [
     gettext
     libtool
diff --git a/pkgs/development/tools/misc/linuxkit/default.nix b/pkgs/development/tools/misc/linuxkit/default.nix
index d646d96ea9ef..e7ecfe24ba0c 100644
--- a/pkgs/development/tools/misc/linuxkit/default.nix
+++ b/pkgs/development/tools/misc/linuxkit/default.nix
@@ -4,8 +4,6 @@
   buildGoModule,
   fetchFromGitHub,
   git,
-  Cocoa,
-  Virtualization,
   sigtool,
   testers,
   linuxkit,
@@ -36,10 +34,6 @@ buildGoModule rec {
   # - sigtool is allows us to validly sign such executables with a dummy
   #   authority.
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ sigtool ];
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    Cocoa
-    Virtualization
-  ];
 
   ldflags = [
     "-s"
diff --git a/pkgs/development/tools/misc/premake/5.nix b/pkgs/development/tools/misc/premake/5.nix
index 6ab724089453..9e7497fde4bf 100644
--- a/pkgs/development/tools/misc/premake/5.nix
+++ b/pkgs/development/tools/misc/premake/5.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   libuuid,
   cacert,
-  Foundation,
   readline,
 }:
 
@@ -22,7 +21,6 @@ stdenv.mkDerivation rec {
   buildInputs =
     [ libuuid ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Foundation
       readline
     ];
 
diff --git a/pkgs/development/tools/misc/pwninit/default.nix b/pkgs/development/tools/misc/pwninit/default.nix
index 7a645f4b8106..3a889cef0f54 100644
--- a/pkgs/development/tools/misc/pwninit/default.nix
+++ b/pkgs/development/tools/misc/pwninit/default.nix
@@ -1,6 +1,5 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
   openssl,
@@ -8,7 +7,6 @@
   makeBinaryWrapper,
   pkg-config,
   xz,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -25,7 +23,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [
     openssl
     xz
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
+  ];
   nativeBuildInputs = [
     pkg-config
     makeBinaryWrapper
diff --git a/pkgs/development/tools/misc/texinfo/common.nix b/pkgs/development/tools/misc/texinfo/common.nix
index e9d6d474e0a5..3a6ba56ee304 100644
--- a/pkgs/development/tools/misc/texinfo/common.nix
+++ b/pkgs/development/tools/misc/texinfo/common.nix
@@ -10,6 +10,7 @@
   gnulib,
   gawk,
   freebsd,
+  glibcLocales,
   libiconv,
   xz,
 
@@ -113,9 +114,19 @@ stdenv.mkDerivation {
   ];
 
   nativeCheckInputs = [ procps ] ++ optionals stdenv.buildPlatform.isFreeBSD [ freebsd.locale ];
+  checkInputs = optionals (lib.versionAtLeast version "7.2") [ glibcLocales ];
 
   doCheck = interactive && !stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isSunOS; # flaky
 
+  # musl does not support locales.
+  preCheck =
+    if interactive && stdenv.hostPlatform.isMusl then
+      ''
+        checkFlagsArray+=(XFAIL_TESTS="different_languages_gen_master_menu.sh test_scripts/formatting_documentlanguage_cmdline.sh test_scripts/layout_formatting_fr_info.sh test_scripts/layout_formatting_fr.sh test_scripts/layout_formatting_fr_icons.sh")
+      ''
+    else
+      null;
+
   checkFlags = optionals (!stdenv.hostPlatform.isMusl && versionOlder version "7") [
     # Test is known to fail on various locales on texinfo-6.8:
     #   https://lists.gnu.org/r/bug-texinfo/2021-07/msg00012.html
diff --git a/pkgs/development/tools/misc/texinfo/packages.nix b/pkgs/development/tools/misc/texinfo/packages.nix
index 2d5a798d7f21..7cda7d1b58cc 100644
--- a/pkgs/development/tools/misc/texinfo/packages.nix
+++ b/pkgs/development/tools/misc/texinfo/packages.nix
@@ -102,7 +102,7 @@ in
     patches = [ ./fix-glibc-2.34.patch ];
   };
   texinfo7 = buildTexinfo {
-    version = "7.1.1";
-    hash = "sha256-Ma435GKDUpQythvuHOAe0AkNWZ5gb8aincofd8dqbII=";
+    version = "7.2";
+    hash = "sha256-AynXeI++8RP6gsuAiJyhl6NEzg33ZG/gAJdMXXFDY6Y=";
   };
 }
diff --git a/pkgs/development/tools/misc/texlab/default.nix b/pkgs/development/tools/misc/texlab/default.nix
index 63d46fcc1a39..8925f8367fc6 100644
--- a/pkgs/development/tools/misc/texlab/default.nix
+++ b/pkgs/development/tools/misc/texlab/default.nix
@@ -6,8 +6,6 @@
   help2man,
   installShellFiles,
   libiconv,
-  Security,
-  CoreServices,
   nix-update-script,
 }:
 
@@ -34,8 +32,6 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     libiconv
-    Security
-    CoreServices
   ];
 
   # When we cross compile we cannot run the output executable to
diff --git a/pkgs/development/tools/misc/tokei/default.nix b/pkgs/development/tools/misc/tokei/default.nix
index ffc18063d13c..42e0ba450c75 100644
--- a/pkgs/development/tools/misc/tokei/default.nix
+++ b/pkgs/development/tools/misc/tokei/default.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   rustPlatform,
   libiconv,
-  Security,
   zlib,
 }:
 
@@ -24,7 +23,6 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     libiconv
-    Security
   ];
 
   checkInputs = lib.optionals stdenv.hostPlatform.isDarwin [ zlib ];
diff --git a/pkgs/development/tools/ocaml/opam/default.nix b/pkgs/development/tools/ocaml/opam/default.nix
index 8871e9dea494..e6d761e19250 100644
--- a/pkgs/development/tools/ocaml/opam/default.nix
+++ b/pkgs/development/tools/ocaml/opam/default.nix
@@ -9,7 +9,6 @@
   ncurses,
   curl,
   bubblewrap,
-  Foundation,
 }:
 
 assert lib.versionAtLeast ocaml.version "4.08.0";
@@ -31,13 +30,10 @@ stdenv.mkDerivation (finalAttrs: {
     ocaml
     curl
   ];
-  buildInputs =
-    [
-      ncurses
-      getconf
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [ bubblewrap ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ Foundation ];
+  buildInputs = [
+    ncurses
+    getconf
+  ] ++ lib.optionals stdenv.hostPlatform.isLinux [ bubblewrap ];
 
   patches = [ ./opam-shebangs.patch ];
 
diff --git a/pkgs/development/tools/pactorio/default.nix b/pkgs/development/tools/pactorio/default.nix
index 9d85c9594ad8..bbced1b8b592 100644
--- a/pkgs/development/tools/pactorio/default.nix
+++ b/pkgs/development/tools/pactorio/default.nix
@@ -5,8 +5,6 @@
   installShellFiles,
   pkg-config,
   bzip2,
-  stdenv,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -28,7 +26,7 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs = [ bzip2 ] ++ lib.optional stdenv.hostPlatform.isDarwin Security;
+  buildInputs = [ bzip2 ];
 
   postInstall = ''
     installManPage artifacts/pactorio.1
diff --git a/pkgs/development/tools/parsing/antlr/4.nix b/pkgs/development/tools/parsing/antlr/4.nix
index f020ab3c149c..c30d235c4f8e 100644
--- a/pkgs/development/tools/parsing/antlr/4.nix
+++ b/pkgs/development/tools/parsing/antlr/4.nix
@@ -108,7 +108,7 @@ let
             ninja
             pkg-config
           ];
-          buildInputs = lib.optional stdenv.hostPlatform.isDarwin CoreFoundation ++ extraCppBuildInputs;
+          buildInputs = extraCppBuildInputs;
 
           cmakeDir = "../runtime/Cpp";
 
diff --git a/pkgs/development/tools/remodel/default.nix b/pkgs/development/tools/remodel/default.nix
index 6d3f6a560271..89ac00bd0169 100644
--- a/pkgs/development/tools/remodel/default.nix
+++ b/pkgs/development/tools/remodel/default.nix
@@ -1,11 +1,9 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
   pkg-config,
   openssl,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -26,13 +24,9 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Security
-    ];
+  buildInputs = [
+    openssl
+  ];
 
   meta = with lib; {
     description = "Roblox file manipulation tool";
diff --git a/pkgs/development/tools/rover/default.nix b/pkgs/development/tools/rover/default.nix
index 720066ca6910..f5c3b50f308e 100644
--- a/pkgs/development/tools/rover/default.nix
+++ b/pkgs/development/tools/rover/default.nix
@@ -4,8 +4,6 @@
   pkg-config,
   rustPlatform,
   openssl,
-  darwin,
-  stdenv,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -22,15 +20,9 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-uR5XvkHUmZzCHZITKgScmzqjLOIvbPyrih/0B1OpsAc=";
 
-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-      darwin.apple_sdk.frameworks.CoreServices
-      darwin.apple_sdk.frameworks.SystemConfiguration
-    ];
+  buildInputs = [
+    openssl
+  ];
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/development/tools/rtags/default.nix b/pkgs/development/tools/rtags/default.nix
index 39fd3f726caf..026ef45b442b 100644
--- a/pkgs/development/tools/rtags/default.nix
+++ b/pkgs/development/tools/rtags/default.nix
@@ -6,7 +6,6 @@
   cmake,
   llvmPackages,
   openssl,
-  apple_sdk,
   emacs,
   pkg-config,
 }:
@@ -19,18 +18,12 @@ stdenv.mkDerivation rec {
     pkg-config
     llvmPackages.llvm.dev
   ];
-  buildInputs =
-    [
-      llvmPackages.llvm
-      llvmPackages.libclang
-      openssl
-      emacs
-    ]
-    ++ lib.optionals stdenv.cc.isGNU [ llvmPackages.clang-unwrapped ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      apple_sdk.libs.xpc
-      apple_sdk.frameworks.CoreServices
-    ];
+  buildInputs = [
+    llvmPackages.llvm
+    llvmPackages.libclang
+    openssl
+    emacs
+  ] ++ lib.optionals stdenv.cc.isGNU [ llvmPackages.clang-unwrapped ];
 
   src = fetchFromGitHub {
     owner = "andersbakken";
diff --git a/pkgs/development/tools/rubyfmt/default.nix b/pkgs/development/tools/rubyfmt/default.nix
index ebb5769e8082..3c395a8608bb 100644
--- a/pkgs/development/tools/rubyfmt/default.nix
+++ b/pkgs/development/tools/rubyfmt/default.nix
@@ -10,13 +10,10 @@
   zlib,
   readline,
   libiconv,
-  libobjc,
   libunwind,
   libxcrypt,
   libyaml,
   rust-jemalloc-sys-unprefixed,
-  Foundation,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -48,10 +45,7 @@ rustPlatform.buildRustPackage rec {
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       readline
       libiconv
-      libobjc
       libunwind
-      Foundation
-      Security
     ];
 
   preConfigure = ''
diff --git a/pkgs/development/tools/rust/cargo-audit/default.nix b/pkgs/development/tools/rust/cargo-audit/default.nix
index 8e478a869487..278182395abf 100644
--- a/pkgs/development/tools/rust/cargo-audit/default.nix
+++ b/pkgs/development/tools/rust/cargo-audit/default.nix
@@ -5,9 +5,6 @@
   pkg-config,
   openssl,
   zlib,
-  stdenv,
-  Security,
-  SystemConfiguration,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -26,15 +23,10 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      openssl
-      zlib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Security
-      SystemConfiguration
-    ];
+  buildInputs = [
+    openssl
+    zlib
+  ];
 
   buildFeatures = [ "fix" ];
 
diff --git a/pkgs/development/tools/rust/cargo-bazel/default.nix b/pkgs/development/tools/rust/cargo-bazel/default.nix
index 1ee5aebc14b7..a92331c607d5 100644
--- a/pkgs/development/tools/rust/cargo-bazel/default.nix
+++ b/pkgs/development/tools/rust/cargo-bazel/default.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   fetchCrate,
   rustPlatform,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -18,8 +16,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-E/yF42Vx9tv8Ik1j23El3+fI19ZGzq6nikVMATY7m3E=";
 
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin Security;
-
   # `test_data` is explicitly excluded from the package published to crates.io, so tests cannot be run
   doCheck = false;
 
diff --git a/pkgs/development/tools/rust/cargo-c/default.nix b/pkgs/development/tools/rust/cargo-c/default.nix
index e8ab6ff42249..7cd88d36d85a 100644
--- a/pkgs/development/tools/rust/cargo-c/default.nix
+++ b/pkgs/development/tools/rust/cargo-c/default.nix
@@ -6,9 +6,7 @@
   curl,
   openssl,
   stdenv,
-  CoreFoundation,
   libiconv,
-  Security,
   rav1e,
 }:
 
@@ -36,9 +34,7 @@ rustPlatform.buildRustPackage rec {
       curl
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CoreFoundation
       libiconv
-      Security
     ];
 
   # Ensure that we are avoiding build of the curl vendored in curl-sys
diff --git a/pkgs/development/tools/rust/cargo-clone/default.nix b/pkgs/development/tools/rust/cargo-clone/default.nix
index 73eae241f3fd..a67332aa956c 100644
--- a/pkgs/development/tools/rust/cargo-clone/default.nix
+++ b/pkgs/development/tools/rust/cargo-clone/default.nix
@@ -5,10 +5,6 @@
   pkg-config,
   openssl,
   zlib,
-  stdenv,
-  CoreServices,
-  Security,
-  SystemConfiguration,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -27,16 +23,10 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    [
-      openssl
-      zlib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CoreServices
-      Security
-      SystemConfiguration
-    ];
+  buildInputs = [
+    openssl
+    zlib
+  ];
 
   # requires internet access
   doCheck = false;
diff --git a/pkgs/development/tools/rust/cargo-codspeed/default.nix b/pkgs/development/tools/rust/cargo-codspeed/default.nix
index 92f732f7d81d..ab6749d0a401 100644
--- a/pkgs/development/tools/rust/cargo-codspeed/default.nix
+++ b/pkgs/development/tools/rust/cargo-codspeed/default.nix
@@ -7,8 +7,6 @@
   libgit2,
   openssl,
   zlib,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -30,16 +28,12 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      curl
-      libgit2
-      openssl
-      zlib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
-    ];
+  buildInputs = [
+    curl
+    libgit2
+    openssl
+    zlib
+  ];
 
   cargoBuildFlags = [ "-p=cargo-codspeed" ];
   cargoTestFlags = cargoBuildFlags;
diff --git a/pkgs/development/tools/rust/cargo-crev/default.nix b/pkgs/development/tools/rust/cargo-crev/default.nix
index 714cabc62a9b..11b1a97c8724 100644
--- a/pkgs/development/tools/rust/cargo-crev/default.nix
+++ b/pkgs/development/tools/rust/cargo-crev/default.nix
@@ -5,9 +5,6 @@
   rustPlatform,
   perl,
   pkg-config,
-  SystemConfiguration,
-  Security,
-  CoreFoundation,
   curl,
   libiconv,
   openssl,
@@ -42,9 +39,6 @@ rustPlatform.buildRustPackage rec {
   buildInputs =
     [ openssl ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      SystemConfiguration
-      Security
-      CoreFoundation
       libiconv
       curl
     ];
diff --git a/pkgs/development/tools/rust/cargo-cyclonedx/default.nix b/pkgs/development/tools/rust/cargo-cyclonedx/default.nix
index b6024347c03f..193a967a79f7 100644
--- a/pkgs/development/tools/rust/cargo-cyclonedx/default.nix
+++ b/pkgs/development/tools/rust/cargo-cyclonedx/default.nix
@@ -5,9 +5,6 @@
   fetchFromGitHub,
   pkg-config,
   openssl,
-  Security,
-  SystemConfiguration,
-  CoreFoundation,
   curl,
 }:
 
@@ -34,9 +31,6 @@ rustPlatform.buildRustPackage rec {
       openssl
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Security
-      SystemConfiguration
-      CoreFoundation
       curl
     ];
 
diff --git a/pkgs/development/tools/rust/cargo-edit/default.nix b/pkgs/development/tools/rust/cargo-edit/default.nix
index da9ada292d86..9c4827882945 100644
--- a/pkgs/development/tools/rust/cargo-edit/default.nix
+++ b/pkgs/development/tools/rust/cargo-edit/default.nix
@@ -5,8 +5,6 @@
   pkg-config,
   openssl,
   zlib,
-  stdenv,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -25,14 +23,10 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    [
-      openssl
-      zlib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Security
-    ];
+  buildInputs = [
+    openssl
+    zlib
+  ];
 
   doCheck = false; # integration tests depend on changing cargo config
 
diff --git a/pkgs/development/tools/rust/cargo-flamegraph/default.nix b/pkgs/development/tools/rust/cargo-flamegraph/default.nix
index 0a62e9a99992..8a37c1d524db 100644
--- a/pkgs/development/tools/rust/cargo-flamegraph/default.nix
+++ b/pkgs/development/tools/rust/cargo-flamegraph/default.nix
@@ -6,7 +6,6 @@
   makeWrapper,
   perf,
   nix-update-script,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -24,9 +23,6 @@ rustPlatform.buildRustPackage rec {
   cargoHash = "sha256-uErlNPkacAmURNKAZp1wLsV2NB1w9HfjLZl5PgeMRu0=";
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ makeWrapper ];
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    Security
-  ];
 
   postFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
     wrapProgram $out/bin/cargo-flamegraph \
diff --git a/pkgs/development/tools/rust/cargo-fund/default.nix b/pkgs/development/tools/rust/cargo-fund/default.nix
index 589186bd86e0..f76b85b33093 100644
--- a/pkgs/development/tools/rust/cargo-fund/default.nix
+++ b/pkgs/development/tools/rust/cargo-fund/default.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   pkg-config,
   rustPlatform,
-  Security,
   curl,
   openssl,
   libiconv,
@@ -32,7 +31,6 @@ rustPlatform.buildRustPackage rec {
   buildInputs =
     [ openssl ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Security
       libiconv
       curl
     ];
diff --git a/pkgs/development/tools/rust/cargo-hf2/default.nix b/pkgs/development/tools/rust/cargo-hf2/default.nix
index 7569b4a10217..6f7960a834ae 100644
--- a/pkgs/development/tools/rust/cargo-hf2/default.nix
+++ b/pkgs/development/tools/rust/cargo-hf2/default.nix
@@ -4,8 +4,6 @@
   fetchCrate,
   pkg-config,
   libusb1,
-  stdenv,
-  AppKit,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -22,7 +20,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ libusb1 ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ AppKit ];
+  buildInputs = [ libusb1 ];
 
   meta = with lib; {
     description = "Cargo Subcommand for Microsoft HID Flashing Library for UF2 Bootloaders";
diff --git a/pkgs/development/tools/rust/cargo-ndk/default.nix b/pkgs/development/tools/rust/cargo-ndk/default.nix
index e132991be676..cbd1db25b326 100644
--- a/pkgs/development/tools/rust/cargo-ndk/default.nix
+++ b/pkgs/development/tools/rust/cargo-ndk/default.nix
@@ -1,10 +1,7 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitHub,
-  CoreGraphics,
-  Foundation,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -21,11 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-Kt4GLvbGK42RjivLpL5W5z5YBfDP5B83mCulWz6Bisw=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    CoreGraphics
-    Foundation
-  ];
-
   meta = with lib; {
     description = "Cargo extension for building Android NDK projects";
     mainProgram = "cargo-ndk";
diff --git a/pkgs/development/tools/rust/cargo-pgrx/buildPgrxExtension.nix b/pkgs/development/tools/rust/cargo-pgrx/buildPgrxExtension.nix
index b4c11bfdf927..304b901a18a9 100644
--- a/pkgs/development/tools/rust/cargo-pgrx/buildPgrxExtension.nix
+++ b/pkgs/development/tools/rust/cargo-pgrx/buildPgrxExtension.nix
@@ -33,7 +33,6 @@
   pkg-config,
   rustPlatform,
   stdenv,
-  Security,
   writeShellScriptBin,
 }:
 
@@ -124,7 +123,7 @@ lib.extendMkDerivation {
       cargoPgrxFlags' = lib.escapeShellArgs cargoPgrxFlags;
     in
     {
-      buildInputs = (args.buildInputs or [ ]) ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
+      buildInputs = (args.buildInputs or [ ]);
 
       nativeBuildInputs =
         (args.nativeBuildInputs or [ ])
diff --git a/pkgs/development/tools/rust/cargo-udeps/default.nix b/pkgs/development/tools/rust/cargo-udeps/default.nix
index 9eedd3129e2e..a98e53c83c39 100644
--- a/pkgs/development/tools/rust/cargo-udeps/default.nix
+++ b/pkgs/development/tools/rust/cargo-udeps/default.nix
@@ -5,10 +5,7 @@
   fetchFromGitHub,
   pkg-config,
   openssl,
-  CoreServices,
-  Security,
   libiconv,
-  SystemConfiguration,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -31,10 +28,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs =
     [ openssl ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CoreServices
-      Security
       libiconv
-      SystemConfiguration
     ];
 
   # Requires network access
diff --git a/pkgs/development/tools/rust/cargo-watch/default.nix b/pkgs/development/tools/rust/cargo-watch/default.nix
index 8564f62150d7..b994a7a853c5 100644
--- a/pkgs/development/tools/rust/cargo-watch/default.nix
+++ b/pkgs/development/tools/rust/cargo-watch/default.nix
@@ -3,8 +3,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  Cocoa,
-  Foundation,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -21,11 +19,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-4AVZ747d6lOjxHN+co0A7APVB5Xj6g5p/Al5fLbgPnc=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    Foundation
-    Cocoa
-  ];
-
   NIX_LDFLAGS = lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
     "-framework"
     "AppKit"
diff --git a/pkgs/development/tools/rust/cargo-whatfeatures/default.nix b/pkgs/development/tools/rust/cargo-whatfeatures/default.nix
index 6014baaf3a90..e46acabfeb9b 100644
--- a/pkgs/development/tools/rust/cargo-whatfeatures/default.nix
+++ b/pkgs/development/tools/rust/cargo-whatfeatures/default.nix
@@ -1,11 +1,9 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
   pkg-config,
   openssl,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -24,7 +22,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ openssl ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
+  buildInputs = [ openssl ];
 
   meta = with lib; {
     description = "Simple cargo plugin to get a list of features for a specific crate";
diff --git a/pkgs/development/tools/rust/cbindgen/default.nix b/pkgs/development/tools/rust/cbindgen/default.nix
index fa4842c65a79..a69f3804ecb9 100644
--- a/pkgs/development/tools/rust/cbindgen/default.nix
+++ b/pkgs/development/tools/rust/cbindgen/default.nix
@@ -5,7 +5,6 @@
   rustPlatform,
   cmake,
   python3Packages,
-  Security,
 
   # tests
   firefox-unwrapped,
@@ -27,8 +26,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-k8n3adoqKp/RXkHybCKV2KlVnaoEhM6vF57BqeCDAP4=";
 
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin Security;
-
   nativeCheckInputs = [
     cmake
     python3Packages.cython
diff --git a/pkgs/development/tools/rust/duckscript/default.nix b/pkgs/development/tools/rust/duckscript/default.nix
index c78f0558b0a0..d3866bdfaac4 100644
--- a/pkgs/development/tools/rust/duckscript/default.nix
+++ b/pkgs/development/tools/rust/duckscript/default.nix
@@ -3,10 +3,8 @@
   stdenv,
   fetchCrate,
   rustPlatform,
-  Security,
   openssl,
   pkg-config,
-  SystemConfiguration,
   libiconv,
 }:
 
@@ -24,8 +22,6 @@ rustPlatform.buildRustPackage rec {
   buildInputs =
     [ openssl ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Security
-      SystemConfiguration
       libiconv
     ];
 
diff --git a/pkgs/development/tools/rust/humility/default.nix b/pkgs/development/tools/rust/humility/default.nix
index 9e3520509071..b6eb5d2183a7 100644
--- a/pkgs/development/tools/rust/humility/default.nix
+++ b/pkgs/development/tools/rust/humility/default.nix
@@ -1,13 +1,11 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitHub,
   libusb1,
   libftdi,
   cargo-readme,
   pkg-config,
-  AppKit,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -18,14 +16,10 @@ rustPlatform.buildRustPackage rec {
     pkg-config
     cargo-readme
   ];
-  buildInputs =
-    [
-      libusb1
-      libftdi
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AppKit
-    ];
+  buildInputs = [
+    libusb1
+    libftdi
+  ];
 
   src = fetchFromGitHub {
     owner = "oxidecomputer";
diff --git a/pkgs/development/tools/rust/rustup-toolchain-install-master/default.nix b/pkgs/development/tools/rust/rustup-toolchain-install-master/default.nix
index 63ddaae84bd9..aace64a71a35 100644
--- a/pkgs/development/tools/rust/rustup-toolchain-install-master/default.nix
+++ b/pkgs/development/tools/rust/rustup-toolchain-install-master/default.nix
@@ -9,7 +9,6 @@
   pkg-config,
   openssl,
   xz,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -47,14 +46,10 @@ rustPlatform.buildRustPackage rec {
     lib.optionals stdenv.hostPlatform.isLinux [ patchelfPatch ];
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs =
-    [
-      openssl
-      xz
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Security
-    ];
+  buildInputs = [
+    openssl
+    xz
+  ];
 
   # update Cargo.lock to work with openssl 3
   postPatch = ''
diff --git a/pkgs/development/tools/rust/rustup/default.nix b/pkgs/development/tools/rust/rustup/default.nix
index 089a4a728c24..54f5002167bf 100644
--- a/pkgs/development/tools/rust/rustup/default.nix
+++ b/pkgs/development/tools/rust/rustup/default.nix
@@ -12,8 +12,6 @@
   writableTmpDirAsHomeHook,
   installShellFiles,
   zlib,
-  Security,
-  CoreServices,
   libiconv,
   xz,
   buildPackages,
@@ -53,8 +51,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
       zlib
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CoreServices
-      Security
       libiconv
       xz
     ];
diff --git a/pkgs/development/tools/rust/sqlx-cli/default.nix b/pkgs/development/tools/rust/sqlx-cli/default.nix
index f1f59c17f1f8..bb62459a145f 100644
--- a/pkgs/development/tools/rust/sqlx-cli/default.nix
+++ b/pkgs/development/tools/rust/sqlx-cli/default.nix
@@ -9,9 +9,6 @@
   libiconv,
   testers,
   sqlx-cli,
-  CoreFoundation,
-  Security,
-  SystemConfiguration,
   nix-update-script,
 }:
 
@@ -51,9 +48,6 @@ rustPlatform.buildRustPackage rec {
       openssl
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CoreFoundation
-      Security
-      SystemConfiguration
       libiconv
     ];
 
diff --git a/pkgs/development/tools/sentry-cli/default.nix b/pkgs/development/tools/sentry-cli/default.nix
index a857291d1fe7..1250f84acb5e 100644
--- a/pkgs/development/tools/sentry-cli/default.nix
+++ b/pkgs/development/tools/sentry-cli/default.nix
@@ -6,9 +6,6 @@
   openssl,
   pkg-config,
   stdenv,
-  CoreServices,
-  Security,
-  SystemConfiguration,
 }:
 rustPlatform.buildRustPackage rec {
   pname = "sentry-cli";
@@ -25,13 +22,7 @@ rustPlatform.buildRustPackage rec {
   # Needed to get openssl-sys to use pkgconfig.
   OPENSSL_NO_VENDOR = 1;
 
-  buildInputs =
-    [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CoreServices
-      Security
-      SystemConfiguration
-    ];
+  buildInputs = [ openssl ];
   nativeBuildInputs = [
     installShellFiles
     pkg-config
diff --git a/pkgs/development/tools/simavr/default.nix b/pkgs/development/tools/simavr/default.nix
index 9a8dc3ef60e7..f655d995f2cc 100644
--- a/pkgs/development/tools/simavr/default.nix
+++ b/pkgs/development/tools/simavr/default.nix
@@ -11,7 +11,6 @@
   avrlibc,
   libGLU,
   libGL,
-  GLUT,
 }:
 
 let
@@ -52,7 +51,7 @@ stdenv.mkDerivation rec {
     libglut
     libGLU
     libGL
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin GLUT;
+  ];
 
   # remove forbidden references to $TMPDIR
   preFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
diff --git a/pkgs/development/tools/spr/default.nix b/pkgs/development/tools/spr/default.nix
index 32a52fc2315e..fe450c314568 100644
--- a/pkgs/development/tools/spr/default.nix
+++ b/pkgs/development/tools/spr/default.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchCrate,
-  Security,
-  stdenv,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -18,8 +16,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-4fYQM+GQ5yqES8HQ23ft4wfM5mwDdcWuE5Ed2LST9Gw=";
 
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin Security;
-
   meta = with lib; {
     description = "Submit pull requests for individual, amendable, rebaseable commits to GitHub";
     mainProgram = "spr";
diff --git a/pkgs/development/tools/viceroy/default.nix b/pkgs/development/tools/viceroy/default.nix
index 9b9709945b76..19ff19753ec3 100644
--- a/pkgs/development/tools/viceroy/default.nix
+++ b/pkgs/development/tools/viceroy/default.nix
@@ -2,8 +2,6 @@
   rustPlatform,
   fetchFromGitHub,
   lib,
-  stdenv,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -17,8 +15,6 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-DeViAqL+7mta/wH7rLyltOCtHCTFXZczn2vAL1k+R2Y=";
   };
 
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin Security;
-
   useFetchCargoVendor = true;
   cargoHash = "sha256-LBJD1w8/jLw5xYdHxR+EM2Cb4eVFpRw+M/K7K4Z0OUw=";
 
diff --git a/pkgs/development/tools/wasmedge/default.nix b/pkgs/development/tools/wasmedge/default.nix
index e416f563788f..1d9e47a9ad7d 100644
--- a/pkgs/development/tools/wasmedge/default.nix
+++ b/pkgs/development/tools/wasmedge/default.nix
@@ -8,7 +8,6 @@
   spdlog,
   libxml2,
   libffi,
-  Foundation,
   testers,
 }:
 
@@ -39,17 +38,13 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
     llvmPackages.lld
   ];
 
-  buildInputs =
-    [
-      boost
-      spdlog
-      llvmPackages.llvm
-      libxml2
-      libffi
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Foundation
-    ];
+  buildInputs = [
+    boost
+    spdlog
+    llvmPackages.llvm
+    libxml2
+    libffi
+  ];
 
   cmakeFlags =
     [
diff --git a/pkgs/development/tools/wrangler_1/default.nix b/pkgs/development/tools/wrangler_1/default.nix
index b51d26745bf2..042832ea99ef 100644
--- a/pkgs/development/tools/wrangler_1/default.nix
+++ b/pkgs/development/tools/wrangler_1/default.nix
@@ -6,9 +6,6 @@
   pkg-config,
   openssl,
   curl,
-  Security,
-  CoreServices,
-  CoreFoundation,
   libiconv,
 }:
 
@@ -32,9 +29,6 @@ rustPlatform.buildRustPackage rec {
     [ openssl ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       curl
-      CoreFoundation
-      CoreServices
-      Security
       libiconv
     ];
 
diff --git a/pkgs/development/web/nodejs/nodejs.nix b/pkgs/development/web/nodejs/nodejs.nix
index 4362164664cf..7e02c21f4f12 100644
--- a/pkgs/development/web/nodejs/nodejs.nix
+++ b/pkgs/development/web/nodejs/nodejs.nix
@@ -28,7 +28,6 @@
   nix,
   runtimeShell,
   gnupg,
-  darwin,
   installShellFiles,
 }:
 
@@ -40,7 +39,6 @@
 }@args:
 
 let
-  inherit (darwin.apple_sdk.frameworks) CoreServices ApplicationServices;
 
   majorVersion = lib.versions.major version;
   minorVersion = lib.versions.minor version;
@@ -176,6 +174,8 @@ let
       done
     '';
 
+  downloadDir = if lib.strings.hasInfix "-rc." version then "download/rc" else "dist";
+
   package = stdenv.mkDerivation (
     finalAttrs:
     let
@@ -188,7 +188,7 @@ let
       inherit pname version;
 
       src = fetchurl {
-        url = "https://nodejs.org/dist/v${version}/node-v${version}.tar.xz";
+        url = "https://nodejs.org/${downloadDir}/v${version}/node-v${version}.tar.xz";
         inherit sha256;
       };
 
@@ -213,20 +213,14 @@ let
       # NB: technically, we do not need bash in build inputs since all scripts are
       # wrappers over the corresponding JS scripts. There are some packages though
       # that use bash wrappers, e.g. polaris-web.
-      buildInputs =
-        lib.optionals stdenv.hostPlatform.isDarwin [
-          CoreServices
-          ApplicationServices
-        ]
-        ++ [
-          zlib
-          libuv
-          openssl
-          http-parser
-          icu
-          bash
-        ]
-        ++ lib.optionals useSharedSQLite [ sqlite ];
+      buildInputs = [
+        zlib
+        libuv
+        openssl
+        http-parser
+        icu
+        bash
+      ] ++ lib.optionals useSharedSQLite [ sqlite ];
 
       nativeBuildInputs =
         [
@@ -420,6 +414,12 @@ let
               ++ lib.optionals (!lib.versionAtLeast version "22") [
                 "test-tls-multi-key"
               ]
+              ++ lib.optionals (lib.versionAtLeast version "24") [
+                # Checks for SQLite's RBU extension, which we don't enable by default.
+                "test-sqlite"
+                # Fails with readline error: 'Uncaught Error [ERR_USE_AFTER_CLOSE]: readline was closed',
+                "test-repl-import-referrer"
+              ]
               ++ lib.optionals stdenv.hostPlatform.is32bit [
                 # utime (actually utimensat) fails with EINVAL on 2038 timestamp
                 "test-fs-utimes-y2K38"
@@ -519,7 +519,7 @@ let
       passthru.tests = {
         version = testers.testVersion {
           package = self;
-          version = "v${version}";
+          version = "v${lib.head (lib.strings.splitString "-rc." version)}";
         };
       };
 
diff --git a/pkgs/development/web/nodejs/v23.nix b/pkgs/development/web/nodejs/v24.nix
similarity index 85%
rename from pkgs/development/web/nodejs/v23.nix
rename to pkgs/development/web/nodejs/v24.nix
index beee5147bac4..4ff7bb3d2ff6 100644
--- a/pkgs/development/web/nodejs/v23.nix
+++ b/pkgs/development/web/nodejs/v24.nix
@@ -17,8 +17,8 @@ let
 in
 buildNodejs {
   inherit enableNpm;
-  version = "23.11.0";
-  sha256 = "f2c5db21fc5d3c3d78c7e8823bff770cef0da8078c3b5ac4fa6d17d5a41be99d";
+  version = "24.0.0-rc.3";
+  sha256 = "9bbca08fba05f075a20f734ea80b195a4a39218476b60b32db79e1d393fda20b";
   patches =
     (
       if (stdenv.hostPlatform.emulatorAvailable buildPackages) then
@@ -51,11 +51,6 @@ buildNodejs {
       ./node-npm-build-npm-package-logic.patch
       ./use-correct-env-in-tests.patch
       ./bin-sh-node-run-v22.patch
-      # fix test failure on macos 15.4
-      (fetchpatch2 {
-        url = "https://github.com/nodejs/node/commit/33f6e1ea296cd20366ab94e666b03899a081af94.patch?full_index=1";
-        hash = "sha256-aVBMcQlhQeviUQpMIfC988jjDB2BgYzlMYsq+w16mzU=";
-      })
     ]
     ++ lib.optionals (!stdenv.buildPlatform.isDarwin) [
       # test-icu-env is failing without the reverts
diff --git a/pkgs/games/anki/default.nix b/pkgs/games/anki/default.nix
index 76033e6fdec7..8e1d69a26acf 100644
--- a/pkgs/games/anki/default.nix
+++ b/pkgs/games/anki/default.nix
@@ -22,8 +22,6 @@
   writeShellScriptBin,
   yarn,
 
-  AVKit,
-  CoreAudio,
   swift,
 
   mesa,
@@ -153,64 +151,58 @@ python3.pkgs.buildPythonApplication {
     qt6.qtsvg
   ] ++ lib.optional stdenv.hostPlatform.isLinux qt6.qtwayland;
 
-  propagatedBuildInputs =
-    with python3.pkgs;
-    [
-      # This rather long list came from running:
-      #    grep --no-filename -oE "^[^ =]*" python/{requirements.base.txt,requirements.bundle.txt,requirements.qt6_lin.txt} | \
-      #      sort | uniq | grep -v "^#$"
-      # in their repo at the git tag for this version
-      # There's probably a more elegant way, but the above extracted all the
-      # names, without version numbers, of their python dependencies. The hope is
-      # that nixpkgs versions are "close enough"
-      # I then removed the ones the check phase failed on (pythonCatchConflictsPhase)
-      attrs
-      beautifulsoup4
-      blinker
-      build
-      certifi
-      charset-normalizer
-      click
-      colorama
-      decorator
-      flask
-      flask-cors
-      google-api-python-client
-      idna
-      importlib-metadata
-      itsdangerous
-      jinja2
-      jsonschema
-      markdown
-      markupsafe
-      orjson
-      packaging
-      pip
-      pip-system-certs
-      pip-tools
-      protobuf
-      pyproject-hooks
-      pyqt6
-      pyqt6-sip
-      pyqt6-webengine
-      pyrsistent
-      pysocks
-      requests
-      send2trash
-      setuptools
-      soupsieve
-      tomli
-      urllib3
-      waitress
-      werkzeug
-      wheel
-      wrapt
-      zipp
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AVKit
-      CoreAudio
-    ];
+  propagatedBuildInputs = with python3.pkgs; [
+    # This rather long list came from running:
+    #    grep --no-filename -oE "^[^ =]*" python/{requirements.base.txt,requirements.bundle.txt,requirements.qt6_lin.txt} | \
+    #      sort | uniq | grep -v "^#$"
+    # in their repo at the git tag for this version
+    # There's probably a more elegant way, but the above extracted all the
+    # names, without version numbers, of their python dependencies. The hope is
+    # that nixpkgs versions are "close enough"
+    # I then removed the ones the check phase failed on (pythonCatchConflictsPhase)
+    attrs
+    beautifulsoup4
+    blinker
+    build
+    certifi
+    charset-normalizer
+    click
+    colorama
+    decorator
+    flask
+    flask-cors
+    google-api-python-client
+    idna
+    importlib-metadata
+    itsdangerous
+    jinja2
+    jsonschema
+    markdown
+    markupsafe
+    orjson
+    packaging
+    pip
+    pip-system-certs
+    pip-tools
+    protobuf
+    pyproject-hooks
+    pyqt6
+    pyqt6-sip
+    pyqt6-webengine
+    pyrsistent
+    pysocks
+    requests
+    send2trash
+    setuptools
+    soupsieve
+    tomli
+    urllib3
+    waitress
+    werkzeug
+    wheel
+    wrapt
+    zipp
+  ];
 
   nativeCheckInputs = with python3.pkgs; [
     pytest
diff --git a/pkgs/games/blightmud/default.nix b/pkgs/games/blightmud/default.nix
index b38c6dffa88d..d12175c67f8a 100644
--- a/pkgs/games/blightmud/default.nix
+++ b/pkgs/games/blightmud/default.nix
@@ -8,16 +8,7 @@
   openssl,
   withTTS ? false,
   speechd-minimal,
-  darwin,
 }:
-let
-  inherit (darwin.apple_sdk.frameworks)
-    CoreAudio
-    AudioUnit
-    AVFoundation
-    AppKit
-    ;
-in
 rustPlatform.buildRustPackage rec {
   pname = "blightmud";
   version = "5.3.1";
@@ -42,15 +33,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs =
     [ openssl ]
     ++ lib.optionals (withTTS && stdenv.hostPlatform.isLinux) [ speechd-minimal ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [ alsa-lib ]
-    ++ lib.optionals (withTTS && stdenv.hostPlatform.isDarwin) [
-      AVFoundation
-      AppKit
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CoreAudio
-      AudioUnit
-    ];
+    ++ lib.optionals stdenv.hostPlatform.isLinux [ alsa-lib ];
 
   checkFlags =
     let
diff --git a/pkgs/games/bugdom/default.nix b/pkgs/games/bugdom/default.nix
index 8d25bf7dc3d9..924b69f29f50 100644
--- a/pkgs/games/bugdom/default.nix
+++ b/pkgs/games/bugdom/default.nix
@@ -4,9 +4,6 @@
   fetchFromGitHub,
   SDL2,
   libGL,
-  IOKit,
-  Foundation,
-  OpenGL,
   cmake,
   makeWrapper,
 }:
@@ -32,16 +29,11 @@ stdenv.mkDerivation rec {
     sed -i '/plutil/d' CMakeLists.txt
   '';
 
-  buildInputs =
-    [
-      SDL2
-      libGL
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      IOKit
-      Foundation
-      OpenGL
-    ];
+  buildInputs = [
+
+    SDL2
+    libGL
+  ];
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/games/crawl/default.nix b/pkgs/games/crawl/default.nix
index 81e8f826e509..10c67bb532a5 100644
--- a/pkgs/games/crawl/default.nix
+++ b/pkgs/games/crawl/default.nix
@@ -23,8 +23,6 @@
   tileMode ? false,
   enableSound ? tileMode,
   buildPackages,
-  # MacOS / Darwin builds
-  darwin,
 }:
 
 stdenv.mkDerivation rec {
@@ -71,19 +69,7 @@ stdenv.mkDerivation rec {
       libGLU
       libGL
     ]
-    ++ lib.optional enableSound SDL2_mixer
-    ++ (lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        AppKit
-        AudioUnit
-        CoreAudio
-        ForceFeedback
-        Carbon
-        IOKit
-        OpenGL
-      ]
-    ));
+    ++ lib.optional enableSound SDL2_mixer;
 
   preBuild =
     ''
diff --git a/pkgs/games/easyrpg-player/default.nix b/pkgs/games/easyrpg-player/default.nix
index be92949cb91a..888c91162592 100644
--- a/pkgs/games/easyrpg-player/default.nix
+++ b/pkgs/games/easyrpg-player/default.nix
@@ -33,9 +33,6 @@
   libdecor,
   alsa-lib,
   asciidoctor,
-  Foundation,
-  AudioUnit,
-  AudioToolbox,
 }:
 
 stdenv.mkDerivation rec {
@@ -98,11 +95,6 @@ stdenv.mkDerivation rec {
       libXxf86vm
       libdecor
       wildmidi # until packaged on Darwin
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Foundation
-      AudioUnit
-      AudioToolbox
     ];
 
   cmakeFlags = [
diff --git a/pkgs/games/exult/default.nix b/pkgs/games/exult/default.nix
index ed3f5118b4e2..10fba6cb9406 100644
--- a/pkgs/games/exult/default.nix
+++ b/pkgs/games/exult/default.nix
@@ -14,8 +14,6 @@
   pkg-config,
   zlib,
   enableTools ? false,
-  # Darwin-specific
-  AudioUnit,
 }:
 
 stdenv.mkDerivation rec {
@@ -44,17 +42,13 @@ stdenv.mkDerivation rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      SDL2
-      libogg
-      libvorbis
-      libX11
-      zlib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AudioUnit
-    ];
+  buildInputs = [
+    SDL2
+    libogg
+    libvorbis
+    libX11
+    zlib
+  ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/games/ferium/default.nix b/pkgs/games/ferium/default.nix
index 4c835cab698a..88f212a9f744 100644
--- a/pkgs/games/ferium/default.nix
+++ b/pkgs/games/ferium/default.nix
@@ -1,10 +1,7 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
-  Security,
-  SystemConfiguration,
   installShellFiles,
 }:
 
@@ -19,11 +16,6 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-eeQjezB6pRdnPADLgDLo8b+bUSP12gfBhFNt/uYCwHU=";
   };
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    Security
-    SystemConfiguration
-  ];
-
   useFetchCargoVendor = true;
   cargoHash = "sha256-3YKFKngyLg2ah4GY+LlbPbnVks7/xFawnMf3D1gjmwI=";
 
diff --git a/pkgs/games/flare/default.nix b/pkgs/games/flare/default.nix
index 8dd6c435c1b5..917c09389fd5 100644
--- a/pkgs/games/flare/default.nix
+++ b/pkgs/games/flare/default.nix
@@ -3,14 +3,13 @@
   buildEnv,
   callPackage,
   makeWrapper,
-  Cocoa,
 }:
 
 buildEnv {
   name = "flare-1.14";
 
   paths = [
-    (callPackage ./engine.nix { inherit Cocoa; })
+    (callPackage ./engine.nix { })
     (callPackage ./game.nix { })
   ];
 
diff --git a/pkgs/games/flare/engine.nix b/pkgs/games/flare/engine.nix
index 8d4069874bd6..41feaac20101 100644
--- a/pkgs/games/flare/engine.nix
+++ b/pkgs/games/flare/engine.nix
@@ -7,7 +7,6 @@
   SDL2_image,
   SDL2_mixer,
   SDL2_ttf,
-  Cocoa,
 }:
 
 stdenv.mkDerivation rec {
@@ -29,7 +28,7 @@ stdenv.mkDerivation rec {
     SDL2_image
     SDL2_mixer
     SDL2_ttf
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin Cocoa;
+  ];
 
   meta = with lib; {
     description = "Free/Libre Action Roleplaying Engine";
diff --git a/pkgs/games/mudlet/default.nix b/pkgs/games/mudlet/default.nix
index 5367f2b6e868..76f3e95b9508 100644
--- a/pkgs/games/mudlet/default.nix
+++ b/pkgs/games/mudlet/default.nix
@@ -22,7 +22,6 @@
   qtmultimedia,
   discord-rpc,
   yajl,
-  AppKit,
 }:
 
 let
@@ -86,25 +85,21 @@ stdenv.mkDerivation rec {
     wrapQtAppsHook
   ];
 
-  buildInputs =
-    [
-      boost
-      hunspell
-      libGLU
-      libsForQt5.qtkeychain
-      libsecret
-      libzip
-      luaEnv
-      pcre
-      pugixml
-      qtbase
-      qtmultimedia
-      yajl
-      discord-rpc
-    ]
-    ++ lib.optional stdenv.hostPlatform.isDarwin [
-      AppKit
-    ];
+  buildInputs = [
+    boost
+    hunspell
+    libGLU
+    libsForQt5.qtkeychain
+    libsecret
+    libzip
+    luaEnv
+    pcre
+    pugixml
+    qtbase
+    qtmultimedia
+    yajl
+    discord-rpc
+  ];
 
   cmakeFlags = [
     # RPATH of binary /nix/store/.../bin/... contains a forbidden reference to /build/
diff --git a/pkgs/games/openmw/default.nix b/pkgs/games/openmw/default.nix
index c83c5648eb62..cff3576ebafe 100644
--- a/pkgs/games/openmw/default.nix
+++ b/pkgs/games/openmw/default.nix
@@ -7,9 +7,6 @@
   pkg-config,
   wrapQtAppsHook,
   SDL2,
-  CoreMedia,
-  VideoToolbox,
-  VideoDecodeAcceleration,
   boost,
   bullet,
   # Please unpin this on the next OpenMW release.
@@ -98,27 +95,21 @@ stdenv.mkDerivation rec {
   # If not set, OSG plugin .so files become shell scripts on Darwin.
   dontWrapQtApps = stdenv.hostPlatform.isDarwin;
 
-  buildInputs =
-    [
-      SDL2
-      boost
-      bullet'
-      ffmpeg_6
-      libXt
-      luajit
-      lz4
-      mygui
-      openal
-      osg'
-      recastnavigation
-      unshield
-      yaml-cpp
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CoreMedia
-      VideoDecodeAcceleration
-      VideoToolbox
-    ];
+  buildInputs = [
+    SDL2
+    boost
+    bullet'
+    ffmpeg_6
+    libXt
+    luajit
+    lz4
+    mygui
+    openal
+    osg'
+    recastnavigation
+    unshield
+    yaml-cpp
+  ];
 
   cmakeFlags =
     [
diff --git a/pkgs/games/openspades/default.nix b/pkgs/games/openspades/default.nix
index 8ad42af360bd..5988ca9d4300 100644
--- a/pkgs/games/openspades/default.nix
+++ b/pkgs/games/openspades/default.nix
@@ -19,7 +19,6 @@
   openal,
   opusfile,
   libogg,
-  Cocoa,
   libXext,
 }:
 
@@ -43,23 +42,19 @@ stdenv.mkDerivation rec {
     file
   ];
 
-  buildInputs =
-    [
-      freetype
-      SDL2
-      SDL2_image
-      libGL
-      zlib
-      curl
-      glew
-      opusfile
-      openal
-      libogg
-      libXext
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Cocoa
-    ];
+  buildInputs = [
+    freetype
+    SDL2
+    SDL2_image
+    libGL
+    zlib
+    curl
+    glew
+    opusfile
+    openal
+    libogg
+    libXext
+  ];
 
   patches = [
     # https://github.com/yvt/openspades/pull/793 fix Darwin build
diff --git a/pkgs/games/quake2/yquake2/default.nix b/pkgs/games/quake2/yquake2/default.nix
index ea98c8227276..0a942f0cf61b 100644
--- a/pkgs/games/quake2/yquake2/default.nix
+++ b/pkgs/games/quake2/yquake2/default.nix
@@ -11,8 +11,6 @@
   curl,
   openalSupport ? true,
   openal,
-  Cocoa,
-  OpenAL,
 }:
 
 let
@@ -53,17 +51,11 @@ let
           --replace "\"libopenal.so.1\"" "\"${openal}/lib/libopenal.so.1\""
       '';
 
-    buildInputs =
-      [
-        SDL2
-        libGL
-        curl
-      ]
-      ++ lib.optionals stdenv.hostPlatform.isDarwin [
-        Cocoa
-        OpenAL
-      ]
-      ++ lib.optional openalSupport openal;
+    buildInputs = [
+      SDL2
+      libGL
+      curl
+    ] ++ lib.optional openalSupport openal;
 
     makeFlags = [
       "WITH_OPENAL=${mkFlag openalSupport}"
diff --git a/pkgs/games/quakespasm/default.nix b/pkgs/games/quakespasm/default.nix
index 86de99a68a86..7f28c9d580d2 100644
--- a/pkgs/games/quakespasm/default.nix
+++ b/pkgs/games/quakespasm/default.nix
@@ -14,11 +14,6 @@
   opusfile,
   libogg,
   libxmp,
-  Cocoa,
-  CoreAudio,
-  CoreFoundation,
-  IOKit,
-  OpenGL,
   copyDesktopItems,
   makeDesktopItem,
   pkg-config,
@@ -51,29 +46,19 @@ stdenv.mkDerivation rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      gzip
-      libGL
-      libGLU
-      libvorbis
-      libmad
-      flac
-      libopus
-      opusfile
-      libogg
-      libxmp
-      (if useSDL2 then SDL2 else SDL)
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Cocoa
-      CoreAudio
-      IOKit
-      OpenGL
-    ]
-    ++ lib.optionals (stdenv.hostPlatform.isDarwin && useSDL2) [
-      CoreFoundation
-    ];
+  buildInputs = [
+    gzip
+    libGL
+    libGLU
+    libvorbis
+    libmad
+    flac
+    libopus
+    opusfile
+    libogg
+    libxmp
+    (if useSDL2 then SDL2 else SDL)
+  ];
 
   buildFlags =
     [
diff --git a/pkgs/games/scummvm/default.nix b/pkgs/games/scummvm/default.nix
index fe583be48a4a..edecf97f68d6 100644
--- a/pkgs/games/scummvm/default.nix
+++ b/pkgs/games/scummvm/default.nix
@@ -19,11 +19,6 @@
   libX11,
   SDL2,
   zlib,
-  Cocoa,
-  AudioToolbox,
-  Carbon,
-  CoreMIDI,
-  AudioUnit,
   cctools,
   nix-update-script,
 }:
@@ -47,13 +42,6 @@ stdenv.mkDerivation rec {
       libGLU
       libGL
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Cocoa
-      AudioToolbox
-      Carbon
-      CoreMIDI
-      AudioUnit
-    ]
     ++ [
       curl
       freetype
diff --git a/pkgs/games/super-tux-kart/default.nix b/pkgs/games/super-tux-kart/default.nix
index d7a1294b3d51..e6bb798f9d7b 100644
--- a/pkgs/games/super-tux-kart/default.nix
+++ b/pkgs/games/super-tux-kart/default.nix
@@ -9,7 +9,6 @@
   SDL2,
   glew,
   openal,
-  OpenAL,
   libvorbis,
   libogg,
   curl,
@@ -23,9 +22,6 @@
   angelscript,
   libopenglrecorder,
   sqlite,
-  Cocoa,
-  IOKit,
-  IOBluetooth,
   libsamplerate,
   shaderc,
 }:
@@ -117,10 +113,6 @@ stdenv.mkDerivation rec {
     ++ lib.optional (stdenv.hostPlatform.isWindows || stdenv.hostPlatform.isLinux) libopenglrecorder
     ++ lib.optional stdenv.hostPlatform.isLinux openal
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      OpenAL
-      IOKit
-      Cocoa
-      IOBluetooth
       libsamplerate
     ];
 
diff --git a/pkgs/games/teeworlds/default.nix b/pkgs/games/teeworlds/default.nix
index 047562bc028a..22e9476f1e6d 100644
--- a/pkgs/games/teeworlds/default.nix
+++ b/pkgs/games/teeworlds/default.nix
@@ -16,7 +16,6 @@
   wavpack,
   icoutils,
   nixosTests,
-  Cocoa,
   buildClient ? true,
 }:
 
@@ -79,9 +78,6 @@ stdenv.mkDerivation rec {
       zlib
       wavpack
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Cocoa
-    ]
     ++ lib.optionals buildClient (
       [
         SDL2
diff --git a/pkgs/games/wesnoth/default.nix b/pkgs/games/wesnoth/default.nix
index 74c2e5230d18..1e058c39481b 100644
--- a/pkgs/games/wesnoth/default.nix
+++ b/pkgs/games/wesnoth/default.nix
@@ -21,8 +21,6 @@
   icu,
   lua,
   curl,
-  Cocoa,
-  Foundation,
 }:
 
 stdenv.mkDerivation rec {
@@ -41,30 +39,25 @@ stdenv.mkDerivation rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      SDL2
-      SDL2_image
-      SDL2_mixer
-      SDL2_net
-      SDL2_ttf
-      pango
-      gettext
-      boost
-      libvorbis
-      fribidi
-      dbus
-      libpng
-      pcre
-      openssl
-      icu
-      lua
-      curl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Cocoa
-      Foundation
-    ];
+  buildInputs = [
+    SDL2
+    SDL2_image
+    SDL2_mixer
+    SDL2_net
+    SDL2_ttf
+    pango
+    gettext
+    boost
+    libvorbis
+    fribidi
+    dbus
+    libpng
+    pcre
+    openssl
+    icu
+    lua
+    curl
+  ];
 
   cmakeFlags = [
     "-DENABLE_SYSTEM_LUA=ON"
diff --git a/pkgs/kde/lib/mk-kde-derivation.nix b/pkgs/kde/lib/mk-kde-derivation.nix
index 61ef7a69f00e..bba43b3bc411 100644
--- a/pkgs/kde/lib/mk-kde-derivation.nix
+++ b/pkgs/kde/lib/mk-kde-derivation.nix
@@ -98,7 +98,9 @@ let
     attrName: attrValue:
     let
       pretty = lib.generators.toPretty { };
-      duplicates = builtins.filter (dep: (builtins.elem (lib.getName dep) filteredDepNames)) attrValue;
+      duplicates = builtins.filter (
+        dep: dep != null && builtins.elem (lib.getName dep) filteredDepNames
+      ) attrValue;
     in
     if duplicates != [ ] then
       lib.warn "Duplicate dependencies in ${attrName} of package ${pname}: ${pretty duplicates}"
diff --git a/pkgs/misc/cups/default.nix b/pkgs/misc/cups/default.nix
index e4d3b4c71dcd..3d6f31030b6f 100644
--- a/pkgs/misc/cups/default.nix
+++ b/pkgs/misc/cups/default.nix
@@ -78,14 +78,7 @@ stdenv.mkDerivation rec {
       dbus
       acl
     ]
-    ++ lib.optional enableSystemd systemd
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin;
-      [
-        configd
-        apple_sdk.frameworks.ApplicationServices
-      ]
-    );
+    ++ lib.optional enableSystemd systemd;
 
   propagatedBuildInputs = [ gmp ];
 
diff --git a/pkgs/misc/drivers/spacenavd/default.nix b/pkgs/misc/drivers/spacenavd/default.nix
index f71387d26405..0914c8898cec 100644
--- a/pkgs/misc/drivers/spacenavd/default.nix
+++ b/pkgs/misc/drivers/spacenavd/default.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   libXext,
   libX11,
-  IOKit,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "spacenavd";
@@ -20,7 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     libX11
     libXext
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin IOKit;
+  ];
 
   configureFlags = [ "--disable-debug" ];
 
diff --git a/pkgs/misc/jackaudio/default.nix b/pkgs/misc/jackaudio/default.nix
index 78e32544b1a3..6098c9a5d419 100644
--- a/pkgs/misc/jackaudio/default.nix
+++ b/pkgs/misc/jackaudio/default.nix
@@ -7,17 +7,10 @@
   python3Packages,
   makeWrapper,
   libsamplerate,
-  libsndfile,
-  readline,
-  eigen,
   celt,
   wafHook,
   # Darwin Dependencies
   aften,
-  AudioUnit,
-  CoreAudio,
-  libobjc,
-  Accelerate,
 
   # BSD Dependencies
   freebsd,
@@ -71,9 +64,6 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs =
     [
       libsamplerate
-      libsndfile
-      readline
-      eigen
       celt
       optDbus
       optPythonDBus
@@ -83,10 +73,6 @@ stdenv.mkDerivation (finalAttrs: {
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       aften
-      AudioUnit
-      CoreAudio
-      Accelerate
-      libobjc
     ]
     ++ lib.optionals stdenv.hostPlatform.isFreeBSD [
       freebsd.libsysinfo
@@ -131,17 +117,17 @@ stdenv.mkDerivation (finalAttrs: {
 
   postFixup = ''
     substituteInPlace "$dev/lib/pkgconfig/jack.pc" \
-      --replace "$out/include" "$dev/include"
+      --replace-fail "$out/include" "$dev/include"
   '';
 
   passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
 
-  meta = with lib; {
+  meta = {
     description = "JACK audio connection kit, version 2 with jackdbus";
     homepage = "https://jackaudio.org";
-    license = licenses.gpl2Plus;
+    license = lib.licenses.gpl2Plus;
     pkgConfigModules = [ "jack" ];
-    platforms = platforms.unix;
+    platforms = lib.platforms.unix;
     maintainers = [ ];
   };
 })
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
index 8f283c6bec54..59a764db18e5 100644
--- a/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
@@ -1,13 +1,8 @@
 # Compatibility stubs for packages that used the old SDK frameworks.
-# TODO(@reckenrode) Make these stubs warn after framework usage has been cleaned up in nixpkgs.
 {
   lib,
   callPackage,
-  newScope,
-  overrideSDK,
   pkgs,
-  stdenv,
-  stdenvNoCC,
 }:
 
 let
diff --git a/pkgs/os-specific/darwin/apple-sdk-12.3/default.nix b/pkgs/os-specific/darwin/apple-sdk-12.3/default.nix
index 468465b19277..65b7c30f65c5 100644
--- a/pkgs/os-specific/darwin/apple-sdk-12.3/default.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-12.3/default.nix
@@ -1,13 +1,8 @@
 # Compatibility stubs for packages that used the old SDK frameworks.
-# TODO(@reckenrode) Make these stubs warn after framework usage has been cleaned up in nixpkgs.
 {
   lib,
   callPackage,
-  newScope,
-  overrideSDK,
   pkgs,
-  stdenv,
-  stdenvNoCC,
 }:
 
 let
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libiconv/package.nix b/pkgs/os-specific/darwin/apple-source-releases/libiconv/package.nix
index 0803ff7a4dad..52cb03245a0e 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libiconv/package.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libiconv/package.nix
@@ -78,7 +78,7 @@ mkAppleDerivation (finalAttrs: {
   # Can’t use `mesonCheckPhase` because it runs the wrong hooks for `installCheckPhase`.
   installCheckPhase = ''
     runHook preInstallCheck
-    meson test --no-rebuild
+    meson test --no-rebuild --print-errorlogs --timeout-multiplier=0
     runHook postInstallCheck
   '';
 
diff --git a/pkgs/os-specific/darwin/defaultbrowser/default.nix b/pkgs/os-specific/darwin/defaultbrowser/default.nix
index f4f4c885d144..a08d7aa2516c 100644
--- a/pkgs/os-specific/darwin/defaultbrowser/default.nix
+++ b/pkgs/os-specific/darwin/defaultbrowser/default.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  Foundation,
 }:
 
 stdenv.mkDerivation rec {
@@ -21,8 +20,6 @@ stdenv.mkDerivation rec {
     "PREFIX=$(out)"
   ];
 
-  buildInputs = [ Foundation ];
-
   meta = with lib; {
     mainProgram = "defaultbrowser";
     description = "Command line tool for getting and setting a default browser (HTTP handler) in Mac OS X";
diff --git a/pkgs/os-specific/darwin/khd/default.nix b/pkgs/os-specific/darwin/khd/default.nix
index 474d750ecc8c..bfdc1dfc7d3b 100644
--- a/pkgs/os-specific/darwin/khd/default.nix
+++ b/pkgs/os-specific/darwin/khd/default.nix
@@ -3,8 +3,6 @@
   stdenv,
   fetchFromGitHub,
   fetchpatch,
-  Carbon,
-  Cocoa,
 }:
 
 stdenv.mkDerivation rec {
@@ -26,11 +24,6 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  buildInputs = [
-    Carbon
-    Cocoa
-  ];
-
   buildPhase = ''
     make install
   '';
diff --git a/pkgs/os-specific/darwin/macfuse/default.nix b/pkgs/os-specific/darwin/macfuse/default.nix
index 7f7c0cb5183b..1461e3ef27f6 100644
--- a/pkgs/os-specific/darwin/macfuse/default.nix
+++ b/pkgs/os-specific/darwin/macfuse/default.nix
@@ -6,7 +6,6 @@
   xar,
   undmg,
   libtapi,
-  DiskArbitration,
 }:
 
 stdenv.mkDerivation rec {
@@ -24,7 +23,6 @@ stdenv.mkDerivation rec {
     undmg
     libtapi
   ];
-  propagatedBuildInputs = [ DiskArbitration ];
 
   postUnpack = ''
     xar -xf 'Install macFUSE.pkg'
diff --git a/pkgs/os-specific/darwin/native-x11-and-opengl/default.nix b/pkgs/os-specific/darwin/native-x11-and-opengl/default.nix
deleted file mode 100644
index fa3d4284e597..000000000000
--- a/pkgs/os-specific/darwin/native-x11-and-opengl/default.nix
+++ /dev/null
@@ -1,14 +0,0 @@
-{ stdenv, writeScript }:
-
-stdenv.mkDerivation rec {
-  name = "darwin-native-x11-and-opengl";
-
-  builder = writeScript "${name}-builder.sh" ''
-    /bin/mkdir -p $out
-    /bin/mkdir $out/lib
-    /bin/ln -sv /usr/X11/lib/{*.dylib,X11,xorg} $out/lib
-    /bin/mkdir $out/lib/pkgconfig
-    /bin/ln -sv /usr/X11/lib/pkgconfig/{x*.pc,gl*.pc} $out/lib/pkgconfig
-    /bin/ln -sv /usr/X11/{bin,include,share} $out/
-  '';
-}
diff --git a/pkgs/os-specific/darwin/noah/default.nix b/pkgs/os-specific/darwin/noah/default.nix
index 421b11df3232..fe149c20ac72 100644
--- a/pkgs/os-specific/darwin/noah/default.nix
+++ b/pkgs/os-specific/darwin/noah/default.nix
@@ -3,7 +3,6 @@
   stdenv,
   fetchFromGitHub,
   cmake,
-  Hypervisor,
 }:
 
 stdenv.mkDerivation rec {
@@ -18,7 +17,6 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = [ Hypervisor ];
 
   meta = with lib; {
     description = "Bash on Ubuntu on macOS";
diff --git a/pkgs/os-specific/darwin/osx-cpu-temp/default.nix b/pkgs/os-specific/darwin/osx-cpu-temp/default.nix
index 03c56c0adf91..016cd81d6831 100644
--- a/pkgs/os-specific/darwin/osx-cpu-temp/default.nix
+++ b/pkgs/os-specific/darwin/osx-cpu-temp/default.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  IOKit,
 }:
 
 stdenv.mkDerivation rec {
@@ -17,8 +16,6 @@ stdenv.mkDerivation rec {
     sha256 = "1nlibgr55bpln6jbdf8vqcp0fj9zv9343vflb7s9w0yh33fsbg9d";
   };
 
-  buildInputs = [ IOKit ];
-
   installPhase = ''
     mkdir -p $out/bin
     cp osx-cpu-temp $out/bin
diff --git a/pkgs/os-specific/darwin/pngpaste/default.nix b/pkgs/os-specific/darwin/pngpaste/default.nix
index 3df66b88534a..2360b9de8d26 100644
--- a/pkgs/os-specific/darwin/pngpaste/default.nix
+++ b/pkgs/os-specific/darwin/pngpaste/default.nix
@@ -2,8 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  AppKit,
-  Cocoa,
 }:
 
 let
@@ -19,11 +17,6 @@ stdenv.mkDerivation {
     sha256 = "uvajxSelk1Wfd5is5kmT2fzDShlufBgC0PDCeabEOSE=";
   };
 
-  buildInputs = [
-    AppKit
-    Cocoa
-  ];
-
   installPhase = ''
     mkdir -p $out/bin
     cp pngpaste $out/bin
diff --git a/pkgs/os-specific/darwin/print-reexports/default.nix b/pkgs/os-specific/darwin/print-reexports/default.nix
deleted file mode 100644
index 88d8d8532cec..000000000000
--- a/pkgs/os-specific/darwin/print-reexports/default.nix
+++ /dev/null
@@ -1,22 +0,0 @@
-{
-  lib,
-  stdenv,
-  libyaml,
-}:
-
-stdenv.mkDerivation {
-  name = "print-reexports";
-  src = lib.sourceFilesBySuffices ./. [ ".c" ];
-
-  buildInputs = [ libyaml ];
-
-  buildPhase = ''
-    $CC -lyaml -o print-reexports main.c
-  '';
-
-  installPhase = ''
-    mkdir -p $out/bin
-    mv print-reexports $out/bin
-  '';
-  meta.mainProgram = "print-reexports";
-}
diff --git a/pkgs/os-specific/darwin/print-reexports/main.c b/pkgs/os-specific/darwin/print-reexports/main.c
deleted file mode 100644
index e6ff527da966..000000000000
--- a/pkgs/os-specific/darwin/print-reexports/main.c
+++ /dev/null
@@ -1,213 +0,0 @@
-/**
- * Display the list of re-exported libraries from a TAPI v2 .tbd file, one per
- * line on stdout.
- *
- * TAPI files are the equivalent of library files for the purposes of linking.
- * Like dylib files, they may re-export other libraries. In upstream usage
- * these refer to the absolute paths of dylibs, and are resolved to .tbd files
- * in combination with the syslibroot option. In nixpkgs, the .tbd files refer
- * directly to other .tbd files without a syslibroot. Note that each .tbd file
- * contains an install name, so the re-exported path does not affect the final
- * result.
- *
- * In nixpkgs each framework is a distinct store path and some frameworks
- * re-export other frameworks. The re-exported names are rewritten to refer to
- * the store paths of dependencies via textual substitution. This utility is
- * used to emit every file that is listed as a re-exported library, which
- * allows the framework builder to verify their existence.
- */
-
-#include <stdio.h>
-#include <sys/errno.h>
-#include <yaml.h>
-
-#define LOG(str, ...) fprintf(stderr, "%s", str)
-
-#define LOGF(...) fprintf(stderr, __VA_ARGS__)
-
-static yaml_node_t *get_mapping_entry(yaml_document_t *document, yaml_node_t *mapping, const char *name) {
-  if (!mapping) {
-    fprintf(stderr, "get_mapping_entry: mapping is null\n");
-    return NULL;
-  }
-
-  for (
-      yaml_node_pair_t *pair = mapping->data.mapping.pairs.start;
-      pair < mapping->data.mapping.pairs.top;
-      ++pair
-  ) {
-    yaml_node_t *key = yaml_document_get_node(document, pair->key);
-
-    if (!key) {
-      LOGF("key (%d) is null\n", pair->key);
-      return NULL;
-    }
-
-    if (key->type != YAML_SCALAR_NODE) {
-      LOG("get_mapping_entry: key is not a scalar\n");
-      return NULL;
-    }
-
-    if (strncmp((const char *)key->data.scalar.value, name, key->data.scalar.length) != 0) {
-      continue;
-    }
-
-    return yaml_document_get_node(document, pair->value);
-  }
-
-  return NULL;
-}
-
-static int emit_reexports_v2(yaml_document_t *document) {
-  yaml_node_t *root = yaml_document_get_root_node(document);
-
-  yaml_node_t *exports = get_mapping_entry(document, root, "exports");
-
-  if (!exports) {
-    return 1;
-  }
-
-  if (exports->type != YAML_SEQUENCE_NODE) {
-    LOG("value is not a sequence\n");
-    return 0;
-  }
-
-  for (
-      yaml_node_item_t *export = exports->data.sequence.items.start;
-      export < exports->data.sequence.items.top;
-      ++export
-  ) {
-    yaml_node_t *export_node = yaml_document_get_node(document, *export);
-
-    yaml_node_t *reexports = get_mapping_entry(document, export_node, "re-exports");
-
-    if (!reexports) {
-      continue;
-    }
-
-    if (reexports->type != YAML_SEQUENCE_NODE) {
-      LOG("re-exports is not a sequence\n");
-      return 0;
-    }
-
-    for (
-        yaml_node_item_t *reexport = reexports->data.sequence.items.start;
-        reexport < reexports->data.sequence.items.top;
-        ++reexport
-    ) {
-      yaml_node_t *val = yaml_document_get_node(document, *reexport);
-
-      if (val->type != YAML_SCALAR_NODE) {
-        LOG("item is not a scalar\n");
-        return 0;
-      }
-
-      fwrite(val->data.scalar.value, val->data.scalar.length, 1, stdout);
-      putchar('\n');
-    }
-  }
-
-  return 1;
-}
-
-static int emit_reexports_v4(yaml_document_t *document) {
-  yaml_node_t *root = yaml_document_get_root_node(document);
-  yaml_node_t *reexports = get_mapping_entry(document, root, "reexported-libraries");
-
-  if (!reexports) {
-    return 1;
-  }
-
-  if (reexports->type != YAML_SEQUENCE_NODE) {
-    LOG("value is not a sequence\n");
-    return 0;
-  }
-
-  for (
-      yaml_node_item_t *entry = reexports->data.sequence.items.start;
-      entry < reexports->data.sequence.items.top;
-      ++entry
-  ) {
-    yaml_node_t *entry_node = yaml_document_get_node(document, *entry);
-
-    yaml_node_t *libs = get_mapping_entry(document, entry_node, "libraries");
-
-    if (!libs) {
-      continue;
-    }
-
-    if (libs->type != YAML_SEQUENCE_NODE) {
-      LOG("libraries is not a sequence\n");
-      return 0;
-    }
-
-    for (
-        yaml_node_item_t *lib = libs->data.sequence.items.start;
-        lib < libs->data.sequence.items.top;
-        ++lib
-    ) {
-      yaml_node_t *val = yaml_document_get_node(document, *lib);
-
-      if (val->type != YAML_SCALAR_NODE) {
-        LOG("item is not a scalar\n");
-        return 0;
-      }
-
-      fwrite(val->data.scalar.value, val->data.scalar.length, 1, stdout);
-      putchar('\n');
-    }
-  }
-
-  return 1;
-}
-
-int main(int argc, char **argv) {
-  int result = 0;
-
-  if (argc != 2) {
-    fprintf(stderr, "Invalid usage\n");
-    result = 2;
-    goto done;
-  }
-
-  FILE *f = fopen(argv[1], "r");
-  if (!f) {
-    perror("opening input file");
-    result = errno;
-    goto done;
-  }
-
-  yaml_parser_t yaml_parser;
-  if (!yaml_parser_initialize(&yaml_parser)) {
-    fprintf(stderr, "Failed to initialize yaml parser\n");
-    result = 1;
-    goto err_file;
-  }
-
-  yaml_parser_set_input_file(&yaml_parser, f);
-
-  yaml_document_t yaml_document;
-
-  if(!yaml_parser_load(&yaml_parser, &yaml_document)) {
-    fprintf(stderr, "Failed to load yaml file\n");
-    result = 1;
-    goto err_yaml;
-  }
-
-  // Try both, only fail if one reports an error.  A lack of re-exports is not
-  // considered an error.
-  int ok = 1;
-  ok = ok && emit_reexports_v2(&yaml_document);
-  ok = ok && emit_reexports_v4(&yaml_document);
-
-  result = !ok;
-
-err_yaml:
-  yaml_parser_delete(&yaml_parser);
-
-err_file:
-  fclose(f);
-
-done:
-  return result;
-}
diff --git a/pkgs/os-specific/darwin/print-reexports/setup-hook.sh b/pkgs/os-specific/darwin/print-reexports/setup-hook.sh
deleted file mode 100644
index 9efb00aeb4dc..000000000000
--- a/pkgs/os-specific/darwin/print-reexports/setup-hook.sh
+++ /dev/null
@@ -1,19 +0,0 @@
-fixupOutputHooks+=('checkTbdReexports')
-
-checkTbdReexports() {
-  local dir="$1"
-
-  while IFS= read -r -d $'\0' tbd; do
-    echo "checkTbdRexports: checking re-exports in $tbd"
-    while read -r target; do
-      local expected="${target%.dylib}.tbd"
-      if ! [ -e "$expected" ]; then
-        echo -e "Re-export missing:\n\t'$target'\n\t(expected '$expected')"
-        echo -e "While processing\n\t'$tbd'"
-        exit 1
-      else
-        echo "Re-exported target '$target' ok"
-      fi
-    done < <(print-reexports "$tbd")
-  done < <(find $prefix -type f -name '*.tbd' -print0)
-}
diff --git a/pkgs/os-specific/darwin/qes/default.nix b/pkgs/os-specific/darwin/qes/default.nix
index 5b824da0f587..cf6702b92c53 100644
--- a/pkgs/os-specific/darwin/qes/default.nix
+++ b/pkgs/os-specific/darwin/qes/default.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  Carbon,
 }:
 
 stdenv.mkDerivation {
@@ -16,8 +15,6 @@ stdenv.mkDerivation {
     sha256 = "1w9ppid7jg6f4q7pq40lhm0whg7xmnxcmf3pb9xqfkq2zj2f7dxv";
   };
 
-  buildInputs = [ Carbon ];
-
   makeFlags = [ "BUILD_PATH=$(out)/bin" ];
 
   meta = with lib; {
diff --git a/pkgs/os-specific/darwin/rewrite-tbd/default.nix b/pkgs/os-specific/darwin/rewrite-tbd/default.nix
deleted file mode 100644
index 1026d9a8983a..000000000000
--- a/pkgs/os-specific/darwin/rewrite-tbd/default.nix
+++ /dev/null
@@ -1,41 +0,0 @@
-{
-  stdenv,
-  lib,
-  fetchFromGitHub,
-  libyaml,
-}:
-
-stdenv.mkDerivation {
-  pname = "rewrite-tbd";
-  version = "unstable-2023-03-27";
-
-  src = fetchFromGitHub {
-    owner = "thefloweringash";
-    repo = "rewrite-tbd";
-    rev = "d7852691762635028d237b7d00c3dc6a6613de79";
-    hash = "sha256-syxioFiGvEv4Ypk5hlIjLQth5YmdFdr+NC+aXSXzG4k=";
-  };
-
-  # Nix takes care of these paths. Avoiding the use of `pkg-config` prevents an infinite recursion.
-  postPatch = ''
-    substituteInPlace Makefile.boot \
-      --replace '$(shell pkg-config --cflags yaml-0.1)' "" \
-      --replace '$(shell pkg-config --libs yaml-0.1)' "-lyaml"
-  '';
-
-  buildInputs = [ libyaml ];
-
-  makeFlags = [
-    "-f"
-    "Makefile.boot"
-    "PREFIX=${placeholder "out"}"
-  ];
-
-  meta = with lib; {
-    homepage = "https://github.com/thefloweringash/rewrite-tbd/";
-    description = "Rewrite filepath in .tbd to Nix applicable format";
-    mainProgram = "rewrite-tbd";
-    platforms = platforms.unix;
-    license = licenses.mit;
-  };
-}
diff --git a/pkgs/os-specific/darwin/stubs/default.nix b/pkgs/os-specific/darwin/stubs/default.nix
deleted file mode 100644
index 832fdc557b5b..000000000000
--- a/pkgs/os-specific/darwin/stubs/default.nix
+++ /dev/null
@@ -1,25 +0,0 @@
-{
-  lib,
-  writeScriptBin,
-  runtimeShell,
-}:
-
-let
-  fake =
-    name:
-    lib.overrideDerivation
-      (writeScriptBin name ''
-        #!${runtimeShell}
-        echo >&2 "Faking call to ${name} with arguments:"
-        echo >&2 "$@"
-      '')
-      (drv: {
-        name = "${name}-stub";
-      });
-in
-
-{
-  setfile = fake "SetFile";
-  rez = fake "Rez";
-  derez = fake "DeRez";
-}
diff --git a/pkgs/os-specific/darwin/swift-corelibs/0001-Add-missing-TARGET_OS_-defines.patch b/pkgs/os-specific/darwin/swift-corelibs/0001-Add-missing-TARGET_OS_-defines.patch
deleted file mode 100644
index db17c517c720..000000000000
--- a/pkgs/os-specific/darwin/swift-corelibs/0001-Add-missing-TARGET_OS_-defines.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From 549160574ee44656d50997b27ef83736e0848201 Mon Sep 17 00:00:00 2001
-From: toonn <toonn@toonn.io>
-Date: Mon, 26 Apr 2021 20:51:05 +0200
-Subject: [PATCH] Add missing TARGET_OS_* defines
-
----
- .../Base.subproj/SwiftRuntime/TargetConditionals.h         | 7 +++++++
- 1 file changed, 7 insertions(+)
-
-diff --git a/CoreFoundation/Base.subproj/SwiftRuntime/TargetConditionals.h b/CoreFoundation/Base.subproj/SwiftRuntime/TargetConditionals.h
-index 6d42b873..abf746c9 100644
---- a/CoreFoundation/Base.subproj/SwiftRuntime/TargetConditionals.h
-+++ b/CoreFoundation/Base.subproj/SwiftRuntime/TargetConditionals.h
-@@ -118,6 +118,13 @@
- 
- #define TARGET_OS_WIN32        TARGET_OS_WINDOWS
- #define TARGET_OS_MAC          TARGET_OS_DARWIN
-+#define TARGET_OS_OSX          TARGET_OS_DARWIN
-+
-+#define TARGET_OS_IPHONE       0
-+#define TARGET_OS_WATCH        0
-+#define TARGET_OS_TV           0
-+#define TARGET_OS_EMBEDDED     0
-+
- 
- #if __x86_64__
- #define TARGET_CPU_PPC          0
--- 
-2.17.2 (Apple Git-113)
-
diff --git a/pkgs/os-specific/darwin/swift-corelibs/0002-Add-missing-launchd-header.patch b/pkgs/os-specific/darwin/swift-corelibs/0002-Add-missing-launchd-header.patch
deleted file mode 100644
index b1187c56587e..000000000000
--- a/pkgs/os-specific/darwin/swift-corelibs/0002-Add-missing-launchd-header.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/CoreFoundation/RunLoop.subproj/CFMessagePort.c	1969-12-31 19:00:01.000000000 -0500
-+++ b/CoreFoundation/RunLoop.subproj/CFMessagePort.c	2023-06-09 20:25:28.599209755 -0400
-@@ -28,6 +28,8 @@
- #endif
- #endif
- 
-+#include <bootstrap.h>
-+
- extern pid_t getpid(void);
- 
- #define __kCFMessagePortMaxNameLengthMax 255
diff --git a/pkgs/os-specific/darwin/swift-corelibs/0003-Fix-incompatible-pointer-conversion.patch b/pkgs/os-specific/darwin/swift-corelibs/0003-Fix-incompatible-pointer-conversion.patch
deleted file mode 100644
index 910b622ed3ce..000000000000
--- a/pkgs/os-specific/darwin/swift-corelibs/0003-Fix-incompatible-pointer-conversion.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-diff -u a/CoreFoundation/URL.subproj/CFURLComponents.c b/CoreFoundation/URL.subproj/CFURLComponents.c
---- a/CoreFoundation/URL.subproj/CFURLComponents.c	1969-12-31 19:00:01.000000000 -0500
-+++ b/CoreFoundation/URL.subproj/CFURLComponents.c	2023-06-09 20:36:52.995514573 -0400
-@@ -66,7 +66,8 @@
-     return CFRetain(CFSTR("A really nice CFURLComponents object"));
- }
- 
--CF_CROSS_PLATFORM_EXPORT void __CFURLComponentsDeallocate(CFURLComponentsRef instance) {
-+CF_CROSS_PLATFORM_EXPORT void __CFURLComponentsDeallocate(CFTypeRef cf) {
-+    CFURLComponentsRef instance = (CFURLComponentsRef)cf;
-     __CFGenericValidateType(instance, _CFURLComponentsGetTypeID());
-     
-     if (instance->_urlString) CFRelease(instance->_urlString);
-diff -u a/CoreFoundation/URL.subproj/CFURLComponents.h b/CoreFoundation/URL.subproj/CFURLComponents.h
---- a/CoreFoundation/URL.subproj/CFURLComponents.h	1969-12-31 19:00:01.000000000 -0500
-+++ b/CoreFoundation/URL.subproj/CFURLComponents.h	2023-06-09 20:39:36.967857713 -0400
-@@ -38,7 +38,7 @@
- 
- CF_EXPORT CFTypeID _CFURLComponentsGetTypeID(void);
- 
--CF_CROSS_PLATFORM_EXPORT void __CFURLComponentsDeallocate(CFURLComponentsRef);
-+CF_CROSS_PLATFORM_EXPORT void __CFURLComponentsDeallocate(CFTypeRef);
- 
- // URLComponents are always mutable.
- CF_EXPORT _Nullable CFURLComponentsRef _CFURLComponentsCreate(CFAllocatorRef alloc);
diff --git a/pkgs/os-specific/darwin/swift-corelibs/0004-Fix-Darwin-cmake-build.patch b/pkgs/os-specific/darwin/swift-corelibs/0004-Fix-Darwin-cmake-build.patch
deleted file mode 100644
index afffa1abc8e0..000000000000
--- a/pkgs/os-specific/darwin/swift-corelibs/0004-Fix-Darwin-cmake-build.patch
+++ /dev/null
@@ -1,66 +0,0 @@
---- a/CoreFoundation/CMakeLists.txt	1969-12-31 19:00:01.000000000 -0500
-+++ b/CoreFoundation/CMakeLists.txt	2023-06-29 18:52:49.096019700 -0400
-@@ -129,7 +129,7 @@
-                 Base.subproj/CFByteOrder.h
-                 Base.subproj/CFUUID.h
-                 Base.subproj/CFUtilities.h
--                Base.subproj/SwiftRuntime/CoreFoundation.h
-+                Base.subproj/CoreFoundation.h  # The SwiftRuntime version of this file causes linker errors and is not correct for standalone CF.
-                 Base.subproj/SwiftRuntime/TargetConditionals.h
-                 # Collections
-                 Collections.subproj/CFArray.h
-@@ -245,6 +245,8 @@
-                 # RunLoop
-                 RunLoop.subproj/CFRunLoop.c
-                 RunLoop.subproj/CFSocket.c
-+                RunLoop.subproj/CFMachPort.c   # These files are missing from the upstream `CMakeLists.txt` but required to build on Darwin.
-+                RunLoop.subproj/CFMessagePort.c
-                 # Stream
-                 Stream.subproj/CFConcreteStreams.c
-                 Stream.subproj/CFSocketStream.c
-@@ -336,6 +338,11 @@
-   target_include_directories(CoreFoundation
-                              PRIVATE
-                                ${CURL_INCLUDE_DIRS})
-+elseif(CMAKE_SYSTEM_NAME STREQUAL Darwin)
-+  find_package(CURL REQUIRED)
-+  target_include_directories(CoreFoundation PRIVATE ${CURL_INCLUDE_DIRS})
-+  find_package(LibXml2 REQUIRED)
-+  target_include_directories(CoreFoundation PRIVATE ${LIBXML2_INCLUDE_DIR})
- else()
-   target_include_directories(CoreFoundation
-                              PRIVATE
-@@ -365,6 +372,10 @@
-                         PRIVATE
-                           ${CURL_LIBRARIES}
-                           ${LIBXML2_LIBRARIES})
-+elseif(CMAKE_SYSTEM_NAME STREQUAL Darwin)
-+  target_link_libraries(CoreFoundation PRIVATE
-+    ${CURL_LIBRARIES}
-+    ${LIBXML2_LIBRARIES})
- else()
-   target_link_libraries(CoreFoundation
-                         PRIVATE
-@@ -398,9 +400,19 @@
-   target_link_libraries(CoreFoundation
-                         PRIVATE
-                           icucore)
--  set_target_properties(CoreFoundation
--                        PROPERTIES LINK_FLAGS
--                          -Xlinker;-alias_list;-Xlinker;Base.subproj/DarwinSymbolAliases;-twolevel_namespace;-sectcreate;__UNICODE;__csbitmaps;CharacterSets/CFCharacterSetBitmaps.bitmap;-sectcreate;__UNICODE;__properties;CharacterSets/CFUniCharPropertyDatabase.data;-sectcreate;__UNICODE;__data;CharacterSets/CFUnicodeData-L.mapping;-segprot;__UNICODE;r;r)
-+  target_link_options(CoreFoundation
-+                      PUBLIC
-+                      "LINKER:-alias_list,../Base.subproj/DarwinSymbolAliases"
-+                      "LINKER:-twolevel_namespace"
-+                      "LINKER:-sectcreate,__UNICODE,__csbitmaps,../CharacterSets/CFCharacterSetBitmaps.bitmap"
-+                      "LINKER:-sectcreate,__UNICODE,__properties,../CharacterSets/CFUniCharPropertyDatabase.data"
-+                      "LINKER:-sectcreate,__UNICODE,__data,../CharacterSets/CFUnicodeData-L.mapping"
-+                      "LINKER:-segprot,__UNICODE,r,r"
-+                      "LINKER:-current_version,1454.90.0"
-+                      "LINKER:-compatibility_version,150.0.0"
-+                      "LINKER:-init,___CFInitialize")
-+  set(CMAKE_SHARED_LIBRARY_PREFIX "")
-+  set(CMAKE_SHARED_LIBRARY_SUFFIX "")
- endif()
- 
- install(TARGETS
diff --git a/pkgs/os-specific/darwin/swift-corelibs/0005-Fix-framework-installation-path.patch b/pkgs/os-specific/darwin/swift-corelibs/0005-Fix-framework-installation-path.patch
deleted file mode 100644
index e771ab3c66f2..000000000000
--- a/pkgs/os-specific/darwin/swift-corelibs/0005-Fix-framework-installation-path.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-diff -u aa/CoreFoundation/CMakeLists.txt b/CoreFoundation/CMakeLists.txt
---- a/CoreFoundation/CMakeLists.txt	1969-12-31 19:00:01.000000000 -0500
-+++ b/CoreFoundation/CMakeLists.txt	2023-06-29 18:59:19.492601179 -0400
-
-@@ -424,16 +424,11 @@
-   set(CMAKE_SHARED_LIBRARY_SUFFIX "")
- endif()
- 
--install(TARGETS
--          CoreFoundation
--        DESTINATION
--          "${CMAKE_INSTALL_FULL_LIBDIR}")
- install(DIRECTORY
-           ${CoreFoundation_FRAMEWORK_DIRECTORY}
-         DESTINATION
--          ${CMAKE_INSTALL_PREFIX}/System/Library/Frameworks
--        USE_SOURCE_PERMISSIONS
--        PATTERN PrivateHeaders EXCLUDE)
-+          ${CMAKE_INSTALL_PREFIX}/Library/Frameworks
-+        USE_SOURCE_PERMISSIONS)
- 
- 
- # TODO(compnerd) formalize this
diff --git a/pkgs/os-specific/darwin/swift-corelibs/0006-System-CF-framework-compatibility.patch b/pkgs/os-specific/darwin/swift-corelibs/0006-System-CF-framework-compatibility.patch
deleted file mode 100644
index 248cb5f60037..000000000000
--- a/pkgs/os-specific/darwin/swift-corelibs/0006-System-CF-framework-compatibility.patch
+++ /dev/null
@@ -1,84 +0,0 @@
-diff -u a/CoreFoundation/CMakeLists.txt b/CoreFoundation/CMakeLists.txt
---- a/CoreFoundation/CMakeLists.txt	1969-12-31 19:00:01.000000000 -0500
-+++ b/CoreFoundation/CMakeLists.txt	2023-06-29 18:59:08.659632504 -0400
-@@ -1,5 +1,5 @@
- 
--cmake_minimum_required(VERSION 3.4.3)
-+cmake_minimum_required(VERSION 3.14)
- list(APPEND CMAKE_MODULE_PATH
-      "${CMAKE_CURRENT_SOURCE_DIR}/cmake/modules")
- 
-@@ -45,6 +45,8 @@
-                 ${FRAMEWORK_LIBRARY_TYPE}
-               FRAMEWORK_DIRECTORY
-                 CoreFoundation_FRAMEWORK_DIRECTORY
-+              VERSION
-+                A
-               MODULE_MAP
-                 Base.subproj/module.modulemap
-               PRIVATE_HEADERS
-diff -u a/CoreFoundation/cmake/modules/CoreFoundationAddFramework.cmake b/CoreFoundation/cmake/modules/CoreFoundationAddFramework.cmake
---- a/CoreFoundation/cmake/modules/CoreFoundationAddFramework.cmake	1969-12-31 19:00:01.000000000 -0500
-+++ b/CoreFoundation/cmake/modules/CoreFoundationAddFramework.cmake	2023-06-29 18:57:55.792860996 -0400
-@@ -3,7 +3,7 @@
- 
- function(add_framework NAME)
-   set(options STATIC SHARED)
--  set(single_value_args MODULE_MAP FRAMEWORK_DIRECTORY)
-+  set(single_value_args MODULE_MAP FRAMEWORK_DIRECTORY VERSION)
-   set(multiple_value_args PRIVATE_HEADERS PUBLIC_HEADERS SOURCES)
-   cmake_parse_arguments(AF "${options}" "${single_value_args}" "${multiple_value_args}" ${ARGN})
- 
-@@ -14,26 +14,32 @@
-     set(AF_TYPE SHARED)
-   endif()
- 
-+  file(MAKE_DIRECTORY ${CMAKE_BINARY_DIR}/${NAME}.framework/Versions/${AF_VERSION})
-+  file(CREATE_LINK ${AF_VERSION} ${CMAKE_BINARY_DIR}/${NAME}.framework/Versions/Current SYMBOLIC)
-+
-   if(AF_MODULE_MAP)
-     file(COPY
-            ${AF_MODULE_MAP}
-          DESTINATION
--           ${CMAKE_BINARY_DIR}/${NAME}.framework/Modules
-+           ${CMAKE_BINARY_DIR}/${NAME}.framework/Versions/Current/Modules
-          NO_SOURCE_PERMISSIONS)
-+    file(CREATE_LINK Versions/Current/Modules ${CMAKE_BINARY_DIR}/${NAME}.framework/Modules SYMBOLIC)
-   endif()
-   if(AF_PUBLIC_HEADERS)
-     file(COPY
-            ${AF_PUBLIC_HEADERS}
-          DESTINATION
--           ${CMAKE_BINARY_DIR}/${NAME}.framework/Headers
-+           ${CMAKE_BINARY_DIR}/${NAME}.framework/Versions/Current/Headers
-          NO_SOURCE_PERMISSIONS)
-+    file(CREATE_LINK Versions/Current/Headers ${CMAKE_BINARY_DIR}/${NAME}.framework/Headers SYMBOLIC)
-   endif()
-   if(AF_PRIVATE_HEADERS)
-     file(COPY
-            ${AF_PRIVATE_HEADERS}
-          DESTINATION
--           ${CMAKE_BINARY_DIR}/${NAME}.framework/PrivateHeaders
-+           ${CMAKE_BINARY_DIR}/${NAME}.framework/Versions/Current/PrivateHeaders
-          NO_SOURCE_PERMISSIONS)
-+    file(CREATE_LINK Versions/Current/PrivateHeaders ${CMAKE_BINARY_DIR}/${NAME}.framework/PrivateHeaders SYMBOLIC)
-   endif()
-   add_custom_target(${NAME}_POPULATE_HEADERS
-                     DEPENDS
-@@ -51,13 +57,15 @@
-   set_target_properties(${NAME}
-                         PROPERTIES
-                           LIBRARY_OUTPUT_DIRECTORY
--                              ${CMAKE_BINARY_DIR}/${NAME}.framework)
-+                              ${CMAKE_BINARY_DIR}/${NAME}.framework/Versions/Current)
-   target_compile_options(${NAME}
-                          PRIVATE
-                            -F;${CMAKE_BINARY_DIR}
-                            -I;${CMAKE_BINARY_DIR}/${NAME}.framework/PrivateHeaders)
-   add_dependencies(${NAME} ${NAME}_POPULATE_HEADERS)
- 
-+  file(CREATE_LINK Versions/Current/${NAME} ${CMAKE_BINARY_DIR}/${NAME}.framework/${NAME} SYMBOLIC)
-+
-   if(AF_FRAMEWORK_DIRECTORY)
-     set(${AF_FRAMEWORK_DIRECTORY} ${CMAKE_BINARY_DIR}/${NAME}.framework PARENT_SCOPE)
-   endif()
diff --git a/pkgs/os-specific/darwin/swift-corelibs/0007-Use-nixpkgs-icu.patch b/pkgs/os-specific/darwin/swift-corelibs/0007-Use-nixpkgs-icu.patch
deleted file mode 100644
index 78fa517ce76d..000000000000
--- a/pkgs/os-specific/darwin/swift-corelibs/0007-Use-nixpkgs-icu.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-diff -ur d/CoreFoundation/CMakeLists.txt e/CoreFoundation/CMakeLists.txt
---- d/CoreFoundation/CMakeLists.txt	1969-12-31 19:00:01.000000000 -0500
-+++ e/CoreFoundation/CMakeLists.txt	2023-06-29 19:13:15.561253229 -0400
-@@ -343,6 +343,7 @@
- elseif(CMAKE_SYSTEM_NAME STREQUAL Darwin)
-   find_package(CURL REQUIRED)
-   target_include_directories(CoreFoundation PRIVATE ${CURL_INCLUDE_DIRS})
-+  find_package(ICU COMPONENTS uc i18n data REQUIRED)
-   find_package(LibXml2 REQUIRED)
-   target_include_directories(CoreFoundation PRIVATE ${LIBXML2_INCLUDE_DIR})
- else()
-@@ -377,6 +378,9 @@
- elseif(CMAKE_SYSTEM_NAME STREQUAL Darwin)
-   target_link_libraries(CoreFoundation PRIVATE
-     ${CURL_LIBRARIES}
-+    ICU::uc
-+    ICU::i18n
-+    ICU::data
-     ${LIBXML2_LIBRARIES})
- else()
-   target_link_libraries(CoreFoundation
-@@ -408,9 +412,6 @@
-                         PROPERTIES LINK_FLAGS
-                           -Xlinker;@${CMAKE_SOURCE_DIR}/linux.ld;-Bsymbolic)
- elseif(CMAKE_SYSTEM_NAME STREQUAL Darwin)
--  target_link_libraries(CoreFoundation
--                        PRIVATE
--                          icucore)
-   target_link_options(CoreFoundation
-                       PUBLIC
-                       "LINKER:-alias_list,../Base.subproj/DarwinSymbolAliases"
diff --git a/pkgs/os-specific/darwin/swift-corelibs/0008-Dont-link-libcurl.patch b/pkgs/os-specific/darwin/swift-corelibs/0008-Dont-link-libcurl.patch
deleted file mode 100644
index 4207bf1a82f5..000000000000
--- a/pkgs/os-specific/darwin/swift-corelibs/0008-Dont-link-libcurl.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-diff -u a/CoreFoundation/CMakeLists.txt b/CoreFoundation/CMakeLists.txt
---- a/CoreFoundation/CMakeLists.txt	1969-12-31 19:00:01.000000000 -0500
-+++ b/CoreFoundation/CMakeLists.txt	2023-06-29 19:39:30.074449222 -0400
-@@ -104,7 +104,6 @@
-                 # URL
-                 URL.subproj/CFURL.inc.h
-                 URL.subproj/CFURLPriv.h
--                URL.subproj/CFURLSessionInterface.h
-               PUBLIC_HEADERS
-                 # FIXME: PrivateHeaders referenced by public headers
-                 Base.subproj/CFKnownLocations.h
-@@ -120,7 +119,6 @@
-                 String.subproj/CFRegularExpression.h
-                 String.subproj/CFRunArray.h
-                 URL.subproj/CFURLPriv.h
--                URL.subproj/CFURLSessionInterface.h
- 
-                 # AppServices
-                 AppServices.subproj/CFNotificationCenter.h
-@@ -280,8 +278,7 @@
-                 URL.subproj/CFURL.c
-                 URL.subproj/CFURLAccess.c
-                 URL.subproj/CFURLComponents.c
--                URL.subproj/CFURLComponents_URIParser.c
--                URL.subproj/CFURLSessionInterface.c)
-+                URL.subproj/CFURLComponents_URIParser.c)
- if(CMAKE_SYSTEM_NAME STREQUAL Linux OR CMAKE_SYSTEM_NAME STREQUAL Android)
-   target_compile_definitions(CoreFoundation
-                              PRIVATE
-@@ -341,8 +338,6 @@
-                              PRIVATE
-                                ${CURL_INCLUDE_DIRS})
- elseif(CMAKE_SYSTEM_NAME STREQUAL Darwin)
--  find_package(CURL REQUIRED)
--  target_include_directories(CoreFoundation PRIVATE ${CURL_INCLUDE_DIRS})
-   find_package(ICU COMPONENTS uc i18n data REQUIRED)
-   find_package(LibXml2 REQUIRED)
-   target_include_directories(CoreFoundation PRIVATE ${LIBXML2_INCLUDE_DIR})
-@@ -377,7 +372,6 @@
-                           ${LIBXML2_LIBRARIES})
- elseif(CMAKE_SYSTEM_NAME STREQUAL Darwin)
-   target_link_libraries(CoreFoundation PRIVATE
--    ${CURL_LIBRARIES}
-     ICU::uc
-     ICU::i18n
-     ICU::data
diff --git a/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix b/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix
deleted file mode 100644
index 96339ac47457..000000000000
--- a/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix
+++ /dev/null
@@ -1,114 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fetchurl,
-  makeSetupHook,
-  cmake,
-  pkg-config,
-  launchd,
-  libdispatch,
-  python3Minimal,
-  libxml2,
-  objc4,
-  icu,
-}:
-
-let
-  # 10.12 adds a new sysdir.h that our version of CF in the main derivation depends on, but
-  # isn't available publicly, so instead we grab an older version of the same file that did
-  # not use sysdir.h, but provided the same functionality. Luckily it's simple :) hack hack
-  sysdir-free-system-directories = fetchurl {
-    url = "https://raw.githubusercontent.com/apple/swift-corelibs-foundation/9a5d8420f7793e63a8d5ec1ede516c4ebec939f0/CoreFoundation/Base.subproj/CFSystemDirectories.c";
-    sha256 = "0krfyghj4f096arvvpf884ra5czqlmbrgf8yyc0b3avqmb613pcc";
-  };
-in
-
-stdenv.mkDerivation {
-  pname = "swift-corefoundation";
-  version = "unstable-2018-09-14";
-
-  src = fetchFromGitHub {
-    owner = "apple";
-    repo = "swift-corelibs-foundation";
-    rev = "71aaba20e1450a82c516af1342fe23268e15de0a";
-    sha256 = "17kpql0f27xxz4jjw84vpas5f5sn4vdqwv10g151rc3rswbwln1z";
-  };
-
-  nativeBuildInputs = [
-    cmake
-    pkg-config
-    python3Minimal
-  ];
-  buildInputs = [
-    (lib.getDev launchd)
-    libdispatch
-    libxml2
-    objc4
-    icu
-  ];
-
-  patches = [
-    ./0001-Add-missing-TARGET_OS_-defines.patch
-    # CFMessagePort.h uses `bootstrap_check_in` without declaring it, which is defined in the launchd headers.
-    ./0002-Add-missing-launchd-header.patch
-    # CFURLComponents fails to build with clang 16 due to an invalid pointer conversion. This is fixed upstream.
-    ./0003-Fix-incompatible-pointer-conversion.patch
-    # Fix `CMakeLists.txt` to allow it to be used instead of `build.py` to build on Darwin.
-    ./0004-Fix-Darwin-cmake-build.patch
-    # Install CF framework in `$out/Library/Frameworks` instead of `$out/System/Frameworks`.
-    ./0005-Fix-framework-installation-path.patch
-    # Build a framework that matches the contents of the system CoreFoundation. This patch adds
-    # versioning and drops the prefix and suffix, so the dynamic library is named `CoreFoundation`
-    # instead of `libCoreFoundation.dylib`.
-    ./0006-System-CF-framework-compatibility.patch
-    # Link against the nixpkgs ICU instead of using Apple’s vendored version.
-    ./0007-Use-nixpkgs-icu.patch
-    # Don’t link against libcurl. This breaks a cycle between CF and curl, which depends on CF and
-    # uses the SystemConfiguration framework to support NAT64.
-    # This is safe because the symbols provided in CFURLSessionInterface are not provided by the
-    # system CoreFoundation. They are meant to be used by the implementation of `NSURLSession` in
-    # swift-corelibs-foundation, which is not built because it is not fully compatible with the
-    # system Foundation used on Darwin.
-    ./0008-Dont-link-libcurl.patch
-  ];
-
-  postPatch = ''
-    cd CoreFoundation
-
-    cp ${sysdir-free-system-directories} Base.subproj/CFSystemDirectories.c
-
-    # Includes xpc for some initialization routine that they don't define anyway, so no harm here
-    substituteInPlace PlugIn.subproj/CFBundlePriv.h \
-      --replace '#if (TARGET_OS_MAC' '#if (0'
-
-    # Why do we define __GNU__? Is that normal?
-    substituteInPlace Base.subproj/CFAsmMacros.h \
-      --replace '#if defined(__GNU__) ||' '#if 0 &&'
-
-    # The MIN macro doesn't seem to be defined sensibly for us. Not sure if our stdenv or their bug
-    substituteInPlace Base.subproj/CoreFoundation_Prefix.h \
-      --replace '#if DEPLOYMENT_TARGET_WINDOWS || DEPLOYMENT_TARGET_LINUX' '#if 1'
-  '';
-
-  env.NIX_CFLAGS_COMPILE = toString [
-    # Silence warnings regarding other targets
-    "-Wno-error=undef-prefix"
-    # Avoid redefinitions when including objc headers
-    "-DINCLUDE_OBJC=1"
-  ];
-
-  cmakeFlags = [
-    "-DBUILD_SHARED_LIBS=ON"
-    "-DCF_ENABLE_LIBDISPATCH=OFF"
-  ];
-
-  enableParallelBuilding = true;
-
-  postInstall = ''
-    install_name_tool -id '@rpath/CoreFoundation.framework/Versions/A/CoreFoundation' \
-      "$out/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation"
-
-    mkdir -p "$out/nix-support"
-  '';
-}
diff --git a/pkgs/os-specific/darwin/swift-corelibs/libdispatch.nix b/pkgs/os-specific/darwin/swift-corelibs/libdispatch.nix
deleted file mode 100644
index ed3512d7b5ad..000000000000
--- a/pkgs/os-specific/darwin/swift-corelibs/libdispatch.nix
+++ /dev/null
@@ -1,22 +0,0 @@
-{
-  stdenv,
-  fetchFromGitHub,
-  cmake,
-  apple_sdk_sierra,
-  xnu-new,
-}:
-
-stdenv.mkDerivation rec {
-  name = "swift-corelibs-libdispatch";
-  src = fetchFromGitHub {
-    owner = "apple";
-    repo = name;
-    rev = "f83b5a498bad8e9ff8916183cf6e8ccf677c346b";
-    sha256 = "1czkyyc9llq2mnqfp19mzcfsxzas0y8zrk0gr5hg60acna6jkz2l";
-  };
-  nativeBuildInputs = [ cmake ];
-  buildInputs = [
-    apple_sdk_sierra.sdk
-    xnu-new
-  ];
-}
diff --git a/pkgs/os-specific/darwin/trash/default.nix b/pkgs/os-specific/darwin/trash/default.nix
index d3bfcf6420d1..d988259daf8c 100644
--- a/pkgs/os-specific/darwin/trash/default.nix
+++ b/pkgs/os-specific/darwin/trash/default.nix
@@ -3,9 +3,6 @@
   stdenv,
   fetchFromGitHub,
   perl,
-  AppKit,
-  Cocoa,
-  ScriptingBridge,
 }:
 
 stdenv.mkDerivation rec {
@@ -21,9 +18,6 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     perl
-    Cocoa
-    AppKit
-    ScriptingBridge
   ];
 
   patches = [ ./trash.diff ];
diff --git a/pkgs/os-specific/linux/apparmor/0001-aa-remove-unknown_empty-ruleset.patch b/pkgs/os-specific/linux/apparmor/0001-aa-remove-unknown_empty-ruleset.patch
deleted file mode 100644
index ce2a0e7cc5b3..000000000000
--- a/pkgs/os-specific/linux/apparmor/0001-aa-remove-unknown_empty-ruleset.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-commit 166afaf144d6473464975438353257359dd51708
-Author: Andreas Wiese <andreas.wiese@kernkonzept.com>
-Date:   Thu Feb 1 11:35:02 2024 +0100
-
-    aa-remove-unknown: fix readability check
-    
-    This check is intended for ensuring that the profiles file can actually
-    be opened.  The *actual* check is performed by the shell, not the read
-    utility, which won't even be executed if the input redirection (and
-    hence the test) fails.
-    
-    If the test succeeds, though, using `read` here might actually
-    jeopardize the test result if there are no profiles loaded and the file
-    is empty.
-    
-    This commit fixes that case by simply using `true` instead of `read`.
-
-diff --git a/utils/aa-remove-unknown b/utils/aa-remove-unknown
-index 0e00d6a0..3351feef 100755
---- a/utils/aa-remove-unknown
-+++ b/utils/aa-remove-unknown
-@@ -63,7 +63,7 @@ fi
- # We have to do this check because error checking awk's getline() below is
- # tricky and, as is, results in an infinite loop when apparmorfs returns an
- # error from open().
--if ! IFS= read -r _ < "$PROFILES" ; then
-+if ! true < "$PROFILES" ; then
- 	echo "ERROR: Unable to read apparmorfs profiles file" 1>&2
- 	exit 1
- elif [ ! -w "$REMOVE" ] ; then
diff --git a/pkgs/os-specific/linux/apparmor/default.nix b/pkgs/os-specific/linux/apparmor/default.nix
deleted file mode 100644
index b9cc52fb5bb8..000000000000
--- a/pkgs/os-specific/linux/apparmor/default.nix
+++ /dev/null
@@ -1,435 +0,0 @@
-{
-  stdenv,
-  lib,
-  fetchFromGitLab,
-  fetchpatch,
-  makeWrapper,
-  autoreconfHook,
-  autoconf-archive,
-  pkg-config,
-  which,
-  flex,
-  bison,
-  linuxHeaders ? stdenv.cc.libc.linuxHeaders,
-  gawk,
-  withPerl ?
-    stdenv.hostPlatform == stdenv.buildPlatform && lib.meta.availableOn stdenv.hostPlatform perl,
-  perl,
-  withPython ?
-    stdenv.hostPlatform == stdenv.buildPlatform && lib.meta.availableOn stdenv.hostPlatform python3,
-  python3,
-  swig,
-  ncurses,
-  pam,
-  libnotify,
-  buildPackages,
-  coreutils,
-  bash,
-  gnugrep,
-  gnused,
-  kmod,
-  writeShellScript,
-  closureInfo,
-  runCommand,
-  libxcrypt,
-}:
-
-let
-  apparmor-version = "4.0.3";
-
-  apparmor-meta =
-    component: with lib; {
-      homepage = "https://apparmor.net/";
-      description = "Mandatory access control system - ${component}";
-      license = with licenses; [
-        gpl2Only
-        lgpl21Only
-      ];
-      maintainers = with maintainers; [
-        julm
-        thoughtpolice
-        grimmauld
-      ];
-      platforms = platforms.linux;
-    };
-
-  apparmor-sources = fetchFromGitLab {
-    owner = "apparmor";
-    repo = "apparmor";
-    rev = "v${apparmor-version}";
-    hash = "sha256-6RMttvlXepxUyqdZeDujjVGOwuXl/nXnjii4sA/ppc4=";
-  };
-
-  aa-teardown = writeShellScript "aa-teardown" ''
-    PATH="${
-      lib.makeBinPath [
-        coreutils
-        gnused
-        gnugrep
-      ]
-    }:$PATH"
-    . ${apparmor-parser}/lib/apparmor/rc.apparmor.functions
-    remove_profiles
-  '';
-
-  prePatchCommon = ''
-    chmod a+x ./common/list_capabilities.sh ./common/list_af_names.sh
-    patchShebangs ./common/list_capabilities.sh ./common/list_af_names.sh
-    substituteInPlace ./common/Make.rules \
-      --replace "/usr/bin/pod2man" "${buildPackages.perl}/bin/pod2man" \
-      --replace "/usr/bin/pod2html" "${buildPackages.perl}/bin/pod2html" \
-      --replace "/usr/share/man" "share/man"
-    substituteInPlace ./utils/Makefile \
-      --replace "/usr/include/linux/capability.h" "${linuxHeaders}/include/linux/capability.h"
-  '';
-
-  patches =
-    [
-      ./0001-aa-remove-unknown_empty-ruleset.patch
-
-      (fetchpatch {
-        name = "basename.patch";
-        url = "https://gitlab.com/apparmor/apparmor/-/commit/7fb040bde69ebdfce48cf1a01c1a62fd4f8eef0a.patch";
-        hash = "sha256-RZ04nfcV8hTd2CO3mYcfOGCLke8+FhV7DPfmDqSSdWk=";
-      })
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isMusl [
-      (fetchpatch {
-        url = "https://git.alpinelinux.org/aports/plain/testing/apparmor/0003-Added-missing-typedef-definitions-on-parser.patch?id=74b8427cc21f04e32030d047ae92caa618105b53";
-        name = "0003-Added-missing-typedef-definitions-on-parser.patch";
-        sha256 = "0yyaqz8jlmn1bm37arggprqz0njb4lhjni2d9c8qfqj0kll0bam0";
-      })
-    ];
-
-  python = python3.withPackages (ps: with ps; [ setuptools ]);
-
-  # Set to `true` after the next FIXME gets fixed or this gets some
-  # common derivation infra. Too much copy-paste to fix one by one.
-  doCheck = false;
-
-  # FIXME: convert these to a single multiple-outputs package?
-
-  libapparmor = stdenv.mkDerivation {
-    pname = "libapparmor";
-    version = apparmor-version;
-
-    src = apparmor-sources;
-
-    # checking whether python bindings are enabled... yes
-    # checking for python3... no
-    # configure: error: python is required when enabling python bindings
-    strictDeps = false;
-
-    nativeBuildInputs = [
-      autoconf-archive
-      autoreconfHook
-      bison
-      flex
-      pkg-config
-      swig
-      ncurses
-      which
-      perl
-    ] ++ lib.optional withPython python;
-
-    buildInputs = [ libxcrypt ] ++ lib.optional withPerl perl ++ lib.optional withPython python;
-
-    # required to build apparmor-parser
-    dontDisableStatic = true;
-
-    prePatch =
-      prePatchCommon
-      + ''
-        substituteInPlace ./libraries/libapparmor/swig/perl/Makefile.am --replace install_vendor install_site
-      '';
-    inherit patches;
-
-    postPatch = ''
-      cd ./libraries/libapparmor
-    '';
-
-    # https://gitlab.com/apparmor/apparmor/issues/1
-    configureFlags = [
-      (lib.withFeature withPerl "perl")
-      (lib.withFeature withPython "python")
-    ];
-
-    outputs = [ "out" ] ++ lib.optional withPython "python";
-
-    postInstall = lib.optionalString withPython ''
-      mkdir -p $python/lib
-      mv $out/lib/python* $python/lib/
-    '';
-
-    inherit doCheck;
-
-    meta = apparmor-meta "library";
-  };
-
-  apparmor-utils = python.pkgs.buildPythonApplication {
-    pname = "apparmor-utils";
-    version = apparmor-version;
-    format = "other";
-
-    src = apparmor-sources;
-
-    strictDeps = true;
-
-    nativeBuildInputs = [
-      makeWrapper
-      which
-      python
-    ];
-
-    buildInputs = [
-      bash
-      perl
-      python
-      libapparmor
-      (libapparmor.python or null)
-    ];
-
-    propagatedBuildInputs = [
-      (libapparmor.python or null)
-
-      # Used by aa-notify
-      python.pkgs.notify2
-      python.pkgs.psutil
-    ];
-
-    prePatch =
-      prePatchCommon
-      +
-        # Do not build vim file
-        lib.optionalString stdenv.hostPlatform.isMusl ''
-          sed -i ./utils/Makefile -e "/\<vim\>/d"
-        ''
-      + ''
-        sed -i -E 's/^(DESTDIR|BINDIR|PYPREFIX)=.*//g' ./utils/Makefile
-
-        sed -i utils/aa-unconfined -e "/my_env\['PATH'\]/d"
-
-        substituteInPlace utils/aa-remove-unknown \
-         --replace "/lib/apparmor/rc.apparmor.functions" "${apparmor-parser}/lib/apparmor/rc.apparmor.functions"
-      '';
-    inherit patches;
-    postPatch = "cd ./utils";
-    makeFlags = [ "LANGS=" ];
-    installFlags = [
-      "DESTDIR=$(out)"
-      "BINDIR=$(out)/bin"
-      "VIM_INSTALL_PATH=$(out)/share"
-      "PYPREFIX="
-    ];
-
-    postInstall = ''
-      wrapProgram $out/bin/aa-remove-unknown \
-       --prefix PATH : ${lib.makeBinPath [ gawk ]}
-
-      ln -s ${aa-teardown} $out/bin/aa-teardown
-    '';
-
-    inherit doCheck;
-
-    meta = apparmor-meta "user-land utilities" // {
-      broken = !(withPython && withPerl);
-    };
-  };
-
-  apparmor-bin-utils = stdenv.mkDerivation {
-    pname = "apparmor-bin-utils";
-    version = apparmor-version;
-
-    src = apparmor-sources;
-
-    nativeBuildInputs = [
-      pkg-config
-      libapparmor
-      which
-    ];
-
-    buildInputs = [
-      libapparmor
-    ];
-
-    prePatch = prePatchCommon;
-    postPatch = ''
-      cd ./binutils
-    '';
-    makeFlags = [
-      "LANGS="
-      "USE_SYSTEM=1"
-    ];
-    installFlags = [
-      "DESTDIR=$(out)"
-      "BINDIR=$(out)/bin"
-      "SBINDIR=$(out)/bin"
-    ];
-
-    inherit doCheck;
-
-    meta = apparmor-meta "binary user-land utilities";
-  };
-
-  apparmor-parser = stdenv.mkDerivation {
-    pname = "apparmor-parser";
-    version = apparmor-version;
-
-    src = apparmor-sources;
-
-    nativeBuildInputs = [
-      bison
-      flex
-      which
-    ];
-
-    buildInputs = [ libapparmor ];
-
-    prePatch =
-      prePatchCommon
-      + ''
-        ## techdoc.pdf still doesn't build ...
-        substituteInPlace ./parser/Makefile \
-          --replace "/usr/bin/bison" "${bison}/bin/bison" \
-          --replace "/usr/bin/flex" "${flex}/bin/flex" \
-          --replace "/usr/include/linux/capability.h" "${linuxHeaders}/include/linux/capability.h" \
-          --replace "manpages htmlmanpages pdf" "manpages htmlmanpages"
-        substituteInPlace parser/rc.apparmor.functions \
-         --replace "/sbin/apparmor_parser" "$out/bin/apparmor_parser"
-        sed -i parser/rc.apparmor.functions -e '2i . ${./fix-rc.apparmor.functions.sh}'
-      '';
-    inherit patches;
-    postPatch = ''
-      cd ./parser
-    '';
-    makeFlags = [
-      "LANGS="
-      "USE_SYSTEM=1"
-      "INCLUDEDIR=${libapparmor}/include"
-      "AR=${stdenv.cc.bintools.targetPrefix}ar"
-    ];
-    installFlags = [
-      "DESTDIR=$(out)"
-      "DISTRO=unknown"
-    ];
-
-    inherit doCheck;
-
-    meta = apparmor-meta "rule parser";
-  };
-
-  apparmor-pam = stdenv.mkDerivation {
-    pname = "apparmor-pam";
-    version = apparmor-version;
-
-    src = apparmor-sources;
-
-    nativeBuildInputs = [
-      pkg-config
-      which
-    ];
-
-    buildInputs = [
-      libapparmor
-      pam
-    ];
-
-    postPatch = ''
-      cd ./changehat/pam_apparmor
-    '';
-    makeFlags = [ "USE_SYSTEM=1" ];
-    installFlags = [ "DESTDIR=$(out)" ];
-
-    inherit doCheck;
-
-    meta = apparmor-meta "PAM service";
-  };
-
-  apparmor-profiles = stdenv.mkDerivation {
-    pname = "apparmor-profiles";
-    version = apparmor-version;
-
-    src = apparmor-sources;
-
-    nativeBuildInputs = [ which ];
-
-    postPatch = ''
-      cd ./profiles
-    '';
-
-    installFlags = [
-      "DESTDIR=$(out)"
-      "EXTRAS_DEST=$(out)/share/apparmor/extra-profiles"
-    ];
-
-    inherit doCheck;
-
-    meta = apparmor-meta "profiles";
-  };
-
-  apparmor-kernel-patches = stdenv.mkDerivation {
-    pname = "apparmor-kernel-patches";
-    version = apparmor-version;
-
-    src = apparmor-sources;
-
-    dontBuild = true;
-
-    installPhase = ''
-      mkdir "$out"
-      cp -R ./kernel-patches/* "$out"
-    '';
-
-    inherit doCheck;
-
-    meta = apparmor-meta "kernel patches";
-  };
-
-  # Generate generic AppArmor rules in a file, from the closure of given
-  # rootPaths. To be included in an AppArmor profile like so:
-  #
-  #   include "${apparmorRulesFromClosure { } [ pkgs.hello ]}"
-  apparmorRulesFromClosure =
-    {
-      # The store path of the derivation is given in $path
-      additionalRules ? [ ],
-      # TODO: factorize here some other common paths
-      # that may emerge from use cases.
-      baseRules ? [
-        "r $path"
-        "r $path/etc/**"
-        "mr $path/share/**"
-        # Note that not all libraries are prefixed with "lib",
-        # eg. glibc-2.30/lib/ld-2.30.so
-        "mr $path/lib/**.so*"
-        "mr $path/lib64/**.so*"
-        # eg. glibc-2.30/lib/gconv/gconv-modules
-        "r $path/lib/**"
-        "r $path/lib64/**"
-        # Internal executables
-        "ixr $path/libexec/**"
-      ],
-      name ? "",
-    }:
-    rootPaths:
-    runCommand ("apparmor-closure-rules" + lib.optionalString (name != "") "-${name}") { } ''
-      touch $out
-      while read -r path
-      do printf >>$out "%s,\n" ${
-        lib.concatMapStringsSep " " (x: "\"${x}\"") (baseRules ++ additionalRules)
-      }
-      done <${closureInfo { inherit rootPaths; }}/store-paths
-    '';
-in
-{
-  inherit
-    libapparmor
-    apparmor-utils
-    apparmor-bin-utils
-    apparmor-parser
-    apparmor-pam
-    apparmor-profiles
-    apparmor-kernel-patches
-    apparmorRulesFromClosure
-    ;
-}
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index ea06f5281950..825ffa4523a9 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -197,7 +197,7 @@ assert withBootloader -> withEfi;
 let
   wantCurl = withRemote || withImportd;
 
-  version = "257.3";
+  version = "257.5";
 
   # Use the command below to update `releaseTimestamp` on every (major) version
   # change. More details in the commentary at mesonFlags.
@@ -215,7 +215,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "systemd";
     repo = "systemd";
     rev = "v${version}";
-    hash = "sha256-GvRn55grHWR6M+tA86RMzqinuXNpPZzRB4ApuGN/ZvU=";
+    hash = "sha256-mn/JB/nrOz2TOobu2d+XBH2dVH3vn/HPvWN4Zz6s+SM=";
   };
 
   # On major changes, or when otherwise required, you *must* :
@@ -336,11 +336,13 @@ stdenv.mkDerivation (finalAttrs: {
     [
       # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111523
       "trivialautovarinit"
-      # breaks clang -target bpf; should be fixed to filter target?
     ]
     ++ (lib.optionals withLibBPF [
+      # breaks clang -target bpf; should be fixed to not use
+      # a wrapped clang?
       "zerocallusedregs"
       "shadowstack"
+      "pacret"
     ]);
 
   nativeBuildInputs =
diff --git a/pkgs/servers/clickhouse/default.nix b/pkgs/servers/clickhouse/default.nix
index b65285ef7133..3e97c23b1a2a 100644
--- a/pkgs/servers/clickhouse/default.nix
+++ b/pkgs/servers/clickhouse/default.nix
@@ -1,6 +1,7 @@
 {
   lib,
   llvmPackages,
+  llvmPackages_16,
   fetchFromGitHub,
   fetchpatch,
   cmake,
@@ -16,7 +17,6 @@
 
   rustSupport ? true,
 
-  corrosion,
   rustc,
   cargo,
   rustPlatform,
@@ -25,12 +25,7 @@
 let
   inherit (llvmPackages) stdenv;
   mkDerivation =
-    (
-      if stdenv.hostPlatform.isDarwin then
-        darwin.apple_sdk_11_0.llvmPackages_16.stdenv
-      else
-        llvmPackages.stdenv
-    ).mkDerivation;
+    (if stdenv.hostPlatform.isDarwin then llvmPackages_16.stdenv else llvmPackages.stdenv).mkDerivation;
 in
 mkDerivation rec {
   pname = "clickhouse";
diff --git a/pkgs/servers/code-server/default.nix b/pkgs/servers/code-server/default.nix
index 4121a5e8b4d3..46977793f6fd 100644
--- a/pkgs/servers/code-server/default.nix
+++ b/pkgs/servers/code-server/default.nix
@@ -18,10 +18,6 @@
   libsecret,
   xorg,
   ripgrep,
-  AppKit,
-  Cocoa,
-  CoreServices,
-  Security,
   cctools,
   xcbuild,
   quilt,
@@ -149,10 +145,6 @@ stdenv.mkDerivation (finalAttrs: {
       libsecret
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AppKit
-      Cocoa
-      CoreServices
-      Security
       cctools
       xcbuild
     ];
diff --git a/pkgs/servers/dns/doh-proxy-rust/default.nix b/pkgs/servers/dns/doh-proxy-rust/default.nix
index 913d77b029ec..cec812fe5ea9 100644
--- a/pkgs/servers/dns/doh-proxy-rust/default.nix
+++ b/pkgs/servers/dns/doh-proxy-rust/default.nix
@@ -3,7 +3,6 @@
   rustPlatform,
   fetchCrate,
   stdenv,
-  Security,
   libiconv,
   nixosTests,
 }:
@@ -22,7 +21,6 @@ rustPlatform.buildRustPackage rec {
   cargoHash = "sha256-eYJoHFIC0NF3OAbZXDWB57IOFC9JDV4IXHQgzIWMT04=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    Security
     libiconv
   ];
 
diff --git a/pkgs/servers/fedigroups/default.nix b/pkgs/servers/fedigroups/default.nix
index 83e53c195fcf..743b0c8a75ae 100644
--- a/pkgs/servers/fedigroups/default.nix
+++ b/pkgs/servers/fedigroups/default.nix
@@ -1,12 +1,10 @@
 {
   lib,
-  stdenv,
   fetchFromGitea,
   rustPlatform,
   pkg-config,
   git,
   openssl,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -42,7 +40,7 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = [
     openssl
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin Security;
+  ];
 
   meta = with lib; {
     homepage = "https://git.ondrovo.com/MightyPork/group-actor#fedi-groups";
diff --git a/pkgs/servers/geospatial/martin/default.nix b/pkgs/servers/geospatial/martin/default.nix
index 9d48f9c1136b..b111df18b60a 100644
--- a/pkgs/servers/geospatial/martin/default.nix
+++ b/pkgs/servers/geospatial/martin/default.nix
@@ -1,12 +1,9 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitHub,
   pkg-config,
   openssl,
-  Security,
-  SystemConfiguration,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -25,12 +22,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Security
-      SystemConfiguration
-    ];
+  buildInputs = [ openssl ];
 
   checkFlags = [
     "--skip function_source_schemas"
diff --git a/pkgs/servers/http/jetty/default.nix b/pkgs/servers/http/jetty/default.nix
index 76ac890cba81..6166c7e34bfe 100644
--- a/pkgs/servers/http/jetty/default.nix
+++ b/pkgs/servers/http/jetty/default.nix
@@ -57,7 +57,7 @@ in
   };
 
   jetty_12 = common {
-    version = "12.0.19";
-    hash = "sha256-rURjebDGDVNILjrim8zBTp5SvIFkWKxpC+oi8b5FTj8=";
+    version = "12.0.20";
+    hash = "sha256-t8BY/vRYdrKHiUfyDp+THNFYyHOW1dOL1SilpZFK32o=";
   };
 }
diff --git a/pkgs/servers/krill/default.nix b/pkgs/servers/krill/default.nix
index 19ea2892e999..2cd92aa24622 100644
--- a/pkgs/servers/krill/default.nix
+++ b/pkgs/servers/krill/default.nix
@@ -5,7 +5,6 @@
   openssl,
   pkg-config,
   stdenv,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -22,7 +21,7 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-PR8HoHroHp5nBbRwR8TZ5NeBH4eDXGV46HkDLeydmAk=";
 
-  buildInputs = [ openssl ] ++ lib.optional stdenv.hostPlatform.isDarwin Security;
+  buildInputs = [ openssl ];
   nativeBuildInputs = [ pkg-config ];
 
   # Needed to get openssl-sys to use pkgconfig.
diff --git a/pkgs/servers/monitoring/prometheus/wireguard-exporter.nix b/pkgs/servers/monitoring/prometheus/wireguard-exporter.nix
index b77b1254c86c..cfef58e0b151 100644
--- a/pkgs/servers/monitoring/prometheus/wireguard-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/wireguard-exporter.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   lib,
   libiconv,
-  Security,
   nixosTests,
 }:
 
@@ -29,7 +28,6 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     libiconv
-    Security
   ];
 
   passthru.tests = { inherit (nixosTests.prometheus-exporters) wireguard; };
diff --git a/pkgs/servers/mpd/default.nix b/pkgs/servers/mpd/default.nix
index 158d0cc142e4..07102e05e42d 100644
--- a/pkgs/servers/mpd/default.nix
+++ b/pkgs/servers/mpd/default.nix
@@ -9,9 +9,6 @@
   systemd,
   fmt,
   buildPackages,
-  # Darwin inputs
-  AudioToolbox,
-  AudioUnit,
   # Inputs
   curl,
   libcdio,
@@ -209,21 +206,15 @@ let
         sha256 = "sha256-6wEFgiMsEoWvmfH609d+UZY7jzqDoNmXalpHBipqTN0=";
       };
 
-      buildInputs =
-        [
-          glib
-          fmt
-          # According to the configurePhase of meson, gtest is considered a
-          # runtime dependency. Quoting:
-          #
-          #    Run-time dependency GTest found: YES 1.10.0
-          gtest
-        ]
-        ++ concatAttrVals features_ featureDependencies
-        ++ lib.optionals stdenv.hostPlatform.isDarwin [
-          AudioToolbox
-          AudioUnit
-        ];
+      buildInputs = [
+        glib
+        fmt
+        # According to the configurePhase of meson, gtest is considered a
+        # runtime dependency. Quoting:
+        #
+        #    Run-time dependency GTest found: YES 1.10.0
+        gtest
+      ] ++ concatAttrVals features_ featureDependencies;
 
       nativeBuildInputs = [
         meson
diff --git a/pkgs/servers/openvscode-server/default.nix b/pkgs/servers/openvscode-server/default.nix
index 9eb723753496..e0637893c92f 100644
--- a/pkgs/servers/openvscode-server/default.nix
+++ b/pkgs/servers/openvscode-server/default.nix
@@ -18,9 +18,6 @@
   libkrb5,
   xorg,
   ripgrep,
-  AppKit,
-  Cocoa,
-  Security,
   cctools,
   nixosTests,
 }:
@@ -127,9 +124,6 @@ stdenv.mkDerivation (finalAttrs: {
       libkrb5
     ])
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AppKit
-      Cocoa
-      Security
       cctools
     ];
 
diff --git a/pkgs/servers/oxigraph/default.nix b/pkgs/servers/oxigraph/default.nix
index 4c53bbc5200f..7aaa0f023f6d 100644
--- a/pkgs/servers/oxigraph/default.nix
+++ b/pkgs/servers/oxigraph/default.nix
@@ -1,11 +1,8 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitHub,
   installShellFiles,
-  IOKit,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -27,10 +24,6 @@ rustPlatform.buildRustPackage rec {
     rustPlatform.bindgenHook
     installShellFiles
   ];
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    IOKit
-    Security
-  ];
 
   buildAndTestSubdir = "cli";
   buildNoDefaultFeatures = true;
diff --git a/pkgs/servers/piping-server-rust/default.nix b/pkgs/servers/piping-server-rust/default.nix
index 2798e203542e..cbdc1e60553a 100644
--- a/pkgs/servers/piping-server-rust/default.nix
+++ b/pkgs/servers/piping-server-rust/default.nix
@@ -2,9 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  CoreServices,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -21,11 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-m6bYkewBE0ZloDVUhUslS+dgPyoK+eay7rrP3+c00mo=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    CoreServices
-    Security
-  ];
-
   meta = with lib; {
     description = "Infinitely transfer between every device over pure HTTP with pipes or browsers";
     homepage = "https://github.com/nwtgck/piping-server-rust";
diff --git a/pkgs/servers/pleroma/default.nix b/pkgs/servers/pleroma/default.nix
index cb9dc6e2ce8c..067fb069e436 100644
--- a/pkgs/servers/pleroma/default.nix
+++ b/pkgs/servers/pleroma/default.nix
@@ -1,6 +1,5 @@
 {
   lib,
-  stdenv,
   beamPackages,
   fetchFromGitHub,
   fetchFromGitLab,
@@ -12,7 +11,6 @@
   vips,
   pkg-config,
   glib,
-  darwin,
   fetchpatch,
   ...
 }:
@@ -126,16 +124,10 @@ beamPackages.mixRelease rec {
 
       vix = prev.vix.override {
         nativeBuildInputs = [ pkg-config ];
-        buildInputs =
-          [
-            vips
-            glib.dev
-          ]
-          ++ lib.optionals stdenv.hostPlatform.isDarwin [
-            darwin.apple_sdk.frameworks.Foundation
-            darwin.apple_sdk.frameworks.AppKit
-            darwin.apple_sdk.frameworks.Kerberos
-          ];
+        buildInputs = [
+          vips
+          glib.dev
+        ];
         VIX_COMPILATION_MODE = "PLATFORM_PROVIDED_LIBVIPS";
       };
 
diff --git a/pkgs/servers/polaris/default.nix b/pkgs/servers/polaris/default.nix
index 0d958d6e5a28..b175fe411d87 100644
--- a/pkgs/servers/polaris/default.nix
+++ b/pkgs/servers/polaris/default.nix
@@ -1,11 +1,9 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
   nix-update-script,
   polaris-web,
-  darwin,
   nixosTests,
 }:
 
@@ -34,10 +32,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-bVXz/rSfkmdQlAa3B4zamZebpRBOkch6zNOFiyEQBbY=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.Security
-  ];
-
   # Compile-time environment variables for where to find assets needed at runtime
   env = {
     POLARIS_WEB_DIR = "${polaris-web}/share/polaris-web";
diff --git a/pkgs/servers/pulseaudio/default.nix b/pkgs/servers/pulseaudio/default.nix
index 4ca3038d410d..cdf726415a89 100644
--- a/pkgs/servers/pulseaudio/default.nix
+++ b/pkgs/servers/pulseaudio/default.nix
@@ -61,10 +61,6 @@
   # Whether to build only the library.
   libOnly ? false,
 
-  AudioUnit,
-  Cocoa,
-  CoreServices,
-  CoreAudio,
 }:
 
 stdenv.mkDerivation rec {
@@ -134,12 +130,6 @@ stdenv.mkDerivation rec {
       glib
       dbus
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AudioUnit
-      Cocoa
-      CoreServices
-      CoreAudio
-    ]
     ++ lib.optionals (stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isFreeBSD) [
       libintl
     ]
diff --git a/pkgs/servers/rtrtr/default.nix b/pkgs/servers/rtrtr/default.nix
index 4774ebd1ce2d..174db43fa5d9 100644
--- a/pkgs/servers/rtrtr/default.nix
+++ b/pkgs/servers/rtrtr/default.nix
@@ -3,8 +3,6 @@
   rustPlatform,
   fetchFromGitHub,
   pkg-config,
-  stdenv,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,8 +18,6 @@ rustPlatform.buildRustPackage rec {
 
   useFetchCargoVendor = true;
   cargoHash = "sha256-RPCT2mmzuvDYSTTDM7S1yRcmCe8RlkA1i80dW7OPVO4=";
-
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin Security;
   nativeBuildInputs = [ pkg-config ];
 
   buildNoDefaultFeatures = true;
diff --git a/pkgs/servers/search/lnx/default.nix b/pkgs/servers/search/lnx/default.nix
index 56331187ff44..08a75bcd4f6a 100644
--- a/pkgs/servers/search/lnx/default.nix
+++ b/pkgs/servers/search/lnx/default.nix
@@ -1,10 +1,7 @@
 {
-  stdenv,
   lib,
   rustPlatform,
   fetchFromGitHub,
-  DiskArbitration,
-  Foundation,
 }:
 
 # unstable was chosen because of an added Cargo.lock
@@ -24,11 +21,6 @@ rustPlatform.buildRustPackage {
 
   useFetchCargoVendor = true;
   cargoHash = "sha256-9fro1Dx7P+P9NTsg0gtMfr0s4TEpkZA31EFAnObiNFo=";
-
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    DiskArbitration
-    Foundation
-  ];
   meta = with lib; {
     description = "Insanely fast, Feature-rich searching. lnx is the adaptable, typo tollerant deployment of the tantivy search engine. Standing on the shoulders of giants.";
     mainProgram = "lnx";
diff --git a/pkgs/servers/search/qdrant/default.nix b/pkgs/servers/search/qdrant/default.nix
index 7c8dd710dce4..fb4ee5fcf4ce 100644
--- a/pkgs/servers/search/qdrant/default.nix
+++ b/pkgs/servers/search/qdrant/default.nix
@@ -3,13 +3,10 @@
   rustPlatform,
   fetchFromGitHub,
   protobuf,
-  stdenv,
   pkg-config,
   openssl,
   rust-jemalloc-sys,
   nix-update-script,
-  Security,
-  SystemConfiguration,
   rust-jemalloc-sys-unprefixed,
 }:
 
@@ -34,16 +31,11 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      openssl
-      rust-jemalloc-sys
-      rust-jemalloc-sys-unprefixed
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Security
-      SystemConfiguration
-    ];
+  buildInputs = [
+    openssl
+    rust-jemalloc-sys
+    rust-jemalloc-sys-unprefixed
+  ];
 
   # Needed to get openssl-sys to use pkg-config.
   env.OPENSSL_NO_VENDOR = 1;
diff --git a/pkgs/servers/search/quickwit/default.nix b/pkgs/servers/search/quickwit/default.nix
index f056a726d476..9cc4559eed74 100644
--- a/pkgs/servers/search/quickwit/default.nix
+++ b/pkgs/servers/search/quickwit/default.nix
@@ -7,7 +7,6 @@
   nix-update-script,
   protobuf,
   rust-jemalloc-sys,
-  Security,
   nodejs,
   yarn,
   fetchYarnDeps,
@@ -84,7 +83,7 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = [
     rust-jemalloc-sys
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
+  ];
 
   cargoLock = {
     lockFile = ./Cargo.lock;
diff --git a/pkgs/servers/sip/freeswitch/default.nix b/pkgs/servers/sip/freeswitch/default.nix
index bbbccaea5fc2..3cfa51885b9b 100644
--- a/pkgs/servers/sip/freeswitch/default.nix
+++ b/pkgs/servers/sip/freeswitch/default.nix
@@ -22,7 +22,6 @@
   libtiff,
   libxcrypt,
   callPackage,
-  SystemConfiguration,
   modules ? null,
   nixosTests,
 }:
@@ -140,25 +139,22 @@ stdenv.mkDerivation rec {
     which
     yasm
   ];
-  buildInputs =
-    [
-      openssl
-      ncurses
-      gnutls
-      readline
-      libjpeg
-      sqlite
-      pcre
-      speex
-      ldns
-      libedit
-      libsndfile
-      libtiff
-      libuuid
-      libxcrypt
-    ]
-    ++ lib.unique (lib.concatMap (mod: mod.inputs) enabledModules)
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ SystemConfiguration ];
+  buildInputs = [
+    openssl
+    ncurses
+    gnutls
+    readline
+    libjpeg
+    sqlite
+    pcre
+    speex
+    ldns
+    libedit
+    libsndfile
+    libtiff
+    libuuid
+    libxcrypt
+  ] ++ lib.unique (lib.concatMap (mod: mod.inputs) enabledModules);
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/servers/sql/mariadb/default.nix b/pkgs/servers/sql/mariadb/default.nix
index 2303f1d7425a..51277f42aada 100644
--- a/pkgs/servers/sql/mariadb/default.nix
+++ b/pkgs/servers/sql/mariadb/default.nix
@@ -27,7 +27,6 @@ let
       libaio,
       liburing,
       systemd,
-      CoreServices,
       cctools,
       perl,
       jemalloc,
@@ -110,7 +109,6 @@ let
             ++ (if (lib.versionOlder version "10.6") then [ libaio ] else [ liburing ])
           )
           ++ lib.optionals stdenv.hostPlatform.isDarwin [
-            CoreServices
             cctools
             perl
             libedit
@@ -374,18 +372,15 @@ self: {
     # Supported until 2026-07-06
     version = "10.6.21";
     hash = "sha256-jX+XFps7ogRIWJZbjPwlQ2RADfQ+kFBC+S4kuPp7DZY=";
-    inherit (self.darwin.apple_sdk.frameworks) CoreServices;
   };
   mariadb_1011 = self.callPackage generic {
     # Supported until 2028-02-16
     version = "10.11.11";
     hash = "sha256-bynU1+QPxJr0oP5giYRQnvLRU9882K/kNZ3OPKDieJA=";
-    inherit (self.darwin.apple_sdk.frameworks) CoreServices;
   };
   mariadb_114 = self.callPackage generic {
     # Supported until 2029-05-29
     version = "11.4.5";
     hash = "sha256-/2WV+MSC+ZIeObl/oRIjd6afDcvZJVPGuQMsvw6bU1Q=";
-    inherit (self.darwin.apple_sdk.frameworks) CoreServices;
   };
 }
diff --git a/pkgs/servers/sql/mysql/8.0.x.nix b/pkgs/servers/sql/mysql/8.0.x.nix
index 735cbdbf4e90..fe1a1488ac0a 100644
--- a/pkgs/servers/sql/mysql/8.0.x.nix
+++ b/pkgs/servers/sql/mysql/8.0.x.nix
@@ -21,7 +21,6 @@
   libfido2,
   numactl,
   cctools,
-  CoreServices,
   developer_cmds,
   libtirpc,
   rpcsvc-proto,
@@ -86,7 +85,6 @@ stdenv.mkDerivation (finalAttrs: {
       libtirpc
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CoreServices
       developer_cmds
     ];
 
diff --git a/pkgs/servers/sql/percona-server/8_0.nix b/pkgs/servers/sql/percona-server/8_0.nix
index dd9125599c48..e75cf362d260 100644
--- a/pkgs/servers/sql/percona-server/8_0.nix
+++ b/pkgs/servers/sql/percona-server/8_0.nix
@@ -22,7 +22,6 @@
   libfido2,
   numactl,
   cctools,
-  CoreServices,
   developer_cmds,
   libtirpc,
   rpcsvc-proto,
@@ -103,7 +102,6 @@ stdenv.mkDerivation (finalAttrs: {
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       cctools
-      CoreServices
       developer_cmds
       DarwinTools
     ];
diff --git a/pkgs/servers/sql/percona-server/8_4.nix b/pkgs/servers/sql/percona-server/8_4.nix
index 7293c97a52d8..3d54b99970cc 100644
--- a/pkgs/servers/sql/percona-server/8_4.nix
+++ b/pkgs/servers/sql/percona-server/8_4.nix
@@ -22,7 +22,6 @@
   libfido2,
   numactl,
   cctools,
-  CoreServices,
   developer_cmds,
   libtirpc,
   rpcsvc-proto,
@@ -112,7 +111,6 @@ stdenv.mkDerivation (finalAttrs: {
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       cctools
-      CoreServices
       developer_cmds
       DarwinTools
     ]
diff --git a/pkgs/servers/sql/percona-server/default.nix b/pkgs/servers/sql/percona-server/default.nix
index aaac48de68ff..50255a8f5397 100644
--- a/pkgs/servers/sql/percona-server/default.nix
+++ b/pkgs/servers/sql/percona-server/default.nix
@@ -2,7 +2,6 @@ pkgs: {
   # old lts
   percona-server_8_0 = pkgs.callPackage ./8_0.nix {
     inherit (pkgs.darwin) developer_cmds DarwinTools;
-    inherit (pkgs.darwin.apple_sdk.frameworks) CoreServices;
     boost = pkgs.boost177; # Configure checks for specific version.
     icu = pkgs.icu69;
     # newer versions cause linking failures against `libabsl_spinlock_wait`
@@ -10,7 +9,6 @@ pkgs: {
   };
   percona-server_8_4 = pkgs.callPackage ./8_4.nix {
     inherit (pkgs.darwin) developer_cmds DarwinTools;
-    inherit (pkgs.darwin.apple_sdk.frameworks) CoreServices;
     # newer versions cause linking failures against `libabsl_spinlock_wait`
     protobuf = pkgs.protobuf_21;
   };
diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index c6a47a424959..348620c54360 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -22,12 +22,10 @@ let
       version: path:
       let
         attrName = if jitSupport then "${version}_jit" else version;
+        postgresql = import path { inherit self; };
+        attrValue = if jitSupport then postgresql.withJIT else postgresql.withoutJIT;
       in
-      self.lib.nameValuePair attrName (
-        import path {
-          inherit jitSupport self;
-        }
-      )
+      self.lib.nameValuePair attrName attrValue
     ) versions;
 
   libpq = self.callPackage ./libpq.nix { };
@@ -35,7 +33,8 @@ let
 in
 {
   # variations without and with JIT
-  postgresqlVersions = mkAttributes false // mkAttributes true;
+  postgresqlVersions = mkAttributes false;
+  postgresqlJitVersions = mkAttributes true;
 
   inherit libpq;
 }
diff --git a/pkgs/servers/sql/postgresql/ext/plv8/package.nix b/pkgs/servers/sql/postgresql/ext/plv8/package.nix
index be8935f42357..5b4423171934 100644
--- a/pkgs/servers/sql/postgresql/ext/plv8/package.nix
+++ b/pkgs/servers/sql/postgresql/ext/plv8/package.nix
@@ -1,6 +1,5 @@
 {
   fetchFromGitHub,
-  jitSupport,
   lib,
   nodejs_20,
   perl,
@@ -135,11 +134,8 @@ postgresqlBuildExtension (finalAttrs: {
     homepage = "https://plv8.github.io/";
     changelog = "https://github.com/plv8/plv8/blob/r${finalAttrs.version}/Changes";
     maintainers = [ ];
-    platforms = [
-      "x86_64-linux"
-      "aarch64-linux"
-    ];
+    platforms = postgresql.meta.platforms;
     license = lib.licenses.postgresql;
-    broken = jitSupport;
+    broken = stdenv.hostPlatform.isDarwin;
   };
 })
diff --git a/pkgs/servers/sql/postgresql/generic.nix b/pkgs/servers/sql/postgresql/generic.nix
index 951858ac6d76..ccb5174b22f2 100644
--- a/pkgs/servers/sql/postgresql/generic.nix
+++ b/pkgs/servers/sql/postgresql/generic.nix
@@ -66,7 +66,11 @@ let
       icu,
 
       # JIT
-      jitSupport, # not default on purpose, this is set via "_jit or not" attributes
+      jitSupport ?
+        stdenv.hostPlatform.canExecute stdenv.buildPlatform
+        # Building with JIT in pkgsStatic fails like this:
+        #   fatal error: 'stdio.h' file not found
+        && !stdenv.hostPlatform.isStatic,
       llvmPackages,
       nukeReferences,
       overrideCC,
@@ -135,10 +139,8 @@ let
 
       dlSuffix = if olderThan "16" then ".so" else stdenv.hostPlatform.extensions.sharedLibrary;
 
-      pname = "postgresql";
-
       stdenv' =
-        if jitSupport && !stdenv.cc.isClang then
+        if !stdenv.cc.isClang then
           overrideCC llvmPackages.stdenv (
             llvmPackages.stdenv.cc.override {
               # LLVM bintools are not used by default, but are needed to make -flto work below.
@@ -150,7 +152,7 @@ let
     in
     stdenv'.mkDerivation (finalAttrs: {
       inherit version;
-      pname = pname + lib.optionalString jitSupport "-jit";
+      pname = "postgresql";
 
       src = fetchFromGitHub {
         owner = "postgres";
@@ -162,8 +164,6 @@ let
 
       __structuredAttrs = true;
 
-      hardeningEnable = lib.optionals (!stdenv'.cc.isClang) [ "pie" ];
-
       outputs =
         [
           "out"
@@ -172,51 +172,69 @@ let
           "lib"
           "man"
         ]
+        ++ lib.optionals jitSupport [ "jit" ]
         ++ lib.optionals perlSupport [ "plperl" ]
         ++ lib.optionals pythonSupport [ "plpython3" ]
         ++ lib.optionals tclSupport [ "pltcl" ];
-      outputChecks = {
-        out = {
-          disallowedReferences = [
-            "dev"
-            "doc"
-            "man"
-          ];
-          disallowedRequisites = [
-            stdenv'.cc
-            llvmPackages.llvm.out
-          ] ++ (map lib.getDev (builtins.filter (drv: drv ? "dev") finalAttrs.buildInputs));
-        };
 
-        lib = {
-          disallowedReferences = [
-            "out"
-            "dev"
-            "doc"
-            "man"
-          ];
-          disallowedRequisites = [
-            stdenv'.cc
-            llvmPackages.llvm.out
-          ] ++ (map lib.getDev (builtins.filter (drv: drv ? "dev") finalAttrs.buildInputs));
-        };
+      outputChecks =
+        {
+          out = {
+            disallowedReferences = [
+              "dev"
+              "doc"
+              "man"
+            ] ++ lib.optionals jitSupport [ "jit" ];
+            disallowedRequisites = [
+              stdenv'.cc
+              llvmPackages.llvm.out
+              llvmPackages.llvm.lib
+            ] ++ (map lib.getDev (builtins.filter (drv: drv ? "dev") finalAttrs.buildInputs));
+          };
 
-        doc = {
-          disallowedReferences = [
-            "out"
-            "dev"
-            "man"
-          ];
-        };
+          lib = {
+            disallowedReferences = [
+              "out"
+              "dev"
+              "doc"
+              "man"
+            ] ++ lib.optionals jitSupport [ "jit" ];
+            disallowedRequisites = [
+              stdenv'.cc
+              llvmPackages.llvm.out
+              llvmPackages.llvm.lib
+            ] ++ (map lib.getDev (builtins.filter (drv: drv ? "dev") finalAttrs.buildInputs));
+          };
 
-        man = {
-          disallowedReferences = [
-            "out"
-            "dev"
-            "doc"
-          ];
+          doc = {
+            disallowedReferences = [
+              "out"
+              "dev"
+              "man"
+            ] ++ lib.optionals jitSupport [ "jit" ];
+          };
+
+          man = {
+            disallowedReferences = [
+              "out"
+              "dev"
+              "doc"
+            ] ++ lib.optionals jitSupport [ "jit" ];
+          };
+        }
+        // lib.optionalAttrs jitSupport {
+          jit = {
+            disallowedReferences = [
+              "dev"
+              "doc"
+              "man"
+            ];
+            disallowedRequisites = [
+              stdenv'.cc
+              llvmPackages.llvm.out
+            ] ++ (map lib.getDev (builtins.filter (drv: drv ? "dev") finalAttrs.buildInputs));
+          };
         };
-      };
 
       strictDeps = true;
 
@@ -271,9 +289,16 @@ let
           # flags will remove unused sections from all shared libraries and binaries - including
           # those paths. This avoids a lot of circular dependency problems with different outputs,
           # and allows splitting them cleanly.
-          CFLAGS =
-            "-fdata-sections -ffunction-sections"
-            + (if stdenv'.cc.isClang then " -flto" else " -fmerge-constants -Wl,--gc-sections");
+          CFLAGS = "-fdata-sections -ffunction-sections -flto";
+
+          # This flag was introduced upstream in:
+          # https://github.com/postgres/postgres/commit/b6c7cfac88c47a9194d76f3d074129da3c46545a
+          # It causes errors when linking against libpq.a in pkgsStatic:
+          #   undefined reference to `pg_encoding_to_char'
+          # Unsetting the flag fixes it. The upstream reasoning to introduce it is about the risk
+          # to have initdb load a libpq.so from a different major version and how to avoid that.
+          # This doesn't apply to us with Nix.
+          NIX_CFLAGS_COMPILE = "-UUSE_PRIVATE_ENCODING_FUNCS";
         }
         // lib.optionalAttrs perlSupport { PERL = lib.getExe perl; }
         // lib.optionalAttrs pythonSupport { PYTHON = lib.getExe python3; }
@@ -364,11 +389,25 @@ let
 
       installTargets = [ "install-world" ];
 
-      postPatch = ''
-        substituteInPlace "src/Makefile.global.in" --subst-var out
-        substituteInPlace "src/common/config_info.c" --subst-var dev
-        cat ${./pg_config.env.mk} >> src/common/Makefile
-      '';
+      postPatch =
+        ''
+          substituteInPlace "src/Makefile.global.in" --subst-var out
+          substituteInPlace "src/common/config_info.c" --subst-var dev
+          cat ${./pg_config.env.mk} >> src/common/Makefile
+        ''
+        # This check was introduced upstream to prevent calls to "exit" inside libpq.
+        # However, this doesn't work reliably with static linking, see this and following:
+        # https://postgr.es/m/flat/20210703001639.GB2374652%40rfd.leadboat.com#52584ca4bd3cb9dac376f3158c419f97
+        # Thus, disable the check entirely, as it would currently fail with this:
+        # > libpq.so.5.17:                  U atexit
+        # > libpq.so.5.17:                  U pthread_exit
+        # > libpq must not be calling any function which invokes exit
+        # Don't mind the fact that this checks libpq.**so** in pkgsStatic - that's correct, since PostgreSQL
+        # still needs a shared library internally.
+        + lib.optionalString (atLeast "15" && stdenv'.hostPlatform.isStatic) ''
+          substituteInPlace src/interfaces/libpq/Makefile \
+            --replace-fail "echo 'libpq must not be calling any function which invokes exit'; exit 1;" "echo;"
+        '';
 
       postInstall =
         ''
@@ -415,6 +454,9 @@ let
 
           # Stop lib depending on the -dev output of llvm
           remove-references-to -t ${llvmPackages.llvm.dev} "$out/lib/llvmjit${dlSuffix}"
+
+          moveToOutput "lib/bitcode" "$jit"
+          moveToOutput "lib/llvmjit*" "$jit"
         ''
         + lib.optionalString stdenv'.hostPlatform.isDarwin ''
           # The darwin specific Makefile for PGXS contains a reference to the postgres
@@ -457,23 +499,23 @@ let
           # the tests works fine most of the time. But once the tests (or any package using
           # postgresqlTestHook) fails on the same machine for a few times, enough IPC objects
           # will be stuck around, and any future builds with the tests enabled *will* fail.
-          !(stdenv'.hostPlatform.isDarwin);
+          !(stdenv'.hostPlatform.isDarwin)
+        &&
+          # Regression tests currently fail in pkgsMusl because of a difference in EXPLAIN output.
+          !(stdenv'.hostPlatform.isMusl);
       installCheckTarget = "check-world";
 
       passthru =
         let
           this = self.callPackage generic args;
-          jitToggle = this.override {
-            jitSupport = !jitSupport;
-          };
         in
         {
           inherit dlSuffix;
 
           psqlSchema = lib.versions.major version;
 
-          withJIT = if jitSupport then this else jitToggle;
-          withoutJIT = if jitSupport then jitToggle else this;
+          withJIT = this.withPackages (_: [ this.jit ]);
+          withoutJIT = this;
 
           pkgs =
             let
@@ -583,18 +625,38 @@ let
         inherit installedExtensions;
         inherit (postgresql)
           pg_config
+          pkgs
           psqlSchema
           version
           ;
 
         withJIT = postgresqlWithPackages {
-          inherit buildEnv lib makeBinaryWrapper;
-          postgresql = postgresql.withJIT;
-        } f;
+          inherit
+            buildEnv
+            lib
+            makeBinaryWrapper
+            postgresql
+            ;
+        } (_: installedExtensions ++ [ postgresql.jit ]);
         withoutJIT = postgresqlWithPackages {
-          inherit buildEnv lib makeBinaryWrapper;
-          postgresql = postgresql.withoutJIT;
-        } f;
+          inherit
+            buildEnv
+            lib
+            makeBinaryWrapper
+            postgresql
+            ;
+        } (_: lib.remove postgresql.jit installedExtensions);
+
+        withPackages =
+          f':
+          postgresqlWithPackages {
+            inherit
+              buildEnv
+              lib
+              makeBinaryWrapper
+              postgresql
+              ;
+          } (ps: installedExtensions ++ f' ps);
       };
     };
 
diff --git a/pkgs/servers/sql/postgresql/libpq.nix b/pkgs/servers/sql/postgresql/libpq.nix
index 6c6ad21e99ef..1a971faf91e9 100644
--- a/pkgs/servers/sql/postgresql/libpq.nix
+++ b/pkgs/servers/sql/postgresql/libpq.nix
@@ -91,6 +91,15 @@ stdenv.mkDerivation (finalAttrs: {
     "-fdata-sections -ffunction-sections"
     + (if stdenv.cc.isClang then " -flto" else " -fmerge-constants -Wl,--gc-sections");
 
+  # This flag was introduced upstream in:
+  # https://github.com/postgres/postgres/commit/b6c7cfac88c47a9194d76f3d074129da3c46545a
+  # It causes errors when linking against libpq.a in pkgsStatic:
+  #   undefined reference to `pg_encoding_to_char'
+  # Unsetting the flag fixes it. The upstream reasoning to introduce it is about the risk
+  # to have initdb load a libpq.so from a different major version and how to avoid that.
+  # This doesn't apply to us with Nix.
+  env.NIX_CFLAGS_COMPILE = "-UUSE_PRIVATE_ENCODING_FUNCS";
+
   configureFlags =
     [
       "--enable-debug"
diff --git a/pkgs/servers/teleport/generic.nix b/pkgs/servers/teleport/generic.nix
index cc99bbb45fd1..d11f45ec7f85 100644
--- a/pkgs/servers/teleport/generic.nix
+++ b/pkgs/servers/teleport/generic.nix
@@ -5,8 +5,6 @@
   fetchFromGitHub,
   fetchpatch,
   makeWrapper,
-  CoreFoundation,
-  AppKit,
   binaryen,
   cargo,
   libfido2,
@@ -15,7 +13,6 @@
   pkg-config,
   pnpm_10,
   rustc,
-  Security,
   stdenv,
   xdg-utils,
   wasm-bindgen-cli,
@@ -50,12 +47,7 @@ let
 
     buildAndTestSubdir = "lib/srv/desktop/rdp/rdpclient";
 
-    buildInputs =
-      [ openssl ]
-      ++ lib.optionals stdenv.hostPlatform.isDarwin [
-        CoreFoundation
-        Security
-      ];
+    buildInputs = [ openssl ];
     nativeBuildInputs = [ pkg-config ];
 
     # https://github.com/NixOS/nixpkgs/issues/161570 ,
@@ -144,16 +136,10 @@ buildGoModule rec {
     "webassets_embed"
   ] ++ lib.optional withRdpClient "desktop_access_rdp";
 
-  buildInputs =
-    [
-      openssl
-      libfido2
-    ]
-    ++ lib.optionals (stdenv.hostPlatform.isDarwin && withRdpClient) [
-      CoreFoundation
-      Security
-      AppKit
-    ];
+  buildInputs = [
+    openssl
+    libfido2
+  ];
   nativeBuildInputs = [
     makeWrapper
     pkg-config
diff --git a/pkgs/servers/trezord/default.nix b/pkgs/servers/trezord/default.nix
index 7b4ea22faa13..b30297ff87c2 100644
--- a/pkgs/servers/trezord/default.nix
+++ b/pkgs/servers/trezord/default.nix
@@ -6,7 +6,6 @@
   fetchpatch,
   trezor-udev-rules,
   nixosTests,
-  AppKit,
 }:
 
 buildGoModule rec {
@@ -37,9 +36,7 @@ buildGoModule rec {
     })
   ];
 
-  propagatedBuildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [ trezor-udev-rules ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ AppKit ];
+  propagatedBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ trezor-udev-rules ];
 
   ldflags = [
     "-s"
diff --git a/pkgs/servers/unpackerr/default.nix b/pkgs/servers/unpackerr/default.nix
index 0e01767fa2ba..7211058f3146 100644
--- a/pkgs/servers/unpackerr/default.nix
+++ b/pkgs/servers/unpackerr/default.nix
@@ -1,10 +1,7 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   buildGoModule,
-  Cocoa,
-  WebKit,
 }:
 
 buildGoModule rec {
@@ -20,11 +17,6 @@ buildGoModule rec {
 
   vendorHash = "sha256-wWIw0gNn5tqRq0udzPy/n2OkiIVESpSotOSn2YlBNS4=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    Cocoa
-    WebKit
-  ];
-
   ldflags = [
     "-s"
     "-w"
diff --git a/pkgs/servers/web-apps/lemmy/server.nix b/pkgs/servers/web-apps/lemmy/server.nix
index 2c0d7c0cf57f..c868e7463e5c 100644
--- a/pkgs/servers/web-apps/lemmy/server.nix
+++ b/pkgs/servers/web-apps/lemmy/server.nix
@@ -6,8 +6,6 @@
   openssl,
   libpq,
   libiconv,
-  Security,
-  SystemConfiguration,
   protobuf,
   rustfmt,
   nixosTests,
@@ -39,8 +37,6 @@ rustPlatform.buildRustPackage rec {
     [ libpq ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       libiconv
-      Security
-      SystemConfiguration
     ];
 
   # Using OPENSSL_NO_VENDOR is not an option on darwin
diff --git a/pkgs/servers/x11/quartz-wm/default.nix b/pkgs/servers/x11/quartz-wm/default.nix
index b6a1c1f525be..646c122b55d1 100644
--- a/pkgs/servers/x11/quartz-wm/default.nix
+++ b/pkgs/servers/x11/quartz-wm/default.nix
@@ -5,9 +5,6 @@
   xorg,
   pixman,
   pkg-config,
-  AppKit,
-  Foundation,
-  Xplugin,
 }:
 
 let
@@ -33,9 +30,6 @@ stdenv.mkDerivation {
     xorg.libXrandr
     xorg.libXext
     pixman
-    AppKit
-    Xplugin
-    Foundation
   ];
   meta = with lib; {
     license = licenses.apple-psl20;
diff --git a/pkgs/servers/x11/xorg/default.nix b/pkgs/servers/x11/xorg/default.nix
index 08c2417c4966..0bdcf2653c85 100644
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@@ -1,14 +1,26 @@
 # THIS IS A GENERATED FILE.  DO NOT EDIT!
 {
   lib,
-  pixman,
+  font-alias,
+  font-util,
+  gccmakedep,
+  libpciaccess,
+  libpthread-stubs,
   luit,
+  pixman,
 }:
 
 self: with self; {
 
-  inherit pixman;
-  inherit luit;
+  inherit
+    gccmakedep
+    libpciaccess
+    luit
+    pixman
+    ;
+  fontalias = font-alias;
+  fontutil = font-util;
+  libpthreadstubs = libpthread-stubs;
 
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   appres = callPackage (
@@ -413,37 +425,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontalias = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-alias";
-      version = "1.0.5";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-alias-1.0.5.tar.xz";
-        sha256 = "0vkb5mybc0fjfq29lgf5w1b536bwifzkyj8ad9iy7q3kpcby52cz";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [ ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontarabicmisc = callPackage (
     {
@@ -1594,37 +1575,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  fontutil = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "font-util";
-      version = "1.4.1";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/font/font-util-1.4.1.tar.xz";
-        sha256 = "15fcd3rzlgm51fwgfapg6vzyd1kkd28rj149xq7iajqr7h9697sw";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [ ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "fontutil" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   fontwinitzkicyrillic = callPackage (
     {
@@ -1703,37 +1653,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  gccmakedep = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "gccmakedep";
-      version = "1.0.4";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/util/gccmakedep-1.0.4.tar.xz";
-        sha256 = "1di5rxv930nhf5ls07fx04l0lqsakxycplmrx4kc6qzvd63zk22h";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [ ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   iceauth = callPackage (
     {
@@ -3282,68 +3201,6 @@ self: with self; {
     })
   ) { };
 
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libpciaccess = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libpciaccess";
-      version = "0.18.1";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/lib/libpciaccess-0.18.1.tar.xz";
-        sha256 = "0xpslrjnfrc1a7y8f8qwnd3wq24ndpj2q77ds12mbnwand239x2a";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [ ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "pciaccess" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
-  # THIS IS A GENERATED FILE.  DO NOT EDIT!
-  libpthreadstubs = callPackage (
-    {
-      stdenv,
-      pkg-config,
-      fetchurl,
-      testers,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      pname = "libpthread-stubs";
-      version = "0.5";
-      builder = ./builder.sh;
-      src = fetchurl {
-        url = "mirror://xorg/individual/xcb/libpthread-stubs-0.5.tar.xz";
-        sha256 = "1g224hyy694jch54357zc895z46r90xs193hg4m7rfnfxinmdnjr";
-      };
-      hardeningDisable = [
-        "bindnow"
-        "relro"
-      ];
-      strictDeps = true;
-      nativeBuildInputs = [ pkg-config ];
-      buildInputs = [ ];
-      passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      meta = {
-        pkgConfigModules = [ "pthread-stubs" ];
-        platforms = lib.platforms.unix;
-      };
-    })
-  ) { };
-
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   libxcb = callPackage (
     {
diff --git a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
index 95b47b5ed425..3a58856b599d 100755
--- a/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
+++ b/pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl
@@ -36,6 +36,9 @@ $pcMap{"gl"} = "libGL";
 $pcMap{"GL"} = "libGL";
 $pcMap{"gbm"} = "libgbm";
 $pcMap{"hwdata"} = "hwdata";
+$pcMap{"fontutil"} = "fontutil";
+$pcMap{"pciaccess"} = "libpciaccess";
+$pcMap{"pthread-stubs"} = "libpthreadstubs";
 $pcMap{"\$PIXMAN"} = "pixman";
 $pcMap{"\$RENDERPROTO"} = "xorgproto";
 $pcMap{"\$DRI3PROTO"} = "xorgproto";
@@ -260,14 +263,26 @@ print OUT <<EOF;
 # THIS IS A GENERATED FILE.  DO NOT EDIT!
 {
   lib,
-  pixman,
+  font-alias,
+  font-util,
+  gccmakedep,
+  libpciaccess,
+  libpthread-stubs,
   luit,
+  pixman,
 }:
 
 self: with self; {
 
-  inherit pixman;
-  inherit luit;
+  inherit
+    gccmakedep
+    libpciaccess
+    luit
+    pixman
+    ;
+  fontalias = font-alias;
+  fontutil = font-util;
+  libpthreadstubs = libpthread-stubs;
 
 EOF
 
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 327f8b3296cd..0d621d703d9d 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -48,10 +48,6 @@
   libxslt,
   libxcrypt,
   hwdata,
-  ApplicationServices,
-  Carbon,
-  Cocoa,
-  Xplugin,
   xorg,
   windows,
   libgbm,
@@ -157,7 +153,6 @@ self: super:
     };
   });
 
-  gccmakedep = addMainProgram super.gccmakedep { };
   iceauth = addMainProgram super.iceauth { };
   ico = addMainProgram super.ico { };
 
@@ -623,45 +618,6 @@ self: super:
     ]; # mainly to avoid propagation
   });
 
-  libpciaccess = super.libpciaccess.overrideAttrs (attrs: {
-    nativeBuildInputs = attrs.nativeBuildInputs ++ [
-      meson
-      ninja
-    ];
-
-    buildInputs =
-      attrs.buildInputs
-      ++ [ zlib ]
-      ++ lib.optionals stdenv.hostPlatform.isNetBSD [
-        netbsd.libarch
-        netbsd.libpci
-      ];
-
-    mesonFlags = [
-      (lib.mesonOption "pci-ids" "${hwdata}/share/hwdata")
-      (lib.mesonEnable "zlib" true)
-    ];
-
-    meta = attrs.meta // {
-      # https://gitlab.freedesktop.org/xorg/lib/libpciaccess/-/blob/master/configure.ac#L108-114
-      platforms =
-        lib.fold (os: ps: ps ++ lib.platforms.${os})
-          [ ]
-          [ "cygwin" "freebsd" "linux" "netbsd" "openbsd" "illumos" ];
-      badPlatforms = [
-        # mandatory shared library
-        lib.systems.inspect.platformPatterns.isStatic
-      ];
-    };
-  });
-
-  libpthreadstubs = super.libpthreadstubs.overrideAttrs (attrs: {
-    # only contains a pkgconfig file on linux and windows
-    meta = attrs.meta // {
-      platforms = lib.platforms.unix ++ lib.platforms.windows;
-    };
-  });
-
   setxkbmap = super.setxkbmap.overrideAttrs (attrs: {
     postInstall = ''
       mkdir -p $out/share/man/man7
@@ -1222,9 +1178,6 @@ self: super:
             bootstrap_cmds
             automake
             autoconf
-            Xplugin
-            Carbon
-            Cocoa
             mesa
           ];
           propagatedBuildInputs = commonPropagatedBuildInputs ++ [
@@ -1283,7 +1236,6 @@ self: super:
           preConfigure = ''
             mkdir -p $out/Applications
             export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -Wno-error"
-            substituteInPlace hw/xquartz/pbproxy/Makefile.in --replace -F/System -F${ApplicationServices}
           '';
           postInstall = ''
             rm -fr $out/share/X11/xkb/compiled
@@ -1324,15 +1276,12 @@ self: super:
         "--without-dtrace"
       ];
 
-    buildInputs =
-      old.buildInputs
-      ++ [
-        xorg.pixman
-        xorg.libXfont2
-        xorg.xtrans
-        xorg.libxcvt
-      ]
-      ++ lib.optional stdenv.hostPlatform.isDarwin [ Xplugin ];
+    buildInputs = old.buildInputs ++ [
+      xorg.pixman
+      xorg.libXfont2
+      xorg.xtrans
+      xorg.libxcvt
+    ];
   });
 
   lndir = super.lndir.overrideAttrs (attrs: {
diff --git a/pkgs/servers/x11/xorg/tarballs.list b/pkgs/servers/x11/xorg/tarballs.list
index 819c9ac4e934..47ae0e74d88e 100644
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@@ -1,4 +1,3 @@
-mirror://xorg/individual/xcb/libpthread-stubs-0.5.tar.xz
 mirror://xorg/individual/xcb/xcb-util-0.4.1.tar.xz
 mirror://xorg/individual/xcb/xcb-util-errors-1.0.1.tar.xz
 mirror://xorg/individual/xcb/xcb-util-image-0.4.1.tar.xz
@@ -132,7 +131,6 @@ mirror://xorg/individual/font/font-adobe-100dpi-1.0.4.tar.xz
 mirror://xorg/individual/font/font-adobe-utopia-75dpi-1.0.5.tar.xz
 mirror://xorg/individual/font/font-adobe-utopia-100dpi-1.0.5.tar.xz
 mirror://xorg/individual/font/font-adobe-utopia-type1-1.0.5.tar.xz
-mirror://xorg/individual/font/font-alias-1.0.5.tar.xz
 mirror://xorg/individual/font/font-arabic-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-bh-75dpi-1.0.4.tar.xz
 mirror://xorg/individual/font/font-bh-100dpi-1.0.4.tar.xz
@@ -161,7 +159,6 @@ mirror://xorg/individual/font/font-schumacher-misc-1.1.3.tar.xz
 mirror://xorg/individual/font/font-screen-cyrillic-1.0.5.tar.xz
 mirror://xorg/individual/font/font-sony-misc-1.0.4.tar.xz
 mirror://xorg/individual/font/font-sun-misc-1.0.4.tar.xz
-mirror://xorg/individual/font/font-util-1.4.1.tar.xz
 mirror://xorg/individual/font/font-winitzki-cyrillic-1.0.4.tar.xz
 mirror://xorg/individual/font/font-xfree86-type1-1.0.5.tar.xz
 https://gitlab.freedesktop.org/xorg/lib/libAppleWM/-/archive/be972ebc3a97292e7d2b2350eff55ae12df99a42/libAppleWM-be972ebc3a97292e7d2b2350eff55ae12df99a42.tar.bz2
@@ -169,7 +166,6 @@ mirror://xorg/individual/lib/libdmx-1.1.5.tar.xz
 mirror://xorg/individual/lib/libfontenc-1.1.8.tar.xz
 mirror://xorg/individual/lib/libFS-1.0.10.tar.xz
 mirror://xorg/individual/lib/libICE-1.1.2.tar.xz
-mirror://xorg/individual/lib/libpciaccess-0.18.1.tar.xz
 mirror://xorg/individual/lib/libSM-1.2.5.tar.xz
 mirror://xorg/individual/lib/libWindowsWM-1.0.1.tar.bz2
 mirror://xorg/individual/lib/libX11-1.8.12.tar.xz
@@ -211,7 +207,6 @@ mirror://xorg/individual/lib/xtrans-1.6.0.tar.xz
 mirror://xorg/individual/proto/xcb-proto-1.17.0.tar.xz
 mirror://xorg/individual/proto/xorgproto-2024.1.tar.xz
 mirror://xorg/individual/util/bdftopcf-1.1.2.tar.xz
-mirror://xorg/individual/util/gccmakedep-1.0.4.tar.xz
 mirror://xorg/individual/util/imake-1.0.10.tar.xz
 mirror://xorg/individual/util/lndir-1.0.5.tar.xz
 mirror://xorg/individual/util/makedepend-1.0.9.tar.xz
diff --git a/pkgs/servers/x11/xorg/update.py b/pkgs/servers/x11/xorg/update.py
index 63aaf885b5b4..a493f3821e5f 100755
--- a/pkgs/servers/x11/xorg/update.py
+++ b/pkgs/servers/x11/xorg/update.py
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell --pure --keep NIX_PATH -i python3 -p nix git "python3.withPackages (ps: [ ps. packaging ps.beautifulsoup4 ps.requests ])"
+#!nix-shell --pure --keep NIX_PATH -i python3 -p nix git nixfmt-rfc-style "python3.withPackages (ps: [ ps. packaging ps.beautifulsoup4 ps.requests ])"
 
 # Usage: Run ./update.py from the directory containing tarballs.list. The script checks for the
 # latest versions of all packages, updates the expressions if any update is found, and commits
@@ -93,6 +93,10 @@ print("Generating updated expr (slow)...")
 
 subprocess.run(["./generate-expr-from-tarballs.pl", "tarballs.list"], check=True)
 
+print("Formatting generated expr...")
+
+subprocess.run(["nixfmt", "default.nix"], check=True)
+
 print("Committing...")
 
 subprocess.run(["git", "add", "default.nix", "tarballs.list"], check=True)
diff --git a/pkgs/shells/nushell/default.nix b/pkgs/shells/nushell/default.nix
index 609e71efca8a..9f1f90feb462 100644
--- a/pkgs/shells/nushell/default.nix
+++ b/pkgs/shells/nushell/default.nix
@@ -9,9 +9,6 @@
   pkg-config,
   python3,
   xorg,
-  Libsystem,
-  AppKit,
-  Security,
   nghttp2,
   libgit2,
   withDefaultFeatures ? true,
@@ -52,12 +49,9 @@ rustPlatform.buildRustPackage {
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       zlib
-      Libsystem
-      Security
     ]
     ++ lib.optionals (withDefaultFeatures && stdenv.hostPlatform.isLinux) [ xorg.libX11 ]
     ++ lib.optionals (withDefaultFeatures && stdenv.hostPlatform.isDarwin) [
-      AppKit
       nghttp2
       libgit2
     ];
diff --git a/pkgs/shells/nushell/plugins/default.nix b/pkgs/shells/nushell/plugins/default.nix
index 25900d9aa960..cdd2f9e367cb 100644
--- a/pkgs/shells/nushell/plugins/default.nix
+++ b/pkgs/shells/nushell/plugins/default.nix
@@ -3,28 +3,24 @@
   config,
   newScope,
   dbus,
-  IOKit,
-  CoreFoundation,
-  Foundation,
-  Security,
 }:
 
 lib.makeScope newScope (
   self:
   with self;
   {
-    gstat = callPackage ./gstat.nix { inherit Security; };
-    formats = callPackage ./formats.nix { inherit IOKit Foundation; };
-    polars = callPackage ./polars.nix { inherit IOKit Foundation; };
-    query = callPackage ./query.nix { inherit IOKit CoreFoundation; };
-    net = callPackage ./net.nix { inherit IOKit CoreFoundation; };
-    units = callPackage ./units.nix { inherit IOKit Foundation; };
-    highlight = callPackage ./highlight.nix { inherit IOKit Foundation; };
+    gstat = callPackage ./gstat.nix { };
+    formats = callPackage ./formats.nix { };
+    polars = callPackage ./polars.nix { };
+    query = callPackage ./query.nix { };
+    net = callPackage ./net.nix { };
+    units = callPackage ./units.nix { };
+    highlight = callPackage ./highlight.nix { };
     dbus = callPackage ./dbus.nix {
       inherit dbus;
       nushell_plugin_dbus = self.dbus;
     };
-    skim = callPackage ./skim.nix { inherit IOKit CoreFoundation; };
+    skim = callPackage ./skim.nix { };
   }
   // lib.optionalAttrs config.allowAliases {
     regex = throw "`nu_plugin_regex` is no longer compatible with the current Nushell release.";
diff --git a/pkgs/shells/nushell/plugins/formats.nix b/pkgs/shells/nushell/plugins/formats.nix
index a1c7a095528b..5a9b2cc03e0d 100644
--- a/pkgs/shells/nushell/plugins/formats.nix
+++ b/pkgs/shells/nushell/plugins/formats.nix
@@ -4,8 +4,6 @@
   rustPlatform,
   nushell,
   pkg-config,
-  IOKit,
-  Foundation,
   nix-update-script,
 }:
 
@@ -15,10 +13,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
 
   nativeBuildInputs = [ pkg-config ] ++ lib.optionals stdenv.cc.isClang [ rustPlatform.bindgenHook ];
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    IOKit
-    Foundation
-  ];
   cargoBuildFlags = [ "--package nu_plugin_formats" ];
 
   checkPhase = ''
diff --git a/pkgs/shells/nushell/plugins/gstat.nix b/pkgs/shells/nushell/plugins/gstat.nix
index 008113de79a8..885828e53cb0 100644
--- a/pkgs/shells/nushell/plugins/gstat.nix
+++ b/pkgs/shells/nushell/plugins/gstat.nix
@@ -5,7 +5,6 @@
   openssl,
   nushell,
   pkg-config,
-  Security,
   nix-update-script,
 }:
 
@@ -15,7 +14,7 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
 
   nativeBuildInputs = [ pkg-config ] ++ lib.optionals stdenv.cc.isClang [ rustPlatform.bindgenHook ];
-  buildInputs = [ openssl ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
+  buildInputs = [ openssl ];
   cargoBuildFlags = [ "--package nu_plugin_gstat" ];
 
   checkPhase = ''
diff --git a/pkgs/shells/nushell/plugins/highlight.nix b/pkgs/shells/nushell/plugins/highlight.nix
index aeb112857ab6..12bb9e212f18 100644
--- a/pkgs/shells/nushell/plugins/highlight.nix
+++ b/pkgs/shells/nushell/plugins/highlight.nix
@@ -5,8 +5,6 @@
   pkg-config,
   nix-update-script,
   fetchFromGitHub,
-  IOKit,
-  Foundation,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -25,10 +23,6 @@ rustPlatform.buildRustPackage rec {
   cargoHash = "sha256-3bLATtK9r4iVpxdbg5eCvzeGpIqWMl/GTDGCORuQfgY=";
 
   nativeBuildInputs = [ pkg-config ] ++ lib.optionals stdenv.cc.isClang [ rustPlatform.bindgenHook ];
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    IOKit
-    Foundation
-  ];
   cargoBuildFlags = [ "--package nu_plugin_highlight" ];
 
   checkPhase = ''
diff --git a/pkgs/shells/nushell/plugins/net.nix b/pkgs/shells/nushell/plugins/net.nix
index 26253b679db7..08b8e1b4d80e 100644
--- a/pkgs/shells/nushell/plugins/net.nix
+++ b/pkgs/shells/nushell/plugins/net.nix
@@ -2,9 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  IOKit,
-  CoreFoundation,
   nix-update-script,
 }:
 
@@ -24,11 +21,6 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ rustPlatform.bindgenHook ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    CoreFoundation
-    IOKit
-  ];
-
   passthru.updateScript = nix-update-script { };
 
   meta = with lib; {
diff --git a/pkgs/shells/nushell/plugins/polars.nix b/pkgs/shells/nushell/plugins/polars.nix
index 2bf100e5f8a7..1811f3520fe5 100644
--- a/pkgs/shells/nushell/plugins/polars.nix
+++ b/pkgs/shells/nushell/plugins/polars.nix
@@ -5,8 +5,6 @@
   openssl,
   nushell,
   pkg-config,
-  IOKit,
-  Foundation,
   nix-update-script,
 }:
 
@@ -17,12 +15,7 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
 
   nativeBuildInputs = [ pkg-config ] ++ lib.optionals stdenv.cc.isClang [ rustPlatform.bindgenHook ];
-  buildInputs =
-    [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      IOKit
-      Foundation
-    ];
+  buildInputs = [ openssl ];
   cargoBuildFlags = [ "--package nu_plugin_polars" ];
 
   checkPhase = ''
diff --git a/pkgs/shells/nushell/plugins/query.nix b/pkgs/shells/nushell/plugins/query.nix
index 1e066c88b003..a24718377116 100644
--- a/pkgs/shells/nushell/plugins/query.nix
+++ b/pkgs/shells/nushell/plugins/query.nix
@@ -3,8 +3,6 @@
   lib,
   rustPlatform,
   nushell,
-  IOKit,
-  CoreFoundation,
   nix-update-script,
   pkg-config,
   openssl,
@@ -17,15 +15,10 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
 
   nativeBuildInputs = [ pkg-config ] ++ lib.optionals stdenv.cc.isClang [ rustPlatform.bindgenHook ];
-  buildInputs =
-    [
-      openssl
-      curl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      IOKit
-      CoreFoundation
-    ];
+  buildInputs = [
+    openssl
+    curl
+  ];
   cargoBuildFlags = [ "--package nu_plugin_query" ];
 
   checkPhase = ''
diff --git a/pkgs/shells/nushell/plugins/skim.nix b/pkgs/shells/nushell/plugins/skim.nix
index 4f99cce8e1ac..86ccd54c3e59 100644
--- a/pkgs/shells/nushell/plugins/skim.nix
+++ b/pkgs/shells/nushell/plugins/skim.nix
@@ -5,8 +5,6 @@
   rustPlatform,
   nix-update-script,
   fetchFromGitHub,
-  IOKit,
-  CoreFoundation,
   nushell,
   skim,
 }:
@@ -26,10 +24,6 @@ rustPlatform.buildRustPackage rec {
   cargoHash = "sha256-CvBBBDi8AkSfCIcUyUH4e5DX5tija1KqE9z05lndNE4=";
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ rustPlatform.bindgenHook ];
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    IOKit
-    CoreFoundation
-  ];
 
   passthru = {
     updateScript = nix-update-script { };
diff --git a/pkgs/shells/nushell/plugins/units.nix b/pkgs/shells/nushell/plugins/units.nix
index f6aa34a02730..179242bf2a1d 100644
--- a/pkgs/shells/nushell/plugins/units.nix
+++ b/pkgs/shells/nushell/plugins/units.nix
@@ -5,8 +5,6 @@
   pkg-config,
   nix-update-script,
   fetchFromGitHub,
-  IOKit,
-  Foundation,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -23,10 +21,6 @@ rustPlatform.buildRustPackage rec {
   cargoHash = "sha256-3v9jP8nL0JqtC76igsCytkQAVTgWqzHH0KQX3o6bi0c=";
 
   nativeBuildInputs = [ pkg-config ] ++ lib.optionals stdenv.cc.isClang [ rustPlatform.bindgenHook ];
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    IOKit
-    Foundation
-  ];
   cargoBuildFlags = [ "--package nu_plugin_units" ];
 
   passthru.updateScript = nix-update-script { };
diff --git a/pkgs/stdenv/adapters.nix b/pkgs/stdenv/adapters.nix
index 54527f841242..0c3b7ba7e979 100644
--- a/pkgs/stdenv/adapters.nix
+++ b/pkgs/stdenv/adapters.nix
@@ -198,7 +198,8 @@ rec {
             {
               env = prevAttrs.env // {
                 NIX_CFLAGS_LINK =
-                  toString args.env.NIX_CFLAGS_LINK + lib.optionalString (stdenv.cc.isGNU or false) " -static-libgcc";
+                  toString (args.env.NIX_CFLAGS_LINK or "")
+                  + lib.optionalString (stdenv.cc.isGNU or false) " -static-libgcc";
               };
             }
           else
@@ -419,15 +420,7 @@ rec {
       });
     });
 
-  # Overriding the SDK changes the Darwin SDK used to build the package, which:
-  # * Ensures that the compiler and bintools have the correct Libsystem version; and
-  # * Replaces any SDK references with those in the SDK corresponding to the requested SDK version.
-  #
-  # `sdkVersion` can be any of the following:
-  # * A version string indicating the requested SDK version; or
-  # * An attrset consisting of either or both of the following fields: darwinSdkVersion and darwinMinVersion.
-  #
-  # Note: `overrideSDK` is deprecated. Add the versioned variants of `apple-sdk` to `buildInputs` change the SDK.
+  # `overrideSDK` is deprecated. Add the versioned variants of `apple-sdk` to `buildInputs` change the SDK.
   overrideSDK = pkgs.callPackage ./darwin/override-sdk.nix { inherit lib extendMkDerivationArgs; };
 
   withDefaultHardeningFlags =
diff --git a/pkgs/stdenv/darwin/override-sdk.nix b/pkgs/stdenv/darwin/override-sdk.nix
index 482c11ce0cb2..ce4d48874b0c 100644
--- a/pkgs/stdenv/darwin/override-sdk.nix
+++ b/pkgs/stdenv/darwin/override-sdk.nix
@@ -1,5 +1,5 @@
 # This is a compatibility shim with `overrideSDK`.
-# Note: `overrideSDK` is deprecated. It will be added to `aliases.nix` after in-tree usage has been cleaned up.
+# Note: `overrideSDK` is deprecated. It will be removed in 25.11.
 {
   lib,
   stdenvNoCC,
@@ -19,6 +19,9 @@ assert lib.assertMsg (darwinSdkVersion == "11.0" || darwinSdkVersion == "12.3")
 
   See the stdenv documentation for how to use `apple-sdk`.
 '';
+assert lib.warn
+  "overrideSDK: this mechanism is deprecated and will be removed in 25.11, use `apple-sdk_*` or `darwinMinVersionHook` in build inputs instead; see <https://nixos.org/manual/nixpkgs/stable/#sec-darwin> for documentation"
+  true;
 stdenv.override (old: {
   mkDerivationFromStdenv = extendMkDerivationArgs old (args: {
     buildInputs =
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 22338e9983ff..8ecdb6879740 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -119,6 +119,7 @@ let
     "fortify"
     "fortify3"
     "shadowstack"
+    "nostrictaliasing"
     "pacret"
     "pic"
     "pie"
diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index 6fedee0f3528..7682419db9d6 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -349,6 +349,15 @@ assert bootstrapTools.passthru.isFromBootstrapFiles or false; # sanity check
           enableThreading = false;
           enableCrypt = false;
         };
+
+        # Let gettext "checking for working iconv" success without trying
+        # to convert between UTF-8 and EUC-JP which doesn't work here
+        # because of missing locale and gconv, same for libunistring below
+        gettext = super.gettext.overrideAttrs (attrs: {
+          env = attrs.env or { } // {
+            am_cv_func_iconv_works = "yes";
+          };
+        });
       };
 
       # `gettext` comes with obsolete config.sub/config.guess that don't recognize LoongArch64.
diff --git a/pkgs/tools/X11/xidlehook/default.nix b/pkgs/tools/X11/xidlehook/default.nix
index ef10ceed7f74..9dfe095de200 100644
--- a/pkgs/tools/X11/xidlehook/default.nix
+++ b/pkgs/tools/X11/xidlehook/default.nix
@@ -8,7 +8,6 @@
   libpulseaudio,
   pkg-config,
   patchelf,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -32,7 +31,7 @@ rustPlatform.buildRustPackage rec {
     xorg.libX11
     xorg.libXScrnSaver
     libpulseaudio
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin Security;
+  ];
   nativeBuildInputs = [
     pkg-config
     patchelf
diff --git a/pkgs/tools/admin/procs/default.nix b/pkgs/tools/admin/procs/default.nix
index 37d84e65cef1..71136f1d5cff 100644
--- a/pkgs/tools/admin/procs/default.nix
+++ b/pkgs/tools/admin/procs/default.nix
@@ -5,9 +5,7 @@
   fetchFromGitHub,
   rustPlatform,
   installShellFiles,
-  Security,
   libiconv,
-  Libsystem,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -36,9 +34,7 @@ rustPlatform.buildRustPackage rec {
   '';
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    Security
     libiconv
-    Libsystem
   ];
 
   meta = with lib; {
diff --git a/pkgs/tools/admin/trinsic-cli/default.nix b/pkgs/tools/admin/trinsic-cli/default.nix
index 06926669fc75..0ac76ace16bf 100644
--- a/pkgs/tools/admin/trinsic-cli/default.nix
+++ b/pkgs/tools/admin/trinsic-cli/default.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchurl,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -18,8 +16,6 @@ rustPlatform.buildRustPackage rec {
   cargoVendorDir = "vendor";
   doCheck = false;
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
-
   meta = with lib; {
     description = "Trinsic CLI";
     longDescription = ''
diff --git a/pkgs/tools/archivers/pax/default.nix b/pkgs/tools/archivers/pax/default.nix
index 6426f1b36517..9dbf30620d73 100644
--- a/pkgs/tools/archivers/pax/default.nix
+++ b/pkgs/tools/archivers/pax/default.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  utmp,
   musl-fts,
 }:
 
@@ -15,9 +14,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-6VXV06+Xrt4KP0Y6mlm4Po0Qg6rxQutvOIxUmn0YLms=";
   };
 
-  buildInputs =
-    lib.optional stdenv.hostPlatform.isDarwin utmp
-    ++ lib.optional stdenv.hostPlatform.isMusl musl-fts;
+  buildInputs = lib.optional stdenv.hostPlatform.isMusl musl-fts;
 
   NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isMusl "-lfts";
 
diff --git a/pkgs/tools/archivers/unar/default.nix b/pkgs/tools/archivers/unar/default.nix
index f84a2ba8406e..640849617f89 100644
--- a/pkgs/tools/archivers/unar/default.nix
+++ b/pkgs/tools/archivers/unar/default.nix
@@ -10,8 +10,6 @@
   openssl,
   wavpack,
   xcbuildHook,
-  Foundation,
-  AppKit,
 }:
 
 stdenv.mkDerivation rec {
@@ -61,19 +59,13 @@ stdenv.mkDerivation rec {
         ''
     );
 
-  buildInputs =
-    [
-      bzip2
-      icu
-      openssl
-      wavpack
-      zlib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [ gnustep-base ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Foundation
-      AppKit
-    ];
+  buildInputs = [
+    bzip2
+    icu
+    openssl
+    wavpack
+    zlib
+  ] ++ lib.optionals stdenv.hostPlatform.isLinux [ gnustep-base ];
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/tools/audio/kaldi/default.nix b/pkgs/tools/audio/kaldi/default.nix
index 4e7381a8f407..a689696c3b6a 100644
--- a/pkgs/tools/audio/kaldi/default.nix
+++ b/pkgs/tools/audio/kaldi/default.nix
@@ -9,7 +9,6 @@
   pkg-config,
   fetchFromGitHub,
   python3,
-  Accelerate,
   _experimental-update-script-combinators,
   common-updater-scripts,
   ripgrep,
@@ -37,14 +36,10 @@ stdenv.mkDerivation (finalAttrs: {
     "-DFETCHCONTENT_SOURCE_DIR_OPENFST:PATH=${finalAttrs.passthru.sources.openfst}"
   ];
 
-  buildInputs =
-    [
-      openblas
-      icu
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Accelerate
-    ];
+  buildInputs = [
+    openblas
+    icu
+  ];
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/tools/backup/bacula/default.nix b/pkgs/tools/backup/bacula/default.nix
index 3146aac36700..b76e7569aece 100644
--- a/pkgs/tools/backup/bacula/default.nix
+++ b/pkgs/tools/backup/bacula/default.nix
@@ -10,9 +10,6 @@
   openssl,
   readline,
   gettext,
-  CoreFoundation,
-  IOKit,
-  Kerberos,
 }:
 
 stdenv.mkDerivation rec {
@@ -41,9 +38,6 @@ stdenv.mkDerivation rec {
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       gettext # bacula requires CoreFoundation, but its `configure` script will only link it when it detects libintl.
-      CoreFoundation
-      IOKit
-      Kerberos
     ]
     # acl relies on attr, which I can't get to build on darwin
     ++ lib.optional (!stdenv.hostPlatform.isDarwin) acl;
diff --git a/pkgs/tools/backup/dar/default.nix b/pkgs/tools/backup/dar/default.nix
index 48e82ee8d244..3c31e3e19999 100644
--- a/pkgs/tools/backup/dar/default.nix
+++ b/pkgs/tools/backup/dar/default.nix
@@ -18,7 +18,6 @@
   xz,
   zlib,
   zstd,
-  CoreFoundation,
 }:
 
 stdenv.mkDerivation rec {
@@ -56,9 +55,6 @@ stdenv.mkDerivation rec {
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       attr
       e2fsprogs
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CoreFoundation
     ];
 
   configureFlags = [
diff --git a/pkgs/tools/backup/monolith/default.nix b/pkgs/tools/backup/monolith/default.nix
index 029fea2f7e16..0b3fce941328 100644
--- a/pkgs/tools/backup/monolith/default.nix
+++ b/pkgs/tools/backup/monolith/default.nix
@@ -6,8 +6,6 @@
   pkg-config,
   openssl,
   libiconv,
-  Security,
-  SystemConfiguration,
   nix-update-script,
 }:
 
@@ -32,8 +30,6 @@ rustPlatform.buildRustPackage rec {
     lib.optionals stdenv.hostPlatform.isLinux [ openssl ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       libiconv
-      Security
-      SystemConfiguration
     ];
 
   checkFlags = [ "--skip=tests::cli" ];
diff --git a/pkgs/tools/backup/rdedup/default.nix b/pkgs/tools/backup/rdedup/default.nix
index 3b49848beffd..cc874b51493a 100644
--- a/pkgs/tools/backup/rdedup/default.nix
+++ b/pkgs/tools/backup/rdedup/default.nix
@@ -1,13 +1,11 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
   pkg-config,
   openssl,
   libsodium,
   xz,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -32,7 +30,7 @@ rustPlatform.buildRustPackage rec {
     openssl
     libsodium
     xz
-  ] ++ (lib.optional stdenv.hostPlatform.isDarwin Security);
+  ];
 
   meta = with lib; {
     description = "Data deduplication with compression and public key encryption";
diff --git a/pkgs/tools/cd-dvd/cdrdao/default.nix b/pkgs/tools/cd-dvd/cdrdao/default.nix
index 5f9c0ca5073e..20a60e9d2db5 100644
--- a/pkgs/tools/cd-dvd/cdrdao/default.nix
+++ b/pkgs/tools/cd-dvd/cdrdao/default.nix
@@ -8,8 +8,6 @@
   libvorbis,
   libmad,
   libao,
-  CoreServices,
-  IOKit,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -31,17 +29,12 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      libiconv
-      libvorbis
-      libmad
-      libao
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CoreServices
-      IOKit
-    ];
+  buildInputs = [
+    libiconv
+    libvorbis
+    libmad
+    libao
+  ];
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/tools/cd-dvd/cdrtools/default.nix b/pkgs/tools/cd-dvd/cdrtools/default.nix
index d9b86e6081d4..6ac321e61fc6 100644
--- a/pkgs/tools/cd-dvd/cdrtools/default.nix
+++ b/pkgs/tools/cd-dvd/cdrtools/default.nix
@@ -5,8 +5,6 @@
   m4,
   acl,
   libcap,
-  Carbon,
-  IOKit,
 }:
 
 stdenv.mkDerivation rec {
@@ -19,17 +17,10 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ m4 ];
-  buildInputs =
-    if stdenv.hostPlatform.isDarwin then
-      [
-        Carbon
-        IOKit
-      ]
-    else
-      [
-        acl
-        libcap
-      ];
+  buildInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) [
+    acl
+    libcap
+  ];
 
   env.CFLAGS = toString [
     "-Wno-error=implicit-int"
diff --git a/pkgs/tools/compression/gzip/default.nix b/pkgs/tools/compression/gzip/default.nix
index dba0cba11815..866ce808d4f3 100644
--- a/pkgs/tools/compression/gzip/default.nix
+++ b/pkgs/tools/compression/gzip/default.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gzip";
-  version = "1.13";
+  version = "1.14";
 
   src = fetchurl {
     url = "mirror://gnu/gzip/${pname}-${version}.tar.xz";
-    hash = "sha256-dFTraTXbF8ZlVXbC4bD6vv04tNCTbg+H9IzQYs6RoFc=";
+    hash = "sha256-Aae4gb0iC/32Ffl7hxj4C9/T9q3ThbmT3Pbv0U6MCsY=";
   };
 
   outputs = [
diff --git a/pkgs/tools/filesystems/ceph/old-python-packages/cryptography.nix b/pkgs/tools/filesystems/ceph/old-python-packages/cryptography.nix
index 8cf82b0db8f1..30ae24b57afc 100644
--- a/pkgs/tools/filesystems/ceph/old-python-packages/cryptography.nix
+++ b/pkgs/tools/filesystems/ceph/old-python-packages/cryptography.nix
@@ -82,7 +82,6 @@ buildPythonPackage rec {
   buildInputs =
     [ openssl ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Security
       libiconv
     ]
     ++ lib.optionals (pythonOlder "3.9") [ libxcrypt ];
diff --git a/pkgs/tools/filesystems/ntfs-3g/default.nix b/pkgs/tools/filesystems/ntfs-3g/default.nix
index ff1347c6c7e1..0c02ede8667f 100644
--- a/pkgs/tools/filesystems/ntfs-3g/default.nix
+++ b/pkgs/tools/filesystems/ntfs-3g/default.nix
@@ -9,7 +9,6 @@
   libuuid,
   kmod,
   macfuse-stubs,
-  DiskArbitration,
   crypto ? false,
   libgcrypt,
   gnutls,
@@ -44,7 +43,6 @@ stdenv.mkDerivation rec {
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       macfuse-stubs
-      DiskArbitration
     ];
 
   # Note: libgcrypt is listed here non-optionally because its m4 macros are
diff --git a/pkgs/tools/graphics/asymptote/default.nix b/pkgs/tools/graphics/asymptote/default.nix
index 95ee6d5f141f..137ada74b3d3 100644
--- a/pkgs/tools/graphics/asymptote/default.nix
+++ b/pkgs/tools/graphics/asymptote/default.nix
@@ -32,7 +32,6 @@
   curl,
   texinfo,
   texliveSmall,
-  darwin,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -126,15 +125,7 @@ stdenv.mkDerivation (finalAttrs: {
       libGLU
       libGL
       libglvnd
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        OpenGL
-        GLUT
-        Cocoa
-      ]
-    );
+    ];
 
   dontWrapQtApps = true;
 
diff --git a/pkgs/tools/graphics/dmtx-utils/default.nix b/pkgs/tools/graphics/dmtx-utils/default.nix
index 395089f14ee6..4736c2b0418c 100644
--- a/pkgs/tools/graphics/dmtx-utils/default.nix
+++ b/pkgs/tools/graphics/dmtx-utils/default.nix
@@ -6,7 +6,6 @@
   pkg-config,
   libdmtx,
   imagemagick,
-  Foundation,
 }:
 
 stdenv.mkDerivation rec {
@@ -28,7 +27,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     libdmtx
     imagemagick
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin Foundation;
+  ];
 
   meta = {
     description = "Data matrix command-line utilities";
diff --git a/pkgs/tools/graphics/gnuplot/default.nix b/pkgs/tools/graphics/gnuplot/default.nix
index 149a0d04bd98..dd2dcaf6825f 100644
--- a/pkgs/tools/graphics/gnuplot/default.nix
+++ b/pkgs/tools/graphics/gnuplot/default.nix
@@ -24,7 +24,6 @@
   aquaterm ? false,
   withWxGTK ? false,
   wxGTK32,
-  Cocoa,
   fontconfig ? null,
   gnused ? null,
   coreutils ? null,
@@ -76,8 +75,7 @@ in
       qtbase
       qtsvg
     ]
-    ++ lib.optional withWxGTK wxGTK32
-    ++ lib.optional (withWxGTK && stdenv.hostPlatform.isDarwin) Cocoa;
+    ++ lib.optional withWxGTK wxGTK32;
 
   postPatch = ''
     # lrelease is in qttools, not in qtbase.
diff --git a/pkgs/tools/graphics/graphviz/default.nix b/pkgs/tools/graphics/graphviz/default.nix
index bcd13cfff089..b73f00771c51 100644
--- a/pkgs/tools/graphics/graphviz/default.nix
+++ b/pkgs/tools/graphics/graphviz/default.nix
@@ -18,8 +18,6 @@
   bash,
   bison,
   xorg,
-  ApplicationServices,
-  Foundation,
   python3,
   withXorg ? true,
 
@@ -52,22 +50,16 @@ stdenv.mkDerivation rec {
     flex
   ];
 
-  buildInputs =
-    [
-      libpng
-      libjpeg
-      expat
-      fontconfig
-      gd
-      gts
-      pango
-      bash
-    ]
-    ++ optionals withXorg (with xorg; [ libXrender ])
-    ++ optionals stdenv.hostPlatform.isDarwin [
-      ApplicationServices
-      Foundation
-    ];
+  buildInputs = [
+    libpng
+    libjpeg
+    expat
+    fontconfig
+    gd
+    gts
+    pango
+    bash
+  ] ++ optionals withXorg (with xorg; [ libXrender ]);
 
   hardeningDisable = [ "fortify" ];
 
diff --git a/pkgs/tools/graphics/pfstools/default.nix b/pkgs/tools/graphics/pfstools/default.nix
index cca813af3c22..43b9bdb9f8e7 100644
--- a/pkgs/tools/graphics/pfstools/default.nix
+++ b/pkgs/tools/graphics/pfstools/default.nix
@@ -5,7 +5,6 @@
   fetchurl,
   cmake,
   pkg-config,
-  darwin,
   openexr,
   zlib,
   imagemagick6,
@@ -68,19 +67,11 @@ mkDerivation rec {
       qtbase
       netpbm
     ]
-    ++ (
-      if stdenv.hostPlatform.isDarwin then
-        (with darwin.apple_sdk.frameworks; [
-          OpenGL
-          GLUT
-        ])
-      else
-        [
-          libGLU
-          libGL
-          libglut
-        ]
-    )
+    ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
+      libGLU
+      libGL
+      libglut
+    ]
     ++ lib.optional enableUnfree (opencv.override { enableUnfree = true; });
 
   patches = [
diff --git a/pkgs/tools/graphics/vulkan-tools/default.nix b/pkgs/tools/graphics/vulkan-tools/default.nix
index 47062e768673..fdb590743974 100644
--- a/pkgs/tools/graphics/vulkan-tools/default.nix
+++ b/pkgs/tools/graphics/vulkan-tools/default.nix
@@ -20,8 +20,6 @@
   wayland-protocols,
   wayland-scanner,
   moltenvk,
-  AppKit,
-  Cocoa,
 }:
 
 stdenv.mkDerivation rec {
@@ -64,8 +62,6 @@ stdenv.mkDerivation rec {
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       moltenvk
       moltenvk.dev
-      AppKit
-      Cocoa
     ];
 
   libraryPath = lib.strings.makeLibraryPath [ vulkan-loader ];
diff --git a/pkgs/tools/graphics/waifu2x-converter-cpp/default.nix b/pkgs/tools/graphics/waifu2x-converter-cpp/default.nix
index 1464e0b0beb2..51f5552c970b 100644
--- a/pkgs/tools/graphics/waifu2x-converter-cpp/default.nix
+++ b/pkgs/tools/graphics/waifu2x-converter-cpp/default.nix
@@ -7,7 +7,6 @@
   stdenv,
   ocl-icd,
   opencl-headers,
-  OpenCL,
   config,
   cudaSupport ? config.cudaSupport,
   cudatoolkit ? null,
@@ -34,7 +33,6 @@ stdenv.mkDerivation rec {
       opencv4
     ]
     ++ lib.optional cudaSupport cudatoolkit
-    ++ lib.optional stdenv.hostPlatform.isDarwin OpenCL
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       ocl-icd
       opencl-headers
diff --git a/pkgs/tools/graphics/zbar/default.nix b/pkgs/tools/graphics/zbar/default.nix
index ce7968e11131..c899421687eb 100644
--- a/pkgs/tools/graphics/zbar/default.nix
+++ b/pkgs/tools/graphics/zbar/default.nix
@@ -25,7 +25,6 @@
   enableDbus ? false,
   libintl,
   libiconv,
-  Foundation,
   bash,
   python3,
   argp-standalone,
@@ -84,7 +83,6 @@ stdenv.mkDerivation rec {
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       libiconv
-      Foundation
     ]
     ++ lib.optionals enableDbus [
       dbus
diff --git a/pkgs/tools/misc/android-tools/default.nix b/pkgs/tools/misc/android-tools/default.nix
index b65590e13d65..5b1da766216c 100644
--- a/pkgs/tools/misc/android-tools/default.nix
+++ b/pkgs/tools/misc/android-tools/default.nix
@@ -8,7 +8,7 @@
   perl,
   go,
   python3,
-  protobuf,
+  protobuf_29, # does not build with 30+
   zlib,
   gtest,
   brotli,
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     go
   ];
   buildInputs = [
-    protobuf
+    protobuf_29
     zlib
     gtest
     brotli
diff --git a/pkgs/tools/misc/aoc-cli/default.nix b/pkgs/tools/misc/aoc-cli/default.nix
index b0c7c615cfaf..f63e2586bc79 100644
--- a/pkgs/tools/misc/aoc-cli/default.nix
+++ b/pkgs/tools/misc/aoc-cli/default.nix
@@ -1,11 +1,9 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitHub,
   pkg-config,
   openssl,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -21,7 +19,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ openssl ] ++ lib.optional stdenv.hostPlatform.isDarwin Security;
+  buildInputs = [ openssl ];
 
   useFetchCargoVendor = true;
   cargoHash = "sha256-cm8yt7PRjar21EVFIjXYgDkO7+VpHGIB3tJ8hkK+Phw=";
diff --git a/pkgs/tools/misc/apkeep/default.nix b/pkgs/tools/misc/apkeep/default.nix
index de68610e76a0..e95face53a8d 100644
--- a/pkgs/tools/misc/apkeep/default.nix
+++ b/pkgs/tools/misc/apkeep/default.nix
@@ -1,12 +1,9 @@
 {
   lib,
-  stdenv,
   fetchCrate,
   rustPlatform,
   openssl,
   pkg-config,
-  Security,
-  SystemConfiguration,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -29,14 +26,9 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Security
-      SystemConfiguration
-    ];
+  buildInputs = [
+    openssl
+  ];
 
   meta = with lib; {
     description = "Command-line tool for downloading APK files from various sources";
diff --git a/pkgs/tools/misc/contacts/default.nix b/pkgs/tools/misc/contacts/default.nix
index 83535fb9d033..d99f0b3a8c05 100644
--- a/pkgs/tools/misc/contacts/default.nix
+++ b/pkgs/tools/misc/contacts/default.nix
@@ -3,8 +3,6 @@
   stdenv,
   fetchFromGitHub,
   xcbuildHook,
-  Foundation,
-  AddressBook,
 }:
 
 stdenv.mkDerivation {
@@ -24,10 +22,6 @@ stdenv.mkDerivation {
   '';
 
   nativeBuildInputs = [ xcbuildHook ];
-  buildInputs = [
-    Foundation
-    AddressBook
-  ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index f87f92363eee..50750c4875b1 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -48,11 +48,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "coreutils" + (optionalString (!minimal) "-full");
-  version = "9.6";
+  version = "9.7";
 
   src = fetchurl {
     url = "mirror://gnu/coreutils/coreutils-${version}.tar.xz";
-    hash = "sha256-egEkMns5j9nrGmq95YM4mCFCLHRP+hBzSyT1V2ENMoM=";
+    hash = "sha256-6LsmrQKT+bWh/EP7QrqXDjEsZs6SwbCxZxPXUA2yUb8=";
   };
 
   postPatch =
@@ -97,6 +97,9 @@ stdenv.mkDerivation rec {
 
       # intermittent failures on builders, unknown reason
       sed '2i echo Skipping du basic test && exit 77' -i ./tests/du/basic.sh
+
+      # fails when syscalls related to acl not being available, e.g. in sandboxed environment
+      sed '2i echo Skipping ls -al with acl test && exit 77' -i ./tests/ls/acl.sh
     ''
     + (optionalString (stdenv.hostPlatform.libc == "musl") (
       concatStringsSep "\n" [
diff --git a/pkgs/tools/misc/dijo/default.nix b/pkgs/tools/misc/dijo/default.nix
index 9ff4b4d058fa..bf716c07a46e 100644
--- a/pkgs/tools/misc/dijo/default.nix
+++ b/pkgs/tools/misc/dijo/default.nix
@@ -1,16 +1,14 @@
 {
-  stdenv,
   lib,
   rustPlatform,
   fetchFromGitHub,
   ncurses,
-  CoreServices,
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "dijo";
   version = "0.2.7";
-  buildInputs = [ ncurses ] ++ lib.optional stdenv.hostPlatform.isDarwin CoreServices;
+  buildInputs = [ ncurses ];
   src = fetchFromGitHub {
     owner = "NerdyPepper";
     repo = "dijo";
diff --git a/pkgs/tools/misc/diskus/default.nix b/pkgs/tools/misc/diskus/default.nix
index 7404b142fc00..d83b2fa79fe2 100644
--- a/pkgs/tools/misc/diskus/default.nix
+++ b/pkgs/tools/misc/diskus/default.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -17,8 +15,6 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-88+U5Y2CC0PhikRO3VqoUwZEYZjwln+61OPWbLLb8T0=";
   };
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
-
   useFetchCargoVendor = true;
   cargoHash = "sha256-keBnhE4ltOVMEuxPifiB2EAHk32u3PqaPGTeVexVXWM=";
 
diff --git a/pkgs/tools/misc/envchain/default.nix b/pkgs/tools/misc/envchain/default.nix
index cfbc7b343d1b..ef7e7d881656 100644
--- a/pkgs/tools/misc/envchain/default.nix
+++ b/pkgs/tools/misc/envchain/default.nix
@@ -7,7 +7,6 @@
   ncurses,
   pkg-config,
   readline,
-  Security,
 }:
 
 stdenv.mkDerivation rec {
@@ -35,7 +34,6 @@ stdenv.mkDerivation rec {
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       libedit
       ncurses
-      Security
     ];
 
   makeFlags = [ "DESTDIR=$(out)" ];
diff --git a/pkgs/tools/misc/fclones/default.nix b/pkgs/tools/misc/fclones/default.nix
index 3d85c7bee433..adc90020619d 100644
--- a/pkgs/tools/misc/fclones/default.nix
+++ b/pkgs/tools/misc/fclones/default.nix
@@ -3,7 +3,6 @@
   rustPlatform,
   fetchFromGitHub,
   stdenv,
-  darwin,
   installShellFiles,
 }:
 
@@ -21,9 +20,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-aEjsBhm0iPysA1Wz1Ea7rtX0g/yH/rklUkYV/Elxcq8=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk_11_0.frameworks.AppKit
-  ];
   nativeBuildInputs = [ installShellFiles ];
 
   # device::test_physical_device_name test fails on Darwin
diff --git a/pkgs/tools/misc/fclones/gui.nix b/pkgs/tools/misc/fclones/gui.nix
index 5eeac952d277..c68950e1848b 100644
--- a/pkgs/tools/misc/fclones/gui.nix
+++ b/pkgs/tools/misc/fclones/gui.nix
@@ -7,8 +7,6 @@
   gdk-pixbuf,
   gtk4,
   libadwaita,
-  stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -30,15 +28,11 @@ rustPlatform.buildRustPackage rec {
     wrapGAppsHook4
   ];
 
-  buildInputs =
-    [
-      gdk-pixbuf
-      gtk4
-      libadwaita
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk_11_0.frameworks.IOKit
-    ];
+  buildInputs = [
+    gdk-pixbuf
+    gtk4
+    libadwaita
+  ];
 
   postInstall = ''
     substituteInPlace snap/gui/fclones-gui.desktop \
diff --git a/pkgs/tools/misc/ffsend/default.nix b/pkgs/tools/misc/ffsend/default.nix
index 5ec56de3c064..062fa92567a5 100644
--- a/pkgs/tools/misc/ffsend/default.nix
+++ b/pkgs/tools/misc/ffsend/default.nix
@@ -7,8 +7,6 @@
   pkg-config,
   openssl,
   installShellFiles,
-  Security,
-  AppKit,
 
   x11Support ? stdenv.hostPlatform.isLinux || stdenv.hostPlatform.isBSD,
   xclip ? null,
@@ -70,14 +68,7 @@ rustPlatform.buildRustPackage rec {
   nativeBuildInputs = [
     installShellFiles
   ] ++ lib.optionals stdenv.hostPlatform.isLinux [ pkg-config ];
-  buildInputs =
-    if stdenv.hostPlatform.isDarwin then
-      [
-        Security
-        AppKit
-      ]
-    else
-      [ openssl ];
+  buildInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) [ openssl ];
 
   preBuild = lib.optionalString (x11Support && usesX11) (
     if preferXsel && xsel != null then
diff --git a/pkgs/tools/misc/flowgger/default.nix b/pkgs/tools/misc/flowgger/default.nix
index 21713f24ce79..bc98069621dd 100644
--- a/pkgs/tools/misc/flowgger/default.nix
+++ b/pkgs/tools/misc/flowgger/default.nix
@@ -1,12 +1,10 @@
 {
   lib,
   rustPlatform,
-  stdenv,
   fetchCrate,
   pkg-config,
   openssl,
   capnproto,
-  CoreServices,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -26,7 +24,7 @@ rustPlatform.buildRustPackage rec {
     capnproto
   ];
 
-  buildInputs = [ openssl ] ++ lib.optional stdenv.hostPlatform.isDarwin CoreServices;
+  buildInputs = [ openssl ];
 
   checkFlags = [
     # test failed
diff --git a/pkgs/tools/misc/fondu/default.nix b/pkgs/tools/misc/fondu/default.nix
index d51d09a469ca..e13ce1b4920f 100644
--- a/pkgs/tools/misc/fondu/default.nix
+++ b/pkgs/tools/misc/fondu/default.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  CoreServices,
 }:
 
 stdenv.mkDerivation rec {
@@ -18,8 +17,6 @@ stdenv.mkDerivation rec {
     substituteInPlace Makefile --replace /System/Library/Frameworks/CoreServices.framework/CoreServices "-framework CoreServices"
   '';
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ CoreServices ];
-
   makeFlags = [ "DESTDIR=$(out)" ];
 
   hardeningDisable = [ "fortify" ];
diff --git a/pkgs/tools/misc/freshfetch/default.nix b/pkgs/tools/misc/freshfetch/default.nix
index eb7799428958..850dc742e840 100644
--- a/pkgs/tools/misc/freshfetch/default.nix
+++ b/pkgs/tools/misc/freshfetch/default.nix
@@ -2,12 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  AppKit,
-  CoreFoundation,
-  DiskArbitration,
-  Foundation,
-  IOKit,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -27,14 +21,6 @@ rustPlatform.buildRustPackage rec {
   # freshfetch depends on rust nightly features
   RUSTC_BOOTSTRAP = 1;
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    AppKit
-    CoreFoundation
-    DiskArbitration
-    Foundation
-    IOKit
-  ];
-
   meta = with lib; {
     description = "Fresh take on neofetch";
     homepage = "https://github.com/k4rakara/freshfetch";
diff --git a/pkgs/tools/misc/fwup/default.nix b/pkgs/tools/misc/fwup/default.nix
index 1b434c71aea8..08b2e2c6937a 100644
--- a/pkgs/tools/misc/fwup/default.nix
+++ b/pkgs/tools/misc/fwup/default.nix
@@ -3,7 +3,6 @@
   lib,
   fetchFromGitHub,
   autoreconfHook,
-  DiskArbitration,
   pkg-config,
   bzip2,
   libarchive,
@@ -36,18 +35,14 @@ stdenv.mkDerivation rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      bzip2
-      libarchive
-      libconfuse
-      libsodium
-      xz
-      zlib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      DiskArbitration
-    ];
+  buildInputs = [
+    bzip2
+    libarchive
+    libconfuse
+    libsodium
+    xz
+    zlib
+  ];
 
   propagatedBuildInputs =
     [
diff --git a/pkgs/tools/misc/grex/default.nix b/pkgs/tools/misc/grex/default.nix
index b302e7c4fbe5..9cc22a265e50 100644
--- a/pkgs/tools/misc/grex/default.nix
+++ b/pkgs/tools/misc/grex/default.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,8 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-OsK6X7qwMMQ1FK3JE98J2u6pn6AixE8izFmxUVDs5GM=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
-
   doInstallCheck = true;
   installCheckPhase = ''
     $out/bin/grex --help > /dev/null
diff --git a/pkgs/tools/misc/hyperfine/default.nix b/pkgs/tools/misc/hyperfine/default.nix
index 79859ce7f990..6b2f2b68e900 100644
--- a/pkgs/tools/misc/hyperfine/default.nix
+++ b/pkgs/tools/misc/hyperfine/default.nix
@@ -3,8 +3,6 @@
   rustPlatform,
   fetchFromGitHub,
   installShellFiles,
-  stdenv,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -22,7 +20,6 @@ rustPlatform.buildRustPackage rec {
   cargoHash = "sha256-eZpGqkowp/R//RqLRk3AIbTpW3i9e+lOWpfdli7S4uE=";
 
   nativeBuildInputs = [ installShellFiles ];
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin Security;
 
   postInstall = ''
     installManPage doc/hyperfine.1
diff --git a/pkgs/tools/misc/iay/default.nix b/pkgs/tools/misc/iay/default.nix
index d30f38d3d4fc..ed75f91ce418 100644
--- a/pkgs/tools/misc/iay/default.nix
+++ b/pkgs/tools/misc/iay/default.nix
@@ -5,10 +5,6 @@
   rustPlatform,
   openssl,
   pkg-config,
-  AppKit,
-  Cocoa,
-  Foundation,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -27,16 +23,9 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AppKit
-      Cocoa
-      Foundation
-      Security
-    ];
+  buildInputs = [
+    openssl
+  ];
 
   NIX_LDFLAGS = lib.optionals stdenv.hostPlatform.isDarwin [
     "-framework"
diff --git a/pkgs/tools/misc/lighthouse-steamvr/default.nix b/pkgs/tools/misc/lighthouse-steamvr/default.nix
index 9979cd0dc2a9..775a22a16c3f 100644
--- a/pkgs/tools/misc/lighthouse-steamvr/default.nix
+++ b/pkgs/tools/misc/lighthouse-steamvr/default.nix
@@ -1,11 +1,9 @@
 {
-  stdenv,
   fetchFromGitHub,
   lib,
   rustPlatform,
   pkg-config,
   dbus,
-  AppKit,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -24,7 +22,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ dbus ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ AppKit ];
+  buildInputs = [ dbus ];
 
   meta = with lib; {
     description = "VR Lighthouse power state management";
diff --git a/pkgs/tools/misc/lorri/default.nix b/pkgs/tools/misc/lorri/default.nix
index a0febe773a63..340cb69988bc 100644
--- a/pkgs/tools/misc/lorri/default.nix
+++ b/pkgs/tools/misc/lorri/default.nix
@@ -1,14 +1,11 @@
 {
   lib,
-  stdenv,
   pkgs,
   rustPackages,
   fetchFromGitHub,
   rustPlatform,
   writers,
   nixosTests,
-  CoreServices,
-  Security,
 }:
 
 let
@@ -45,10 +42,6 @@ in
   RUN_TIME_CLOSURE = pkgs.callPackage ./runtime.nix { };
 
   nativeBuildInputs = [ rustPackages.rustfmt ];
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    CoreServices
-    Security
-  ];
 
   # copy the docs to the $man and $doc outputs
   postInstall = ''
diff --git a/pkgs/tools/misc/minicom/default.nix b/pkgs/tools/misc/minicom/default.nix
index 54b4fd6f93d7..a4252e97065e 100644
--- a/pkgs/tools/misc/minicom/default.nix
+++ b/pkgs/tools/misc/minicom/default.nix
@@ -8,7 +8,6 @@
   lrzsz,
   ncurses,
   libiconv,
-  IOKit,
 }:
 
 stdenv.mkDerivation rec {
@@ -27,7 +26,6 @@ stdenv.mkDerivation rec {
     [ ncurses ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       libiconv
-      IOKit
     ];
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/misc/octofetch/default.nix b/pkgs/tools/misc/octofetch/default.nix
index e3fbe0415d41..516ea40f1317 100644
--- a/pkgs/tools/misc/octofetch/default.nix
+++ b/pkgs/tools/misc/octofetch/default.nix
@@ -5,7 +5,6 @@
   openssl,
   pkg-config,
   rustPlatform,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -24,9 +23,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ openssl ];
 
   meta = with lib; {
     homepage = "https://github.com/azur1s/octofetch";
diff --git a/pkgs/tools/misc/owofetch/default.nix b/pkgs/tools/misc/owofetch/default.nix
index f850a9ad6949..7647a0712e4d 100644
--- a/pkgs/tools/misc/owofetch/default.nix
+++ b/pkgs/tools/misc/owofetch/default.nix
@@ -3,8 +3,6 @@
   stdenvNoCC,
   rustPlatform,
   fetchFromGitHub,
-  Foundation,
-  DiskArbitration,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -22,11 +20,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-0ON1h8+ruLOvBR7Q/hOIW6j+BjfPAAuYA2wrUYj59Ow=";
 
-  buildInputs = lib.optionals stdenvNoCC.hostPlatform.isDarwin [
-    Foundation
-    DiskArbitration
-  ];
-
   meta = with lib; {
     description = "Alternative to *fetch, uwuifies all stats";
     homepage = "https://github.com/netthier/owofetch-rs";
diff --git a/pkgs/tools/misc/rust-motd/default.nix b/pkgs/tools/misc/rust-motd/default.nix
index 54ffb7caf835..e45e0f090f6c 100644
--- a/pkgs/tools/misc/rust-motd/default.nix
+++ b/pkgs/tools/misc/rust-motd/default.nix
@@ -4,8 +4,6 @@
   fetchFromGitHub,
   pkg-config,
   openssl,
-  stdenv,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -26,13 +24,9 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Security
-    ];
+  buildInputs = [
+    openssl
+  ];
 
   OPENSSL_NO_VENDOR = 1;
 
diff --git a/pkgs/tools/misc/screen/default.nix b/pkgs/tools/misc/screen/default.nix
index 5079345becfd..77cad786f9d3 100644
--- a/pkgs/tools/misc/screen/default.nix
+++ b/pkgs/tools/misc/screen/default.nix
@@ -5,7 +5,6 @@
   autoreconfHook,
   ncurses,
   libxcrypt,
-  utmp,
   pam ? null,
 }:
 
@@ -40,7 +39,7 @@ stdenv.mkDerivation rec {
     ncurses
     libxcrypt
     pam
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin utmp;
+  ];
 
   # The test suite seems to have some glibc malloc hooks that don't exist/link on macOS
   # With pkgsLLVM: tests/test-winmsgcond.c:53: assertion 'wmc_end(&wmc, pos + 1, &chg) == pos' failed
diff --git a/pkgs/tools/misc/shadowenv/default.nix b/pkgs/tools/misc/shadowenv/default.nix
index c4e787f1d503..b9cb01474888 100644
--- a/pkgs/tools/misc/shadowenv/default.nix
+++ b/pkgs/tools/misc/shadowenv/default.nix
@@ -1,10 +1,8 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
   installShellFiles,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -23,8 +21,6 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
-
   postInstall = ''
     installManPage man/man1/shadowenv.1
     installManPage man/man5/shadowlisp.5
diff --git a/pkgs/tools/misc/sheldon/default.nix b/pkgs/tools/misc/sheldon/default.nix
index fec1bdb3e5b0..fa13c5fcb0e7 100644
--- a/pkgs/tools/misc/sheldon/default.nix
+++ b/pkgs/tools/misc/sheldon/default.nix
@@ -6,7 +6,6 @@
   pkg-config,
   openssl,
   installShellFiles,
-  Security,
   curl,
 }:
 
@@ -27,7 +26,6 @@ rustPlatform.buildRustPackage rec {
   buildInputs =
     [ openssl ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Security
       curl
     ];
   nativeBuildInputs = [
diff --git a/pkgs/tools/misc/sshx/default.nix b/pkgs/tools/misc/sshx/default.nix
index 8529f3983ba5..1f3432979f5f 100644
--- a/pkgs/tools/misc/sshx/default.nix
+++ b/pkgs/tools/misc/sshx/default.nix
@@ -4,8 +4,6 @@
   rustPlatform,
   fetchFromGitHub,
   protobuf,
-  darwin,
-  stdenv,
   buildNpmPackage,
 }:
 let
@@ -33,8 +31,6 @@ let
 
         nativeBuildInputs = [ protobuf ];
 
-        buildInputs = lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.frameworks.Security;
-
         cargoBuildFlags = [
           "--package"
           pname
diff --git a/pkgs/tools/misc/synth/default.nix b/pkgs/tools/misc/synth/default.nix
index 9dd4cb6ff039..b6f061f4647e 100644
--- a/pkgs/tools/misc/synth/default.nix
+++ b/pkgs/tools/misc/synth/default.nix
@@ -2,9 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  AppKit,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -21,11 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-sJSU85f4bLh89qo8fojWJNfJ9t7i/Hlg5pnLcxcwKt4=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    AppKit
-    Security
-  ];
-
   checkFlags = [
     # https://github.com/shuttle-hq/synth/issues/309
     "--skip=docs_blog_2021_08_31_seeding_databases_tutorial_dot_md"
diff --git a/pkgs/tools/misc/tab-rs/default.nix b/pkgs/tools/misc/tab-rs/default.nix
index 7d5d1a906ff0..3469d56bc7e1 100644
--- a/pkgs/tools/misc/tab-rs/default.nix
+++ b/pkgs/tools/misc/tab-rs/default.nix
@@ -3,7 +3,6 @@
   stdenv,
   fetchFromGitHub,
   rustPlatform,
-  IOKit,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,8 +19,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-4bscAhYE3JNk4ikTH+Sw2kGDDsBWcCZZ88weg9USjC0=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ IOKit ];
-
   # many tests are failing
   doCheck = false;
 
diff --git a/pkgs/tools/misc/timidity/default.nix b/pkgs/tools/misc/timidity/default.nix
index a6c2349bef13..68d5a23b3474 100644
--- a/pkgs/tools/misc/timidity/default.nix
+++ b/pkgs/tools/misc/timidity/default.nix
@@ -4,8 +4,6 @@
   fetchurl,
   nixosTests,
   pkg-config,
-  CoreAudio,
-  libobjc,
   libjack2,
   ncurses,
   alsa-lib,
@@ -46,10 +44,6 @@ stdenv.mkDerivation rec {
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       alsa-lib
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CoreAudio
-      libobjc
-    ]
     ++ lib.optionals enableVorbis [
       libvorbis
     ];
diff --git a/pkgs/tools/misc/tmux-sessionizer/default.nix b/pkgs/tools/misc/tmux-sessionizer/default.nix
index 37bfd5a8aa8e..d95e7d74c1f9 100644
--- a/pkgs/tools/misc/tmux-sessionizer/default.nix
+++ b/pkgs/tools/misc/tmux-sessionizer/default.nix
@@ -5,7 +5,6 @@
   rustPlatform,
   openssl,
   pkg-config,
-  Security,
   testers,
   tmux-sessionizer,
   installShellFiles,
@@ -42,7 +41,7 @@ rustPlatform.buildRustPackage {
     pkg-config
     installShellFiles
   ];
-  buildInputs = [ openssl ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
+  buildInputs = [ openssl ];
 
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd tms \
diff --git a/pkgs/tools/misc/toastify/default.nix b/pkgs/tools/misc/toastify/default.nix
index a95122afbeef..7271aa6834c9 100644
--- a/pkgs/tools/misc/toastify/default.nix
+++ b/pkgs/tools/misc/toastify/default.nix
@@ -3,7 +3,6 @@
   rustPlatform,
   fetchFromGitHub,
   stdenv,
-  darwin,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,10 +19,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-xnmns0YXsKuoNxxax3St5pLiFwu6BD0iIYHNi9N9mO0=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk_11_0.frameworks.Cocoa
-  ];
-
   preBuild = lib.optionalString stdenv.hostPlatform.isDarwin ''
     export HOME=$(mktemp -d)
   '';
diff --git a/pkgs/tools/misc/topgrade/default.nix b/pkgs/tools/misc/topgrade/default.nix
index e445c7668a83..099046b2001f 100644
--- a/pkgs/tools/misc/topgrade/default.nix
+++ b/pkgs/tools/misc/topgrade/default.nix
@@ -3,9 +3,6 @@
   lib,
   fetchFromGitHub,
   rustPlatform,
-  AppKit,
-  Cocoa,
-  Foundation,
   installShellFiles,
 }:
 
@@ -27,12 +24,6 @@ rustPlatform.buildRustPackage rec {
     installShellFiles
   ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    AppKit
-    Cocoa
-    Foundation
-  ];
-
   env.NIX_CFLAGS_COMPILE = toString (
     lib.optionals stdenv.hostPlatform.isDarwin [
       "-framework"
diff --git a/pkgs/tools/misc/tremor-rs/default.nix b/pkgs/tools/misc/tremor-rs/default.nix
index 3d53fe0b43bb..3a2d425fe376 100644
--- a/pkgs/tools/misc/tremor-rs/default.nix
+++ b/pkgs/tools/misc/tremor-rs/default.nix
@@ -7,7 +7,6 @@
   fetchFromGitHub,
   installShellFiles,
   stdenv,
-  Security,
   libiconv,
   protobuf,
 }:
@@ -36,7 +35,6 @@ rustPlatform.buildRustPackage rec {
   buildInputs =
     [ openssl ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Security
       libiconv
     ];
 
diff --git a/pkgs/tools/misc/wagyu/default.nix b/pkgs/tools/misc/wagyu/default.nix
index b711e6d8ca9a..c40d2add083c 100644
--- a/pkgs/tools/misc/wagyu/default.nix
+++ b/pkgs/tools/misc/wagyu/default.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitHub,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -22,8 +20,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-vtNxRW/b8kvy21YQezCUiZNtLnlMSkdTRr/OkGy6UAw=";
 
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin Security;
-
   meta = with lib; {
     description = "Rust library for generating cryptocurrency wallets";
     homepage = "https://github.com/AleoHQ/wagyu";
diff --git a/pkgs/tools/misc/watchexec/default.nix b/pkgs/tools/misc/watchexec/default.nix
index 581ac08c5bd6..dd36d8e84617 100644
--- a/pkgs/tools/misc/watchexec/default.nix
+++ b/pkgs/tools/misc/watchexec/default.nix
@@ -3,8 +3,6 @@
   stdenv,
   rustPlatform,
   fetchFromGitHub,
-  Cocoa,
-  AppKit,
   installShellFiles,
 }:
 
@@ -24,11 +22,6 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    Cocoa
-    AppKit
-  ];
-
   NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-framework AppKit";
 
   checkFlags = [
diff --git a/pkgs/tools/networking/aria2/default.nix b/pkgs/tools/networking/aria2/default.nix
index c625d37362fc..ee98ae99d934 100644
--- a/pkgs/tools/networking/aria2/default.nix
+++ b/pkgs/tools/networking/aria2/default.nix
@@ -12,7 +12,6 @@
   libssh2,
   cppunit,
   sphinx,
-  Security,
   nixosTests,
 }:
 
@@ -41,7 +40,7 @@ stdenv.mkDerivation rec {
     sqlite
     zlib
     libssh2
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin Security;
+  ];
 
   outputs = [
     "bin"
diff --git a/pkgs/tools/networking/bitmask-vpn/default.nix b/pkgs/tools/networking/bitmask-vpn/default.nix
index bd7b819ecfea..e5d772e27798 100644
--- a/pkgs/tools/networking/bitmask-vpn/default.nix
+++ b/pkgs/tools/networking/bitmask-vpn/default.nix
@@ -21,8 +21,6 @@
   qtsvg,
   qttools,
   qtwayland,
-  CoreFoundation,
-  Security,
   provider ? "riseup",
 }:
 let
@@ -121,17 +119,11 @@ buildGoModule rec {
     qtsvg
   ];
 
-  buildInputs =
-    [
-      qtbase
-      qtdeclarative
-      qtsvg
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      CoreFoundation
-      Security
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [ qtwayland ];
+  buildInputs = [
+    qtbase
+    qtdeclarative
+    qtsvg
+  ] ++ lib.optionals stdenv.hostPlatform.isLinux [ qtwayland ];
 
   # FIXME: building on Darwin currently fails
   # due to missing debug symbols for Qt,
diff --git a/pkgs/tools/networking/bore-cli/default.nix b/pkgs/tools/networking/bore-cli/default.nix
index fcca3ed8e954..0c1d01f877b7 100644
--- a/pkgs/tools/networking/bore-cli/default.nix
+++ b/pkgs/tools/networking/bore-cli/default.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitHub,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,10 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-uaSnH3pLpgASjauNWE94cpLxeAmVPqa/VUksR12hnGM=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    Security
-  ];
-
   # tests do not find grcov path correctly
   meta = with lib; {
     description = "Rust tool to create TCP tunnels";
diff --git a/pkgs/tools/networking/bore/default.nix b/pkgs/tools/networking/bore/default.nix
index fdc69871baf6..6b1c58f072a2 100644
--- a/pkgs/tools/networking/bore/default.nix
+++ b/pkgs/tools/networking/bore/default.nix
@@ -3,8 +3,6 @@
   stdenv,
   rustPlatform,
   fetchFromBitbucket,
-  Libsystem,
-  SystemConfiguration,
   installShellFiles,
 }:
 
@@ -40,11 +38,6 @@ rustPlatform.buildRustPackage rec {
     installShellFiles
   ] ++ lib.optional stdenv.hostPlatform.isDarwin rustPlatform.bindgenHook;
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    Libsystem
-    SystemConfiguration
-  ];
-
   postInstall = ''
     installManPage $src/bore/doc/bore.1
   '';
diff --git a/pkgs/tools/networking/cocom/default.nix b/pkgs/tools/networking/cocom/default.nix
index 98f837cf0bba..0e3d79ec2d32 100644
--- a/pkgs/tools/networking/cocom/default.nix
+++ b/pkgs/tools/networking/cocom/default.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,8 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-kfseD0dYNC1IFAamLJee7LozGppE2mZgBMCUHJC0dP4=";
 
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin Security;
-
   # Tests require network access
   doCheck = false;
 
diff --git a/pkgs/tools/networking/davix/default.nix b/pkgs/tools/networking/davix/default.nix
index 4709b57656f1..dd29f9f561b0 100644
--- a/pkgs/tools/networking/davix/default.nix
+++ b/pkgs/tools/networking/davix/default.nix
@@ -12,7 +12,6 @@
   curl,
   gsoap,
   rapidjson,
-  Security,
   enableTools ? true,
   # Use libcurl instead of libneon
   # Note that the libneon used is bundled in the project
@@ -43,7 +42,6 @@ stdenv.mkDerivation rec {
       openssl
       rapidjson
     ]
-    ++ lib.optional stdenv.hostPlatform.isDarwin Security
     ++ lib.optional (!stdenv.hostPlatform.isDarwin) libuuid
     ++ lib.optional (enableThirdPartyCopy) gsoap;
 
diff --git a/pkgs/tools/networking/dogdns/default.nix b/pkgs/tools/networking/dogdns/default.nix
index d6075d7bb960..58775dde22a4 100644
--- a/pkgs/tools/networking/dogdns/default.nix
+++ b/pkgs/tools/networking/dogdns/default.nix
@@ -8,7 +8,6 @@
   openssl,
   just,
   pandoc,
-  Security,
 }:
 
 rustPlatform.buildRustPackage {
@@ -33,9 +32,7 @@ rustPlatform.buildRustPackage {
     just
     pandoc
   ] ++ lib.optionals stdenv.hostPlatform.isLinux [ pkg-config ];
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ openssl ];
 
   outputs = [
     "out"
diff --git a/pkgs/tools/networking/drill/default.nix b/pkgs/tools/networking/drill/default.nix
index e02263f7a3f7..348780dab757 100644
--- a/pkgs/tools/networking/drill/default.nix
+++ b/pkgs/tools/networking/drill/default.nix
@@ -5,7 +5,6 @@
   fetchFromGitHub,
   pkg-config,
   openssl,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -29,13 +28,9 @@ rustPlatform.buildRustPackage rec {
   OPENSSL_LIB_DIR = "${lib.getLib openssl}/lib";
   OPENSSL_DIR = "${lib.getDev openssl}";
 
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Security
-    ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    openssl
+  ];
 
   meta = with lib; {
     description = "HTTP load testing application inspired by Ansible syntax";
diff --git a/pkgs/tools/networking/fast-ssh/default.nix b/pkgs/tools/networking/fast-ssh/default.nix
index c8ce11fc984a..b3b64a6fea71 100644
--- a/pkgs/tools/networking/fast-ssh/default.nix
+++ b/pkgs/tools/networking/fast-ssh/default.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,8 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-qkvonLuS18BBPdBUUnIAbmA+9ZJZFmTRaewrnK9PHFE=";
 
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin Security;
-
   meta = with lib; {
     description = "TUI tool to use the SSH config for connections";
     homepage = "https://github.com/julien-r44/fast-ssh";
diff --git a/pkgs/tools/networking/ifwifi/default.nix b/pkgs/tools/networking/ifwifi/default.nix
index 3504a56c920f..83f3a240e3f1 100644
--- a/pkgs/tools/networking/ifwifi/default.nix
+++ b/pkgs/tools/networking/ifwifi/default.nix
@@ -6,7 +6,6 @@
   makeWrapper,
   networkmanager,
   iw,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -24,7 +23,6 @@ rustPlatform.buildRustPackage rec {
   cargoHash = "sha256-oxuOc9FSKYq6UjimZPLayJ+5xsWzh3gZV/mVpPbPWHk=";
 
   nativeBuildInputs = [ makeWrapper ];
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin Security;
 
   postInstall = ''
     wrapProgram "$out/bin/ifwifi" \
diff --git a/pkgs/tools/networking/innernet/default.nix b/pkgs/tools/networking/innernet/default.nix
index 19277c0d446b..52108501c237 100644
--- a/pkgs/tools/networking/innernet/default.nix
+++ b/pkgs/tools/networking/innernet/default.nix
@@ -5,7 +5,6 @@
   fetchFromGitHub,
   sqlite,
   installShellFiles,
-  Security,
   libiconv,
   innernet,
   testers,
@@ -35,7 +34,6 @@ rustPlatform.buildRustPackage rec {
       sqlite
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Security
       libiconv
     ];
 
diff --git a/pkgs/tools/networking/isync/default.nix b/pkgs/tools/networking/isync/default.nix
index 017e6dd96ada..1a0864249264 100644
--- a/pkgs/tools/networking/isync/default.nix
+++ b/pkgs/tools/networking/isync/default.nix
@@ -10,7 +10,6 @@
   zlib,
   perl538Packages,
   autoreconfHook,
-  Security,
   # Disabled by default as XOAUTH2 is an "OBSOLETE" SASL mechanism and this relies
   # on a package that isn't really maintained anymore:
   withCyrusSaslXoauth2 ? false,
@@ -48,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
     db
     cyrus_sasl
     zlib
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
+  ];
 
   postInstall = lib.optionalString withCyrusSaslXoauth2 ''
     wrapProgram "$out/bin/mbsync" \
diff --git a/pkgs/tools/networking/lldpd/default.nix b/pkgs/tools/networking/lldpd/default.nix
index 042fd3c65234..ff6ea5e3d2a7 100644
--- a/pkgs/tools/networking/lldpd/default.nix
+++ b/pkgs/tools/networking/lldpd/default.nix
@@ -1,6 +1,5 @@
 {
   stdenv,
-  Foundation,
   fetchurl,
   lib,
   libevent,
@@ -43,7 +42,7 @@ stdenv.mkDerivation rec {
     readline
     net-snmp
     openssl
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Foundation ];
+  ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/tools/networking/mozwire/default.nix b/pkgs/tools/networking/mozwire/default.nix
index 20fddf5ba910..081f399a73db 100644
--- a/pkgs/tools/networking/mozwire/default.nix
+++ b/pkgs/tools/networking/mozwire/default.nix
@@ -1,10 +1,7 @@
 {
   rustPlatform,
   lib,
-  stdenv,
   fetchFromGitHub,
-  CoreServices,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -18,11 +15,6 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-2i8C1XgfI3MXnwXZzY6n8tIcw45G9h3vZqRlFaVoLH0=";
   };
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    CoreServices
-    Security
-  ];
-
   useFetchCargoVendor = true;
   cargoHash = "sha256-UEo/CSRg1hS/BIEQTEgqfwwz1LAMDdjKwV8bDyspX7o=";
 
diff --git a/pkgs/tools/networking/ockam/default.nix b/pkgs/tools/networking/ockam/default.nix
index 2b5e8e4e7988..70d4ffc4f253 100644
--- a/pkgs/tools/networking/ockam/default.nix
+++ b/pkgs/tools/networking/ockam/default.nix
@@ -1,5 +1,4 @@
 {
-  stdenv,
   lib,
   fetchFromGitHub,
   rustPlatform,
@@ -8,8 +7,6 @@
   pkg-config,
   openssl,
   dbus,
-  AppKit,
-  Security,
 }:
 
 let
@@ -32,15 +29,10 @@ rustPlatform.buildRustPackage {
     git
     pkg-config
   ];
-  buildInputs =
-    [
-      openssl
-      dbus
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AppKit
-      Security
-    ];
+  buildInputs = [
+    openssl
+    dbus
+  ];
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/tools/networking/openconnect/common.nix b/pkgs/tools/networking/openconnect/common.nix
index 1c432ee7493d..a6520b48d858 100644
--- a/pkgs/tools/networking/openconnect/common.nix
+++ b/pkgs/tools/networking/openconnect/common.nix
@@ -17,7 +17,6 @@
   zlib,
   pcsclite,
   vpnc-scripts,
-  PCSC,
   useDefaultExternalBrowser ?
     stdenv.hostPlatform.isLinux && stdenv.buildPlatform == stdenv.hostPlatform, # xdg-utils doesn't cross-compile
   xdg-utils,
@@ -47,7 +46,6 @@ stdenv.mkDerivation {
       zlib
       (if useOpenSSL then openssl else gnutls)
     ]
-    ++ lib.optional stdenv.hostPlatform.isDarwin PCSC
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       p11-kit
       pcsclite
diff --git a/pkgs/tools/networking/openconnect/default.nix b/pkgs/tools/networking/openconnect/default.nix
index 84d80d5eca41..d81fe2ef67b2 100644
--- a/pkgs/tools/networking/openconnect/default.nix
+++ b/pkgs/tools/networking/openconnect/default.nix
@@ -1,14 +1,9 @@
 {
   callPackage,
   fetchurl,
-  darwin,
 }:
 let
-  common =
-    opts:
-    callPackage (import ./common.nix opts) {
-      inherit (darwin.apple_sdk.frameworks) PCSC;
-    };
+  common = opts: callPackage (import ./common.nix opts) { };
 in
 rec {
   openconnect = common rec {
diff --git a/pkgs/tools/networking/openssh/common.nix b/pkgs/tools/networking/openssh/common.nix
index e25993483f9d..7f94a1e8408d 100644
--- a/pkgs/tools/networking/openssh/common.nix
+++ b/pkgs/tools/networking/openssh/common.nix
@@ -36,7 +36,8 @@
   withSecurityKey ? !stdenv.hostPlatform.isStatic,
   withFIDO ? stdenv.hostPlatform.isUnix && !stdenv.hostPlatform.isMusl && withSecurityKey,
   withPAM ? stdenv.hostPlatform.isLinux,
-  dsaKeysSupport ? false,
+  # Attempts to mlock the entire sshd process on startup to prevent swapping.
+  withLinuxMemlock ? stdenv.hostPlatform.isLinux,
   linkOpenssl ? true,
   isNixos ? stdenv.hostPlatform.isLinux,
 }:
@@ -106,7 +107,6 @@ stdenv.mkDerivation (finalAttrs: {
       "--with-libedit=yes"
       "--disable-strip"
       (lib.withFeature withPAM "pam")
-      (lib.enableFeature dsaKeysSupport "dsa-keys")
     ]
     ++ lib.optional (etcDir != null) "--sysconfdir=${etcDir}"
     ++ lib.optional (!withSecurityKey) "--disable-security-key"
@@ -119,6 +119,7 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optional (!linkOpenssl) "--without-openssl"
     ++ lib.optional withLdns "--with-ldns"
     ++ lib.optional stdenv.hostPlatform.isOpenBSD "--with-bsd-auth"
+    ++ lib.optional withLinuxMemlock "--with-linux-memlock-onfault"
     ++ extraConfigureFlags;
 
   ${if stdenv.hostPlatform.isStatic then "NIX_LDFLAGS" else null} =
@@ -201,6 +202,13 @@ stdenv.mkDerivation (finalAttrs: {
     "sysconfdir=\${out}/etc/ssh"
   ];
 
+  doInstallCheck = true;
+  installCheckPhase = ''
+    for binary in ssh sshd; do
+      $out/bin/$binary -V 2>&1 | grep -P "$(printf '^OpenSSH_\\Q%s\\E,' "$version")"
+    done
+  '';
+
   passthru = {
     inherit withKerberos;
     tests = {
diff --git a/pkgs/tools/networking/openssh/default.nix b/pkgs/tools/networking/openssh/default.nix
index bb06b6909478..ab020a2d4b57 100644
--- a/pkgs/tools/networking/openssh/default.nix
+++ b/pkgs/tools/networking/openssh/default.nix
@@ -7,15 +7,29 @@
 }:
 let
   common = opts: callPackage (import ./common.nix opts) { };
+
+  # Gets the correct OpenSSH URL for a given version.
+  urlFor =
+    version:
+    let
+      urlVersion =
+        {
+          # 10.0p1 was accidentally released as 10.0p2:
+          # https://www.openwall.com/lists/oss-security/2025/04/09/6
+          "10.0p2" = "10.0p1";
+        }
+        .${version} or version;
+    in
+    "mirror://openbsd/OpenSSH/portable/openssh-${urlVersion}.tar.gz";
 in
 {
   openssh = common rec {
     pname = "openssh";
-    version = "9.9p2";
+    version = "10.0p2";
 
     src = fetchurl {
-      url = "mirror://openbsd/OpenSSH/portable/openssh-${version}.tar.gz";
-      hash = "sha256-karbYD4IzChe3fll4RmdAlhfqU2ZTWyuW0Hhch4hVnM=";
+      url = urlFor version;
+      hash = "sha256-AhoucJoO30JQsSVr1anlAEEakN3avqgw7VnO+Q652Fw=";
     };
 
     extraPatches = [ ./ssh-keysign-8.5.patch ];
@@ -27,17 +41,17 @@ in
 
   openssh_hpn = common rec {
     pname = "openssh-with-hpn";
-    version = "9.9p2";
+    version = "10.0p2";
     extraDesc = " with high performance networking patches";
 
     src = fetchurl {
-      url = "mirror://openbsd/OpenSSH/portable/openssh-${version}.tar.gz";
-      hash = "sha256-karbYD4IzChe3fll4RmdAlhfqU2ZTWyuW0Hhch4hVnM=";
+      url = urlFor version;
+      hash = "sha256-AhoucJoO30JQsSVr1anlAEEakN3avqgw7VnO+Q652Fw=";
     };
 
     extraPatches =
       let
-        url = "https://raw.githubusercontent.com/freebsd/freebsd-ports/7ba88c964b6e5724eec462021d984da3989e6a08/security/openssh-portable/files/extra-patch-hpn";
+        url = "https://raw.githubusercontent.com/freebsd/freebsd-ports/dde9561b3ff73639aeebe8ec33ad52ecca0bf58d/security/openssh-portable/files/extra-patch-hpn";
       in
       [
         ./ssh-keysign-8.5.patch
@@ -48,7 +62,7 @@ in
           inherit url;
           stripLen = 1;
           excludes = [ "channels.c" ];
-          hash = "sha256-zk7t6FNzTE+8aDU4QuteR1x0W3O2gjIQmeCkTNbaUfA=";
+          hash = "sha256-0HQAacNdvqX+7CTDhkbgAyb0WbqnnH6iAYQBFh8XenA=";
         })
 
         (fetchpatch {
@@ -70,12 +84,12 @@ in
 
   openssh_gssapi = common rec {
     pname = "openssh-with-gssapi";
-    version = "9.9p2";
+    version = "10.0p2";
     extraDesc = " with GSSAPI support";
 
     src = fetchurl {
-      url = "mirror://openbsd/OpenSSH/portable/openssh-${version}.tar.gz";
-      hash = "sha256-karbYD4IzChe3fll4RmdAlhfqU2ZTWyuW0Hhch4hVnM=";
+      url = urlFor version;
+      hash = "sha256-AhoucJoO30JQsSVr1anlAEEakN3avqgw7VnO+Q652Fw=";
     };
 
     extraPatches = [
@@ -83,8 +97,8 @@ in
 
       (fetchpatch {
         name = "openssh-gssapi.patch";
-        url = "https://salsa.debian.org/ssh-team/openssh/raw/debian/1%25${version}-1/debian/patches/gssapi.patch";
-        hash = "sha256-JyOXA8Al8IFLdndJQ1LO+r4hJqtXjz1NHwOPiSAQkE8=";
+        url = "https://salsa.debian.org/ssh-team/openssh/raw/debian/1%2510.0p1-1/debian/patches/gssapi.patch";
+        hash = "sha256-7Q27tvtCY3b9evC3lbqEz4u7v5DcerjWZfhh8azIAQo=";
       })
     ];
 
diff --git a/pkgs/tools/networking/s3rs/default.nix b/pkgs/tools/networking/s3rs/default.nix
index 3a09bee66c52..fa40ad221611 100644
--- a/pkgs/tools/networking/s3rs/default.nix
+++ b/pkgs/tools/networking/s3rs/default.nix
@@ -1,11 +1,9 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   python3,
   perl,
   openssl,
-  Security,
   fetchFromGitHub,
   pkg-config,
 }:
@@ -29,7 +27,7 @@ rustPlatform.buildRustPackage rec {
     perl
     pkg-config
   ];
-  buildInputs = [ openssl ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
+  buildInputs = [ openssl ];
 
   meta = with lib; {
     description = "S3 cli client with multi configs with diffent provider";
diff --git a/pkgs/tools/networking/suckit/default.nix b/pkgs/tools/networking/suckit/default.nix
index 8cbbefeab601..af8db72d3c13 100644
--- a/pkgs/tools/networking/suckit/default.nix
+++ b/pkgs/tools/networking/suckit/default.nix
@@ -4,8 +4,6 @@
   fetchFromGitHub,
   pkg-config,
   openssl,
-  stdenv,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -24,7 +22,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ openssl ] ++ lib.optional stdenv.hostPlatform.isDarwin Security;
+  buildInputs = [ openssl ];
 
   # requires internet access
   checkFlags = [
diff --git a/pkgs/tools/networking/tcpreplay/default.nix b/pkgs/tools/networking/tcpreplay/default.nix
index 0f612f17d386..00a0f7d429a0 100644
--- a/pkgs/tools/networking/tcpreplay/default.nix
+++ b/pkgs/tools/networking/tcpreplay/default.nix
@@ -4,8 +4,6 @@
   fetchurl,
   libpcap,
   tcpdump,
-  Carbon,
-  CoreServices,
 }:
 
 stdenv.mkDerivation rec {
@@ -17,12 +15,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-Leeb/Wfsksqa4v+1BFbdHVP/QPP6cbQixl6AYgE8noU=";
   };
 
-  buildInputs =
-    [ libpcap ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Carbon
-      CoreServices
-    ];
+  buildInputs = [ libpcap ];
 
   configureFlags = [
     "--disable-local-libopts"
diff --git a/pkgs/tools/networking/tunnelto/default.nix b/pkgs/tools/networking/tunnelto/default.nix
index 788ea6bfbe05..4d6b2eccebac 100644
--- a/pkgs/tools/networking/tunnelto/default.nix
+++ b/pkgs/tools/networking/tunnelto/default.nix
@@ -5,7 +5,6 @@
   fetchFromGitHub,
   openssl,
   pkg-config,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -23,10 +22,7 @@ rustPlatform.buildRustPackage rec {
   cargoHash = "sha256-QXkKqEEbNEDcypErDIFarJLuIoYWOZj/9jCbslxrOXs=";
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ pkg-config ];
-  buildInputs =
-    [ ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ openssl ];
 
   meta = with lib; {
     description = "Expose your local web server to the internet with a public URL";
diff --git a/pkgs/tools/networking/veilid/default.nix b/pkgs/tools/networking/veilid/default.nix
index d6c66cc514cd..bab5c1c96643 100644
--- a/pkgs/tools/networking/veilid/default.nix
+++ b/pkgs/tools/networking/veilid/default.nix
@@ -1,8 +1,5 @@
 {
   lib,
-  stdenv,
-  AppKit,
-  Security,
   fetchFromGitLab,
   rustPlatform,
   protobuf,
@@ -33,11 +30,6 @@ rustPlatform.buildRustPackage rec {
     protobuf
   ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    AppKit
-    Security
-  ];
-
   cargoBuildFlags = [
     "--workspace"
   ];
diff --git a/pkgs/tools/networking/wg-netmanager/default.nix b/pkgs/tools/networking/wg-netmanager/default.nix
index 31bb2df07c36..bd5f76c3591e 100644
--- a/pkgs/tools/networking/wg-netmanager/default.nix
+++ b/pkgs/tools/networking/wg-netmanager/default.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,8 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-LtZTfmVVUqxc9GAM6mLLmlJXBhLqnfrvBZWh0RWrR/0=";
 
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin Security;
-
   # Test 01 tries to create a wireguard interface, which requires sudo.
   doCheck = true;
   checkFlags = [
diff --git a/pkgs/tools/package-management/lix/common-lix.nix b/pkgs/tools/package-management/lix/common-lix.nix
index d8c68dd211e8..4f332142526e 100644
--- a/pkgs/tools/package-management/lix/common-lix.nix
+++ b/pkgs/tools/package-management/lix/common-lix.nix
@@ -58,7 +58,6 @@ assert lib.assertMsg (
   python3,
   pkg-config,
   rapidcheck,
-  Security,
   sqlite,
   util-linuxMinimal,
   removeReferencesTo,
@@ -182,7 +181,6 @@ stdenv.mkDerivation (finalAttrs: {
     ]
     ++ lib.optionals hasExternalLixDoc [ lix-doc ]
     ++ lib.optionals (!isLegacyParser) [ pegtl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security ]
     # NOTE(Raito): I'd have expected that the LLVM packaging would inject the
     # libunwind library path directly in the wrappers, but it does inject
     # -lunwind without injecting the library path...
diff --git a/pkgs/tools/package-management/lix/default.nix b/pkgs/tools/package-management/lix/default.nix
index c898d099fdbc..dbd778943bfc 100644
--- a/pkgs/tools/package-management/lix/default.nix
+++ b/pkgs/tools/package-management/lix/default.nix
@@ -1,16 +1,15 @@
 {
   lib,
+  stdenv,
   aws-sdk-cpp,
   boehmgc,
   callPackage,
   fetchgit,
   fetchFromGitHub,
   rustPlatform,
-  Security,
   newScope,
   editline,
   ncurses,
-  stdenv,
   clangStdenv,
   nix-direnv,
   nix-fast-build,
@@ -33,7 +32,6 @@ let
       self:
       lib.recurseIntoAttrs {
         inherit
-          Security
           storeDir
           stateDir
           confDir
diff --git a/pkgs/tools/package-management/nix-du/default.nix b/pkgs/tools/package-management/nix-du/default.nix
index 86452c61bc23..cb9ea6f585bf 100644
--- a/pkgs/tools/package-management/nix-du/default.nix
+++ b/pkgs/tools/package-management/nix-du/default.nix
@@ -1,13 +1,11 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
   nixVersions,
   nlohmann_json,
   boost,
   graphviz,
-  Security,
   pkg-config,
 }:
 
@@ -35,7 +33,7 @@ rustPlatform.buildRustPackage rec {
     boost
     nixVersions.nix_2_24
     nlohmann_json
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
+  ];
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/tools/package-management/nix-index/default.nix b/pkgs/tools/package-management/nix-index/default.nix
index de1cf8319039..e4a7c6077ba0 100644
--- a/pkgs/tools/package-management/nix-index/default.nix
+++ b/pkgs/tools/package-management/nix-index/default.nix
@@ -1,13 +1,11 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitHub,
   pkg-config,
   openssl,
   curl,
   sqlite,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -29,7 +27,7 @@ rustPlatform.buildRustPackage rec {
     openssl
     curl
     sqlite
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin Security;
+  ];
 
   postInstall = ''
     substituteInPlace command-not-found.sh \
diff --git a/pkgs/tools/package-management/nix-template/default.nix b/pkgs/tools/package-management/nix-template/default.nix
index 1f255aef6796..e81ac8de681d 100644
--- a/pkgs/tools/package-management/nix-template/default.nix
+++ b/pkgs/tools/package-management/nix-template/default.nix
@@ -8,7 +8,6 @@
   nix,
   openssl,
   pkg-config,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -32,7 +31,7 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs = [ openssl ] ++ lib.optional stdenv.hostPlatform.isDarwin Security;
+  buildInputs = [ openssl ];
 
   # needed for nix-prefetch-url
   postInstall =
diff --git a/pkgs/tools/package-management/nix/common-autoconf.nix b/pkgs/tools/package-management/nix/common-autoconf.nix
index 4500d95f6d71..01b87cddc17d 100644
--- a/pkgs/tools/package-management/nix/common-autoconf.nix
+++ b/pkgs/tools/package-management/nix/common-autoconf.nix
@@ -37,7 +37,6 @@ in
   callPackage,
   coreutils,
   curl,
-  darwin,
   docbook_xsl_ns,
   docbook5,
   editline,
@@ -67,7 +66,6 @@ in
   python3,
   pkg-config,
   rapidcheck,
-  Security,
   sqlite,
   util-linuxMinimal,
   xz,
@@ -169,9 +167,6 @@ let
       ++ lib.optionals (atLeast225 && enableDocumentation) [
         python3
       ]
-      ++ lib.optionals stdenv.hostPlatform.isDarwin [
-        Security
-      ]
       ++ lib.optionals (stdenv.hostPlatform.isx86_64) [
         libcpuid
       ]
@@ -180,9 +175,6 @@ let
       ]
       ++ lib.optionals withAWS [
         aws-sdk-cpp
-      ]
-      ++ lib.optional (atLeast224 && stdenv.hostPlatform.isDarwin) [
-        darwin.apple_sdk.libs.sandbox
       ];
 
     propagatedBuildInputs =
@@ -309,7 +301,6 @@ let
       perl-bindings = perl.pkgs.toPerlModule (
         callPackage ./nix-perl.nix {
           nix = self;
-          inherit Security;
         }
       );
 
diff --git a/pkgs/tools/package-management/nix/common-meson.nix b/pkgs/tools/package-management/nix/common-meson.nix
index f2ac615b33fa..8775feab540f 100644
--- a/pkgs/tools/package-management/nix/common-meson.nix
+++ b/pkgs/tools/package-management/nix/common-meson.nix
@@ -30,7 +30,6 @@ assert (hash == null) -> (src != null);
   callPackage,
   cmake,
   curl,
-  darwin,
   doxygen,
   editline,
   flex,
@@ -59,7 +58,6 @@ assert (hash == null) -> (src != null);
   pkg-config,
   rapidcheck,
   rsync,
-  Security,
   sqlite,
   util-linuxMinimal,
   xz,
@@ -152,9 +150,6 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optionals (lib.versionAtLeast version "2.26") [
       libblake3
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Security
-    ]
     ++ lib.optionals stdenv.hostPlatform.isx86_64 [
       libcpuid
     ]
@@ -163,9 +158,6 @@ stdenv.mkDerivation (finalAttrs: {
     ]
     ++ lib.optionals withAWS [
       aws-sdk-cpp
-    ]
-    ++ lib.optionals (stdenv.hostPlatform.isDarwin) [
-      darwin.apple_sdk.libs.sandbox
     ];
 
   propagatedBuildInputs = [
@@ -246,7 +238,6 @@ stdenv.mkDerivation (finalAttrs: {
     perl-bindings = perl.pkgs.toPerlModule (
       callPackage ./nix-perl.nix {
         nix = finalAttrs.finalPackage;
-        inherit Security;
       }
     );
 
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 3d118f98be53..713f8341f87f 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -7,7 +7,6 @@
   fetchFromGitHub,
   fetchpatch2,
   runCommand,
-  Security,
   pkgs,
   pkgsi686Linux,
   pkgsStatic,
@@ -26,7 +25,6 @@ let
       (import ./common-autoconf.nix ({ inherit lib fetchFromGitHub; } // args))
       {
         inherit
-          Security
           storeDir
           stateDir
           confDir
@@ -44,7 +42,6 @@ let
     args:
     nixDependencies.callPackage (import ./common-meson.nix ({ inherit lib fetchFromGitHub; } // args)) {
       inherit
-        Security
         storeDir
         stateDir
         confDir
diff --git a/pkgs/tools/package-management/nix/dependencies.nix b/pkgs/tools/package-management/nix/dependencies.nix
index a1a964836959..73bce4a9f04e 100644
--- a/pkgs/tools/package-management/nix/dependencies.nix
+++ b/pkgs/tools/package-management/nix/dependencies.nix
@@ -4,27 +4,10 @@ regular@{
   aws-sdk-cpp,
   fetchFromGitHub,
   pkgs,
-  stdenv,
 }:
 
-let
-  stdenv =
-    if regular.stdenv.isDarwin && regular.stdenv.isx86_64 then darwinStdenv else regular.stdenv;
-
-  # Fix the following error with the default x86_64-darwin SDK:
-  #
-  #     error: aligned allocation function of type 'void *(std::size_t, std::align_val_t)' is only available on macOS 10.13 or newer
-  #
-  # Despite the use of the 10.13 deployment target here, the aligned
-  # allocation function Clang uses with this setting actually works
-  # all the way back to 10.6.
-  darwinStdenv = regular.pkgs.overrideSDK regular.stdenv { darwinMinVersion = "10.13"; };
-in
-
 {
   scopeFunction = scope: {
-    inherit stdenv;
-
     boehmgc = regular.boehmgc.override { enableLargeConfig = true; };
 
     # old nix fails to build with newer aws-sdk-cpp and the patch doesn't apply
diff --git a/pkgs/tools/package-management/nix/modular/src/libstore/package.nix b/pkgs/tools/package-management/nix/modular/src/libstore/package.nix
index 63ea2c743687..e005000a737b 100644
--- a/pkgs/tools/package-management/nix/modular/src/libstore/package.nix
+++ b/pkgs/tools/package-management/nix/modular/src/libstore/package.nix
@@ -4,7 +4,6 @@
   mkMesonLibrary,
 
   unixtools,
-  darwin,
 
   nix-util,
   boost,
@@ -39,7 +38,6 @@ mkMesonLibrary (finalAttrs: {
     ]
     ++ lib.optional stdenv.hostPlatform.isLinux libseccomp
     # There have been issues building these dependencies
-    ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.libs.sandbox
     ++ lib.optional (
       stdenv.hostPlatform == stdenv.buildPlatform && (stdenv.isLinux || stdenv.isDarwin)
     ) aws-sdk-cpp;
diff --git a/pkgs/tools/package-management/nix/nix-perl.nix b/pkgs/tools/package-management/nix/nix-perl.nix
index f3b42e4c7c2e..38478c79c0d7 100644
--- a/pkgs/tools/package-management/nix/nix-perl.nix
+++ b/pkgs/tools/package-management/nix/nix-perl.nix
@@ -10,7 +10,6 @@
   autoreconfHook,
   autoconf-archive,
   xz,
-  Security,
   meson,
   ninja,
   bzip2,
@@ -47,18 +46,15 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail 'config-store.hh' 'nix/config.h'
   '';
 
-  buildInputs =
-    [
-      boost
-      bzip2
-      curl
-      libsodium
-      nix
-      perl
-      xz
-    ]
-    ++ lib.optional (stdenv.hostPlatform.isDarwin) Security
-    ++ lib.optional atLeast226 libarchive;
+  buildInputs = [
+    boost
+    bzip2
+    curl
+    libsodium
+    nix
+    perl
+    xz
+  ] ++ lib.optional atLeast226 libarchive;
 
   # Not cross-safe since Nix checks for curl/perl via
   # NEED_PROG/find_program, but both seem to be needed at runtime
diff --git a/pkgs/tools/security/age-plugin-ledger/default.nix b/pkgs/tools/security/age-plugin-ledger/default.nix
index 9c441ccda539..c885ff169ff8 100644
--- a/pkgs/tools/security/age-plugin-ledger/default.nix
+++ b/pkgs/tools/security/age-plugin-ledger/default.nix
@@ -1,13 +1,11 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitHub,
   pkg-config,
   libusb1,
   openssl,
   rage,
-  AppKit,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -31,7 +29,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [
     libusb1
     openssl
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin AppKit;
+  ];
 
   nativeCheckInputs = [
     rage
diff --git a/pkgs/tools/security/clamav/default.nix b/pkgs/tools/security/clamav/default.nix
index afa9701563db..6cafb20cee6e 100644
--- a/pkgs/tools/security/clamav/default.nix
+++ b/pkgs/tools/security/clamav/default.nix
@@ -15,7 +15,6 @@
   pcre2,
   libmspack,
   systemd,
-  Foundation,
   json_c,
   check,
   rustc,
@@ -50,23 +49,20 @@ stdenv.mkDerivation rec {
     cargo
     python3
   ];
-  buildInputs =
-    [
-      zlib
-      bzip2
-      libxml2
-      openssl
-      ncurses
-      curl
-      libiconv
-      libmilter
-      pcre2
-      libmspack
-      json_c
-      check
-    ]
-    ++ lib.optional stdenv.hostPlatform.isLinux systemd
-    ++ lib.optional stdenv.hostPlatform.isDarwin Foundation;
+  buildInputs = [
+    zlib
+    bzip2
+    libxml2
+    openssl
+    ncurses
+    curl
+    libiconv
+    libmilter
+    pcre2
+    libmspack
+    json_c
+    check
+  ] ++ lib.optional stdenv.hostPlatform.isLinux systemd;
 
   cmakeFlags = [
     "-DSYSTEMD_UNIT_DIR=${placeholder "out"}/lib/systemd"
diff --git a/pkgs/tools/security/cosign/default.nix b/pkgs/tools/security/cosign/default.nix
index 9c70795da08b..52de7fc557cd 100644
--- a/pkgs/tools/security/cosign/default.nix
+++ b/pkgs/tools/security/cosign/default.nix
@@ -6,7 +6,6 @@
   pcsclite,
   pkg-config,
   installShellFiles,
-  PCSC,
   pivKeySupport ? true,
   pkcs11Support ? true,
   testers,
@@ -23,9 +22,7 @@ buildGoModule (finalAttrs: {
     hash = "sha256-QvU+JpIcE9EX+ehRWvs2bS2VGgGVekNX8f5+mITIwU0=";
   };
 
-  buildInputs =
-    lib.optional (stdenv.hostPlatform.isLinux && pivKeySupport) (lib.getDev pcsclite)
-    ++ lib.optionals (stdenv.hostPlatform.isDarwin && pivKeySupport) [ PCSC ];
+  buildInputs = lib.optional (stdenv.hostPlatform.isLinux && pivKeySupport) (lib.getDev pcsclite);
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/tools/security/gnupg/24.nix b/pkgs/tools/security/gnupg/24.nix
index 80776bb58ab4..0b78165a7c26 100644
--- a/pkgs/tools/security/gnupg/24.nix
+++ b/pkgs/tools/security/gnupg/24.nix
@@ -142,7 +142,7 @@ stdenv.mkDerivation rec {
         ln -s $out/bin/gpg $out/bin/gpg2
 
         # Make libexec tools available in PATH
-        for f in $out/libexec/; do
+        for f in $out/libexec/*; do
           if [[ "$(basename $f)" == "gpg-wks-client" ]]; then continue; fi
           ln -s $f $out/bin/$(basename $f)
         done
diff --git a/pkgs/tools/security/gpg-tui/default.nix b/pkgs/tools/security/gpg-tui/default.nix
index 2d650d3ac395..042e27913b18 100644
--- a/pkgs/tools/security/gpg-tui/default.nix
+++ b/pkgs/tools/security/gpg-tui/default.nix
@@ -7,10 +7,7 @@
   libgpg-error,
   pkg-config,
   python3,
-  AppKit,
-  Foundation,
   libiconv,
-  libobjc,
   libresolv,
   x11Support ? true,
   libxcb,
@@ -48,10 +45,7 @@ rustPlatform.buildRustPackage rec {
       libxkbcommon
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      AppKit
-      Foundation
       libiconv
-      libobjc
       libresolv
     ];
 
diff --git a/pkgs/tools/security/hashcat/default.nix b/pkgs/tools/security/hashcat/default.nix
index d3eda42db806..994c6daa561a 100644
--- a/pkgs/tools/security/hashcat/default.nix
+++ b/pkgs/tools/security/hashcat/default.nix
@@ -12,10 +12,6 @@
   ocl-icd,
   xxHash,
   zlib,
-  Foundation,
-  IOKit,
-  Metal,
-  OpenCL,
   libiconv,
 }:
 
@@ -54,10 +50,6 @@ stdenv.mkDerivation rec {
       zlib
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Foundation
-      IOKit
-      Metal
-      OpenCL
       libiconv
     ];
 
diff --git a/pkgs/tools/security/kbs2/default.nix b/pkgs/tools/security/kbs2/default.nix
index 056d9699a745..22263bb8d5b5 100644
--- a/pkgs/tools/security/kbs2/default.nix
+++ b/pkgs/tools/security/kbs2/default.nix
@@ -6,8 +6,6 @@
   installShellFiles,
   python3,
   libxcb,
-  AppKit,
-  SystemConfiguration,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -26,13 +24,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ installShellFiles ] ++ lib.optionals stdenv.hostPlatform.isLinux [ python3 ];
 
-  buildInputs =
-    [ ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [ libxcb ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      SystemConfiguration
-      AppKit
-    ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ libxcb ];
 
   preCheck = ''
     export HOME=$TMPDIR
diff --git a/pkgs/tools/security/keybase/default.nix b/pkgs/tools/security/keybase/default.nix
index c58852e05ab8..cbc4e5a19fa3 100644
--- a/pkgs/tools/security/keybase/default.nix
+++ b/pkgs/tools/security/keybase/default.nix
@@ -1,17 +1,8 @@
 {
-  stdenv,
   replaceVars,
   lib,
   buildGoModule,
   fetchFromGitHub,
-  AppKit,
-  AVFoundation,
-  AudioToolbox,
-  ImageIO,
-  CoreMedia,
-  Foundation,
-  CoreGraphics,
-  MediaToolbox,
   gnupg,
 }:
 
@@ -41,17 +32,6 @@ buildGoModule rec {
       gpg2 = "${gnupg}/bin/gpg2";
     })
   ];
-
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    AppKit
-    AVFoundation
-    AudioToolbox
-    ImageIO
-    CoreMedia
-    Foundation
-    CoreGraphics
-    MediaToolbox
-  ];
   tags = [ "production" ];
   ldflags = [
     "-s"
diff --git a/pkgs/tools/security/lethe/default.nix b/pkgs/tools/security/lethe/default.nix
index c654c975eebc..182258015850 100644
--- a/pkgs/tools/security/lethe/default.nix
+++ b/pkgs/tools/security/lethe/default.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,8 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-Ky39RpLoYks4xDiheSsrUj3l/ZrGcY+y5IuDZ28pH/c=";
 
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin Security;
-
   meta = with lib; {
     description = "Tool to wipe drives in a secure way";
     homepage = "https://github.com/kostassoid/lethe";
diff --git a/pkgs/tools/security/libacr38u/default.nix b/pkgs/tools/security/libacr38u/default.nix
index c5e4ad0aca1d..a4ac9de90bd4 100644
--- a/pkgs/tools/security/libacr38u/default.nix
+++ b/pkgs/tools/security/libacr38u/default.nix
@@ -6,7 +6,6 @@
   pkg-config,
   pcsclite,
   libusb-compat-0_1,
-  IOKit,
 }:
 
 stdenv.mkDerivation {
@@ -27,7 +26,7 @@ stdenv.mkDerivation {
   buildInputs = [
     pcsclite
     libusb-compat-0_1
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin IOKit;
+  ];
 
   preBuild = ''
     makeFlagsArray=(usbdropdir="$out/pcsc/drivers");
diff --git a/pkgs/tools/security/pcsc-tools/default.nix b/pkgs/tools/security/pcsc-tools/default.nix
index 4e41a44a92ff..6b724185b9c4 100644
--- a/pkgs/tools/security/pcsc-tools/default.nix
+++ b/pkgs/tools/security/pcsc-tools/default.nix
@@ -13,7 +13,6 @@
   dbusSupport ? stdenv.hostPlatform.isLinux,
   dbus,
   pcsclite,
-  PCSC,
   wget,
   coreutils,
   perlPackages,
@@ -49,7 +48,6 @@ stdenv.mkDerivation (finalAttrs: {
       perlPackages.perl
       pcsclite
     ]
-    ++ lib.optional stdenv.hostPlatform.isDarwin PCSC
     ++ lib.optional systemdSupport systemd;
 
   nativeBuildInputs =
diff --git a/pkgs/tools/security/pcsclite/default.nix b/pkgs/tools/security/pcsclite/default.nix
index 9b01613a8082..4fd0d974e94d 100644
--- a/pkgs/tools/security/pcsclite/default.nix
+++ b/pkgs/tools/security/pcsclite/default.nix
@@ -17,8 +17,6 @@
   systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
   udevSupport ? dbusSupport,
   libusb1,
-  Foundation,
-  IOKit,
   testers,
   nix-update-script,
   pname ? "pcsclite",
@@ -110,10 +108,6 @@ stdenv.mkDerivation (finalAttrs: {
     [ python3 ]
     ++ lib.optionals systemdSupport [ systemdLibs ]
     ++ lib.optionals (!systemdSupport && udevSupport) [ udev ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Foundation
-      IOKit
-    ]
     ++ lib.optionals dbusSupport [ dbus ]
     ++ lib.optionals polkitSupport [ polkit ]
     ++ lib.optionals (!udevSupport) [ libusb1 ];
diff --git a/pkgs/tools/security/proxmark3/default.nix b/pkgs/tools/security/proxmark3/default.nix
index 877ba4a65775..6b86a9a76fd7 100644
--- a/pkgs/tools/security/proxmark3/default.nix
+++ b/pkgs/tools/security/proxmark3/default.nix
@@ -12,8 +12,6 @@
   whereami,
   lua,
   lz4,
-  Foundation,
-  AppKit,
   withGui ? true,
   wrapQtAppsHook,
   qtbase,
@@ -73,11 +71,7 @@ stdenv.mkDerivation (finalAttrs: {
     ]
     ++ lib.optional withGui qtbase
     ++ lib.optional withPython python3
-    ++ lib.optional withBlueshark bluez5
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Foundation
-      AppKit
-    ];
+    ++ lib.optional withBlueshark bluez5;
 
   makeFlags =
     [
diff --git a/pkgs/tools/security/quill/default.nix b/pkgs/tools/security/quill/default.nix
index 8f9cf642c969..d1464f0442c3 100644
--- a/pkgs/tools/security/quill/default.nix
+++ b/pkgs/tools/security/quill/default.nix
@@ -4,7 +4,6 @@
   rustPlatform,
   fetchFromGitHub,
   openssl,
-  Security,
   libiconv,
   udev,
   pkg-config,
@@ -58,7 +57,6 @@ rustPlatform.buildRustPackage rec {
       udev
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Security
       libiconv
     ];
 
diff --git a/pkgs/tools/security/rblake2sum/default.nix b/pkgs/tools/security/rblake2sum/default.nix
index 06b1853cf5c5..8dc252af0539 100644
--- a/pkgs/tools/security/rblake2sum/default.nix
+++ b/pkgs/tools/security/rblake2sum/default.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitHub,
-  Security,
 }:
 rustPlatform.buildRustPackage {
   pname = "rblake2sum";
@@ -19,8 +17,6 @@ rustPlatform.buildRustPackage {
   useFetchCargoVendor = true;
   cargoHash = "sha256-wIJWwU4D0OeVa2RMgmpN512TIvNdcBdorXU8KfFRTIg=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
-
   meta = with lib; {
     description = "Recursive blake2 digest (hash) of a file-system path";
     homepage = "https://github.com/crev-dev/rblake2sum";
diff --git a/pkgs/tools/security/rblake3sum/default.nix b/pkgs/tools/security/rblake3sum/default.nix
index 19428078db00..1e0ad125994b 100644
--- a/pkgs/tools/security/rblake3sum/default.nix
+++ b/pkgs/tools/security/rblake3sum/default.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitHub,
-  Security,
 }:
 rustPlatform.buildRustPackage {
   pname = "rblake3sum";
@@ -19,8 +17,6 @@ rustPlatform.buildRustPackage {
   useFetchCargoVendor = true;
   cargoHash = "sha256-cxPNqUVNMkNY9Ov7/ajTAwnBd2j/gKDHVLXPtd1aPVA=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
-
   meta = with lib; {
     description = "Recursive blake3 digest (hash) of a file-system path";
     homepage = "https://github.com/rustshop/rblake3sum";
diff --git a/pkgs/tools/security/rucredstash/default.nix b/pkgs/tools/security/rucredstash/default.nix
index f98cd0f74858..3a352a29fc08 100644
--- a/pkgs/tools/security/rucredstash/default.nix
+++ b/pkgs/tools/security/rucredstash/default.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,8 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-QylZkqE8my2ldCjtg3++6TTDm0om3SVp0jwYUZ9qVes=";
 
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin Security;
-
   # Disable tests since it requires network access and relies on the
   # presence of certain AWS infrastructure
   doCheck = false;
diff --git a/pkgs/tools/security/rustscan/default.nix b/pkgs/tools/security/rustscan/default.nix
index 6800e96ffaa9..c012668a34fe 100644
--- a/pkgs/tools/security/rustscan/default.nix
+++ b/pkgs/tools/security/rustscan/default.nix
@@ -1,12 +1,10 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   nmap,
   perl,
   python3,
   rustPlatform,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -29,8 +27,6 @@ rustPlatform.buildRustPackage rec {
     patchShebangs fixtures/.rustscan_scripts/*
   '';
 
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin Security;
-
   nativeCheckInputs = [
     perl
     python3
diff --git a/pkgs/tools/security/saml2aws/default.nix b/pkgs/tools/security/saml2aws/default.nix
index 6da20e6ba3e3..5a698ee06811 100644
--- a/pkgs/tools/security/saml2aws/default.nix
+++ b/pkgs/tools/security/saml2aws/default.nix
@@ -4,7 +4,6 @@
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
-  AppKit,
 }:
 
 buildGoModule rec {
@@ -21,7 +20,6 @@ buildGoModule rec {
   vendorHash = "sha256-oCYtEMx3+wK1TyS18iYgRwH3NopWY63xsguvanNDSEo=";
 
   nativeBuildInputs = [ installShellFiles ];
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ AppKit ];
 
   subPackages = [
     "."
diff --git a/pkgs/tools/security/softhsm/default.nix b/pkgs/tools/security/softhsm/default.nix
index 3cbf2e759418..48d64a0935d2 100644
--- a/pkgs/tools/security/softhsm/default.nix
+++ b/pkgs/tools/security/softhsm/default.nix
@@ -4,8 +4,6 @@
   fetchurl,
   botan2,
   sqlite,
-  libobjc,
-  Security,
 }:
 
 stdenv.mkDerivation rec {
@@ -26,11 +24,6 @@ stdenv.mkDerivation rec {
     "--localstatedir=$out/var"
   ];
 
-  propagatedBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    libobjc
-    Security
-  ];
-
   buildInputs = [
     botan2
     sqlite
diff --git a/pkgs/tools/security/solo2-cli/default.nix b/pkgs/tools/security/solo2-cli/default.nix
index 99a633dafe61..18f5e509a71f 100644
--- a/pkgs/tools/security/solo2-cli/default.nix
+++ b/pkgs/tools/security/solo2-cli/default.nix
@@ -7,10 +7,6 @@
   pkg-config,
   pcsclite,
   udev,
-  PCSC,
-  IOKit,
-  CoreFoundation,
-  AppKit,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -37,12 +33,6 @@ rustPlatform.buildRustPackage rec {
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       pcsclite
       udev
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      PCSC
-      IOKit
-      CoreFoundation
-      AppKit
     ];
 
   postInstall = ''
diff --git a/pkgs/tools/security/vaultwarden/default.nix b/pkgs/tools/security/vaultwarden/default.nix
index de0793a6a89c..0eba9e6e26c6 100644
--- a/pkgs/tools/security/vaultwarden/default.nix
+++ b/pkgs/tools/security/vaultwarden/default.nix
@@ -8,9 +8,6 @@
   pkg-config,
   openssl,
   libiconv,
-  Security,
-  CoreServices,
-  SystemConfiguration,
   dbBackend ? "sqlite",
   libmysqlclient,
   libpq,
@@ -42,9 +39,6 @@ rustPlatform.buildRustPackage rec {
     [ openssl ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       libiconv
-      Security
-      CoreServices
-      SystemConfiguration
     ]
     ++ lib.optional (dbBackend == "mysql") libmysqlclient
     ++ lib.optional (dbBackend == "postgresql") libpq;
diff --git a/pkgs/tools/system/clinfo/default.nix b/pkgs/tools/system/clinfo/default.nix
index 4db3a1d780ba..5eb7ef8dfc68 100644
--- a/pkgs/tools/system/clinfo/default.nix
+++ b/pkgs/tools/system/clinfo/default.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   ocl-icd,
   opencl-headers,
-  OpenCL,
 }:
 
 stdenv.mkDerivation rec {
@@ -18,14 +17,10 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-UkkrRpmY5vZtTeEqPNYfxAGaJDoTSrNUG9N1Bknozow=";
   };
 
-  buildInputs =
-    lib.optionals (!stdenv.hostPlatform.isDarwin) [
-      ocl-icd
-      opencl-headers
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      OpenCL
-    ];
+  buildInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) [
+    ocl-icd
+    opencl-headers
+  ];
 
   makeFlags = [ "PREFIX=${placeholder "out"}" ];
 
diff --git a/pkgs/tools/system/collectd/default.nix b/pkgs/tools/system/collectd/default.nix
index 4be42d86237e..90645a045a49 100644
--- a/pkgs/tools/system/collectd/default.nix
+++ b/pkgs/tools/system/collectd/default.nix
@@ -3,7 +3,6 @@
   stdenv,
   fetchurl,
   fetchpatch,
-  darwin,
   callPackage,
   autoreconfHook,
   pkg-config,
@@ -41,14 +40,9 @@ stdenv.mkDerivation rec {
     pkg-config
     autoreconfHook
   ];
-  buildInputs =
-    [
-      libtool
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.ApplicationServices
-    ]
-    ++ plugins.buildInputs;
+  buildInputs = [
+    libtool
+  ] ++ plugins.buildInputs;
 
   configureFlags =
     [
diff --git a/pkgs/tools/system/collectd/plugins.nix b/pkgs/tools/system/collectd/plugins.nix
index 2a716b0ab3f2..44301c956d9e 100644
--- a/pkgs/tools/system/collectd/plugins.nix
+++ b/pkgs/tools/system/collectd/plugins.nix
@@ -42,7 +42,6 @@
   varnish,
   xen,
   yajl,
-  IOKit,
   # Defaults to `null` for all supported plugins (except xen, which is marked as
   # insecure), otherwise a list of plugin names for a custom build
   enabledPlugins ? null,
@@ -61,9 +60,6 @@ let
       curl
       libxml2
     ];
-    battery.buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-      IOKit
-    ];
     bind.buildInputs = [
       curl
       libxml2
@@ -79,13 +75,9 @@ let
       libxml2
     ];
     dbi.buildInputs = [ libdbi ];
-    disk.buildInputs =
-      lib.optionals stdenv.hostPlatform.isLinux [
-        udev
-      ]
-      ++ lib.optionals stdenv.hostPlatform.isDarwin [
-        IOKit
-      ];
+    disk.buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+      udev
+    ];
     dns.buildInputs = [ libpcap ];
     ipmi.buildInputs = [ openipmi ];
     iptables.buildInputs =
diff --git a/pkgs/tools/system/gotop/default.nix b/pkgs/tools/system/gotop/default.nix
index d61e7432ce10..ded71d3bf8d1 100644
--- a/pkgs/tools/system/gotop/default.nix
+++ b/pkgs/tools/system/gotop/default.nix
@@ -1,10 +1,8 @@
 {
   lib,
-  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
-  IOKit,
   writableTmpDirAsHomeHook,
 }:
 
@@ -34,9 +32,6 @@ buildGoModule (finalAttrs: {
   ];
 
   nativeBuildInputs = [ installShellFiles ];
-
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ IOKit ];
-
   nativeCheckInputs = [ writableTmpDirAsHomeHook ];
 
   postInstall = ''
diff --git a/pkgs/tools/system/htop/default.nix b/pkgs/tools/system/htop/default.nix
index 87c6e6b30f9a..ad416c4b77bb 100644
--- a/pkgs/tools/system/htop/default.nix
+++ b/pkgs/tools/system/htop/default.nix
@@ -5,7 +5,6 @@
   autoreconfHook,
   pkg-config,
   ncurses,
-  IOKit,
   libcap,
   libnl,
   sensorsSupport ? stdenv.hostPlatform.isLinux,
@@ -44,7 +43,6 @@ stdenv.mkDerivation rec {
 
   buildInputs =
     [ ncurses ]
-    ++ lib.optional stdenv.hostPlatform.isDarwin IOKit
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       libcap
       libnl
diff --git a/pkgs/tools/system/netdata/default.nix b/pkgs/tools/system/netdata/default.nix
index 17b96fd7c2d1..dc2f5a516949 100644
--- a/pkgs/tools/system/netdata/default.nix
+++ b/pkgs/tools/system/netdata/default.nix
@@ -5,7 +5,6 @@
   cmake,
   cups,
   curl,
-  darwin,
   dlib,
   fetchFromGitHub,
   fetchurl,
@@ -33,7 +32,6 @@
   ninja,
   nixosTests,
   openssl,
-  overrideSDK,
   pkg-config,
   protobuf,
   replaceVars,
@@ -58,10 +56,7 @@
   withSystemdJournal ? (stdenv.hostPlatform.isLinux),
   withML ? true,
 }:
-let
-  stdenv' = if stdenv.hostPlatform.isDarwin then overrideSDK stdenv "11.0" else stdenv;
-in
-stdenv'.mkDerivation (finalAttrs: {
+stdenv.mkDerivation (finalAttrs: {
   version = "2.4.0";
   pname = "netdata";
 
@@ -98,14 +93,10 @@ stdenv'.mkDerivation (finalAttrs: {
       protobuf
       zlib
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (
-      with darwin.apple_sdk.frameworks;
-      [
-        CoreFoundation
-        IOKit
-        libossp_uuid
-      ]
-    )
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      libossp_uuid
+    ]
+
     ++ lib.optionals (stdenv.hostPlatform.isLinux) [
       libcap
       libuuid
diff --git a/pkgs/tools/system/pciutils/default.nix b/pkgs/tools/system/pciutils/default.nix
index 345afacf0016..8224369d0992 100644
--- a/pkgs/tools/system/pciutils/default.nix
+++ b/pkgs/tools/system/pciutils/default.nix
@@ -8,7 +8,6 @@
   which,
   hwdata,
   static ? stdenv.hostPlatform.isStatic,
-  IOKit,
   gitUpdater,
 }:
 
@@ -24,13 +23,10 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs =
-    [
-      which
-      zlib
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ IOKit ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [ kmod ];
+  buildInputs = [
+    which
+    zlib
+  ] ++ lib.optionals stdenv.hostPlatform.isLinux [ kmod ];
 
   preConfigure = lib.optionalString (!stdenv.cc.isGNU) ''
     substituteInPlace Makefile --replace 'CC=$(CROSS_COMPILE)gcc' ""
diff --git a/pkgs/tools/system/plan9port/default.nix b/pkgs/tools/system/plan9port/default.nix
index ed3cbe37b2c0..8887d0623776 100644
--- a/pkgs/tools/system/plan9port/default.nix
+++ b/pkgs/tools/system/plan9port/default.nix
@@ -11,11 +11,6 @@
   perl, # For building web manuals
   which,
   ed,
-  Carbon,
-  Cocoa,
-  IOKit,
-  Metal,
-  QuartzCore,
   DarwinTools, # For building on Darwin
 }:
 
@@ -66,11 +61,6 @@ stdenv.mkDerivation rec {
         ]
       else
         [
-          Carbon
-          Cocoa
-          IOKit
-          Metal
-          QuartzCore
           DarwinTools
         ]
     );
diff --git a/pkgs/tools/system/smartmontools/default.nix b/pkgs/tools/system/smartmontools/default.nix
index d4b80e17bc96..a08ab722aeec 100644
--- a/pkgs/tools/system/smartmontools/default.nix
+++ b/pkgs/tools/system/smartmontools/default.nix
@@ -8,8 +8,6 @@
   hostname,
   mailutils,
   systemdLibs,
-  IOKit,
-  ApplicationServices,
 }:
 
 let
@@ -53,12 +51,7 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [ autoreconfHook ];
-  buildInputs =
-    lib.optionals (lib.meta.availableOn stdenv.hostPlatform systemdLibs) [ systemdLibs ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      IOKit
-      ApplicationServices
-    ];
+  buildInputs = lib.optionals (lib.meta.availableOn stdenv.hostPlatform systemdLibs) [ systemdLibs ];
   enableParallelBuilding = true;
 
   meta = with lib; {
diff --git a/pkgs/tools/text/autocorrect/default.nix b/pkgs/tools/text/autocorrect/default.nix
index 29b3f9ed2ea7..ec62b9adca50 100644
--- a/pkgs/tools/text/autocorrect/default.nix
+++ b/pkgs/tools/text/autocorrect/default.nix
@@ -1,10 +1,7 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitHub,
-  Security,
-  SystemConfiguration,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -26,11 +23,6 @@ rustPlatform.buildRustPackage rec {
     cp ${./Cargo.lock} Cargo.lock
   '';
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
-    Security
-    SystemConfiguration
-  ];
-
   cargoBuildFlags = [
     "-p"
     "autocorrect-cli"
diff --git a/pkgs/tools/text/chars/default.nix b/pkgs/tools/text/chars/default.nix
index 02933bf8fa2d..ae87f1efd6c8 100644
--- a/pkgs/tools/text/chars/default.nix
+++ b/pkgs/tools/text/chars/default.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
-  Security,
   nix-update-script,
 }:
 
@@ -21,8 +19,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-Df+twOjzfq+Vxzuv+APiy94XmhBajgk+6+1BRFf+xm0=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
-
   passthru = {
     updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
   };
diff --git a/pkgs/tools/text/coloursum/default.nix b/pkgs/tools/text/coloursum/default.nix
index 3b9c6d2b383a..08bf30cb08ba 100644
--- a/pkgs/tools/text/coloursum/default.nix
+++ b/pkgs/tools/text/coloursum/default.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,8 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-aZkWzJaEW6/fiCfb+RKNef0eJf/CJW8OU1N2OlHwuJM=";
 
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin Security;
-
   meta = with lib; {
     description = "Colourise your checksum output";
     mainProgram = "coloursum";
diff --git a/pkgs/tools/text/diffr/default.nix b/pkgs/tools/text/diffr/default.nix
index e3502dd3c54f..a599e8188400 100644
--- a/pkgs/tools/text/diffr/default.nix
+++ b/pkgs/tools/text/diffr/default.nix
@@ -1,9 +1,7 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   rustPlatform,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,8 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-pbGfoEk8peWBA0F0EdiAJJtan74O5RD6TmNJUTY2ijA=";
 
-  buildInputs = (lib.optional stdenv.hostPlatform.isDarwin Security);
-
   preCheck = ''
     export DIFFR_TESTS_BINARY_PATH=$releaseDir/diffr
   '';
diff --git a/pkgs/tools/text/diffutils/default.nix b/pkgs/tools/text/diffutils/default.nix
index ceeae464da4d..2d2d34b698b5 100644
--- a/pkgs/tools/text/diffutils/default.nix
+++ b/pkgs/tools/text/diffutils/default.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation rec {
   pname = "diffutils";
-  version = "3.10";
+  version = "3.12";
 
   src = fetchurl {
     url = "mirror://gnu/diffutils/diffutils-${version}.tar.xz";
-    hash = "sha256-kOXpPMck5OvhLt6A3xY0Bjx6hVaSaFkZv+YLVWyb0J4=";
+    hash = "sha256-fIt/n8hgkUH96pzs6FJJ0whiQ5H/Yd7a9Sj8szdyff0=";
   };
 
   outputs = [
@@ -34,14 +34,15 @@ stdenv.mkDerivation rec {
   buildInputs = [ coreutils ];
 
   # Disable stack-related gnulib tests on x86_64-darwin because they have problems running under
-  # Rosetta 2: test-c-stack hangs, test-sigsegv-catch-stackoverflow fails.
+  # Rosetta 2: test-c-stack hangs, test-sigsegv-catch-stackoverflow and test-sigaction fail.
   postPatch =
     if
       ((stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) || (stdenv.hostPlatform.isAarch32))
     then
       ''
-        sed -i -E 's:test-c-stack2?\.sh::g' gnulib-tests/Makefile.in
-        sed -i -E 's:test-sigsegv-catch-stackoverflow[12]::g' gnulib-tests/Makefile.in
+        sed -i -E 's:[[:space:]]test-c-stack2?\.sh::g' gnulib-tests/Makefile.in
+        sed -i -E 's:[[:space:]]test-sigsegv-catch-stackoverflow[12]\$\(EXEEXT\)::g' gnulib-tests/Makefile.in
+        sed -i -E 's:[[:space:]]test-sigaction\$\(EXEEXT\)::g' gnulib-tests/Makefile.in
       ''
     else
       null;
@@ -50,7 +51,10 @@ stdenv.mkDerivation rec {
     # "pr" need not be on the PATH as a run-time dep, so we need to tell
     # configure where it is. Covers the cross and native case alike.
     lib.optional (coreutils != null) "PR_PROGRAM=${coreutils}/bin/pr"
-    ++ lib.optional (stdenv.buildPlatform != stdenv.hostPlatform) "gl_cv_func_getopt_gnu=yes";
+    ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+      "gl_cv_func_getopt_gnu=yes"
+      "gl_cv_func_strcasecmp_works=yes"
+    ];
 
   # Test failure on QEMU only (#300550)
   doCheck = !stdenv.buildPlatform.isRiscV64;
@@ -60,6 +64,6 @@ stdenv.mkDerivation rec {
     description = "Commands for showing the differences between files (diff, cmp, etc.)";
     license = licenses.gpl3;
     platforms = platforms.unix;
-    maintainers = with maintainers; [ das_j ];
+    maintainers = lib.teams.helsinki-systems.members;
   };
 }
diff --git a/pkgs/tools/text/fastmod/default.nix b/pkgs/tools/text/fastmod/default.nix
index 5d94bd299fd0..0c238b3bc21b 100644
--- a/pkgs/tools/text/fastmod/default.nix
+++ b/pkgs/tools/text/fastmod/default.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   rustPlatform,
   libiconv,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -23,7 +22,6 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     libiconv
-    Security
   ];
 
   meta = with lib; {
diff --git a/pkgs/tools/text/gawk/default.nix b/pkgs/tools/text/gawk/default.nix
index dd5e5827b7c1..d8247d6b69ca 100644
--- a/pkgs/tools/text/gawk/default.nix
+++ b/pkgs/tools/text/gawk/default.nix
@@ -25,11 +25,11 @@ assert (doCheck && stdenv.hostPlatform.isLinux) -> glibcLocales != null;
 
 stdenv.mkDerivation rec {
   pname = "gawk" + lib.optionalString interactive "-interactive";
-  version = "5.3.1";
+  version = "5.3.2";
 
   src = fetchurl {
     url = "mirror://gnu/gawk/gawk-${version}.tar.xz";
-    hash = "sha256-aU23ZIEqYjZCPU/0DOt7bExEEwG3KtUCu1wn4AzVb3g=";
+    hash = "sha256-+MNIZQnecFGSE4sA7ywAu73Q6Eww1cB9I/xzqdxMycw=";
   };
 
   # PIE is incompatible with the "persistent malloc" ("pma") feature.
@@ -72,6 +72,11 @@ stdenv.mkDerivation rec {
     (if interactive then "--with-readline=${readline.dev}" else "--without-readline")
   ];
 
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    # TODO: figure out a better way to unbreak _NSGetExecutablePath invocations
+    NIX_CFLAGS_COMPILE = "-Wno-implicit-function-declaration";
+  };
+
   makeFlags = [
     "AR=${stdenv.cc.targetPrefix}ar"
   ];
diff --git a/pkgs/tools/text/igrep/default.nix b/pkgs/tools/text/igrep/default.nix
index 77537ec0adbd..fd36e112b38b 100644
--- a/pkgs/tools/text/igrep/default.nix
+++ b/pkgs/tools/text/igrep/default.nix
@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  stdenv,
-  Security,
   testers,
   igrep,
 }:
@@ -22,8 +20,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-NZN9pB9McZkTlpGgAbxi8bwn+aRiPMymGmBLYBc6bmw=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
-
   passthru.tests = {
     version = testers.testVersion {
       package = igrep;
diff --git a/pkgs/tools/text/languagetool-rust/default.nix b/pkgs/tools/text/languagetool-rust/default.nix
index 389f36581b22..a740365f7a5a 100644
--- a/pkgs/tools/text/languagetool-rust/default.nix
+++ b/pkgs/tools/text/languagetool-rust/default.nix
@@ -6,7 +6,6 @@
   installShellFiles,
   pkg-config,
   openssl,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -29,7 +28,7 @@ rustPlatform.buildRustPackage rec {
     installShellFiles
     pkg-config
   ];
-  buildInputs = [ openssl ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
+  buildInputs = [ openssl ];
 
   checkFlags = [
     # requires network access
diff --git a/pkgs/tools/text/mdbook-linkcheck/default.nix b/pkgs/tools/text/mdbook-linkcheck/default.nix
index 474f4f5004c5..498cb0f85582 100644
--- a/pkgs/tools/text/mdbook-linkcheck/default.nix
+++ b/pkgs/tools/text/mdbook-linkcheck/default.nix
@@ -5,7 +5,6 @@
   rustPlatform,
   pkg-config,
   openssl,
-  Security,
   testers,
   mdbook-linkcheck,
 }:
@@ -24,7 +23,7 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-Tt7ljjWv2CMtP/ELZNgSH/ifmBk/42+E0r9ZXQEJNP8=";
 
-  buildInputs = if stdenv.hostPlatform.isDarwin then [ Security ] else [ openssl ];
+  buildInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) [ openssl ];
 
   nativeBuildInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) [ pkg-config ];
 
diff --git a/pkgs/tools/text/mdcat/default.nix b/pkgs/tools/text/mdcat/default.nix
index 4133f5cecda2..75f05104bd6e 100644
--- a/pkgs/tools/text/mdcat/default.nix
+++ b/pkgs/tools/text/mdcat/default.nix
@@ -7,8 +7,6 @@
   pkg-config,
   asciidoctor,
   openssl,
-  Security,
-  SystemConfiguration,
   ansi2html,
   installShellFiles,
 }:
@@ -29,15 +27,10 @@ rustPlatform.buildRustPackage rec {
     asciidoctor
     installShellFiles
   ];
-  buildInputs =
-    [
-      curl
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Security
-      SystemConfiguration
-    ];
+  buildInputs = [
+    curl
+    openssl
+  ];
 
   useFetchCargoVendor = true;
   cargoHash = "sha256-8A0RLbFkh3fruZAbjJzipQvuFLchqIRovPcc6MSKdOc=";
diff --git a/pkgs/tools/text/pinyin-tool/default.nix b/pkgs/tools/text/pinyin-tool/default.nix
index 05dd8c2305c7..bbd3e0b42097 100644
--- a/pkgs/tools/text/pinyin-tool/default.nix
+++ b/pkgs/tools/text/pinyin-tool/default.nix
@@ -1,9 +1,7 @@
 {
-  stdenv,
   lib,
   rustPlatform,
   fetchFromGitHub,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,8 +18,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-SOeyk2uWCdO99ooQc2L1eXlV77lR4DLBK6PnV6Ur49A=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
-
   meta = with lib; {
     description = "Simple command line tool for converting Chinese characters to space-separate pinyin words";
     mainProgram = "pinyin-tool";
diff --git a/pkgs/tools/text/ripgrep-all/default.nix b/pkgs/tools/text/ripgrep-all/default.nix
index afb2e7f55660..4e317167864d 100644
--- a/pkgs/tools/text/ripgrep-all/default.nix
+++ b/pkgs/tools/text/ripgrep-all/default.nix
@@ -1,5 +1,4 @@
 {
-  stdenv,
   lib,
   fetchFromGitHub,
   rustPlatform,
@@ -8,7 +7,6 @@
   pandoc,
   poppler-utils,
   ripgrep,
-  Security,
   zip,
   fzf,
 }:
@@ -44,7 +42,6 @@ rustPlatform.buildRustPackage rec {
     makeWrapper
     poppler-utils
   ];
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin Security;
 
   nativeCheckInputs = path;
 
diff --git a/pkgs/tools/typesetting/htmldoc/default.nix b/pkgs/tools/typesetting/htmldoc/default.nix
index 143b919778cb..6f5e643826c2 100644
--- a/pkgs/tools/typesetting/htmldoc/default.nix
+++ b/pkgs/tools/typesetting/htmldoc/default.nix
@@ -7,8 +7,6 @@
   cups,
   libpng,
   libjpeg,
-  SystemConfiguration,
-  Foundation,
   pkg-config,
   htmldoc,
 }:
@@ -24,17 +22,12 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs =
-    [
-      zlib
-      cups
-      libpng
-      libjpeg
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Foundation
-      SystemConfiguration
-    ];
+  buildInputs = [
+    zlib
+    cups
+    libpng
+    libjpeg
+  ];
 
   # do not generate universal binary on Darwin
   # because it is not supported by Nix's clang
diff --git a/pkgs/tools/video/atomicparsley/default.nix b/pkgs/tools/video/atomicparsley/default.nix
index 3b5ccde7979e..823693975ac0 100644
--- a/pkgs/tools/video/atomicparsley/default.nix
+++ b/pkgs/tools/video/atomicparsley/default.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   cmake,
   zlib,
-  Cocoa,
 }:
 
 stdenv.mkDerivation rec {
@@ -20,7 +19,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
-  buildInputs = [ zlib ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Cocoa ];
+  buildInputs = [ zlib ];
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/tools/video/yaydl/default.nix b/pkgs/tools/video/yaydl/default.nix
index a888e091b4d6..8ad5b99c893f 100644
--- a/pkgs/tools/video/yaydl/default.nix
+++ b/pkgs/tools/video/yaydl/default.nix
@@ -1,13 +1,11 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitHub,
   pkg-config,
   makeWrapper,
   openssl,
   ffmpeg,
-  Security,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -29,7 +27,7 @@ rustPlatform.buildRustPackage rec {
     makeWrapper
   ];
 
-  buildInputs = [ openssl ] ++ lib.optional stdenv.hostPlatform.isDarwin Security;
+  buildInputs = [ openssl ];
 
   postInstall = ''
     wrapProgram $out/bin/yaydl \
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index ed5619d6dedf..bbc45db63605 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -290,6 +290,7 @@ mapAliases {
   apacheKafka_3_6 = throw "apacheKafka_2_8 through _3_6 have been removed from nixpkgs as outdated"; # Added 2024-11-27
   antimicroX = throw "'antimicroX' has been renamed to/replaced by 'antimicrox'"; # Converted to throw 2024-10-17
   apacheAnt = ant; # Added 2024-11-28
+  apparmor-kernel-patches = throw "'apparmor-kernel-patches' has been removed as they were unmaintained, irrelevant and effectively broken"; # Added 2025-04-20
   appimagekit = throw "'appimagekit' has been removed as it was broken in nixpkgs and archived upstream"; # Added 2025-04-19
   apple-sdk_10_12 = throw "apple-sdk_10_12 was removed as Nixpkgs no longer supports macOS 10.12; see the 25.05 release notes"; # Added 2024-10-27
   apple-sdk_10_13 = throw "apple-sdk_10_13 was removed as Nixpkgs no longer supports macOS 10.13; see the 25.05 release notes"; # Added 2024-10-27
@@ -1471,6 +1472,14 @@ mapAliases {
   postgresql12Packages = throw "postgresql_12 has been removed since it reached its EOL upstream"; # Added 2024-11-14
   postgresql12JitPackages = throw "postgresql_12 has been removed since it reached its EOL upstream"; # Added 2024-11-14
 
+  # Ever since building with JIT by default, those are the same.
+  postgresqlJitPackages = postgresqlPackages; # Added 2025-04-12
+  postgresql13JitPackages = postgresql13Packages; # Added 2025-04-12
+  postgresql14JitPackages = postgresql14Packages; # Added 2025-04-12
+  postgresql15JitPackages = postgresql15Packages; # Added 2025-04-12
+  postgresql16JitPackages = postgresql16Packages; # Added 2025-04-12
+  postgresql17JitPackages = postgresql17Packages; # Added 2025-04-12
+
   # pinentry was using multiple outputs, this emulates the old interface for i.e. home-manager
   # soon: throw "'pinentry' has been removed. Pick an appropriate variant like 'pinentry-curses' or 'pinentry-gnome3'";
   pinentry = pinentry-all // {
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c44c5860f4a1..8d35d3f0b7e8 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -940,9 +940,7 @@ with pkgs;
 
   makeHardcodeGsettingsPatch = callPackage ../build-support/make-hardcode-gsettings-patch { };
 
-  mitm-cache = callPackage ../build-support/mitm-cache {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  mitm-cache = callPackage ../build-support/mitm-cache { };
 
   # intended to be used like nix-build -E 'with import <nixpkgs> { }; enableDebugging fooPackage'
   enableDebugging = pkg: pkg.override { stdenv = stdenvAdapters.keepDebugInfo pkg.stdenv; };
@@ -1015,7 +1013,7 @@ with pkgs;
 
   _1password-gui-beta = callPackage ../applications/misc/1password-gui { channel = "beta"; };
 
-  _7zz = darwin.apple_sdk_11_0.callPackage ../tools/archivers/7zz { };
+  _7zz = callPackage ../tools/archivers/7zz { };
   _7zz-rar = _7zz.override { enableUnfree = true; };
 
   acquire = with python3Packages; toPythonApplication acquire;
@@ -1242,7 +1240,6 @@ with pkgs;
   ### APPLICATIONS/VERSION-MANAGEMENT
 
   git = callPackage ../applications/version-management/git {
-    inherit (darwin.apple_sdk.frameworks) CoreServices Security;
     perlLibs = [
       perlPackages.LWP
       perlPackages.URI
@@ -1329,17 +1326,13 @@ with pkgs;
 
   git-credential-manager = callPackage ../applications/version-management/git-credential-manager { };
 
-  git-gone = callPackage ../applications/version-management/git-gone {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  git-gone = callPackage ../applications/version-management/git-gone { };
 
   git-imerge = python3Packages.callPackage ../applications/version-management/git-imerge { };
 
   git-machete = python3Packages.callPackage ../applications/version-management/git-machete { };
 
-  git-ps-rs = callPackage ../development/tools/git-ps-rs {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  git-ps-rs = callPackage ../development/tools/git-ps-rs { };
 
   git-publish = python3Packages.callPackage ../applications/version-management/git-publish { };
 
@@ -1354,15 +1347,11 @@ with pkgs;
 
   git-review = python3Packages.callPackage ../applications/version-management/git-review { };
 
-  git-stack = callPackage ../applications/version-management/git-stack {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  git-stack = callPackage ../applications/version-management/git-stack { };
 
   gittyup = libsForQt5.callPackage ../applications/version-management/gittyup { };
 
-  lucky-commit = callPackage ../applications/version-management/lucky-commit {
-    inherit (darwin.apple_sdk.frameworks) OpenCL;
-  };
+  lucky-commit = callPackage ../applications/version-management/lucky-commit { };
 
   merge-fmt = callPackage ../applications/version-management/merge-fmt {
     inherit (ocamlPackages)
@@ -1432,13 +1421,10 @@ with pkgs;
   cdemu-daemon = callPackage ../applications/emulators/cdemu/daemon.nix { };
 
   dosbox = callPackage ../applications/emulators/dosbox {
-    inherit (darwin.apple_sdk.frameworks) OpenGL;
     SDL = if stdenv.hostPlatform.isDarwin then SDL else SDL_compat;
   };
 
-  dosbox-x = darwin.apple_sdk_11_0.callPackage ../applications/emulators/dosbox-x {
-    inherit (darwin.apple_sdk_11_0.frameworks) AudioUnit Carbon Cocoa;
-  };
+  dosbox-x = callPackage ../applications/emulators/dosbox-x { };
 
   fceux-qt5 = fceux.override { ___qtVersion = "5"; };
   fceux-qt6 = fceux.override { ___qtVersion = "6"; };
@@ -1589,19 +1575,12 @@ with pkgs;
 
   cool-retro-term = libsForQt5.callPackage ../applications/terminal-emulators/cool-retro-term { };
 
-  kitty = darwin.apple_sdk_11_0.callPackage ../by-name/ki/kitty/package.nix {
+  kitty = callPackage ../by-name/ki/kitty/package.nix {
     harfbuzz = harfbuzz.override { withCoreText = stdenv.hostPlatform.isDarwin; };
     inherit (darwin) autoSignDarwinBinariesHook;
-    inherit (darwin.apple_sdk_11_0) Libsystem;
-    inherit (darwin.apple_sdk_11_0.frameworks)
-      Cocoa
-      Kernel
-      UniformTypeIdentifiers
-      UserNotifications
-      ;
   };
 
-  mlterm = darwin.apple_sdk_11_0.callPackage ../applications/terminal-emulators/mlterm { };
+  mlterm = callPackage ../applications/terminal-emulators/mlterm { };
   mlterm-wayland = mlterm.override {
     enableX11 = false;
   };
@@ -1639,9 +1618,7 @@ with pkgs;
 
   twine = with python3Packages; toPythonApplication twine;
 
-  amazon-qldb-shell = callPackage ../development/tools/amazon-qldb-shell {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  amazon-qldb-shell = callPackage ../development/tools/amazon-qldb-shell { };
 
   inherit (callPackages ../development/tools/ammonite { })
     ammonite_2_12
@@ -1650,7 +1627,7 @@ with pkgs;
     ;
   ammonite = ammonite_3_3;
 
-  android-tools = lowPrio (darwin.apple_sdk_11_0.callPackage ../tools/misc/android-tools { });
+  android-tools = lowPrio (callPackage ../tools/misc/android-tools { });
 
   angie = callPackage ../servers/http/angie {
     zlib-ng = zlib-ng.override { withZlibCompat = true; };
@@ -1707,9 +1684,7 @@ with pkgs;
 
   asymptote = libsForQt5.callPackage ../tools/graphics/asymptote { };
 
-  atomicparsley = callPackage ../tools/video/atomicparsley {
-    inherit (darwin.apple_sdk.frameworks) Cocoa;
-  };
+  atomicparsley = callPackage ../tools/video/atomicparsley { };
 
   authelia = callPackage ../servers/authelia {
     buildGoModule = buildGo124Module;
@@ -1726,21 +1701,9 @@ with pkgs;
 
   azure-cli-extensions = recurseIntoAttrs azure-cli.extensions;
 
-  binocle = callPackage ../applications/misc/binocle {
-    inherit (darwin.apple_sdk.frameworks)
-      AppKit
-      CoreFoundation
-      CoreGraphics
-      CoreVideo
-      Foundation
-      Metal
-      QuartzCore
-      ;
-  };
+  binocle = callPackage ../applications/misc/binocle { };
 
-  blisp = darwin.apple_sdk_11_0.callPackage ../development/embedded/blisp {
-    inherit (darwin.apple_sdk_11_0.frameworks) IOKit;
-  };
+  blisp = callPackage ../development/embedded/blisp { };
 
   brakeman = callPackage ../development/tools/analysis/brakeman { };
 
@@ -1762,9 +1725,7 @@ with pkgs;
     else
       throw "freshBootstrapTools: unknown hostPlatform ${stdenv.hostPlatform.config}";
 
-  chars = callPackage ../tools/text/chars {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  chars = callPackage ../tools/text/chars { };
 
   crystfel = callPackage ../applications/science/physics/crystfel { };
 
@@ -1828,9 +1789,7 @@ with pkgs;
 
   corsair = with python3Packages; toPythonApplication corsair-scan;
 
-  cosign = callPackage ../tools/security/cosign {
-    inherit (darwin.apple_sdk.frameworks) PCSC;
-  };
+  cosign = callPackage ../tools/security/cosign { };
 
   inherit (cue) writeCueValidator;
 
@@ -1846,9 +1805,7 @@ with pkgs;
     forPlatform = stdenv.targetPlatform; # offset by 1 so it works in nativeBuildInputs
   };
 
-  diskus = callPackage ../tools/misc/diskus {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  diskus = callPackage ../tools/misc/diskus { };
 
   dkimpy = with python3Packages; toPythonApplication dkimpy;
 
@@ -1858,9 +1815,7 @@ with pkgs;
 
   libfx2 = with python3Packages; toPythonApplication fx2;
 
-  fastmod = callPackage ../tools/text/fastmod {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  fastmod = callPackage ../tools/text/fastmod { };
 
   flirc = libsForQt5.callPackage ../applications/video/flirc {
     readline = readline70;
@@ -1888,14 +1843,7 @@ with pkgs;
 
   glaxnimate = libsForQt5.callPackage ../applications/video/glaxnimate { };
 
-  go2tv = darwin.apple_sdk_11_0.callPackage ../applications/video/go2tv {
-    inherit (darwin.apple_sdk_11_0.frameworks)
-      Carbon
-      Cocoa
-      Kernel
-      UserNotifications
-      ;
-  };
+  go2tv = callPackage ../applications/video/go2tv { };
   go2tv-lite = go2tv.override { withGui = false; };
 
   guglielmo = libsForQt5.callPackage ../applications/radio/guglielmo { };
@@ -1910,9 +1858,7 @@ with pkgs;
     openjdk = openjdk11;
   };
 
-  grex = callPackage ../tools/misc/grex {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  grex = callPackage ../tools/misc/grex { };
 
   hinit = haskell.lib.compose.justStaticExecutables haskellPackages.hinit;
 
@@ -1939,9 +1885,7 @@ with pkgs;
 
   passExtensions = recurseIntoAttrs pass.extensions;
 
-  inherd-quake = callPackage ../applications/misc/inherd-quake {
-    inherit (darwin.apple_sdk.frameworks) CoreServices Security;
-  };
+  inherd-quake = callPackage ../applications/misc/inherd-quake { };
 
   gopass = callPackage ../tools/security/gopass { };
 
@@ -1954,16 +1898,9 @@ with pkgs;
   kerf = kerf_1; # kerf2 is WIP
   kerf_1 = callPackage ../development/interpreters/kerf {
     stdenv = clangStdenv;
-    inherit (darwin.apple_sdk.frameworks)
-      Accelerate
-      CoreGraphics
-      CoreVideo
-      ;
   };
 
-  khd = callPackage ../os-specific/darwin/khd {
-    inherit (darwin.apple_sdk.frameworks) Carbon Cocoa;
-  };
+  khd = callPackage ../os-specific/darwin/khd { };
 
   kjv = callPackage ../applications/misc/kjv { };
 
@@ -1976,9 +1913,7 @@ with pkgs;
 
   reattach-to-user-namespace = callPackage ../os-specific/darwin/reattach-to-user-namespace { };
 
-  qes = callPackage ../os-specific/darwin/qes {
-    inherit (darwin.apple_sdk.frameworks) Carbon;
-  };
+  qes = callPackage ../os-specific/darwin/qes { };
 
   xcodeenv = callPackage ../development/mobile/xcodeenv { };
 
@@ -2006,15 +1941,11 @@ with pkgs;
     novacomd = callPackage ../development/mobile/webos/novacomd.nix { };
   };
 
-  aoc-cli = callPackage ../tools/misc/aoc-cli {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  aoc-cli = callPackage ../tools/misc/aoc-cli { };
 
   apprise = with python3Packages; toPythonApplication apprise;
 
-  aria2 = callPackage ../tools/networking/aria2 {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  aria2 = callPackage ../tools/networking/aria2 { };
 
   asmrepl = callPackage ../development/interpreters/asmrepl { };
 
@@ -2085,7 +2016,7 @@ with pkgs;
 
   behave = with python3Packages; toPythonApplication behave;
 
-  blink = darwin.apple_sdk_11_0.callPackage ../applications/emulators/blink { };
+  blink = callPackage ../applications/emulators/blink { };
 
   blockdiag = with python3Packages; toPythonApplication blockdiag;
 
@@ -2109,9 +2040,7 @@ with pkgs;
   buildah = callPackage ../development/tools/buildah/wrapper.nix { };
   buildah-unwrapped = callPackage ../development/tools/buildah { };
 
-  c3d = callPackage ../applications/graphics/c3d {
-    inherit (darwin.apple_sdk.frameworks) Cocoa;
-  };
+  c3d = callPackage ../applications/graphics/c3d { };
 
   cabal2nix-unwrapped = haskell.lib.compose.justStaticExecutables (
     haskellPackages.generateOptparseApplicativeCompletions [ "cabal2nix" ] haskellPackages.cabal2nix
@@ -2228,13 +2157,9 @@ with pkgs;
 
   cplex = callPackage ../applications/science/math/cplex (config.cplex or { });
 
-  contacts = callPackage ../tools/misc/contacts {
-    inherit (darwin.apple_sdk.frameworks) Foundation AddressBook;
-  };
+  contacts = callPackage ../tools/misc/contacts { };
 
-  coloursum = callPackage ../tools/text/coloursum {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  coloursum = callPackage ../tools/text/coloursum { };
 
   cot = with python3Packages; toPythonApplication cot;
 
@@ -2256,9 +2181,7 @@ with pkgs;
 
   dialogbox = libsForQt5.callPackage ../tools/misc/dialogbox { };
 
-  dijo = callPackage ../tools/misc/dijo {
-    inherit (darwin.apple_sdk.frameworks) CoreServices;
-  };
+  dijo = callPackage ../tools/misc/dijo { };
 
   ding = callPackage ../applications/misc/ding {
     aspellDicts_de = aspellDicts.de;
@@ -2289,9 +2212,7 @@ with pkgs;
 
   dnschef = python3Packages.callPackage ../tools/networking/dnschef { };
 
-  dotenv-linter = callPackage ../development/tools/analysis/dotenv-linter {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  dotenv-linter = callPackage ../development/tools/analysis/dotenv-linter { };
 
   inherit (ocamlPackages) dot-merlin-reader;
 
@@ -2341,23 +2262,17 @@ with pkgs;
     # If buildGoModule is overridden, provide a matching version of the go attribute
   };
 
-  f3d = callPackage ../applications/graphics/f3d {
-    inherit (darwin.apple_sdk.frameworks) Cocoa OpenGL;
-  };
+  f3d = callPackage ../applications/graphics/f3d { };
 
   f3d_egl = f3d.override { vtk_9 = vtk_9_egl; };
 
   fast-cli = nodePackages.fast-cli;
 
-  fast-ssh = callPackage ../tools/networking/fast-ssh {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  fast-ssh = callPackage ../tools/networking/fast-ssh { };
 
   fdroidcl = pkgs.callPackage ../development/mobile/fdroidcl { };
 
-  flowgger = callPackage ../tools/misc/flowgger {
-    inherit (darwin.apple_sdk.frameworks) CoreServices;
-  };
+  flowgger = callPackage ../tools/misc/flowgger { };
 
   ### TOOLS/TYPESETTING/TEX
 
@@ -2391,32 +2306,26 @@ with pkgs;
     ;
   texlivePackages = recurseIntoAttrs (lib.mapAttrs (_: v: v.build) texlive.pkgs);
 
-  fondu = callPackage ../tools/misc/fondu {
-    inherit (darwin.apple_sdk.frameworks) CoreServices;
-  };
+  fondu = callPackage ../tools/misc/fondu { };
 
   futhark = haskell.lib.compose.justStaticExecutables haskellPackages.futhark;
 
   qt-video-wlr = libsForQt5.callPackage ../applications/misc/qt-video-wlr { };
 
-  fwup = callPackage ../tools/misc/fwup {
-    inherit (darwin.apple_sdk.frameworks) DiskArbitration;
-  };
+  fwup = callPackage ../tools/misc/fwup { };
 
   g2o = libsForQt5.callPackage ../development/libraries/g2o { };
 
   inherit (go-containerregistry) crane gcrane;
 
-  geckodriver = callPackage ../development/tools/geckodriver {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  geckodriver = callPackage ../development/tools/geckodriver { };
 
   geekbench_4 = callPackage ../tools/misc/geekbench/4.nix { };
   geekbench_5 = callPackage ../tools/misc/geekbench/5.nix { };
   geekbench_6 = callPackage ../tools/misc/geekbench/6.nix { };
   geekbench = geekbench_6;
 
-  ghidra = darwin.apple_sdk_11_0.callPackage ../tools/security/ghidra/build.nix {
+  ghidra = callPackage ../tools/security/ghidra/build.nix {
     protobuf = protobuf_21;
   };
 
@@ -2424,13 +2333,10 @@ with pkgs;
 
   ghidra-bin = callPackage ../tools/security/ghidra { };
 
-  glslviewer = callPackage ../development/tools/glslviewer {
-    inherit (darwin.apple_sdk.frameworks) Cocoa;
-  };
+  glslviewer = callPackage ../development/tools/glslviewer { };
 
   gpg-tui = callPackage ../tools/security/gpg-tui {
-    inherit (darwin.apple_sdk.frameworks) AppKit Foundation;
-    inherit (darwin) libobjc libresolv;
+    inherit (darwin) libresolv;
   };
 
   greg = callPackage ../applications/audio/greg {
@@ -2461,20 +2367,11 @@ with pkgs;
 
   intensity-normalization = with python3Packages; toPythonApplication intensity-normalization;
 
-  jellyfin-media-player = libsForQt5.callPackage ../applications/video/jellyfin-media-player {
-    inherit (darwin.apple_sdk.frameworks)
-      CoreFoundation
-      Cocoa
-      CoreAudio
-      MediaPlayer
-      ;
-  };
+  jellyfin-media-player = libsForQt5.callPackage ../applications/video/jellyfin-media-player { };
 
   jellyfin-mpv-shim = python3Packages.callPackage ../applications/video/jellyfin-mpv-shim { };
 
-  kaldi = callPackage ../tools/audio/kaldi {
-    inherit (darwin.apple_sdk.frameworks) Accelerate;
-  };
+  kaldi = callPackage ../tools/audio/kaldi { };
 
   klaus = with python3Packages; toPythonApplication klaus;
 
@@ -2486,23 +2383,15 @@ with pkgs;
 
   klipper-genconf = callPackage ../servers/klipper/klipper-genconf.nix { };
 
-  klipper-estimator = callPackage ../applications/misc/klipper-estimator {
-    inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration;
-  };
+  klipper-estimator = callPackage ../applications/misc/klipper-estimator { };
 
   klog = qt5.callPackage ../applications/radio/klog { };
 
-  krill = callPackage ../servers/krill {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  krill = callPackage ../servers/krill { };
 
-  lapce = callPackage ../applications/editors/lapce {
-    inherit (darwin) libobjc;
-  };
+  lapce = callPackage ../applications/editors/lapce { };
 
-  languagetool-rust = callPackage ../tools/text/languagetool-rust {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  languagetool-rust = callPackage ../tools/text/languagetool-rust { };
 
   lexicon = with python3Packages; toPythonApplication dns-lexicon;
 
@@ -2510,9 +2399,7 @@ with pkgs;
     python = python3;
   };
 
-  lite-xl = callPackage ../applications/editors/lite-xl {
-    inherit (darwin.apple_sdk.frameworks) Foundation;
-  };
+  lite-xl = callPackage ../applications/editors/lite-xl { };
 
   # Less secure variant of lowdown for use inside Nix builds.
   lowdown-unsandboxed = lowdown.override {
@@ -2570,9 +2457,7 @@ with pkgs;
 
   mpd-sima = python3Packages.callPackage ../tools/audio/mpd-sima { };
 
-  nix-template = callPackage ../tools/package-management/nix-template {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  nix-template = callPackage ../tools/package-management/nix-template { };
 
   nltk-data = callPackage ../tools/text/nltk-data { };
 
@@ -2596,17 +2481,11 @@ with pkgs;
 
   online-judge-tools = with python3.pkgs; toPythonApplication online-judge-tools;
 
-  onnxruntime = callPackage ../development/libraries/onnxruntime {
-    inherit (darwin.apple_sdk.frameworks) Foundation;
-  };
+  onnxruntime = callPackage ../development/libraries/onnxruntime { };
 
-  ockam = callPackage ../tools/networking/ockam {
-    inherit (darwin.apple_sdk.frameworks) AppKit Security;
-  };
+  ockam = callPackage ../tools/networking/ockam { };
 
-  pastel = callPackage ../applications/misc/pastel {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  pastel = callPackage ../applications/misc/pastel { };
 
   inherit (ocamlPackages) patdiff;
 
@@ -2616,31 +2495,21 @@ with pkgs;
     electron = electron_34;
   };
 
-  pueue = darwin.apple_sdk_11_0.callPackage ../applications/misc/pueue {
-    inherit (darwin.apple_sdk_11_0) Libsystem;
-    inherit (darwin.apple_sdk_11_0.frameworks) SystemConfiguration;
-  };
+  pueue = callPackage ../applications/misc/pueue { };
 
   pixcat = with python3Packages; toPythonApplication pixcat;
 
   pyznap = python3Packages.callPackage ../tools/backup/pyznap { };
 
-  procs = darwin.apple_sdk_11_0.callPackage ../tools/admin/procs {
-    inherit (darwin.apple_sdk_11_0.frameworks) Security;
-    inherit (darwin.apple_sdk_11_0) Libsystem;
-  };
+  procs = callPackage ../tools/admin/procs { };
 
   psrecord = python3Packages.callPackage ../tools/misc/psrecord { };
 
   rare = python3Packages.callPackage ../games/rare { };
 
-  rblake2sum = callPackage ../tools/security/rblake2sum {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  rblake2sum = callPackage ../tools/security/rblake2sum { };
 
-  rblake3sum = callPackage ../tools/security/rblake3sum {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  rblake3sum = callPackage ../tools/security/rblake3sum { };
 
   rmview = libsForQt5.callPackage ../applications/misc/remarkable/rmview { };
 
@@ -2650,17 +2519,13 @@ with pkgs;
 
   scour = with python3Packages; toPythonApplication scour;
 
-  sheldon = callPackage ../tools/misc/sheldon {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  sheldon = callPackage ../tools/misc/sheldon { };
 
   steampipePackages = recurseIntoAttrs (callPackage ../tools/misc/steampipe-packages { });
 
   swappy = callPackage ../applications/misc/swappy { };
 
-  synth = callPackage ../tools/misc/synth {
-    inherit (darwin.apple_sdk.frameworks) AppKit Security;
-  };
+  synth = callPackage ../tools/misc/synth { };
 
   inherit (callPackages ../servers/rainloop { })
     rainloop-community
@@ -2705,9 +2570,7 @@ with pkgs;
     withHiredis = false;
   };
 
-  rtrtr = callPackage ../servers/rtrtr {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  rtrtr = callPackage ../servers/rtrtr { };
 
   xmlsort = perlPackages.XMLFilterSort;
 
@@ -2748,9 +2611,7 @@ with pkgs;
     inherit (llvmPackages) openmp;
   };
 
-  bacula = callPackage ../tools/backup/bacula {
-    inherit (darwin.apple_sdk.frameworks) CoreFoundation IOKit Kerberos;
-  };
+  bacula = callPackage ../tools/backup/bacula { };
 
   beamerpresenter = beamerpresenter-mupdf;
 
@@ -2774,7 +2635,7 @@ with pkgs;
 
   bmrsa = callPackage ../tools/security/bmrsa/11.nix { };
 
-  bupstash = darwin.apple_sdk_11_0.callPackage ../tools/backup/bupstash { };
+  bupstash = callPackage ../tools/backup/bupstash { };
 
   anystyle-cli = callPackage ../tools/misc/anystyle-cli { };
 
@@ -2786,21 +2647,16 @@ with pkgs;
     stdenv = clangStdenv;
   };
 
-  davix = callPackage ../tools/networking/davix {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  davix = callPackage ../tools/networking/davix { };
 
   davix-copy = davix.override { enableThirdPartyCopy = true; };
 
   cdist = python3Packages.callPackage ../tools/admin/cdist { };
 
-  cdrdao = callPackage ../tools/cd-dvd/cdrdao {
-    inherit (darwin.apple_sdk.frameworks) CoreServices IOKit;
-  };
+  cdrdao = callPackage ../tools/cd-dvd/cdrdao { };
 
   cdrtools = callPackage ../tools/cd-dvd/cdrtools {
     stdenv = if stdenv.hostPlatform.isDarwin then llvmPackages_14.stdenv else stdenv;
-    inherit (darwin.apple_sdk.frameworks) Carbon IOKit;
   };
 
   cemu-ti = qt5.callPackage ../applications/science/math/cemu-ti { };
@@ -2883,9 +2739,7 @@ with pkgs;
     enableWispr = false;
   };
 
-  collectd = callPackage ../tools/system/collectd {
-    inherit (darwin.apple_sdk.frameworks) IOKit;
-  };
+  collectd = callPackage ../tools/system/collectd { };
 
   collectd-data = callPackage ../tools/system/collectd/data.nix { };
 
@@ -2967,22 +2821,16 @@ with pkgs;
         { };
   };
 
-  age-plugin-ledger = callPackage ../tools/security/age-plugin-ledger {
-    inherit (darwin.apple_sdk.frameworks) AppKit;
-  };
+  age-plugin-ledger = callPackage ../tools/security/age-plugin-ledger { };
 
   blacken-docs = with python3Packages; toPythonApplication blacken-docs;
 
-  bore = callPackage ../tools/networking/bore {
-    inherit (darwin) Libsystem;
-    inherit (darwin.apple_sdk.frameworks) SystemConfiguration;
-  };
+  bore = callPackage ../tools/networking/bore { };
 
   bluetooth_battery = python3Packages.callPackage ../applications/misc/bluetooth_battery { };
 
   calyx-vpn = qt6Packages.callPackage ../tools/networking/bitmask-vpn {
     provider = "calyx";
-    inherit (darwin.apple_sdk.frameworks) CoreFoundation Security;
   };
 
   cask-server = libsForQt5.callPackage ../applications/misc/cask-server { };
@@ -2995,10 +2843,7 @@ with pkgs;
 
   ckb-next = libsForQt5.callPackage ../tools/misc/ckb-next { };
 
-  clamav = callPackage ../tools/security/clamav {
-    stdenv = if stdenv.hostPlatform.isDarwin then overrideSDK stdenv "11.0" else stdenv;
-    inherit (darwin.apple_sdk_11_0.frameworks) Foundation;
-  };
+  clamav = callPackage ../tools/security/clamav { };
 
   cmdpack = callPackages ../tools/misc/cmdpack { };
 
@@ -3006,9 +2851,7 @@ with pkgs;
 
   cocoapods-beta = lowPrio (callPackage ../development/tools/cocoapods { beta = true; });
 
-  cocom = callPackage ../tools/networking/cocom {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  cocom = callPackage ../tools/networking/cocom { };
 
   compass = callPackage ../development/tools/compass { };
 
@@ -3086,7 +2929,7 @@ with pkgs;
     opensslSupport = false;
   };
 
-  curl-impersonate = darwin.apple_sdk_11_0.callPackage ../tools/networking/curl-impersonate { };
+  curl-impersonate = callPackage ../tools/networking/curl-impersonate { };
   curl-impersonate-ff = curl-impersonate.curl-impersonate-ff;
   curl-impersonate-chrome = curl-impersonate.curl-impersonate-chrome;
 
@@ -3094,9 +2937,7 @@ with pkgs;
 
   danger-gitlab = callPackage ../applications/version-management/danger-gitlab { };
 
-  dar = callPackage ../tools/backup/dar {
-    inherit (darwin.apple_sdk.frameworks) CoreFoundation;
-  };
+  dar = callPackage ../tools/backup/dar { };
 
   dconf2nix = callPackage ../development/tools/haskell/dconf2nix { };
 
@@ -3116,15 +2957,12 @@ with pkgs;
     enableBloat = false;
   };
 
-  diffr = callPackage ../tools/text/diffr {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  diffr = callPackage ../tools/text/diffr { };
 
   diffutils = callPackage ../tools/text/diffutils { };
 
   dmd = callPackage ../by-name/dm/dmd/package.nix (
     {
-      inherit (darwin.apple_sdk.frameworks) Foundation;
     }
     // lib.optionalAttrs stdenv.hostPlatform.isLinux {
       # https://github.com/NixOS/nixpkgs/pull/206907#issuecomment-1527034123
@@ -3132,9 +2970,7 @@ with pkgs;
     }
   );
 
-  dogdns = callPackage ../tools/networking/dogdns {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  dogdns = callPackage ../tools/networking/dogdns { };
 
   dotnetfx35 = callPackage ../development/libraries/dotnetfx35 { };
 
@@ -3142,9 +2978,7 @@ with pkgs;
 
   sl1-to-photon = python3Packages.callPackage ../applications/misc/sl1-to-photon { };
 
-  drill = callPackage ../tools/networking/drill {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  drill = callPackage ../tools/networking/drill { };
 
   drone = callPackage ../development/tools/continuous-integration/drone { };
   drone-oss = callPackage ../development/tools/continuous-integration/drone {
@@ -3162,9 +2996,7 @@ with pkgs;
     autoreconfHook = buildPackages.autoreconfHook269;
   };
 
-  dump_syms = callPackage ../development/tools/dump_syms {
-    inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration;
-  };
+  dump_syms = callPackage ../development/tools/dump_syms { };
 
   dvtm = callPackage ../tools/misc/dvtm {
     # if you prefer a custom config, write the config.h in dvtm.config.h
@@ -3182,26 +3014,15 @@ with pkgs;
 
   kramdown-asciidoc = callPackage ../tools/typesetting/kramdown-asciidoc { };
 
-  mozwire = callPackage ../tools/networking/mozwire {
-    inherit (darwin.apple_sdk.frameworks) CoreServices Security;
-  };
+  mozwire = callPackage ../tools/networking/mozwire { };
 
-  pax = callPackage ../tools/archivers/pax {
-    inherit (pkgs.darwin.apple_sdk.libs) utmp;
-  };
+  pax = callPackage ../tools/archivers/pax { };
 
   rocmPackages = rocmPackages_6;
   rocmPackages_5 = recurseIntoAttrs (callPackage ../development/rocm-modules/5 { });
   rocmPackages_6 = recurseIntoAttrs (callPackage ../development/rocm-modules/6 { });
 
-  solo2-cli = callPackage ../tools/security/solo2-cli {
-    inherit (darwin.apple_sdk.frameworks)
-      PCSC
-      IOKit
-      CoreFoundation
-      AppKit
-      ;
-  };
+  solo2-cli = callPackage ../tools/security/solo2-cli { };
 
   sonobuoy = callPackage ../applications/networking/cluster/sonobuoy { };
 
@@ -3227,13 +3048,11 @@ with pkgs;
 
   vorta = qt6Packages.callPackage ../applications/backup/vorta { };
 
-  wrangler_1 = callPackage ../development/tools/wrangler_1 {
-    inherit (darwin.apple_sdk.frameworks) CoreFoundation CoreServices Security;
-  };
+  wrangler_1 = callPackage ../development/tools/wrangler_1 { };
 
   xkcdpass = with python3Packages; toPythonApplication xkcdpass;
 
-  zeek = darwin.apple_sdk_11_0.callPackage ../applications/networking/ids/zeek { };
+  zeek = callPackage ../applications/networking/ids/zeek { };
 
   zonemaster-cli = perlPackages.ZonemasterCLI;
 
@@ -3270,21 +3089,13 @@ with pkgs;
 
   emborg = python3Packages.callPackage ../development/python-modules/emborg { };
 
-  emulsion = callPackage ../applications/graphics/emulsion {
-    inherit (darwin.apple_sdk.frameworks)
-      AppKit
-      CoreGraphics
-      CoreServices
-      Foundation
-      OpenGL
-      ;
-  };
+  emulsion = callPackage ../applications/graphics/emulsion { };
 
   encfs = callPackage ../tools/filesystems/encfs {
     tinyxml2 = tinyxml-2;
   };
 
-  envchain = callPackage ../tools/misc/envchain { inherit (darwin.apple_sdk.frameworks) Security; };
+  envchain = callPackage ../tools/misc/envchain { };
 
   ethercalc = callPackage ../servers/web-apps/ethercalc { };
 
@@ -3330,9 +3141,7 @@ with pkgs;
 
   featherpad = callPackage ../applications/editors/featherpad { };
 
-  ffsend = callPackage ../tools/misc/ffsend {
-    inherit (darwin.apple_sdk.frameworks) Security AppKit;
-  };
+  ffsend = callPackage ../tools/misc/ffsend { };
 
   flannel = callPackage ../tools/networking/flannel { };
   cni-plugin-flannel = callPackage ../tools/networking/flannel/plugin.nix { };
@@ -3365,9 +3174,7 @@ with pkgs;
 
   hmetis = pkgsi686Linux.callPackage ../applications/science/math/hmetis { };
 
-  libbtbb = callPackage ../development/libraries/libbtbb {
-    inherit (darwin.apple_sdk.frameworks) CoreServices;
-  };
+  libbtbb = callPackage ../development/libraries/libbtbb { };
 
   lpd8editor = libsForQt5.callPackage ../applications/audio/lpd8editor { };
 
@@ -3379,9 +3186,7 @@ with pkgs;
 
   fox = callPackage ../development/libraries/fox { };
 
-  fox_1_6 = callPackage ../development/libraries/fox/fox-1.6.nix {
-    inherit (darwin.apple_sdk.frameworks) CoreServices;
-  };
+  fox_1_6 = callPackage ../development/libraries/fox/fox-1.6.nix { };
 
   fpm = callPackage ../tools/package-management/fpm { };
 
@@ -3397,21 +3202,13 @@ with pkgs;
     wxGTK = wxGTK32;
   };
 
-  freshfetch = callPackage ../tools/misc/freshfetch {
-    inherit (darwin.apple_sdk.frameworks)
-      AppKit
-      CoreFoundation
-      DiskArbitration
-      Foundation
-      IOKit
-      ;
-  };
+  freshfetch = callPackage ../tools/misc/freshfetch { };
 
   frostwire-bin = callPackage ../applications/networking/p2p/frostwire/frostwire-bin.nix { };
 
   fstl = qt5.callPackage ../applications/graphics/fstl { };
 
-  fuse-ext2 = darwin.apple_sdk_11_0.callPackage ../tools/filesystems/fuse-ext2 { };
+  fuse-ext2 = callPackage ../tools/filesystems/fuse-ext2 { };
 
   fwknop = callPackage ../tools/security/fwknop {
     texinfo = texinfo6_7; # Uses @setcontentsaftertitlepage, removed in 6.8.
@@ -3471,10 +3268,6 @@ with pkgs;
 
   gitqlient = libsForQt5.callPackage ../applications/version-management/gitqlient { };
 
-  globalplatform = callPackage ../by-name/gl/globalplatform/package.nix {
-    inherit (darwin.apple_sdk.frameworks) PCSC;
-  };
-
   glogg = libsForQt5.callPackage ../tools/text/glogg { };
 
   gmrender-resurrect = callPackage ../tools/networking/gmrender-resurrect {
@@ -3524,9 +3317,7 @@ with pkgs;
   };
   gnupg = gnupg24;
 
-  gnuplot = libsForQt5.callPackage ../tools/graphics/gnuplot {
-    inherit (darwin.apple_sdk.frameworks) Cocoa;
-  };
+  gnuplot = libsForQt5.callPackage ../tools/graphics/gnuplot { };
 
   gnuplot_qt = gnuplot.override { withQt = true; };
 
@@ -3584,9 +3375,7 @@ with pkgs;
     cudaSupport = true;
   };
 
-  gptcommit = callPackage ../development/tools/gptcommit {
-    inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration;
-  };
+  gptcommit = callPackage ../development/tools/gptcommit { };
 
   gprof2dot = with python3Packages; toPythonApplication gprof2dot;
 
@@ -3605,22 +3394,15 @@ with pkgs;
     callPackage ../tools/misc/graylog/plugins.nix { graylogPackage = graylog-6_0; }
   );
 
-  graphviz = callPackage ../tools/graphics/graphviz {
-    inherit (darwin.apple_sdk.frameworks) ApplicationServices Foundation;
-  };
+  graphviz = callPackage ../tools/graphics/graphviz { };
 
   graphviz-nox = callPackage ../tools/graphics/graphviz {
-    inherit (darwin.apple_sdk.frameworks) ApplicationServices Foundation;
     withXorg = false;
   };
 
-  igrep = callPackage ../tools/text/igrep {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  igrep = callPackage ../tools/text/igrep { };
 
-  ripgrep-all = callPackage ../tools/text/ripgrep-all {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  ripgrep-all = callPackage ../tools/text/ripgrep-all { };
 
   grub2 = callPackage ../tools/misc/grub/default.nix { };
 
@@ -3666,18 +3448,9 @@ with pkgs;
 
   gzip = callPackage ../tools/compression/gzip { };
 
-  plplot = callPackage ../development/libraries/plplot {
-    inherit (darwin.apple_sdk.frameworks) Cocoa;
-  };
+  plplot = callPackage ../development/libraries/plplot { };
 
-  hashcat = callPackage ../tools/security/hashcat {
-    inherit (darwin.apple_sdk.frameworks)
-      Foundation
-      IOKit
-      Metal
-      OpenCL
-      ;
-  };
+  hashcat = callPackage ../tools/security/hashcat { };
 
   haskell-language-server =
     callPackage ../development/tools/haskell/haskell-language-server/withWrapper.nix
@@ -3753,9 +3526,7 @@ with pkgs;
 
   html-proofer = callPackage ../tools/misc/html-proofer { };
 
-  htmlq = callPackage ../development/tools/htmlq {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  htmlq = callPackage ../development/tools/htmlq { };
 
   httpie = with python3Packages; toPythonApplication httpie;
 
@@ -3777,9 +3548,7 @@ with pkgs;
 
   icepeak = haskell.lib.compose.justStaticExecutables haskellPackages.icepeak;
 
-  ifwifi = callPackage ../tools/networking/ifwifi {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  ifwifi = callPackage ../tools/networking/ifwifi { };
 
   inherit
     (callPackages ../tools/filesystems/irods rec {
@@ -3820,11 +3589,9 @@ with pkgs;
 
   infisical = callPackage ../development/tools/infisical { };
 
-  inform6 = darwin.apple_sdk_11_0.callPackage ../development/compilers/inform6 { };
+  inform6 = callPackage ../development/compilers/inform6 { };
 
-  innernet = callPackage ../tools/networking/innernet {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  innernet = callPackage ../tools/networking/innernet { };
 
   input-remapper = python3Packages.callPackage ../tools/inputmethods/input-remapper { };
 
@@ -3847,9 +3614,7 @@ with pkgs;
   isl_0_20 = callPackage ../development/libraries/isl/0.20.0.nix { };
   isl_0_24 = callPackage ../development/libraries/isl/0.24.0.nix { };
 
-  isync = callPackage ../tools/networking/isync {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  isync = callPackage ../tools/networking/isync { };
 
   jackett = callPackage ../servers/jackett { };
 
@@ -3872,9 +3637,7 @@ with pkgs;
 
   jl = haskellPackages.jl;
 
-  jless = callPackage ../development/tools/jless {
-    inherit (darwin.apple_sdk.frameworks) AppKit;
-  };
+  jless = callPackage ../development/tools/jless { };
 
   joplin = nodePackages.joplin;
 
@@ -3911,39 +3674,15 @@ with pkgs;
 
   kaffeine = libsForQt5.callPackage ../applications/video/kaffeine { };
 
-  kakoune-lsp = callPackage ../by-name/ka/kakoune-lsp/package.nix {
-    inherit (darwin.apple_sdk.frameworks) CoreServices Security SystemConfiguration;
-  };
+  kbs2 = callPackage ../tools/security/kbs2 { };
 
-  kbs2 = callPackage ../tools/security/kbs2 {
-    inherit (darwin.apple_sdk.frameworks) AppKit SystemConfiguration;
-  };
-
-  kdash = callPackage ../development/tools/kdash {
-    inherit (darwin.apple_sdk.frameworks) AppKit;
-  };
+  kdash = callPackage ../development/tools/kdash { };
 
   kdiskmark = libsForQt5.callPackage ../tools/filesystems/kdiskmark { };
 
   keepkey-agent = with python3Packages; toPythonApplication keepkey-agent;
 
-  keybase = darwin.apple_sdk_11_0.callPackage ../tools/security/keybase {
-    # Reasoning for the inherited apple_sdk.frameworks:
-    # 1. specific compiler errors about: AVFoundation, AudioToolbox, MediaToolbox
-    # 2. the rest are added from here: https://github.com/keybase/client/blob/68bb8c893c5214040d86ea36f2f86fbb7fac8d39/go/chat/attachments/preview_darwin.go#L7
-    #      #cgo LDFLAGS: -framework AVFoundation -framework CoreFoundation -framework ImageIO -framework CoreMedia  -framework Foundation -framework CoreGraphics -lobjc
-    #    with the exception of CoreFoundation, due to the warning in https://github.com/NixOS/nixpkgs/blob/master/pkgs/os-specific/darwin/apple-sdk/frameworks.nix#L25
-    inherit (darwin.apple_sdk_11_0.frameworks)
-      AppKit
-      AVFoundation
-      AudioToolbox
-      ImageIO
-      CoreMedia
-      Foundation
-      CoreGraphics
-      MediaToolbox
-      ;
-  };
+  keybase = callPackage ../tools/security/keybase { };
 
   kbfs = callPackage ../tools/security/keybase/kbfs.nix { };
 
@@ -4004,15 +3743,11 @@ with pkgs;
     ocamlPackages = ocaml-ng.ocamlPackages_4_14;
   };
 
-  lldpd = callPackage ../tools/networking/lldpd {
-    inherit (darwin.apple_sdk.frameworks) Foundation;
-  };
+  lldpd = callPackage ../tools/networking/lldpd { };
 
   llm = with python3Packages; toPythonApplication llm;
 
-  lnx = callPackage ../servers/search/lnx {
-    inherit (darwin.apple_sdk.frameworks) DiskArbitration Foundation;
-  };
+  lnx = callPackage ../servers/search/lnx { };
 
   loganalyzer = libsForQt5.callPackage ../development/tools/loganalyzer { };
 
@@ -4039,9 +3774,7 @@ with pkgs;
 
   kristall = libsForQt5.callPackage ../applications/networking/browsers/kristall { };
 
-  lagrange = callPackage ../applications/networking/browsers/lagrange {
-    inherit (darwin.apple_sdk.frameworks) AppKit;
-  };
+  lagrange = callPackage ../applications/networking/browsers/lagrange { };
   lagrange-tui = lagrange.override { enableTUI = true; };
 
   kzipmix = pkgsi686Linux.callPackage ../tools/compression/kzipmix { };
@@ -4063,13 +3796,10 @@ with pkgs;
   md2pdf = with python3Packages; toPythonApplication md2pdf;
 
   mdcat = callPackage ../tools/text/mdcat {
-    inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration;
     inherit (python3Packages) ansi2html;
   };
 
-  mdbook-linkcheck = callPackage ../tools/text/mdbook-linkcheck {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  mdbook-linkcheck = callPackage ../tools/text/mdbook-linkcheck { };
 
   medfile = callPackage ../development/libraries/medfile {
     hdf5 = hdf5.override { usev110Api = true; };
@@ -4077,9 +3807,7 @@ with pkgs;
 
   mhonarc = perlPackages.MHonArc;
 
-  mujmap = callPackage ../applications/networking/mujmap {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  mujmap = callPackage ../applications/networking/mujmap { };
 
   mx-puppet-discord = callPackage ../servers/mx-puppet-discord { };
 
@@ -4121,14 +3849,14 @@ with pkgs;
   nodejs-slim_22 = callPackage ../development/web/nodejs/v22.nix { enableNpm = false; };
   corepack_22 = hiPrio (callPackage ../development/web/nodejs/corepack.nix { nodejs = nodejs_22; });
 
-  nodejs_23 = callPackage ../development/web/nodejs/v23.nix { };
-  nodejs-slim_23 = callPackage ../development/web/nodejs/v23.nix { enableNpm = false; };
-  corepack_23 = hiPrio (callPackage ../development/web/nodejs/corepack.nix { nodejs = nodejs_23; });
+  nodejs_24 = callPackage ../development/web/nodejs/v24.nix { };
+  nodejs-slim_24 = callPackage ../development/web/nodejs/v24.nix { enableNpm = false; };
+  corepack_24 = hiPrio (callPackage ../development/web/nodejs/corepack.nix { nodejs = nodejs_24; });
 
   # Update this when adding the newest nodejs major version!
-  nodejs_latest = nodejs_23;
-  nodejs-slim_latest = nodejs-slim_23;
-  corepack_latest = hiPrio corepack_23;
+  nodejs_latest = nodejs_24;
+  nodejs-slim_latest = nodejs-slim_24;
+  corepack_latest = hiPrio corepack_24;
 
   buildNpmPackage = callPackage ../build-support/node/build-npm-package { };
 
@@ -4147,9 +3875,7 @@ with pkgs;
 
   node2nix = nodePackages.node2nix;
 
-  oxigraph = callPackage ../servers/oxigraph {
-    inherit (darwin.apple_sdk.frameworks) IOKit Security;
-  };
+  oxigraph = callPackage ../servers/oxigraph { };
 
   kcollectd = libsForQt5.callPackage ../tools/misc/kcollectd { };
 
@@ -4165,9 +3891,7 @@ with pkgs;
     ;
   lerna = lerna_8;
 
-  lethe = callPackage ../tools/security/lethe {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  lethe = callPackage ../tools/security/lethe { };
 
   libhandy = callPackage ../development/libraries/libhandy { };
 
@@ -4244,7 +3968,6 @@ with pkgs;
   inherit
     ({
       limesuite = callPackage ../applications/radio/limesuite {
-        inherit (darwin.apple_sdk.frameworks) GLUT;
       };
       limesuiteWithGui = limesuite.override {
         withGui = true;
@@ -4323,9 +4046,7 @@ with pkgs;
 
   molecule = with python3Packages; toPythonApplication molecule;
 
-  monolith = callPackage ../tools/backup/monolith {
-    inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration;
-  };
+  monolith = callPackage ../tools/backup/monolith { };
 
   moreutils = callPackage ../tools/misc/moreutils {
     docbook-xsl = docbook_xsl;
@@ -4333,9 +4054,7 @@ with pkgs;
 
   metasploit = callPackage ../tools/security/metasploit { };
 
-  mhost = callPackage ../applications/networking/mhost {
-    inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration;
-  };
+  mhost = callPackage ../applications/networking/mhost { };
 
   mtr = callPackage ../tools/networking/mtr { };
 
@@ -4370,9 +4089,7 @@ with pkgs;
     hdf5 = hdf5-mpi.override { usev110Api = true; };
   };
 
-  netcdffortran = callPackage ../development/libraries/netcdf-fortran {
-    inherit (darwin.apple_sdk.frameworks) CoreFoundation CoreServices SystemConfiguration;
-  };
+  netcdffortran = callPackage ../development/libraries/netcdf-fortran { };
 
   inherit (callPackage ../servers/web-apps/netbox { }) netbox_3_7;
 
@@ -4431,10 +4148,7 @@ with pkgs;
 
   mkgmap-splitter = callPackage ../applications/misc/mkgmap/splitter { };
 
-  op-geth = callPackage ../applications/blockchains/optimism/geth.nix {
-    inherit (darwin) libobjc;
-    inherit (darwin.apple_sdk.frameworks) IOKit;
-  };
+  op-geth = callPackage ../applications/blockchains/optimism/geth.nix { };
 
   optimism = callPackage ../applications/blockchains/optimism { };
 
@@ -4470,9 +4184,7 @@ with pkgs;
     protobuf = protobuf_21;
   };
 
-  ntfs3g = callPackage ../tools/filesystems/ntfs-3g {
-    inherit (darwin.apple_sdk.frameworks) DiskArbitration;
-  };
+  ntfs3g = callPackage ../tools/filesystems/ntfs-3g { };
 
   # ntfsprogs are merged into ntfs-3g
   ntfsprogs = pkgs.ntfs3g;
@@ -4487,9 +4199,7 @@ with pkgs;
 
   nxdomain = python3.pkgs.callPackage ../tools/networking/nxdomain { };
 
-  octofetch = callPackage ../tools/misc/octofetch {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  octofetch = callPackage ../tools/misc/octofetch { };
 
   ofono-phonesim = libsForQt5.callPackage ../development/tools/ofono-phonesim { };
 
@@ -4497,9 +4207,7 @@ with pkgs;
     protobuf = protobuf_21;
   };
 
-  olive-editor = qt6Packages.callPackage ../applications/video/olive-editor {
-    inherit (darwin.apple_sdk.frameworks) CoreFoundation;
-  };
+  olive-editor = qt6Packages.callPackage ../applications/video/olive-editor { };
 
   ombi = callPackage ../servers/ombi { };
 
@@ -4513,9 +4221,7 @@ with pkgs;
 
   openboard = libsForQt5.callPackage ../applications/graphics/openboard { };
 
-  opendht = callPackage ../development/libraries/opendht {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  opendht = callPackage ../development/libraries/opendht { };
 
   ophcrack-cli = ophcrack.override { enableGui = false; };
 
@@ -4543,7 +4249,7 @@ with pkgs;
     openrgb-plugin-hardwaresync
   ];
 
-  toastify = darwin.apple_sdk_11_0.callPackage ../tools/misc/toastify { };
+  toastify = callPackage ../tools/misc/toastify { };
 
   opensshPackages = dontRecurseIntoAttrs (callPackage ../tools/networking/openssh { });
 
@@ -4624,9 +4330,7 @@ with pkgs;
 
   ossec-server = callPackage ../tools/security/ossec/server.nix { };
 
-  ovito = qt6Packages.callPackage ../applications/graphics/ovito {
-    inherit (darwin.apple_sdk.frameworks) VideoDecodeAcceleration;
-  };
+  ovito = qt6Packages.callPackage ../applications/graphics/ovito { };
 
   p4c = callPackage ../development/compilers/p4c {
     protobuf = protobuf_21;
@@ -4655,9 +4359,7 @@ with pkgs;
     autoreconfHook = buildPackages.autoreconfHook269;
   };
 
-  parrot = callPackage ../applications/audio/parrot {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  parrot = callPackage ../applications/audio/parrot { };
 
   patchutils = callPackage ../tools/text/patchutils { };
 
@@ -4686,22 +4388,16 @@ with pkgs;
 
   patchance = python3Packages.callPackage ../applications/audio/patchance { };
 
-  pciutils = callPackage ../tools/system/pciutils {
-    inherit (darwin.apple_sdk.frameworks) IOKit;
-  };
+  pciutils = callPackage ../tools/system/pciutils { };
 
-  pcsclite = callPackage ../tools/security/pcsclite {
-    inherit (darwin.apple_sdk.frameworks) Foundation IOKit;
-  };
+  pcsclite = callPackage ../tools/security/pcsclite { };
 
   pcscliteWithPolkit = pcsclite.override {
     pname = "pcsclite-with-polkit";
     polkitSupport = true;
   };
 
-  pcsc-tools = callPackage ../tools/security/pcsc-tools {
-    inherit (pkgs.darwin.apple_sdk.frameworks) PCSC;
-  };
+  pcsc-tools = callPackage ../tools/security/pcsc-tools { };
 
   pdd = python3Packages.callPackage ../tools/misc/pdd { };
 
@@ -4739,22 +4435,11 @@ with pkgs;
 
   pinnwand = callPackage ../servers/pinnwand { };
 
-  piping-server-rust = callPackage ../servers/piping-server-rust {
-    inherit (darwin.apple_sdk.frameworks) CoreServices Security;
-  };
+  piping-server-rust = callPackage ../servers/piping-server-rust { };
 
-  pinyin-tool = callPackage ../tools/text/pinyin-tool {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  pinyin-tool = callPackage ../tools/text/pinyin-tool { };
 
-  plan9port = darwin.apple_sdk_11_0.callPackage ../tools/system/plan9port {
-    inherit (darwin.apple_sdk_11_0.frameworks)
-      Carbon
-      Cocoa
-      IOKit
-      Metal
-      QuartzCore
-      ;
+  plan9port = callPackage ../tools/system/plan9port {
     inherit (darwin) DarwinTools;
   };
 
@@ -4794,9 +4479,7 @@ with pkgs;
     python = null;
   };
 
-  pngpaste = callPackage ../os-specific/darwin/pngpaste {
-    inherit (darwin.apple_sdk.frameworks) AppKit Cocoa;
-  };
+  pngpaste = callPackage ../os-specific/darwin/pngpaste { };
 
   inherit (callPackage ../development/tools/pnpm { })
     pnpm_8
@@ -4820,15 +4503,11 @@ with pkgs;
 
   projectm_3 = libsForQt5.callPackage ../applications/audio/projectm_3 { };
 
-  proxmark3 = libsForQt5.callPackage ../tools/security/proxmark3/default.nix {
-    inherit (darwin.apple_sdk_11_0.frameworks) Foundation AppKit;
-  };
+  proxmark3 = libsForQt5.callPackage ../tools/security/proxmark3/default.nix { };
 
   pws = callPackage ../tools/misc/pws { };
 
-  pwninit = callPackage ../development/tools/misc/pwninit {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  pwninit = callPackage ../development/tools/misc/pwninit { };
 
   pycflow2dot = with python3.pkgs; toPythonApplication pycflow2dot;
 
@@ -4840,7 +4519,7 @@ with pkgs;
 
   pypass = with python3Packages; toPythonApplication pypass;
 
-  py-spy = darwin.apple_sdk_11_0.callPackage ../development/tools/py-spy { };
+  py-spy = callPackage ../development/tools/py-spy { };
 
   pydeps = with python3Packages; toPythonApplication pydeps;
 
@@ -4852,7 +4531,6 @@ with pkgs;
 
   riseup-vpn = qt6Packages.callPackage ../tools/networking/bitmask-vpn {
     provider = "riseup";
-    inherit (darwin.apple_sdk.frameworks) CoreFoundation Security;
   };
 
   rocket = libsForQt5.callPackage ../tools/graphics/rocket { };
@@ -4863,12 +4541,10 @@ with pkgs;
 
   rtaudio = callPackage ../development/libraries/audio/rtaudio {
     jack = libjack2;
-    inherit (darwin.apple_sdk.frameworks) CoreAudio;
   };
 
   rtmidi = callPackage ../development/libraries/audio/rtmidi {
     jack = libjack2;
-    inherit (darwin.apple_sdk.frameworks) CoreMIDI CoreAudio CoreServices;
   };
 
   mpi = openmpi; # this attribute should used to build MPI applications
@@ -4876,9 +4552,7 @@ with pkgs;
 
   qarte = libsForQt5.callPackage ../applications/video/qarte { };
 
-  qdrant = darwin.apple_sdk_11_0.callPackage ../servers/search/qdrant {
-    inherit (darwin.apple_sdk_11_0.frameworks) Security SystemConfiguration;
-  };
+  qdrant = callPackage ../servers/search/qdrant { };
 
   qlcplus = libsForQt5.callPackage ../applications/misc/qlcplus { };
 
@@ -4900,9 +4574,7 @@ with pkgs;
 
   quictls = callPackage ../development/libraries/quictls { };
 
-  quickwit = callPackage ../servers/search/quickwit {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  quickwit = callPackage ../servers/search/quickwit { };
 
   quota = if stdenv.hostPlatform.isLinux then linuxquota else unixtools.quota;
 
@@ -4946,7 +4618,7 @@ with pkgs;
 
   recoll-nox = recoll.override { withGui = false; };
 
-  remmina = darwin.apple_sdk_11_0.callPackage ../applications/networking/remote/remmina { };
+  remmina = callPackage ../applications/networking/remote/remmina { };
 
   reckon = callPackage ../tools/text/reckon { };
 
@@ -4968,11 +4640,7 @@ with pkgs;
     inherit (python3Packages) sphinx;
   };
 
-  # Use `apple_sdk_11_0` because `apple_sdk.libs` does not provide `simd`
-  rnnoise-plugin = darwin.apple_sdk_11_0.callPackage ../development/libraries/rnnoise-plugin {
-    inherit (darwin.apple_sdk_11_0.frameworks) WebKit MetalKit CoreAudioKit;
-    inherit (darwin.apple_sdk_11_0.libs) simd;
-  };
+  rnnoise-plugin = callPackage ../development/libraries/rnnoise-plugin { };
 
   rosenpass = callPackage ../tools/networking/rosenpass { };
 
@@ -4992,43 +4660,29 @@ with pkgs;
 
   ruby-lsp = rubyPackages.ruby-lsp;
 
-  rust-motd = callPackage ../tools/misc/rust-motd {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  rust-motd = callPackage ../tools/misc/rust-motd { };
 
-  rustscan = callPackage ../tools/security/rustscan {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  rustscan = callPackage ../tools/security/rustscan { };
 
-  rustdesk-server = callPackage ../by-name/ru/rustdesk-server/package.nix {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
-
-  s3fs = darwin.apple_sdk_11_0.callPackage ../tools/filesystems/s3fs { };
+  s3fs = callPackage ../tools/filesystems/s3fs { };
 
   s3cmd = python3Packages.callPackage ../tools/networking/s3cmd { };
 
-  s3rs = callPackage ../tools/networking/s3rs {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  s3rs = callPackage ../tools/networking/s3rs { };
 
   s3-credentials = with python3Packages; toPythonApplication s3-credentials;
 
   safety-cli = with python3.pkgs; toPythonApplication safety;
 
-  saml2aws = callPackage ../tools/security/saml2aws {
-    inherit (darwin.apple_sdk.frameworks) AppKit;
-  };
+  saml2aws = callPackage ../tools/security/saml2aws { };
 
   sasview = libsForQt5.callPackage ../applications/science/misc/sasview { };
 
-  screen = callPackage ../tools/misc/screen {
-    inherit (darwin.apple_sdk.libs) utmp;
-  };
+  screen = callPackage ../tools/misc/screen { };
 
   scfbuild = python3.pkgs.callPackage ../tools/misc/scfbuild { };
 
-  securefs = darwin.apple_sdk_11_0.callPackage ../tools/filesystems/securefs { };
+  securefs = callPackage ../tools/filesystems/securefs { };
 
   segger-jlink-headless = callPackage ../by-name/se/segger-jlink/package.nix { headless = true; };
 
@@ -5058,9 +4712,7 @@ with pkgs;
     conf = config.slstatus.conf or null;
   };
 
-  smartmontools = callPackage ../tools/system/smartmontools {
-    inherit (darwin.apple_sdk.frameworks) IOKit ApplicationServices;
-  };
+  smartmontools = callPackage ../tools/system/smartmontools { };
 
   smpq = callPackage ../by-name/sm/smpq/package.nix {
     stormlib = stormlib.overrideAttrs (old: {
@@ -5074,8 +4726,7 @@ with pkgs;
     });
   };
 
-  snapcast = darwin.apple_sdk_11_0.callPackage ../applications/audio/snapcast {
-    inherit (darwin.apple_sdk_11_0.frameworks) IOKit AudioToolbox;
+  snapcast = callPackage ../applications/audio/snapcast {
     pulseaudioSupport = config.pulseaudio or stdenv.hostPlatform.isLinux;
   };
 
@@ -5095,10 +4746,7 @@ with pkgs;
 
   spoof-mac = python3Packages.callPackage ../tools/networking/spoof-mac { };
 
-  softhsm = callPackage ../tools/security/softhsm {
-    inherit (darwin) libobjc;
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  softhsm = callPackage ../tools/security/softhsm { };
 
   soundkonverter = libsForQt5.soundkonverter;
 
@@ -5121,7 +4769,7 @@ with pkgs;
 
   splot = haskell.lib.compose.justStaticExecutables haskellPackages.splot;
 
-  squashfs-tools-ng = darwin.apple_sdk_11_0.callPackage ../tools/filesystems/squashfs-tools-ng { };
+  squashfs-tools-ng = callPackage ../tools/filesystems/squashfs-tools-ng { };
 
   sourcehut = callPackage ../applications/version-management/sourcehut { };
 
@@ -5162,9 +4810,7 @@ with pkgs;
 
   subzerod = with python3Packages; toPythonApplication subzerod;
 
-  suckit = callPackage ../tools/networking/suckit {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  suckit = callPackage ../tools/networking/suckit { };
 
   system-config-printer = callPackage ../tools/misc/system-config-printer {
     autoreconfHook = buildPackages.autoreconfHook269;
@@ -5179,9 +4825,7 @@ with pkgs;
 
   t = callPackage ../tools/misc/t { };
 
-  tab-rs = callPackage ../tools/misc/tab-rs {
-    inherit (darwin.apple_sdk.frameworks) IOKit;
-  };
+  tab-rs = callPackage ../tools/misc/tab-rs { };
 
   tartube = callPackage ../applications/video/tartube { };
 
@@ -5189,15 +4833,12 @@ with pkgs;
     youtube-dl = yt-dlp;
   };
 
-  tcpreplay = callPackage ../tools/networking/tcpreplay {
-    inherit (darwin.apple_sdk.frameworks) Carbon CoreServices;
-  };
+  tcpreplay = callPackage ../tools/networking/tcpreplay { };
 
   teamviewer = libsForQt5.callPackage ../applications/networking/remote/teamviewer { };
 
   inherit
     (callPackages ../servers/teleport {
-      inherit (darwin.apple_sdk.frameworks) CoreFoundation Security AppKit;
     })
     teleport_16
     teleport_17
@@ -5244,9 +4885,7 @@ with pkgs;
 
   tldr-hs = haskellPackages.tldr;
 
-  tmux-sessionizer = callPackage ../tools/misc/tmux-sessionizer {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  tmux-sessionizer = callPackage ../tools/misc/tmux-sessionizer { };
 
   tmuxPlugins = recurseIntoAttrs (
     callPackage ../misc/tmux-plugins {
@@ -5254,19 +4893,15 @@ with pkgs;
     }
   );
 
-  tokei = callPackage ../development/tools/misc/tokei {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  tokei = callPackage ../development/tools/misc/tokei { };
 
-  topgrade = callPackage ../tools/misc/topgrade {
-    inherit (darwin.apple_sdk.frameworks) AppKit Cocoa Foundation;
-  };
+  topgrade = callPackage ../tools/misc/topgrade { };
 
   tor = callPackage ../tools/security/tor { };
 
   torsocks = callPackage ../tools/security/tor/torsocks.nix { };
 
-  toybox = darwin.apple_sdk_11_0.callPackage ../tools/misc/toybox { };
+  toybox = callPackage ../tools/misc/toybox { };
 
   trackma-curses = trackma.override { withCurses = true; };
 
@@ -5278,16 +4913,10 @@ with pkgs;
 
   trezorctl = with python3Packages; toPythonApplication trezor;
 
-  trezord = callPackage ../servers/trezord {
-    inherit (darwin.apple_sdk.frameworks) AppKit;
-  };
+  trezord = callPackage ../servers/trezord { };
 
   trezor-agent = with python3Packages; toPythonApplication trezor-agent;
 
-  trunk-ng = callPackage ../by-name/tr/trunk-ng/package.nix {
-    inherit (darwin.apple_sdk.frameworks) CoreServices Security SystemConfiguration;
-  };
-
   ttp = with python3.pkgs; toPythonApplication ttp;
 
   trace-cmd = callPackage ../os-specific/linux/trace-cmd { };
@@ -5314,13 +4943,9 @@ with pkgs;
   };
   ttfautohint-nox = ttfautohint.override { enableGUI = false; };
 
-  tuifeed = callPackage ../applications/networking/feedreaders/tuifeed {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  tuifeed = callPackage ../applications/networking/feedreaders/tuifeed { };
 
-  tunnelto = callPackage ../tools/networking/tunnelto {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  tunnelto = callPackage ../tools/networking/tunnelto { };
 
   twilight = callPackage ../tools/graphics/twilight {
     libX11 = xorg.libX11;
@@ -5389,17 +5014,11 @@ with pkgs;
     inherit (perlPackages) Po4a;
   };
 
-  sentry-cli = callPackage ../development/tools/sentry-cli {
-    inherit (darwin.apple_sdk.frameworks) CoreServices Security SystemConfiguration;
-  };
+  sentry-cli = callPackage ../development/tools/sentry-cli { };
 
-  waifu2x-converter-cpp = callPackage ../tools/graphics/waifu2x-converter-cpp {
-    inherit (darwin.apple_sdk.frameworks) OpenCL;
-  };
+  waifu2x-converter-cpp = callPackage ../tools/graphics/waifu2x-converter-cpp { };
 
-  watchexec = callPackage ../tools/misc/watchexec {
-    inherit (darwin.apple_sdk.frameworks) Cocoa AppKit;
-  };
+  watchexec = callPackage ../tools/misc/watchexec { };
 
   webassemblyjs-cli = nodePackages."@webassemblyjs/cli-1.11.1";
   webassemblyjs-repl = nodePackages."@webassemblyjs/repl-1.11.1";
@@ -5411,15 +5030,12 @@ with pkgs;
   wast-refmt = nodePackages."@webassemblyjs/wast-refmt-1.11.1";
 
   wasmedge = callPackage ../development/tools/wasmedge {
-    stdenv = if stdenv.hostPlatform.isDarwin then overrideSDK stdenv "11.0" else llvmPackages.stdenv;
-    inherit (darwin.apple_sdk_11_0.frameworks) Foundation;
+    stdenv = clangStdenv;
   };
 
   whatweb = callPackage ../tools/security/whatweb { };
 
-  wg-netmanager = callPackage ../tools/networking/wg-netmanager {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  wg-netmanager = callPackage ../tools/networking/wg-netmanager { };
 
   woodpecker-agent = callPackage ../development/tools/continuous-integration/woodpecker/agent.nix { };
 
@@ -5435,9 +5051,7 @@ with pkgs;
 
   testdisk-qt = testdisk.override { enableQt = true; };
 
-  htmldoc = callPackage ../tools/typesetting/htmldoc {
-    inherit (darwin.apple_sdk.frameworks) SystemConfiguration Foundation;
-  };
+  htmldoc = callPackage ../tools/typesetting/htmldoc { };
 
   td = callPackage ../tools/misc/td { };
 
@@ -5445,9 +5059,7 @@ with pkgs;
 
   tkgate = callPackage ../applications/science/electronics/tkgate/1.x.nix { };
 
-  tremor-rs = darwin.apple_sdk_11_0.callPackage ../tools/misc/tremor-rs {
-    inherit (darwin.apple_sdk_11_0.frameworks) Security;
-  };
+  tremor-rs = callPackage ../tools/misc/tremor-rs { };
 
   tremor-language-server = callPackage ../tools/misc/tremor-rs/ls.nix { };
 
@@ -5481,9 +5093,7 @@ with pkgs;
     withRedis = true;
   };
 
-  unicorn = callPackage ../development/libraries/unicorn {
-    inherit (darwin.apple_sdk.frameworks) IOKit;
-  };
+  unicorn = callPackage ../development/libraries/unicorn { };
 
   unrar-wrapper = python3Packages.callPackage ../tools/archivers/unrar-wrapper { };
 
@@ -5496,7 +5106,6 @@ with pkgs;
   };
 
   unar = callPackage ../tools/archivers/unar {
-    inherit (darwin.apple_sdk.frameworks) Foundation AppKit;
     stdenv = clangStdenv;
   };
 
@@ -5515,9 +5124,7 @@ with pkgs;
   varnishPackages = varnish77Packages;
   varnish = varnishPackages.varnish;
 
-  viceroy = callPackage ../development/tools/viceroy {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  viceroy = callPackage ../development/tools/viceroy { };
 
   vncdo = with python3Packages; toPythonApplication vncdo;
 
@@ -5528,9 +5135,7 @@ with pkgs;
   # https://github.com/NixOS/nixpkgs/issues/227327
   wafHook = waf.hook;
 
-  wagyu = callPackage ../tools/misc/wagyu {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  wagyu = callPackage ../tools/misc/wagyu { };
 
   web-eid-app = libsForQt5.callPackage ../tools/security/web-eid-app { };
 
@@ -5538,10 +5143,7 @@ with pkgs;
     wlroots = wlroots_0_17;
   };
 
-  wiiuse = callPackage ../development/libraries/wiiuse {
-    inherit (darwin) libobjc;
-    inherit (darwin.apple_sdk.frameworks) Foundation IOBluetooth;
-  };
+  wiiuse = callPackage ../development/libraries/wiiuse { };
 
   wring = nodePackages.wring;
 
@@ -5578,9 +5180,7 @@ with pkgs;
     w3m = w3m-batch;
   };
 
-  xidlehook = callPackage ../tools/X11/xidlehook {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  xidlehook = callPackage ../tools/X11/xidlehook { };
 
   xorriso = libisoburn;
 
@@ -5611,17 +5211,13 @@ with pkgs;
   # To expose more packages for Yi, override the extraPackages arg.
   yi = callPackage ../applications/editors/yi/wrapper.nix { };
 
-  yaydl = callPackage ../tools/video/yaydl {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  yaydl = callPackage ../tools/video/yaydl { };
 
   zbackup = callPackage ../tools/backup/zbackup {
     protobuf = protobuf_21;
   };
 
-  zbar = libsForQt5.callPackage ../tools/graphics/zbar {
-    inherit (darwin.apple_sdk.frameworks) Foundation;
-  };
+  zbar = libsForQt5.callPackage ../tools/graphics/zbar { };
 
   # Nvidia support does not require any propietary libraries, so CI can build it.
   # Note that when enabling this unconditionally, non-nvidia users will always have an empty "GPU" section.
@@ -5710,9 +5306,7 @@ with pkgs;
     stdenv = gcc10Stdenv;
   };
 
-  autocorrect = callPackage ../tools/text/autocorrect {
-    inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration;
-  };
+  autocorrect = callPackage ../tools/text/autocorrect { };
 
   ballerina = callPackage ../development/compilers/ballerina {
     openjdk = openjdk17_headless;
@@ -5807,11 +5401,9 @@ with pkgs;
   corretto17 = javaPackages.compiler.corretto17;
   corretto21 = javaPackages.compiler.corretto21;
 
-  cotton = callPackage ../development/tools/cotton {
-    inherit (darwin.apple_sdk.frameworks) CoreServices;
-  };
+  cotton = callPackage ../development/tools/cotton { };
 
-  inherit (darwin.apple_sdk_11_0.callPackage ../development/compilers/crystal { })
+  inherit (callPackage ../development/compilers/crystal { })
     crystal_1_11
     crystal_1_14
     crystal_1_15
@@ -6282,6 +5874,10 @@ with pkgs;
         # JS backend can't use gmp
         else if stdenv.hostPlatform.isGhcjs then
           haskell.packages.native-bignum.ghc98
+        # ICEs horribly on i686, see https://gitlab.haskell.org/ghc/ghc/-/issues/25904
+        # FIXME: remove when fixed
+        else if stdenv.hostPlatform.isi686 then
+          haskell.packages.ghc96
         else
           haskell.packages.ghc98
       )
@@ -6307,6 +5903,10 @@ with pkgs;
       # JS backend can't use GMP
       else if stdenv.targetPlatform.isGhcjs then
         haskell.compiler.native-bignum.ghc98
+      # ICEs horribly on i686, see https://gitlab.haskell.org/ghc/ghc/-/issues/25904
+      # FIXME: remove when fixed
+      else if stdenv.hostPlatform.isi686 then
+        haskell.compiler.ghc96
       else
         haskell.compiler.ghc98
     );
@@ -6369,7 +5969,6 @@ with pkgs;
 
   inherit
     (callPackage ../development/compilers/haxe {
-      inherit (darwin.apple_sdk.frameworks) Security;
     })
     haxe_4_3
     haxe_4_1
@@ -6398,14 +5997,7 @@ with pkgs;
 
   gwt240 = callPackage ../development/compilers/gwt/2.4.0.nix { };
 
-  iay = callPackage ../tools/misc/iay {
-    inherit (darwin.apple_sdk.frameworks)
-      AppKit
-      Security
-      Foundation
-      Cocoa
-      ;
-  };
+  iay = callPackage ../tools/misc/iay { };
 
   idrisPackages = dontRecurseIntoAttrs (
     callPackage ../development/idris-modules {
@@ -6525,7 +6117,7 @@ with pkgs;
   julia-stable-bin = julia_111-bin;
   julia-bin = julia-stable-bin;
 
-  kind2 = darwin.apple_sdk_11_0.callPackage ../development/compilers/kind2 { };
+  kind2 = callPackage ../development/compilers/kind2 { };
 
   koka = haskell.lib.compose.justStaticExecutables (
     haskellPackages.callPackage ../development/compilers/koka { }
@@ -6548,16 +6140,7 @@ with pkgs;
     withQt = true;
   };
 
-  lobster = callPackage ../development/compilers/lobster {
-    inherit (darwin.apple_sdk.frameworks)
-      CoreFoundation
-      Cocoa
-      AudioToolbox
-      OpenGL
-      Foundation
-      ForceFeedback
-      ;
-  };
+  lobster = callPackage ../development/compilers/lobster { };
 
   lld = llvmPackages.lld;
   lld_12 = llvmPackages_12.lld;
@@ -6651,9 +6234,7 @@ with pkgs;
     mkLLVMPackages
     ;
 
-  lorri = callPackage ../tools/misc/lorri {
-    inherit (darwin.apple_sdk.frameworks) CoreServices Security;
-  };
+  lorri = callPackage ../tools/misc/lorri { };
 
   mercury = callPackage ../development/compilers/mercury {
     jdk_headless = openjdk8_headless; # TODO: remove override https://github.com/NixOS/nixpkgs/pull/89731
@@ -6679,22 +6260,11 @@ with pkgs;
 
   mono = mono6;
 
-  mono4 = lowPrio (
-    callPackage ../development/compilers/mono/4.nix {
-      inherit (darwin) libobjc;
-      inherit (darwin.apple_sdk.frameworks) Foundation;
-    }
-  );
+  mono4 = lowPrio (callPackage ../development/compilers/mono/4.nix { });
 
-  mono5 = callPackage ../development/compilers/mono/5.nix {
-    inherit (darwin) libobjc;
-    inherit (darwin.apple_sdk.frameworks) Foundation;
-  };
+  mono5 = callPackage ../development/compilers/mono/5.nix { };
 
-  mono6 = callPackage ../development/compilers/mono/6.nix {
-    inherit (darwin) libobjc;
-    inherit (darwin.apple_sdk.frameworks) Foundation;
-  };
+  mono6 = callPackage ../development/compilers/mono/6.nix { };
 
   mozart2 = callPackage ../development/compilers/mozart {
     emacs = emacs-nox;
@@ -6753,9 +6323,7 @@ with pkgs;
 
   ber_metaocaml = callPackage ../development/compilers/ocaml/ber-metaocaml.nix { };
 
-  opam = callPackage ../development/tools/ocaml/opam {
-    inherit (darwin.apple_sdk.frameworks) Foundation;
-  };
+  opam = callPackage ../development/tools/ocaml/opam { };
 
   opam-installer = callPackage ../development/tools/ocaml/opam/installer.nix { };
 
@@ -6765,17 +6333,13 @@ with pkgs;
   open-watcom-bin-unwrapped = callPackage ../development/compilers/open-watcom/bin.nix { };
   open-watcom-bin = wrapWatcom open-watcom-bin-unwrapped { };
 
-  replibyte = callPackage ../development/tools/database/replibyte {
-    inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration;
-  };
+  replibyte = callPackage ../development/tools/database/replibyte { };
 
   rml = callPackage ../development/compilers/rml {
     ocamlPackages = ocaml-ng.ocamlPackages_4_14;
   };
 
-  rtags = callPackage ../development/tools/rtags {
-    inherit (darwin) apple_sdk;
-  };
+  rtags = callPackage ../development/tools/rtags { };
 
   wrapRustcWith = { rustc-unwrapped, ... }@args: callPackage ../build-support/rust/rustc-wrapper args;
   wrapRustc = rustc-unwrapped: wrapRustcWith { inherit rustc-unwrapped; };
@@ -6828,33 +6392,17 @@ with pkgs;
   buildRustCrateHelpers = callPackage ../build-support/rust/build-rust-crate/helpers.nix { };
 
   cargo-flamegraph = callPackage ../development/tools/rust/cargo-flamegraph {
-    inherit (darwin.apple_sdk.frameworks) Security;
     inherit (linuxPackages) perf;
   };
 
   defaultCrateOverrides = callPackage ../build-support/rust/default-crate-overrides.nix { };
 
-  cargo-audit = callPackage ../development/tools/rust/cargo-audit {
-    inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration;
-  };
-  cargo-c = callPackage ../development/tools/rust/cargo-c {
-    inherit (darwin.apple_sdk.frameworks) CoreFoundation Security;
-  };
-  cargo-clone = callPackage ../development/tools/rust/cargo-clone {
-    inherit (darwin.apple_sdk.frameworks) CoreServices Security SystemConfiguration;
-  };
-  cargo-codspeed = callPackage ../development/tools/rust/cargo-codspeed {
-    rustPlatform = makeRustPlatform {
-      stdenv = if stdenv.hostPlatform.isDarwin then overrideSDK stdenv "11.0" else stdenv;
-      inherit rustc cargo;
-    };
-  };
-  cargo-cyclonedx = callPackage ../development/tools/rust/cargo-cyclonedx {
-    inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration CoreFoundation;
-  };
-  cargo-edit = callPackage ../development/tools/rust/cargo-edit {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  cargo-audit = callPackage ../development/tools/rust/cargo-audit { };
+  cargo-c = callPackage ../development/tools/rust/cargo-c { };
+  cargo-clone = callPackage ../development/tools/rust/cargo-clone { };
+  cargo-codspeed = callPackage ../development/tools/rust/cargo-codspeed { };
+  cargo-cyclonedx = callPackage ../development/tools/rust/cargo-cyclonedx { };
+  cargo-edit = callPackage ../development/tools/rust/cargo-edit { };
   inherit (callPackages ../development/tools/rust/cargo-pgrx { })
     cargo-pgrx_0_12_0_alpha_1
     cargo-pgrx_0_12_5
@@ -6862,56 +6410,27 @@ with pkgs;
     ;
   cargo-pgrx = cargo-pgrx_0_12_6;
 
-  buildPgrxExtension = callPackage ../development/tools/rust/cargo-pgrx/buildPgrxExtension.nix {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
-  cargo-tarpaulin = callPackage ../development/tools/analysis/cargo-tarpaulin {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
-  cargo-bazel = callPackage ../development/tools/rust/cargo-bazel {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
-  cargo-crev = callPackage ../development/tools/rust/cargo-crev {
-    inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration CoreFoundation;
-  };
-  cargo-fund = callPackage ../development/tools/rust/cargo-fund {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
-  cargo-hf2 = callPackage ../development/tools/rust/cargo-hf2 {
-    inherit (darwin.apple_sdk.frameworks) AppKit;
-  };
-  cargo-ndk = callPackage ../development/tools/rust/cargo-ndk {
-    inherit (darwin.apple_sdk.frameworks) CoreGraphics Foundation;
-  };
-
-  cargo-rdme = callPackage ../by-name/ca/cargo-rdme/package.nix {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
-  cargo-udeps = callPackage ../development/tools/rust/cargo-udeps {
-    inherit (darwin.apple_sdk.frameworks) CoreServices Security SystemConfiguration;
-  };
-  cargo-watch = callPackage ../development/tools/rust/cargo-watch {
-    inherit (darwin.apple_sdk.frameworks) Foundation Cocoa;
-  };
-  cargo-whatfeatures = callPackage ../development/tools/rust/cargo-whatfeatures {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  buildPgrxExtension = callPackage ../development/tools/rust/cargo-pgrx/buildPgrxExtension.nix { };
+  cargo-tarpaulin = callPackage ../development/tools/analysis/cargo-tarpaulin { };
+  cargo-bazel = callPackage ../development/tools/rust/cargo-bazel { };
+  cargo-crev = callPackage ../development/tools/rust/cargo-crev { };
+  cargo-fund = callPackage ../development/tools/rust/cargo-fund { };
+  cargo-hf2 = callPackage ../development/tools/rust/cargo-hf2 { };
+  cargo-ndk = callPackage ../development/tools/rust/cargo-ndk { };
+  cargo-udeps = callPackage ../development/tools/rust/cargo-udeps { };
+  cargo-watch = callPackage ../development/tools/rust/cargo-watch { };
+  cargo-whatfeatures = callPackage ../development/tools/rust/cargo-whatfeatures { };
 
   opensmalltalk-vm = callPackage ../development/compilers/opensmalltalk-vm { };
 
   rustfmt = rustPackages.rustfmt;
   rust-bindgen-unwrapped = callPackage ../development/tools/rust/bindgen/unwrapped.nix { };
   rust-bindgen = callPackage ../development/tools/rust/bindgen { };
-  rust-cbindgen = callPackage ../development/tools/rust/cbindgen {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
-  rustup = callPackage ../development/tools/rust/rustup {
-    inherit (darwin.apple_sdk.frameworks) CoreServices Security;
-  };
+  rust-cbindgen = callPackage ../development/tools/rust/cbindgen { };
+  rustup = callPackage ../development/tools/rust/rustup { };
   rustup-toolchain-install-master =
     callPackage ../development/tools/rust/rustup-toolchain-install-master
       {
-        inherit (darwin.apple_sdk.frameworks) Security;
       };
   scala_2_12 = callPackage ../development/compilers/scala/2.x.nix { majorVersion = "2.12"; };
   scala_2_13 = callPackage ../development/compilers/scala/2.x.nix { majorVersion = "2.13"; };
@@ -6927,13 +6446,9 @@ with pkgs;
   };
   # smlnjBootstrap should be redundant, now that smlnj works on Darwin natively
   smlnjBootstrap = callPackage ../development/compilers/smlnj/bootstrap.nix { };
-  smlnj = callPackage ../development/compilers/smlnj {
-    inherit (darwin) Libsystem;
-  };
+  smlnj = callPackage ../development/compilers/smlnj { };
 
-  sqlx-cli = callPackage ../development/tools/rust/sqlx-cli {
-    inherit (darwin.apple_sdk.frameworks) SystemConfiguration CoreFoundation Security;
-  };
+  sqlx-cli = callPackage ../development/tools/rust/sqlx-cli { };
 
   squeak = callPackage ../development/compilers/squeak {
     stdenv = clangStdenv;
@@ -6948,9 +6463,7 @@ with pkgs;
     ];
   };
 
-  surrealdb-migrations = callPackage ../development/tools/database/surrealdb-migrations {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  surrealdb-migrations = callPackage ../development/tools/database/surrealdb-migrations { };
 
   swiftPackages = recurseIntoAttrs (callPackage ../development/compilers/swift { });
   inherit (swiftPackages)
@@ -6961,9 +6474,7 @@ with pkgs;
     swiftpm2nix
     ;
 
-  swi-prolog = callPackage ../development/compilers/swi-prolog {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  swi-prolog = callPackage ../development/compilers/swi-prolog { };
   swi-prolog-gui = swi-prolog.override { withGui = true; };
 
   tbb_2020_3 = callPackage ../development/libraries/tbb/2020_3.nix { };
@@ -6972,10 +6483,7 @@ with pkgs;
   # many packages still fail with latest version
   tbb = tbb_2020_3;
 
-  terra = callPackage ../development/compilers/terra {
-    inherit (darwin) libobjc;
-    inherit (darwin.apple_sdk.frameworks) Cocoa Foundation;
-  };
+  terra = callPackage ../development/compilers/terra { };
 
   teyjus = callPackage ../development/compilers/teyjus {
     inherit (ocaml-ng.ocamlPackages_4_14) buildDunePackage;
@@ -6985,7 +6493,7 @@ with pkgs;
     gconf = gnome2.GConf;
   };
 
-  tinycc = darwin.apple_sdk_11_0.callPackage ../development/compilers/tinycc { };
+  tinycc = callPackage ../development/compilers/tinycc { };
 
   urweb = callPackage ../development/compilers/urweb {
     icu = icu67;
@@ -7209,13 +6717,9 @@ with pkgs;
 
   dhallPackages = recurseIntoAttrs (callPackage ./dhall-packages.nix { });
 
-  duckscript = callPackage ../development/tools/rust/duckscript {
-    inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration;
-  };
+  duckscript = callPackage ../development/tools/rust/duckscript { };
 
-  evcxr = callPackage ../development/interpreters/evcxr {
-    inherit (darwin.apple_sdk.frameworks) CoreServices Security;
-  };
+  evcxr = callPackage ../development/interpreters/evcxr { };
 
   beam = callPackage ./beam-packages.nix { };
   beam_minimal = callPackage ./beam-packages.nix {
@@ -7266,14 +6770,11 @@ with pkgs;
 
   gnudatalanguage = callPackage ../development/interpreters/gnudatalanguage {
     inherit (llvmPackages) openmp;
-    inherit (darwin.apple_sdk.frameworks) Cocoa;
     # MPICH currently build on Darwin
     mpi = mpich;
   };
 
-  graphql-client = callPackage ../development/tools/graphql-client {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  graphql-client = callPackage ../development/tools/graphql-client { };
 
   inherit (callPackages ../applications/networking/cluster/hadoop { })
     hadoop_3_4
@@ -7555,20 +7056,15 @@ with pkgs;
   };
 
   rakudo = callPackage ../development/interpreters/rakudo { };
-  moarvm = darwin.apple_sdk_11_0.callPackage ../development/interpreters/rakudo/moarvm.nix {
-    inherit (darwin.apple_sdk_11_0.frameworks) CoreServices ApplicationServices;
-  };
+  moarvm = callPackage ../development/interpreters/rakudo/moarvm.nix { };
   nqp = callPackage ../development/interpreters/rakudo/nqp.nix { };
   zef = callPackage ../development/interpreters/rakudo/zef.nix { };
 
   inherit (ocamlPackages) reason rtop;
 
-  buildRubyGem = callPackage ../development/ruby-modules/gem {
-    inherit (darwin) libobjc;
-  };
+  buildRubyGem = callPackage ../development/ruby-modules/gem { };
   defaultGemConfig = callPackage ../development/ruby-modules/gem-config {
     inherit (darwin) DarwinTools autoSignDarwinBinariesHook;
-    inherit (darwin.apple_sdk.frameworks) CoreServices;
   };
   bundlerEnv = callPackage ../development/ruby-modules/bundler-env { };
   bundlerApp = callPackage ../development/ruby-modules/bundler-app { };
@@ -7578,15 +7074,11 @@ with pkgs;
 
   solargraph = rubyPackages.solargraph;
 
-  rubyfmt = darwin.apple_sdk_11_0.callPackage ../development/tools/rubyfmt {
-    inherit (darwin.apple_sdk_11_0.frameworks) Foundation Security;
-    inherit (darwin) libobjc;
-  };
+  rubyfmt = callPackage ../development/tools/rubyfmt { };
 
   inherit
     (callPackage ../development/interpreters/ruby {
-      inherit (darwin) libobjc libunwind;
-      inherit (darwin.apple_sdk.frameworks) Foundation;
+      inherit (darwin) libunwind;
     })
     mkRubyVersion
     mkRuby
@@ -7615,15 +7107,9 @@ with pkgs;
 
   inherit
     ({
-      spidermonkey_91 = callPackage ../development/interpreters/spidermonkey/91.nix {
-        inherit (darwin) libobjc;
-      };
-      spidermonkey_115 = callPackage ../development/interpreters/spidermonkey/115.nix {
-        inherit (darwin) libobjc;
-      };
-      spidermonkey_128 = callPackage ../development/interpreters/spidermonkey/128.nix {
-        inherit (darwin) libobjc;
-      };
+      spidermonkey_91 = callPackage ../development/interpreters/spidermonkey/91.nix { };
+      spidermonkey_115 = callPackage ../development/interpreters/spidermonkey/115.nix { };
+      spidermonkey_128 = callPackage ../development/interpreters/spidermonkey/128.nix { };
     })
     spidermonkey_91
     spidermonkey_115
@@ -7708,10 +7194,6 @@ with pkgs;
 
   or1k-newlib = callPackage ../development/misc/or1k/newlib.nix { };
 
-  mise = callPackage ../by-name/mi/mise/package.nix {
-    inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration;
-  };
-
   ### DEVELOPMENT / TOOLS
 
   actiona = libsForQt5.callPackage ../applications/misc/actiona { };
@@ -7888,15 +7370,13 @@ with pkgs;
   buildozer = bazel-buildtools;
   unused_deps = bazel-buildtools;
 
-  buildBazelPackage = darwin.apple_sdk_11_0.callPackage ../build-support/build-bazel-package { };
+  buildBazelPackage = callPackage ../build-support/build-bazel-package { };
 
   binutils-unwrapped = callPackage ../development/tools/misc/binutils {
-    inherit (darwin.apple_sdk.frameworks) CoreServices;
     # FHS sys dirs presumably only have stuff for the build platform
     noSysDirs = (stdenv.targetPlatform != stdenv.hostPlatform) || noSysDirs;
   };
   binutils-unwrapped-all-targets = callPackage ../development/tools/misc/binutils {
-    inherit (darwin.apple_sdk.frameworks) CoreServices;
     # FHS sys dirs presumably only have stuff for the build platform
     noSysDirs = (stdenv.targetPlatform != stdenv.hostPlatform) || noSysDirs;
     withAllTargets = true;
@@ -7997,16 +7477,13 @@ with pkgs;
 
   bdep = callPackage ../development/tools/build-managers/build2/bdep.nix { };
 
-  bore-cli = callPackage ../tools/networking/bore-cli/default.nix {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  bore-cli = callPackage ../tools/networking/bore-cli/default.nix { };
 
   bpkg = callPackage ../development/tools/build-managers/build2/bpkg.nix { };
 
   buildkite-test-collector-rust =
     callPackage ../development/tools/continuous-integration/buildkite-test-collector-rust
       {
-        inherit (darwin.apple_sdk.frameworks) Security;
       };
 
   libbpf = callPackage ../os-specific/linux/libbpf { };
@@ -8202,18 +7679,15 @@ with pkgs;
 
   dot2tex = with python3.pkgs; toPythonApplication dot2tex;
 
-  doxygen = darwin.apple_sdk_11_0.callPackage ../development/tools/documentation/doxygen {
+  doxygen = callPackage ../development/tools/documentation/doxygen {
     qt5 = null;
-    inherit (darwin.apple_sdk_11_0.frameworks) CoreServices;
   };
 
   doxygen_gui = lowPrio (doxygen.override { inherit qt5; });
 
   drake = callPackage ../development/tools/build-managers/drake { };
 
-  dura = callPackage ../development/tools/misc/dura {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  dura = callPackage ../development/tools/misc/dura { };
 
   edb = libsForQt5.callPackage ../development/tools/misc/edb { };
 
@@ -8225,7 +7699,6 @@ with pkgs;
   );
 
   flow = callPackage ../development/tools/analysis/flow {
-    inherit (darwin.apple_sdk.frameworks) CoreServices;
     ocamlPackages = ocaml-ng.ocamlPackages_4_14;
   };
 
@@ -8239,13 +7712,10 @@ with pkgs;
   };
 
   fswatch = callPackage ../development/tools/misc/fswatch {
-    inherit (darwin.apple_sdk.frameworks) CoreServices;
     autoreconfHook = buildPackages.autoreconfHook269;
   };
 
-  fujprog = callPackage ../development/embedded/fpga/fujprog {
-    inherit (darwin.apple_sdk.frameworks) IOKit;
-  };
+  fujprog = callPackage ../development/embedded/fpga/fujprog { };
 
   gede = libsForQt5.callPackage ../development/tools/misc/gede { };
 
@@ -8333,9 +7803,7 @@ with pkgs;
 
   kcc = libsForQt5.callPackage ../applications/graphics/kcc { };
 
-  kubie = callPackage ../development/tools/kubie {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  kubie = callPackage ../development/tools/kubie { };
 
   kustomize = callPackage ../development/tools/kustomize { };
 
@@ -8352,13 +7820,10 @@ with pkgs;
   libtool_2 = callPackage ../development/tools/misc/libtool/libtool2.nix { };
 
   linuxkit = callPackage ../development/tools/misc/linuxkit {
-    inherit (darwin.apple_sdk_11_0.frameworks) Cocoa Virtualization;
     inherit (darwin) sigtool;
   };
 
-  listenbrainz-mpd = callPackage ../applications/audio/listenbrainz-mpd {
-    inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration CoreFoundation;
-  };
+  listenbrainz-mpd = callPackage ../applications/audio/listenbrainz-mpd { };
 
   lit = with python3Packages; toPythonApplication lit;
 
@@ -8382,14 +7847,11 @@ with pkgs;
     );
 
   minizinc = callPackage ../development/tools/minizinc { };
-  minizincide = qt6Packages.callPackage ../development/tools/minizinc/ide.nix {
-    inherit (darwin.apple_sdk_11_0.frameworks) Cocoa;
-  };
+  minizincide = qt6Packages.callPackage ../development/tools/minizinc/ide.nix { };
 
   mkdocs = with python3Packages; toPythonApplication mkdocs;
 
   mold = callPackage ../by-name/mo/mold/package.nix {
-    stdenv = if stdenv.hostPlatform.isDarwin then overrideSDK stdenv "11.0" else stdenv;
     tbb = tbb_2021_11;
   };
 
@@ -8454,9 +7916,7 @@ with pkgs;
     libiberty_static = libiberty.override { staticBuild = true; };
   };
 
-  pactorio = callPackage ../development/tools/pactorio {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  pactorio = callPackage ../development/tools/pactorio { };
 
   patchelf = callPackage ../development/tools/misc/patchelf { };
 
@@ -8495,9 +7955,7 @@ with pkgs;
 
   premake4 = callPackage ../development/tools/misc/premake { };
 
-  premake5 = callPackage ../development/tools/misc/premake/5.nix {
-    inherit (darwin.apple_sdk.frameworks) Foundation;
-  };
+  premake5 = callPackage ../development/tools/misc/premake/5.nix { };
 
   premake = premake4;
 
@@ -8570,9 +8028,7 @@ with pkgs;
 
   scss-lint = callPackage ../development/tools/scss-lint { };
 
-  shadowenv = callPackage ../tools/misc/shadowenv {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  shadowenv = callPackage ../tools/misc/shadowenv { };
 
   shake =
     # TODO: Erroneous references to GHC on aarch64-darwin: https://github.com/NixOS/nixpkgs/issues/318013
@@ -8620,9 +8076,7 @@ with pkgs;
     protobuf = protobuf_21;
   };
 
-  spr = callPackage ../development/tools/spr {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  spr = callPackage ../development/tools/spr { };
 
   sqlitebrowser = libsForQt5.callPackage ../development/tools/database/sqlitebrowser { };
 
@@ -8657,9 +8111,7 @@ with pkgs;
   texinfo = texinfo7;
   texinfoInteractive = texinfo.override { interactive = true; };
 
-  texlab = callPackage ../development/tools/misc/texlab {
-    inherit (darwin.apple_sdk.frameworks) Security CoreServices;
-  };
+  texlab = callPackage ../development/tools/misc/texlab { };
 
   tflint-plugins = recurseIntoAttrs (callPackage ../development/tools/analysis/tflint-plugins { });
 
@@ -8684,9 +8136,7 @@ with pkgs;
     jdk = jdk11;
   };
 
-  valgrind = callPackage ../development/tools/analysis/valgrind {
-    inherit (buildPackages.darwin) xnu bootstrap_cmds;
-  };
+  valgrind = callPackage ../development/tools/analysis/valgrind { };
   valgrind-light = (res.valgrind.override { gdb = null; }).overrideAttrs (oldAttrs: {
     meta = oldAttrs.meta // {
       description = "${oldAttrs.meta.description} (without GDB)";
@@ -8711,9 +8161,7 @@ with pkgs;
 
   watson-ruby = callPackage ../development/tools/misc/watson-ruby { };
 
-  xmake = darwin.apple_sdk_11_0.callPackage ../development/tools/build-managers/xmake {
-    inherit (darwin.apple_sdk_11_0.frameworks) CoreServices;
-  };
+  xmake = callPackage ../development/tools/build-managers/xmake { };
 
   xcbuild = callPackage ../by-name/xc/xcbuild/package.nix {
     stdenv =
@@ -8733,7 +8181,6 @@ with pkgs;
   xxdiff-tip = xxdiff;
 
   ycmd = callPackage ../by-name/yc/ycmd/package.nix {
-    inherit (darwin.apple_sdk.frameworks) Cocoa;
     python = python3;
   };
 
@@ -8751,39 +8198,11 @@ with pkgs;
 
   ### DEVELOPMENT / LIBRARIES
 
-  abseil-cpp_202103 = callPackage ../development/libraries/abseil-cpp/202103.nix {
-    # If abseil-cpp doesn’t have a deployment target of 10.13+, arrow-cpp crashes in libgrpc.dylib.
-    stdenv =
-      if stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64 then
-        overrideSDK stdenv { darwinMinVersion = "10.13"; }
-      else
-        stdenv;
-  };
-  abseil-cpp_202301 = callPackage ../development/libraries/abseil-cpp/202301.nix {
-    # If abseil-cpp doesn’t have a deployment target of 10.13+, arrow-cpp crashes in libgrpc.dylib.
-    stdenv =
-      if stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64 then
-        overrideSDK stdenv { darwinMinVersion = "10.13"; }
-      else
-        stdenv;
-  };
-  abseil-cpp_202401 = callPackage ../development/libraries/abseil-cpp/202401.nix {
-    # If abseil-cpp doesn’t have a deployment target of 10.13+, arrow-cpp crashes in libgrpc.dylib.
-    stdenv =
-      if stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64 then
-        overrideSDK stdenv { darwinMinVersion = "10.13"; }
-      else
-        stdenv;
-  };
-  abseil-cpp_202407 = callPackage ../development/libraries/abseil-cpp/202407.nix {
-    # If abseil-cpp doesn’t have a deployment target of 10.13+, arrow-cpp crashes in libgrpc.dylib.
-    stdenv =
-      if stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64 then
-        overrideSDK stdenv { darwinMinVersion = "10.13"; }
-      else
-        stdenv;
-  };
-  abseil-cpp = abseil-cpp_202407;
+  abseil-cpp_202103 = callPackage ../development/libraries/abseil-cpp/202103.nix { };
+  abseil-cpp_202301 = callPackage ../development/libraries/abseil-cpp/202301.nix { };
+  abseil-cpp_202401 = callPackage ../development/libraries/abseil-cpp/202401.nix { };
+  abseil-cpp_202407 = callPackage ../development/libraries/abseil-cpp/202407.nix { };
+  abseil-cpp = abseil-cpp_202501;
 
   acl = callPackage ../development/libraries/acl { };
 
@@ -8805,9 +8224,7 @@ with pkgs;
 
   argparse-manpage = with python3Packages; toPythonApplication argparse-manpage;
 
-  aribb25 = callPackage ../development/libraries/aribb25 {
-    inherit (darwin.apple_sdk.frameworks) PCSC;
-  };
+  aribb25 = callPackage ../development/libraries/aribb25 { };
 
   asio_1_10 = callPackage ../development/libraries/asio/1.10.nix { };
   asio = callPackage ../development/libraries/asio { };
@@ -8829,21 +8246,13 @@ with pkgs;
 
   aqbanking = callPackage ../development/libraries/aqbanking { };
 
-  audiofile = callPackage ../development/libraries/audiofile {
-    inherit (darwin.apple_sdk.frameworks) AudioUnit CoreServices;
-  };
+  audiofile = callPackage ../development/libraries/audiofile { };
 
-  aws-c-cal = callPackage ../development/libraries/aws-c-cal {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  aws-c-cal = callPackage ../development/libraries/aws-c-cal { };
 
-  aws-c-io = callPackage ../development/libraries/aws-c-io {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  aws-c-io = callPackage ../development/libraries/aws-c-io { };
 
-  aws-sdk-cpp = callPackage ../development/libraries/aws-sdk-cpp {
-    inherit (darwin.apple_sdk.frameworks) CoreAudio AudioToolbox;
-  };
+  aws-sdk-cpp = callPackage ../development/libraries/aws-sdk-cpp { };
 
   aws-spend-summary = haskellPackages.aws-spend-summary.bin;
 
@@ -8895,9 +8304,7 @@ with pkgs;
     };
   });
 
-  cubeb = callPackage ../development/libraries/audio/cubeb {
-    inherit (darwin.apple_sdk.frameworks) AudioUnit CoreAudio CoreServices;
-  };
+  cubeb = callPackage ../development/libraries/audio/cubeb { };
 
   hercules-ci-agent = callPackage ../development/tools/continuous-integration/hercules-ci-agent { };
 
@@ -8918,9 +8325,7 @@ with pkgs;
     tbb = tbb_2021_11;
   };
 
-  cctz = callPackage ../development/libraries/cctz {
-    inherit (darwin.apple_sdk.frameworks) Foundation;
-  };
+  cctz = callPackage ../development/libraries/cctz { };
 
   ceedling = callPackage ../development/tools/ceedling { };
 
@@ -8938,24 +8343,19 @@ with pkgs;
     ]
   );
 
-  check = callPackage ../development/libraries/check {
-    inherit (darwin.apple_sdk.frameworks) CoreServices;
-  };
+  check = callPackage ../development/libraries/check { };
 
   clucene_core_2 = callPackage ../development/libraries/clucene-core/2.x.nix { };
 
   clucene_core = clucene_core_2;
 
-  clutter-gst = callPackage ../development/libraries/clutter-gst {
-  };
+  clutter-gst = callPackage ../development/libraries/clutter-gst { };
 
   codecserver = callPackage ../applications/audio/codecserver {
     protobuf = protobuf_21;
   };
 
-  cogl = callPackage ../development/libraries/cogl {
-    inherit (darwin.apple_sdk.frameworks) OpenGL;
-  };
+  cogl = callPackage ../development/libraries/cogl { };
 
   inherit (cosmopolitan) cosmocc;
 
@@ -8975,7 +8375,6 @@ with pkgs;
 
   ustream-ssl-mbedtls = callPackage ../development/libraries/ustream-ssl {
     ssl_implementation = mbedtls_2;
-    stdenv = if stdenv.hostPlatform.isDarwin then overrideSDK stdenv "11.0" else stdenv;
   };
 
   cxxtest = python3Packages.callPackage ../development/libraries/cxxtest { };
@@ -9006,9 +8405,7 @@ with pkgs;
     autoreconfHook = buildPackages.autoreconfHook269;
   };
 
-  discord-rpc = callPackage ../development/libraries/discord-rpc {
-    inherit (darwin.apple_sdk.frameworks) AppKit;
-  };
+  discord-rpc = callPackage ../development/libraries/discord-rpc { };
 
   draco = callPackage ../development/libraries/draco {
     tinygltf = callPackage ../development/libraries/draco/tinygltf.nix { };
@@ -9035,20 +8432,14 @@ with pkgs;
 
   vapoursynth-editor = libsForQt5.callPackage ../by-name/va/vapoursynth/editor.nix { };
 
-  vmmlib = callPackage ../development/libraries/vmmlib {
-    inherit (darwin.apple_sdk.frameworks) Accelerate CoreGraphics CoreVideo;
-  };
+  vmmlib = callPackage ../development/libraries/vmmlib { };
 
-  elastix = callPackage ../development/libraries/science/biology/elastix {
-    inherit (darwin.apple_sdk.frameworks) Cocoa;
-  };
+  elastix = callPackage ../development/libraries/science/biology/elastix { };
 
   # TODO: Fix references and add justStaticExecutables https://github.com/NixOS/nixpkgs/issues/318013
   emanote = haskellPackages.emanote;
 
-  enchant2 = callPackage ../development/libraries/enchant/2.x.nix {
-    inherit (darwin.apple_sdk.frameworks) Cocoa;
-  };
+  enchant2 = callPackage ../development/libraries/enchant/2.x.nix { };
   enchant = enchant2;
 
   factorPackages-0_99 = callPackage ./factor-packages.nix {
@@ -9063,16 +8454,7 @@ with pkgs;
   factor-lang-0_100 = factorPackages-0_100.factor-lang;
   factor-lang = factor-lang-0_100;
 
-  far2l = callPackage ../applications/misc/far2l {
-    inherit (darwin.apple_sdk.frameworks)
-      IOKit
-      Carbon
-      Cocoa
-      AudioToolbox
-      OpenGL
-      System
-      ;
-  };
+  far2l = callPackage ../applications/misc/far2l { };
 
   farstream = callPackage ../development/libraries/farstream {
     inherit (gst_all_1)
@@ -9114,22 +8496,8 @@ with pkgs;
 
   flint3 = callPackage ../development/libraries/flint/3.nix { };
 
-  fltk13 = callPackage ../development/libraries/fltk {
-    inherit (darwin.apple_sdk.frameworks)
-      ApplicationServices
-      Carbon
-      Cocoa
-      OpenGL
-      ;
-  };
-  fltk14 = callPackage ../development/libraries/fltk/1.4.nix {
-    inherit (darwin.apple_sdk.frameworks)
-      ApplicationServices
-      Carbon
-      Cocoa
-      OpenGL
-      ;
-  };
+  fltk13 = callPackage ../development/libraries/fltk { };
+  fltk14 = callPackage ../development/libraries/fltk/1.4.nix { };
   fltk13-minimal = fltk13.override {
     withGL = false;
     withCairo = false;
@@ -9171,17 +8539,13 @@ with pkgs;
 
   frog = res.languageMachines.frog;
 
-  fontconfig = callPackage ../development/libraries/fontconfig {
-    inherit (darwin.apple_sdk.frameworks) CoreFoundation;
-  };
+  fontconfig = callPackage ../development/libraries/fontconfig { };
 
   makeFontsConf = callPackage ../development/libraries/fontconfig/make-fonts-conf.nix { };
 
   makeFontsCache = callPackage ../development/libraries/fontconfig/make-fonts-cache.nix { };
 
-  freenect = callPackage ../development/libraries/freenect {
-    inherit (darwin.apple_sdk.frameworks) Cocoa GLUT;
-  };
+  freenect = callPackage ../development/libraries/freenect { };
 
   gamenetworkingsockets = callPackage ../development/libraries/gamenetworkingsockets {
     protobuf = protobuf_21;
@@ -9200,11 +8564,10 @@ with pkgs;
   geph = recurseIntoAttrs (callPackages ../applications/networking/geph { pnpm = pnpm_8; });
 
   gegl = callPackage ../development/libraries/gegl {
-    inherit (darwin.apple_sdk.frameworks) OpenCL;
     openexr = openexr_2;
   };
 
-  gensio = darwin.apple_sdk_11_0.callPackage ../development/libraries/gensio { };
+  gensio = callPackage ../development/libraries/gensio { };
 
   geoclue2-with-demo-agent = geoclue2.override { withDemoAgent = true; };
 
@@ -9244,16 +8607,10 @@ with pkgs;
 
   graphia = qt6Packages.callPackage ../applications/science/misc/graphia { };
 
-  libgit2 = callPackage ../development/libraries/libgit2 {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  libgit2 = callPackage ../development/libraries/libgit2 { };
 
-  glew = callPackage ../development/libraries/glew {
-    inherit (darwin.apple_sdk.frameworks) OpenGL;
-  };
-  glew110 = callPackage ../development/libraries/glew/1.10.nix {
-    inherit (darwin.apple_sdk.frameworks) AGL OpenGL;
-  };
+  glew = callPackage ../development/libraries/glew { };
+  glew110 = callPackage ../development/libraries/glew/1.10.nix { };
   glfw = glfw3;
   glfw2 = callPackage ../development/libraries/glfw/2.x.nix { };
 
@@ -9426,45 +8783,18 @@ with pkgs;
   goocanvas = callPackage ../development/libraries/goocanvas { };
   goocanvas2 = callPackage ../development/libraries/goocanvas/2.x.nix { };
   goocanvas3 = callPackage ../development/libraries/goocanvas/3.x.nix { };
-  grpc = callPackage ../by-name/gr/grpc/package.nix {
-    stdenv =
-      if stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64 then
-        overrideSDK stdenv { darwinMinVersion = "10.13"; }
-      else
-        stdenv;
-  };
 
   gsettings-qt = libsForQt5.callPackage ../development/libraries/gsettings-qt { };
 
   gst_all_1 = recurseIntoAttrs (
     callPackage ../development/libraries/gstreamer {
       callPackage = newScope gst_all_1;
-      stdenv = if stdenv.hostPlatform.isDarwin then overrideSDK stdenv "12.3" else stdenv;
-      inherit (darwin.apple_sdk_12_3.frameworks)
-        AudioToolbox
-        AVFoundation
-        Cocoa
-        CoreFoundation
-        CoreMedia
-        CoreServices
-        CoreVideo
-        DiskArbitration
-        Foundation
-        IOKit
-        MediaToolbox
-        OpenGL
-        Security
-        SystemConfiguration
-        VideoToolbox
-        ;
-      inherit (darwin.apple_sdk_12_3.libs) xpc;
     }
   );
 
   qxmpp = qt6Packages.callPackage ../development/libraries/qxmpp { };
 
   gnutls = callPackage ../development/libraries/gnutls {
-    inherit (darwin.apple_sdk.frameworks) Security;
     util-linux = util-linuxMinimal; # break the cyclic dependency
     autoconf = buildPackages.autoconf269;
   };
@@ -9488,9 +8818,7 @@ with pkgs;
 
   glibmm = callPackage ../development/libraries/glibmm { };
 
-  glibmm_2_68 = callPackage ../development/libraries/glibmm/2.68.nix {
-    inherit (darwin.apple_sdk.frameworks) Cocoa;
-  };
+  glibmm_2_68 = callPackage ../development/libraries/glibmm/2.68.nix { };
 
   glirc = haskell.lib.compose.justStaticExecutables haskellPackages.glirc;
 
@@ -9503,37 +8831,25 @@ with pkgs;
 
   cairomm = callPackage ../development/libraries/cairomm { };
 
-  cairomm_1_16 = callPackage ../development/libraries/cairomm/1.16.nix {
-    inherit (darwin.apple_sdk.frameworks) ApplicationServices;
-  };
+  cairomm_1_16 = callPackage ../development/libraries/cairomm/1.16.nix { };
 
   pango = callPackage ../development/libraries/pango {
     harfbuzz = harfbuzz.override { withCoreText = stdenv.hostPlatform.isDarwin; };
   };
 
-  pangolin = callPackage ../development/libraries/pangolin {
-    inherit (darwin.apple_sdk.frameworks) Carbon Cocoa;
-  };
+  pangolin = callPackage ../development/libraries/pangolin { };
 
-  pangomm = callPackage ../development/libraries/pangomm {
-    inherit (darwin.apple_sdk.frameworks) ApplicationServices;
-  };
+  pangomm = callPackage ../development/libraries/pangomm { };
 
-  pangomm_2_48 = callPackage ../development/libraries/pangomm/2.48.nix {
-    inherit (darwin.apple_sdk.frameworks) ApplicationServices;
-  };
+  pangomm_2_48 = callPackage ../development/libraries/pangomm/2.48.nix { };
 
-  pangomm_2_42 = callPackage ../development/libraries/pangomm/2.42.nix {
-    inherit (darwin.apple_sdk.frameworks) ApplicationServices;
-  };
+  pangomm_2_42 = callPackage ../development/libraries/pangomm/2.42.nix { };
 
   gdk-pixbuf = callPackage ../development/libraries/gdk-pixbuf { };
 
   gdk-pixbuf-xlib = callPackage ../development/libraries/gdk-pixbuf/xlib.nix { };
 
-  gtk2 = callPackage ../development/libraries/gtk/2.x.nix {
-    inherit (darwin.apple_sdk.frameworks) AppKit Cocoa;
-  };
+  gtk2 = callPackage ../development/libraries/gtk/2.x.nix { };
 
   gtk2-x11 = gtk2.override {
     cairo = cairo.override { x11Support = true; };
@@ -9544,9 +8860,7 @@ with pkgs;
     gdktarget = "x11";
   };
 
-  gtk3 = callPackage ../development/libraries/gtk/3.x.nix {
-    inherit (darwin.apple_sdk.frameworks) AppKit Cocoa QuartzCore;
-  };
+  gtk3 = callPackage ../development/libraries/gtk/3.x.nix { };
 
   gtk4 = callPackage ../development/libraries/gtk/4.x.nix { };
 
@@ -9599,13 +8913,10 @@ with pkgs;
   hamlib_4 = callPackage ../development/libraries/hamlib/4.nix { };
 
   heimdal = callPackage ../development/libraries/kerberos/heimdal.nix {
-    inherit (darwin.apple_sdk.frameworks) CoreFoundation Security SystemConfiguration;
     autoreconfHook = buildPackages.autoreconfHook269;
   };
 
-  harfbuzz = callPackage ../development/libraries/harfbuzz {
-    inherit (darwin.apple_sdk.frameworks) ApplicationServices CoreText;
-  };
+  harfbuzz = callPackage ../development/libraries/harfbuzz { };
 
   harfbuzzFull = harfbuzz.override {
     withCoreText = stdenv.hostPlatform.isDarwin;
@@ -9615,9 +8926,7 @@ with pkgs;
 
   herqq = libsForQt5.callPackage ../development/libraries/herqq { };
 
-  hidapi = callPackage ../development/libraries/hidapi {
-    inherit (darwin.apple_sdk.frameworks) Cocoa IOKit;
-  };
+  hidapi = callPackage ../development/libraries/hidapi { };
 
   highfive-mpi = highfive.override { hdf5 = hdf5-mpi; };
 
@@ -9663,9 +8972,7 @@ with pkgs;
 
   idasen = with python3Packages; toPythonApplication idasen;
 
-  imgui = callPackage ../development/libraries/imgui {
-    stdenv = if stdenv.hostPlatform.isDarwin then overrideSDK stdenv "11.0" else stdenv;
-  };
+  imgui = callPackage ../development/libraries/imgui { };
 
   imlib2Full = imlib2.override {
     # Compilation error on Darwin with librsvg. For more information see:
@@ -9691,7 +8998,7 @@ with pkgs;
     callPackage ../development/libraries/indicator-application/gtk3.nix
       { };
 
-  indilib = darwin.apple_sdk_11_0.callPackage ../development/libraries/science/astronomy/indilib { };
+  indilib = callPackage ../development/libraries/science/astronomy/indilib { };
   indi-3rdparty = recurseIntoAttrs (
     callPackages ../development/libraries/science/astronomy/indilib/indi-3rdparty.nix { }
   );
@@ -9703,7 +9010,6 @@ with pkgs;
       callPackage ../development/libraries/irrlicht { }
     else
       callPackage ../development/libraries/irrlicht/mac.nix {
-        inherit (darwin.apple_sdk.frameworks) Cocoa OpenGL IOKit;
       };
 
   iso-flags-png-320x240 = iso-flags.overrideAttrs (oldAttrs: {
@@ -9724,13 +9030,10 @@ with pkgs;
   };
 
   itk_5_2 = callPackage ../development/libraries/itk/5.2.x.nix {
-    inherit (darwin.apple_sdk.frameworks) Cocoa;
     enableRtk = false;
   };
 
-  itk_5 = callPackage ../development/libraries/itk/5.x.nix {
-    inherit (darwin.apple_sdk.frameworks) Cocoa;
-  };
+  itk_5 = callPackage ../development/libraries/itk/5.x.nix { };
 
   itk = itk_5;
 
@@ -9774,35 +9077,21 @@ with pkgs;
 
   lcms = lcms2;
 
-  libacr38u = callPackage ../tools/security/libacr38u {
-    inherit (darwin.apple_sdk.frameworks) IOKit;
-  };
+  libacr38u = callPackage ../tools/security/libacr38u { };
 
-  libadwaita = callPackage ../development/libraries/libadwaita {
-    inherit (pkgs.darwin.apple_sdk.frameworks) AppKit Foundation;
-  };
+  libadwaita = callPackage ../development/libraries/libadwaita { };
 
   libagar = callPackage ../development/libraries/libagar { };
   libagar_test = callPackage ../development/libraries/libagar/libagar_test.nix { };
 
   libao = callPackage ../development/libraries/libao {
     usePulseAudio = config.pulseaudio or (lib.meta.availableOn stdenv.hostPlatform libpulseaudio);
-    inherit (darwin.apple_sdk.frameworks) CoreAudio CoreServices AudioUnit;
   };
 
   libappindicator-gtk2 = libappindicator.override { gtkVersion = "2"; };
   libappindicator-gtk3 = libappindicator.override { gtkVersion = "3"; };
   libarchive-qt = callPackage ../development/libraries/libarchive-qt { };
 
-  libaribcaption = callPackage ../by-name/li/libaribcaption/package.nix {
-    inherit (darwin.apple_sdk.frameworks)
-      ApplicationServices
-      CoreFoundation
-      CoreGraphics
-      CoreText
-      ;
-  };
-
   libasn1c = callPackage ../servers/osmocom/libasn1c/default.nix { };
 
   libbap = callPackage ../development/libraries/libbap {
@@ -9820,15 +9109,11 @@ with pkgs;
   libbassmidi = (callPackage ../development/libraries/audio/libbass { }).bassmidi;
   libbassmix = (callPackage ../development/libraries/audio/libbass { }).bassmix;
 
-  libbluray = callPackage ../development/libraries/libbluray {
-    inherit (darwin.apple_sdk.frameworks) DiskArbitration;
-  };
+  libbluray = callPackage ../development/libraries/libbluray { };
 
   libcamera-qcam = callPackage ../by-name/li/libcamera/package.nix { withQcam = true; };
 
-  libcanberra = callPackage ../development/libraries/libcanberra {
-    inherit (darwin.apple_sdk.frameworks) Carbon CoreServices AppKit;
-  };
+  libcanberra = callPackage ../development/libraries/libcanberra { };
   libcanberra-gtk2 = pkgs.libcanberra.override {
     gtkSupport = "gtk2";
   };
@@ -9848,13 +9133,7 @@ with pkgs;
 
   libcef = callPackage ../development/libraries/libcef { };
 
-  libcdio = callPackage ../development/libraries/libcdio {
-    inherit (darwin.apple_sdk.frameworks) Carbon IOKit;
-  };
-
-  libcdio-paranoia = callPackage ../development/libraries/libcdio-paranoia {
-    inherit (darwin.apple_sdk.frameworks) DiskArbitration IOKit;
-  };
+  libcdio-paranoia = callPackage ../development/libraries/libcdio-paranoia { };
 
   libcdr = callPackage ../development/libraries/libcdr { lcms = lcms2; };
 
@@ -9880,26 +9159,19 @@ with pkgs;
   libdbusmenu-gtk2 = libdbusmenu.override { gtkVersion = "2"; };
   libdbusmenu-gtk3 = libdbusmenu.override { gtkVersion = "3"; };
 
-  libdc1394 = callPackage ../development/libraries/libdc1394 {
-    inherit (darwin.apple_sdk.frameworks) CoreServices;
-  };
+  libdc1394 = callPackage ../development/libraries/libdc1394 { };
 
-  libdeflate = darwin.apple_sdk_11_0.callPackage ../development/libraries/libdeflate { };
+  libdeflate = callPackage ../development/libraries/libdeflate { };
 
-  libdevil = callPackage ../development/libraries/libdevil {
-    inherit (darwin.apple_sdk.frameworks) OpenGL;
-  };
+  libdevil = callPackage ../development/libraries/libdevil { };
 
   libdevil-nox = callPackage ../development/libraries/libdevil {
-    inherit (darwin.apple_sdk.frameworks) OpenGL;
     withXorg = false;
   };
 
   libdnf = callPackage ../tools/package-management/libdnf { python = python3; };
 
-  libdvdcss = callPackage ../development/libraries/libdvdcss {
-    inherit (darwin) IOKit;
-  };
+  libdvdcss = callPackage ../development/libraries/libdvdcss { };
 
   libdvdnav = callPackage ../development/libraries/libdvdnav { };
   libdvdnav_4_2_1 = callPackage ../development/libraries/libdvdnav/4.2.1.nix {
@@ -9911,9 +9183,7 @@ with pkgs;
 
   dwarfdump = libdwarf.bin;
 
-  libfilezilla = darwin.apple_sdk_11_0.callPackage ../development/libraries/libfilezilla {
-    inherit (darwin.apple_sdk_11_0.frameworks) ApplicationServices;
-  };
+  libfilezilla = callPackage ../development/libraries/libfilezilla { };
 
   libfm-extra = libfm.override {
     extraOnly = true;
@@ -9929,20 +9199,16 @@ with pkgs;
       { };
 
   libiio = callPackage ../development/libraries/libiio {
-    inherit (darwin.apple_sdk.frameworks) CFNetwork CoreServices;
     python = python3;
   };
 
-  libsoundio = callPackage ../development/libraries/libsoundio {
-    inherit (darwin.apple_sdk.frameworks) AudioUnit;
-  };
+  libsoundio = callPackage ../development/libraries/libsoundio { };
 
   libextractor = callPackage ../development/libraries/libextractor {
     libmpeg2 = mpeg2dec;
   };
 
   libfive = libsForQt5.callPackage ../development/libraries/libfive {
-    stdenv = if stdenv.hostPlatform.isDarwin then overrideSDK stdenv "11.0" else stdenv;
     python = python3;
   };
 
@@ -9957,14 +9223,9 @@ with pkgs;
     doCheck = false;
   };
 
-  libftdi = callPackage ../development/libraries/libftdi {
-    inherit (darwin) libobjc;
-    inherit (darwin.apple_sdk.frameworks) IOKit Security;
-  };
+  libftdi = callPackage ../development/libraries/libftdi { };
 
-  libgdiplus = callPackage ../development/libraries/libgdiplus {
-    inherit (darwin.apple_sdk.frameworks) Carbon;
-  };
+  libgdiplus = callPackage ../development/libraries/libgdiplus { };
 
   # https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgpg-error.git;a=blob;f=README;h=fd6e1a83f55696c1f7a08f6dfca08b2d6b7617ec;hb=70058cd9f944d620764e57c838209afae8a58c78#l118
   libgpg-error-gen-posix-lock-obj = libgpg-error.override {
@@ -9975,22 +9236,16 @@ with pkgs;
     autoreconfHook = buildPackages.autoreconfHook269;
   };
 
-  libimobiledevice = callPackage ../development/libraries/libimobiledevice {
-    inherit (darwin.apple_sdk.frameworks) SystemConfiguration CoreFoundation;
-  };
+  libimobiledevice = callPackage ../development/libraries/libimobiledevice { };
 
   libindicator-gtk2 = libindicator.override { gtkVersion = "2"; };
   libindicator-gtk3 = libindicator.override { gtkVersion = "3"; };
-  libiodbc = callPackage ../development/libraries/libiodbc {
-    inherit (darwin.apple_sdk.frameworks) Carbon;
-  };
+  libiodbc = callPackage ../development/libraries/libiodbc { };
 
   inherit (callPackage ../development/libraries/libliftoff { }) libliftoff_0_4 libliftoff_0_5;
   libliftoff = libliftoff_0_5;
 
-  liblqr1 = callPackage ../development/libraries/liblqr-1 {
-    inherit (darwin.apple_sdk.frameworks) Carbon AppKit;
-  };
+  liblqr1 = callPackage ../development/libraries/liblqr-1 { };
 
   libqtdbusmock = libsForQt5.callPackage ../development/libraries/libqtdbusmock {
     inherit (lomiri) cmake-extras;
@@ -10000,9 +9255,7 @@ with pkgs;
     inherit (lomiri) cmake-extras;
   };
 
-  libre = callPackage ../development/libraries/libre {
-    inherit (darwin.apple_sdk.frameworks) SystemConfiguration;
-  };
+  libre = callPackage ../development/libraries/libre { };
 
   libremines = qt6.callPackage ../games/libremines { };
 
@@ -10017,9 +9270,7 @@ with pkgs;
     memHierarchy = "L3:16/64/8192K,L2:16/64/2048K,L1:8/64/16K";
   };
 
-  libsamplerate = callPackage ../development/libraries/libsamplerate {
-    inherit (darwin.apple_sdk.frameworks) ApplicationServices Carbon CoreServices;
-  };
+  libsamplerate = callPackage ../development/libraries/libsamplerate { };
 
   # GNU libc provides libiconv so systems with glibc don't need to
   # build libiconv separately. Additionally, Apple forked/repackaged
@@ -10104,9 +9355,7 @@ with pkgs;
 
   libmicrohttpd = libmicrohttpd_1_0;
 
-  libmikmod = callPackage ../development/libraries/libmikmod {
-    inherit (darwin.apple_sdk.frameworks) CoreAudio;
-  };
+  libmikmod = callPackage ../development/libraries/libmikmod { };
 
   libmusicbrainz3 = callPackage ../development/libraries/libmusicbrainz { };
 
@@ -10119,9 +9368,7 @@ with pkgs;
   libpeas = callPackage ../development/libraries/libpeas { };
   libpeas2 = callPackage ../development/libraries/libpeas/2.x.nix { };
 
-  libphonenumber = callPackage ../development/libraries/libphonenumber {
-    inherit (darwin.apple_sdk.frameworks) Foundation;
-  };
+  libphonenumber = callPackage ../development/libraries/libphonenumber { };
 
   libpng = callPackage ../development/libraries/libpng {
     stdenv =
@@ -10148,29 +9395,21 @@ with pkgs;
     python = python3;
   };
 
-  librsvg = callPackage ../development/libraries/librsvg {
-    inherit (darwin.apple_sdk.frameworks) Foundation;
-  };
+  librsvg = callPackage ../development/libraries/librsvg { };
 
   libsigcxx = callPackage ../development/libraries/libsigcxx { };
 
   libsigcxx30 = callPackage ../development/libraries/libsigcxx/3.0.nix { };
 
-  libsndfile = callPackage ../development/libraries/libsndfile {
-    inherit (darwin.apple_sdk.frameworks) Carbon AudioToolbox;
-  };
+  libsndfile = callPackage ../development/libraries/libsndfile { };
 
   libsoup_2_4 = callPackage ../development/libraries/libsoup { };
 
   libsoup_3 = callPackage ../development/libraries/libsoup/3.x.nix { };
 
-  libstatgrab = callPackage ../development/libraries/libstatgrab {
-    inherit (darwin.apple_sdk.frameworks) IOKit;
-  };
+  libstatgrab = callPackage ../development/libraries/libstatgrab { };
 
-  libticalcs2 = callPackage ../development/libraries/libticalcs2 {
-    inherit (darwin) libobjc;
-  };
+  libticalcs2 = callPackage ../development/libraries/libticalcs2 { };
 
   libtorrent-rasterbar = libtorrent-rasterbar-2_0_x;
 
@@ -10188,13 +9427,9 @@ with pkgs;
     ustream-ssl = ustream-ssl-mbedtls;
   };
 
-  libui = callPackage ../development/libraries/libui {
-    inherit (darwin.apple_sdk.frameworks) Cocoa;
-  };
+  libui = callPackage ../development/libraries/libui { };
 
-  libuiohook = callPackage ../development/libraries/libuiohook {
-    inherit (darwin.apple_sdk.frameworks) AppKit ApplicationServices Carbon;
-  };
+  libuiohook = callPackage ../development/libraries/libuiohook { };
 
   libunistring = callPackage ../development/libraries/libunistring { };
 
@@ -10203,10 +9438,7 @@ with pkgs;
 
   libusb-compat-0_1 = callPackage ../development/libraries/libusb-compat/0.1.nix { };
 
-  libusb1 = callPackage ../development/libraries/libusb1 {
-    inherit (darwin) libobjc;
-    inherit (darwin.apple_sdk.frameworks) IOKit Security;
-  };
+  libusb1 = callPackage ../development/libraries/libusb1 { };
 
   libunicode = callPackage ../by-name/li/libunicode/package.nix {
     stdenv = if stdenv.hostPlatform.isDarwin then llvmPackages_17.stdenv else stdenv;
@@ -10223,7 +9455,7 @@ with pkgs;
     else
       callPackage ../development/libraries/libunwind { };
 
-  libuv = darwin.apple_sdk_11_0.callPackage ../development/libraries/libuv { };
+  libuv = callPackage ../development/libraries/libuv { };
 
   libv4l = lowPrio (
     v4l-utils.override {
@@ -10238,17 +9470,11 @@ with pkgs;
   libva1 = callPackage ../development/libraries/libva/1.nix { };
   libva1-minimal = libva1.override { minimal = true; };
 
-  libvgm = callPackage ../development/libraries/libvgm {
-    inherit (darwin.apple_sdk.frameworks) CoreAudio AudioToolbox;
-  };
+  libvgm = callPackage ../development/libraries/libvgm { };
 
-  libvirt = callPackage ../development/libraries/libvirt {
-    inherit (darwin.apple_sdk.frameworks) Carbon AppKit;
-  };
+  libvirt = callPackage ../development/libraries/libvirt { };
 
-  libvncserver = callPackage ../development/libraries/libvncserver {
-    inherit (darwin.apple_sdk.frameworks) Carbon;
-  };
+  libvncserver = callPackage ../development/libraries/libvncserver { };
 
   libwnck = callPackage ../development/libraries/libwnck { };
   libwnck2 = callPackage ../development/libraries/libwnck/2.nix { };
@@ -10363,12 +9589,15 @@ with pkgs;
   #
   # Android NDK provides an OpenGL implementation, we can just use that.
   #
-  # On macOS, we use the OpenGL framework. Packages that still need GLX
-  # specifically can pull in libGLX instead. If you have a package that
-  # should work without X11 but it can’t find the library, it may help
-  # to add the path to `NIX_CFLAGS_COMPILE`:
+  # On macOS, the SDK provides the OpenGL framework in `stdenv`.
+  # Packages that still need GLX specifically can pull in `libGLX`
+  # instead. If you have a package that should work without X11 but it
+  # can’t find the library, it may help to add the path to
+  # `$NIX_CFLAGS_COMPILE`:
   #
-  #     -L${libGL}/Library/Frameworks/OpenGL.framework/Versions/Current/Libraries
+  #    preConfigure = ''
+  #      export NIX_CFLAGS_COMPILE+=" -L$SDKROOT/System/Library/Frameworks/OpenGL.framework/Versions/Current/Libraries"
+  #    '';
   #
   # If you still can’t get it working, please don’t hesitate to ping
   # @NixOS/darwin-maintainers to ask an expert to take a look.
@@ -10376,26 +9605,26 @@ with pkgs;
     if stdenv.hostPlatform.useAndroidPrebuilt then
       stdenv
     else if stdenv.hostPlatform.isDarwin then
-      darwin.apple_sdk.frameworks.OpenGL
+      null
     else
       libglvnd;
 
-  # On macOS, we use the OpenGL framework. Packages that use libGLX on
-  # macOS may need to depend on mesa_glu directly if this doesn’t work.
-  libGLU = if stdenv.hostPlatform.isDarwin then darwin.apple_sdk.frameworks.OpenGL else mesa_glu;
+  # On macOS, the SDK provides the OpenGL framework in `stdenv`.
+  # Packages that use `libGLX` on macOS may need to depend on
+  # `mesa_glu` directly if this doesn’t work.
+  libGLU = if stdenv.hostPlatform.isDarwin then null else mesa_glu;
 
-  # libglvnd does not work (yet?) on macOS.
+  # `libglvnd` does not work (yet?) on macOS.
   libGLX = if stdenv.hostPlatform.isDarwin then mesa else libglvnd;
 
-  # On macOS, we use the GLUT framework. Packages that use libGLX on
-  # macOS may need to depend on freeglut directly if this doesn’t work.
-  libglut = if stdenv.hostPlatform.isDarwin then darwin.apple_sdk.frameworks.GLUT else freeglut;
+  # On macOS, the SDK provides the GLUT framework in `stdenv`. Packages
+  # that use `libGLX` on macOS may need to depend on `freeglut`
+  # directly if this doesn’t work.
+  libglut = if stdenv.hostPlatform.isDarwin then null else freeglut;
 
   mesa =
     if stdenv.hostPlatform.isDarwin then
-      darwin.apple_sdk_11_0.callPackage ../development/libraries/mesa/darwin.nix {
-        inherit (darwin.apple_sdk_11_0.libs) Xplugin;
-      }
+      callPackage ../development/libraries/mesa/darwin.nix { }
     else
       callPackage ../development/libraries/mesa { };
 
@@ -10406,23 +9635,13 @@ with pkgs;
 
   ## End libGL/libGLU/Mesa stuff
 
-  midivisualizer = darwin.apple_sdk_11_0.callPackage ../applications/audio/midivisualizer {
-    inherit (darwin.apple_sdk_11_0.frameworks)
-      AppKit
-      Cocoa
-      Carbon
-      CoreAudio
-      CoreMIDI
-      CoreServices
-      Kernel
-      ;
-  };
+  midivisualizer = callPackage ../applications/audio/midivisualizer { };
 
   mkvtoolnix-cli = mkvtoolnix.override {
     withGUI = false;
   };
 
-  mlt = darwin.apple_sdk_11_0.callPackage ../development/libraries/mlt { };
+  mlt = callPackage ../development/libraries/mlt { };
 
   mpeg2dec = libmpeg2;
 
@@ -10439,9 +9658,7 @@ with pkgs;
 
   mygpoclient = with python3.pkgs; toPythonApplication mygpoclient;
 
-  mygui = callPackage ../development/libraries/mygui {
-    inherit (darwin.apple_sdk.frameworks) Cocoa;
-  };
+  mygui = callPackage ../development/libraries/mygui { };
 
   nanovna-saver = libsForQt5.callPackage ../applications/science/electronics/nanovna-saver { };
 
@@ -10466,9 +9683,7 @@ with pkgs;
 
   libnghttp2 = nghttp2.lib;
 
-  nghttp3 = callPackage ../development/libraries/nghttp3 {
-    inherit (darwin.apple_sdk.frameworks) CoreServices;
-  };
+  nghttp3 = callPackage ../development/libraries/nghttp3 { };
 
   ngtcp2 = callPackage ../development/libraries/ngtcp2 { };
   ngtcp2-gnutls = callPackage ../development/libraries/ngtcp2/gnutls.nix { };
@@ -10477,9 +9692,7 @@ with pkgs;
     wafHook = (waf.override { extraTools = [ "gccdeps" ]; }).hook;
   };
 
-  nspr = callPackage ../development/libraries/nspr {
-    inherit (darwin.apple_sdk.frameworks) CoreServices;
-  };
+  nspr = callPackage ../development/libraries/nspr { };
 
   nss_latest = callPackage ../development/libraries/nss/latest.nix { };
   nss_esr = callPackage ../development/libraries/nss/esr.nix { };
@@ -10513,9 +9726,7 @@ with pkgs;
 
   ogre = ogre_14;
 
-  openalSoft = callPackage ../development/libraries/openal-soft {
-    inherit (darwin.apple_sdk.frameworks) CoreServices AudioUnit AudioToolbox;
-  };
+  openalSoft = callPackage ../development/libraries/openal-soft { };
   openal = openalSoft;
 
   openbabel = openbabel3;
@@ -10557,7 +9768,6 @@ with pkgs;
 
   opencsg = callPackage ../development/libraries/opencsg {
     inherit (qt5) qmake;
-    inherit (darwin.apple_sdk.frameworks) GLUT;
   };
 
   opencv4 = callPackage ../development/libraries/opencv/4.x.nix {
@@ -10576,24 +9786,12 @@ with pkgs;
   openexr = callPackage ../development/libraries/openexr/3.nix { };
   openexr_2 = callPackage ../development/libraries/openexr/2.nix { };
 
-  opencolorio = darwin.apple_sdk_11_0.callPackage ../development/libraries/opencolorio {
-    inherit (darwin.apple_sdk_11_0.frameworks) Carbon GLUT Cocoa;
-  };
+  opencolorio = callPackage ../development/libraries/opencolorio { };
   opencolorio_1 = callPackage ../development/libraries/opencolorio/1.x.nix { };
 
-  ois = callPackage ../development/libraries/ois {
-    inherit (darwin.apple_sdk.frameworks) Cocoa IOKit Kernel;
-  };
+  ois = callPackage ../development/libraries/ois { };
 
-  openscenegraph = callPackage ../development/libraries/openscenegraph {
-    inherit (darwin.apple_sdk.frameworks)
-      AGL
-      Accelerate
-      Carbon
-      Cocoa
-      Foundation
-      ;
-  };
+  openscenegraph = callPackage ../development/libraries/openscenegraph { };
 
   openstackclient = with python312Packages; toPythonApplication python-openstackclient;
   openstackclient-full = openstackclient.overridePythonAttrs (oldAttrs: {
@@ -10614,10 +9812,6 @@ with pkgs;
   openvdb = callPackage ../development/libraries/openvdb { };
   openvdb_11 = callPackage ../development/libraries/openvdb/11.nix { };
 
-  openvr = callPackage ../by-name/op/openvr/package.nix {
-    inherit (darwin.apple_sdk.frameworks) Foundation AppKit;
-  };
-
   inherit (callPackages ../development/libraries/libressl { })
     libressl_3_6
     libressl_3_7
@@ -10628,9 +9822,7 @@ with pkgs;
 
   libressl = libressl_4_0;
 
-  wolfssl = darwin.apple_sdk_11_0.callPackage ../development/libraries/wolfssl {
-    inherit (darwin.apple_sdk_11_0.frameworks) Security;
-  };
+  wolfssl = callPackage ../development/libraries/wolfssl { };
 
   openssl = openssl_3_4;
 
@@ -10663,13 +9855,10 @@ with pkgs;
 
   pdfhummus = libsForQt5.callPackage ../development/libraries/pdfhummus { };
 
-  phetch = callPackage ../applications/networking/gopher/phetch {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  phetch = callPackage ../applications/networking/gopher/phetch { };
 
   inherit
     (callPackage ../development/libraries/physfs {
-      inherit (darwin.apple_sdk.frameworks) Foundation;
     })
     physfs_2
     physfs
@@ -10707,15 +9896,7 @@ with pkgs;
     utils = true;
   };
 
-  portmidi = callPackage ../development/libraries/portmidi {
-    inherit (darwin.apple_sdk.frameworks)
-      Carbon
-      CoreAudio
-      CoreFoundation
-      CoreMIDI
-      CoreServices
-      ;
-  };
+  portmidi = callPackage ../development/libraries/portmidi { };
 
   proj = callPackage ../development/libraries/proj { };
 
@@ -10723,10 +9904,11 @@ with pkgs;
 
   prospector = callPackage ../development/tools/prospector { };
 
-  protobuf = protobuf_29;
+  protobuf = protobuf_30;
 
   inherit
     ({
+      protobuf_30 = callPackage ../development/libraries/protobuf/30.nix { };
       protobuf_29 = callPackage ../development/libraries/protobuf/29.nix { };
       protobuf_28 = callPackage ../development/libraries/protobuf/28.nix { };
       protobuf_27 = callPackage ../development/libraries/protobuf/27.nix { };
@@ -10737,6 +9919,7 @@ with pkgs;
         abseil-cpp = abseil-cpp_202103;
       };
     })
+    protobuf_30
     protobuf_29
     protobuf_28
     protobuf_27
@@ -10780,6 +9963,7 @@ with pkgs;
         makeScopeWithSplicing'
         generateSplicesForMkScope
         lib
+        stdenv
         fetchurl
         fetchpatch
         fetchgit
@@ -10795,13 +9979,11 @@ with pkgs;
         gtk3
         python3
         llvmPackages_15
-        overrideSDK
         overrideLibcxx
         darwin
         ;
       inherit (__splicedPackages.gst_all_1) gstreamer gst-plugins-base;
       inherit config;
-      stdenv = if stdenv.hostPlatform.isDarwin then overrideSDK stdenv "11.0" else stdenv;
     }
   );
 
@@ -10845,9 +10027,7 @@ with pkgs;
     }
   );
 
-  quill = callPackage ../tools/security/quill {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  quill = callPackage ../tools/security/quill { };
 
   qv2ray = libsForQt5.callPackage ../applications/networking/qv2ray { };
 
@@ -10892,11 +10072,9 @@ with pkgs;
     useQt6 = true;
   };
 
-  randomx = darwin.apple_sdk_11_0.callPackage ../development/libraries/randomx { };
+  randomx = callPackage ../development/libraries/randomx { };
 
-  remodel = callPackage ../development/tools/remodel {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  remodel = callPackage ../development/tools/remodel { };
 
   reposilitePlugins = recurseIntoAttrs (callPackage ../by-name/re/reposilite/plugins.nix { });
 
@@ -10960,22 +10138,9 @@ with pkgs;
   SDL = SDL_compat;
   SDL2 = sdl2-compat;
 
-  SDL2_classic = callPackage ../by-name/sd/SDL2_classic/package.nix {
-    inherit (darwin.apple_sdk.frameworks)
-      AudioUnit
-      Cocoa
-      CoreAudio
-      CoreServices
-      ForceFeedback
-      OpenGL
-      ;
-  };
-
   sdr-j-fm = libsForQt5.callPackage ../applications/radio/sdr-j-fm { };
 
-  sdrpp = callPackage ../applications/radio/sdrpp {
-    inherit (darwin.apple_sdk.frameworks) AppKit;
-  };
+  sdrpp = callPackage ../applications/radio/sdrpp { };
 
   sigdigger = libsForQt5.callPackage ../applications/radio/sigdigger { };
 
@@ -10986,7 +10151,6 @@ with pkgs;
   simavr = callPackage ../development/tools/simavr {
     avrgcc = pkgsCross.avr.buildPackages.gcc;
     avrlibc = pkgsCross.avr.libcCross;
-    inherit (darwin.apple_sdk.frameworks) GLUT;
   };
 
   simpleitk = callPackage ../development/libraries/simpleitk { lua = lua5_4; };
@@ -11024,24 +10188,13 @@ with pkgs;
     scheme = guile;
   };
 
-  soapyairspy = callPackage ../applications/radio/soapyairspy {
-    inherit (darwin) libobjc;
-    inherit (darwin.apple_sdk.frameworks) IOKit Security;
-  };
+  soapyairspy = callPackage ../applications/radio/soapyairspy { };
 
-  soapyaudio = callPackage ../applications/radio/soapyaudio {
-    inherit (darwin.apple_sdk.frameworks) Accelerate CoreAudio;
-  };
+  soapyaudio = callPackage ../applications/radio/soapyaudio { };
 
-  soapybladerf = callPackage ../applications/radio/soapybladerf {
-    inherit (darwin) libobjc;
-    inherit (darwin.apple_sdk.frameworks) IOKit Security;
-  };
+  soapybladerf = callPackage ../applications/radio/soapybladerf { };
 
-  soapyhackrf = callPackage ../applications/radio/soapyhackrf {
-    inherit (darwin) libobjc;
-    inherit (darwin.apple_sdk.frameworks) IOKit Security;
-  };
+  soapyhackrf = callPackage ../applications/radio/soapyhackrf { };
 
   soapysdr = callPackage ../applications/radio/soapysdr { };
 
@@ -11059,23 +10212,13 @@ with pkgs;
     ];
   };
 
-  soapyrtlsdr = callPackage ../applications/radio/soapyrtlsdr {
-    inherit (darwin) libobjc;
-    inherit (darwin.apple_sdk.frameworks) IOKit Security;
-  };
+  soapyrtlsdr = callPackage ../applications/radio/soapyrtlsdr { };
 
-  soapyuhd = callPackage ../applications/radio/soapyuhd {
-    inherit (darwin) libobjc;
-    inherit (darwin.apple_sdk.frameworks) IOKit Security;
-  };
+  soapyuhd = callPackage ../applications/radio/soapyuhd { };
 
-  sofia_sip = callPackage ../development/libraries/sofia-sip {
-    inherit (darwin.apple_sdk.frameworks) SystemConfiguration;
-  };
+  sofia_sip = callPackage ../development/libraries/sofia-sip { };
 
-  soil = callPackage ../development/libraries/soil {
-    inherit (darwin.apple_sdk.frameworks) Carbon;
-  };
+  soil = callPackage ../development/libraries/soil { };
 
   spandsp = callPackage ../development/libraries/spandsp { };
   spandsp3 = callPackage ../development/libraries/spandsp/3.nix { };
@@ -11091,9 +10234,7 @@ with pkgs;
     libsOnly = true;
   };
 
-  speech-tools = callPackage ../development/libraries/speech-tools {
-    inherit (darwin.apple_sdk.frameworks) CoreServices AudioUnit Cocoa;
-  };
+  speech-tools = callPackage ../development/libraries/speech-tools { };
 
   speex = callPackage ../development/libraries/speex {
     fftw = fftwFloat;
@@ -11119,7 +10260,6 @@ with pkgs;
 
   inherit
     (callPackage ../development/libraries/sqlite/tools.nix {
-      inherit (darwin.apple_sdk.frameworks) Foundation;
     })
     sqlite-analyzer
     sqldiff
@@ -11136,7 +10276,7 @@ with pkgs;
 
   structuresynth = libsForQt5.callPackage ../development/libraries/structuresynth { };
 
-  suil = darwin.apple_sdk_11_0.callPackage ../development/libraries/audio/suil { };
+  suil = callPackage ../development/libraries/audio/suil { };
 
   sundials = callPackage ../development/libraries/sundials {
     python = python3;
@@ -11144,9 +10284,7 @@ with pkgs;
 
   svxlink = libsForQt5.callPackage ../applications/radio/svxlink { };
 
-  tachyon = callPackage ../development/libraries/tachyon {
-    inherit (darwin.apple_sdk.frameworks) Carbon;
-  };
+  tachyon = callPackage ../development/libraries/tachyon { };
 
   tclap = tclap_1_2;
 
@@ -11227,11 +10365,9 @@ with pkgs;
 
   vulkan-caps-viewer = libsForQt5.callPackage ../tools/graphics/vulkan-caps-viewer { };
 
-  vulkan-tools = callPackage ../tools/graphics/vulkan-tools {
-    inherit (darwin.apple_sdk.frameworks) AppKit Cocoa;
-  };
+  vulkan-tools = callPackage ../tools/graphics/vulkan-tools { };
 
-  wayland = darwin.apple_sdk_11_0.callPackage ../development/libraries/wayland { };
+  wayland = callPackage ../development/libraries/wayland { };
   wayland-scanner = callPackage ../development/libraries/wayland/scanner.nix { };
 
   wayland-protocols = callPackage ../development/libraries/wayland/protocols.nix { };
@@ -11262,9 +10398,7 @@ with pkgs;
   # bump when majoring of packages have updated
   webrtc-audio-processing = webrtc-audio-processing_0_3;
 
-  wildmidi = callPackage ../development/libraries/wildmidi {
-    inherit (darwin.apple_sdk.frameworks) OpenAL CoreAudioKit;
-  };
+  wildmidi = callPackage ../development/libraries/wildmidi { };
 
   wlr-protocols = callPackage ../development/libraries/wlroots/protocols.nix { };
 
@@ -11289,9 +10423,7 @@ with pkgs;
 
   xgboostWithCuda = xgboost.override { cudaSupport = true; };
 
-  yubico-pam = callPackage ../development/libraries/yubico-pam {
-    inherit (darwin.apple_sdk.frameworks) CoreServices SystemConfiguration;
-  };
+  yubico-pam = callPackage ../development/libraries/yubico-pam { };
 
   yubikey-manager-qt = libsForQt5.callPackage ../tools/misc/yubikey-manager-qt { };
 
@@ -11575,11 +10707,9 @@ with pkgs;
 
   ### DEVELOPMENT / R MODULES
 
-  R = darwin.apple_sdk_11_0.callPackage ../applications/science/math/R {
+  R = callPackage ../applications/science/math/R {
     # TODO: split docs into a separate output
     withRecommendedPackages = false;
-    inherit (darwin.apple_sdk_11_0.frameworks) Cocoa Foundation;
-    inherit (darwin) libobjc;
   };
 
   rWrapper = callPackage ../development/r-modules/wrapper.nix {
@@ -11767,9 +10897,7 @@ with pkgs;
 
   deconz = qt5.callPackage ../servers/deconz { };
 
-  doh-proxy-rust = callPackage ../servers/dns/doh-proxy-rust {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  doh-proxy-rust = callPackage ../servers/dns/doh-proxy-rust { };
 
   dict = callPackage ../servers/dict {
     flex = flex_2_5_35;
@@ -11809,9 +10937,7 @@ with pkgs;
 
   eventstore = callPackage ../servers/nosql/eventstore { };
 
-  fedigroups = callPackage ../servers/fedigroups {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  fedigroups = callPackage ../servers/fedigroups { };
 
   felix = callPackage ../servers/felix { };
 
@@ -11827,9 +10953,7 @@ with pkgs;
   freshrss = callPackage ../servers/web-apps/freshrss { };
   freshrss-extensions = recurseIntoAttrs (callPackage ../servers/web-apps/freshrss/extensions { });
 
-  freeswitch = callPackage ../servers/sip/freeswitch {
-    inherit (darwin.apple_sdk.frameworks) SystemConfiguration;
-  };
+  freeswitch = callPackage ../servers/sip/freeswitch { };
 
   glabels-qt = libsForQt5.callPackage ../applications/graphics/glabels-qt { };
 
@@ -11909,9 +11033,7 @@ with pkgs;
 
   leafnode1 = callPackage ../servers/news/leafnode/1.nix { };
 
-  lemmy-server = callPackage ../servers/web-apps/lemmy/server.nix {
-    inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration;
-  };
+  lemmy-server = callPackage ../servers/web-apps/lemmy/server.nix { };
 
   lemmy-ui = callPackage ../servers/web-apps/lemmy/ui.nix {
     nodejs = nodejs_20;
@@ -11956,7 +11078,6 @@ with pkgs;
 
   inherit
     (callPackages ../servers/mpd {
-      inherit (darwin.apple_sdk.frameworks) AudioToolbox AudioUnit;
     })
     mpd
     mpd-small
@@ -12062,14 +11183,7 @@ with pkgs;
 
   hsphfpd = callPackage ../servers/pulseaudio/hsphfpd.nix { };
 
-  pulseaudio = callPackage ../servers/pulseaudio {
-    inherit (darwin.apple_sdk.frameworks)
-      CoreServices
-      AudioUnit
-      Cocoa
-      CoreAudio
-      ;
-  };
+  pulseaudio = callPackage ../servers/pulseaudio { };
 
   qpaeq = libsForQt5.callPackage ../servers/pulseaudio/qpaeq.nix { };
 
@@ -12134,7 +11248,6 @@ with pkgs;
 
   mysql80 = callPackage ../servers/sql/mysql/8.0.x.nix {
     inherit (darwin) developer_cmds DarwinTools;
-    inherit (darwin.apple_sdk.frameworks) CoreServices;
     boost = boost177; # Configure checks for specific version.
     icu = icu69;
     protobuf = protobuf_21;
@@ -12188,6 +11301,7 @@ with pkgs;
 
   inherit (import ../servers/sql/postgresql pkgs)
     postgresqlVersions
+    postgresqlJitVersions
     libpq
     ;
 
@@ -12197,7 +11311,9 @@ with pkgs;
     postgresql_15
     postgresql_16
     postgresql_17
+    ;
 
+  inherit (postgresqlJitVersions)
     postgresql_13_jit
     postgresql_14_jit
     postgresql_15_jit
@@ -12207,17 +11323,11 @@ with pkgs;
   postgresql = postgresql_17;
   postgresql_jit = postgresql_17_jit;
   postgresqlPackages = recurseIntoAttrs postgresql.pkgs;
-  postgresqlJitPackages = recurseIntoAttrs postgresql_jit.pkgs;
   postgresql13Packages = recurseIntoAttrs postgresql_13.pkgs;
   postgresql14Packages = recurseIntoAttrs postgresql_14.pkgs;
   postgresql15Packages = recurseIntoAttrs postgresql_15.pkgs;
   postgresql16Packages = recurseIntoAttrs postgresql_16.pkgs;
   postgresql17Packages = recurseIntoAttrs postgresql_17.pkgs;
-  postgresql13JitPackages = recurseIntoAttrs postgresql_13_jit.pkgs;
-  postgresql14JitPackages = recurseIntoAttrs postgresql_14_jit.pkgs;
-  postgresql15JitPackages = recurseIntoAttrs postgresql_15_jit.pkgs;
-  postgresql16JitPackages = recurseIntoAttrs postgresql_16_jit.pkgs;
-  postgresql17JitPackages = recurseIntoAttrs postgresql_17_jit.pkgs;
 
   postgres-websockets = haskellPackages.postgres-websockets.bin;
   postgrest = haskellPackages.postgrest.bin;
@@ -12327,7 +11437,6 @@ with pkgs;
   prometheus-wireguard-exporter =
     callPackage ../servers/monitoring/prometheus/wireguard-exporter.nix
       {
-        inherit (darwin.apple_sdk.frameworks) Security;
       };
   prometheus-zfs-exporter = callPackage ../servers/monitoring/prometheus/zfs-exporter.nix { };
   prometheus-xmpp-alerts = callPackage ../servers/monitoring/prometheus/xmpp-alerts.nix { };
@@ -12359,11 +11468,7 @@ with pkgs;
     protobuf = protobuf_21;
   };
 
-  rustic = callPackage ../by-name/ru/rustic/package.nix {
-    inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration;
-  };
-
-  samba4 = darwin.apple_sdk_11_0.callPackage ../servers/samba/4.x.nix { };
+  samba4 = callPackage ../servers/samba/4.x.nix { };
 
   samba = samba4;
 
@@ -12421,9 +11526,7 @@ with pkgs;
     autoreconfHook = buildPackages.autoreconfHook269;
   };
 
-  unpackerr = callPackage ../servers/unpackerr {
-    inherit (darwin.apple_sdk.frameworks) Cocoa WebKit;
-  };
+  unpackerr = callPackage ../servers/unpackerr { };
 
   virtualenv = with python3Packages; toPythonApplication virtualenv;
 
@@ -12431,8 +11534,6 @@ with pkgs;
 
   quartz-wm = callPackage ../servers/x11/quartz-wm {
     stdenv = clangStdenv;
-    inherit (darwin.apple_sdk.frameworks) AppKit Foundation;
-    inherit (darwin.apple_sdk.libs) Xplugin;
   };
 
   xorg =
@@ -12441,8 +11542,6 @@ with pkgs;
       # so as not to have the newly bound xorg items already in scope,  which would
       # have created a cycle.
       overrides = lib.callPackageWith __splicedPackages ../servers/x11/xorg/overrides.nix {
-        inherit (darwin.apple_sdk.frameworks) ApplicationServices Carbon Cocoa;
-        inherit (darwin.apple_sdk.libs) Xplugin;
         inherit (buildPackages.darwin) bootstrap_cmds;
         udev = if stdenv.hostPlatform.isLinux then udev else null;
         libdrm = if stdenv.hostPlatform.isLinux then libdrm else null;
@@ -12487,9 +11586,7 @@ with pkgs;
 
   ### SERVERS / GEOSPATIAL
 
-  martin = callPackage ../servers/geospatial/martin {
-    inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration;
-  };
+  martin = callPackage ../servers/geospatial/martin { };
 
   ### OS-SPECIFIC
 
@@ -12514,16 +11611,7 @@ with pkgs;
     armTrustedFirmwareS905
     ;
 
-  inherit (callPackages ../os-specific/linux/apparmor { })
-    libapparmor
-    apparmor-utils
-    apparmor-bin-utils
-    apparmor-parser
-    apparmor-pam
-    apparmor-profiles
-    apparmor-kernel-patches
-    apparmorRulesFromClosure
-    ;
+  inherit (libapparmor.passthru) apparmorRulesFromClosure;
 
   ath9k-htc-blobless-firmware = callPackage ../os-specific/linux/firmware/ath9k { };
   ath9k-htc-blobless-firmware-unstable = callPackage ../os-specific/linux/firmware/ath9k {
@@ -12576,9 +11664,7 @@ with pkgs;
   # `.override` clobbered. C.F. `llvmPackages` which does the same.
   darwin = recurseIntoAttrs (callPackage ./darwin-packages.nix { });
 
-  defaultbrowser = callPackage ../os-specific/darwin/defaultbrowser {
-    inherit (darwin.apple_sdk.frameworks) Foundation;
-  };
+  defaultbrowser = callPackage ../os-specific/darwin/defaultbrowser { };
 
   displaylink = callPackage ../os-specific/linux/displaylink {
     inherit (linuxPackages) evdi;
@@ -12624,15 +11710,11 @@ with pkgs;
 
   gpm-ncurses = gpm.override { withNcurses = true; };
 
-  htop = callPackage ../tools/system/htop {
-    inherit (darwin) IOKit;
-  };
+  htop = callPackage ../tools/system/htop { };
 
-  humility = callPackage ../development/tools/rust/humility {
-    inherit (darwin.apple_sdk.frameworks) AppKit;
-  };
+  humility = callPackage ../development/tools/rust/humility { };
 
-  btop = darwin.apple_sdk_11_0.callPackage ../tools/system/btop { };
+  btop = callPackage ../tools/system/btop { };
   btop-cuda = btop.override { cudaSupport = true; };
   btop-rocm = btop.override { rocmSupport = true; };
 
@@ -12661,13 +11743,9 @@ with pkgs;
 
   linthesia = callPackage ../games/linthesia/default.nix { };
 
-  osx-cpu-temp = callPackage ../os-specific/darwin/osx-cpu-temp {
-    inherit (darwin.apple_sdk.frameworks) IOKit;
-  };
+  osx-cpu-temp = callPackage ../os-specific/darwin/osx-cpu-temp { };
 
-  macfuse-stubs = callPackage ../os-specific/darwin/macfuse {
-    inherit (darwin.apple_sdk.frameworks) DiskArbitration;
-  };
+  macfuse-stubs = callPackage ../os-specific/darwin/macfuse { };
 
   projecteur = libsForQt5.callPackage ../os-specific/linux/projecteur { };
 
@@ -12773,15 +11851,9 @@ with pkgs;
 
   cryptodev = linuxPackages.cryptodev;
 
-  libsemanage = callPackage ../os-specific/linux/libsemanage {
-    python = python3;
-  };
+  librasterlite2 = callPackage ../development/libraries/librasterlite2 { };
 
-  librasterlite2 = callPackage ../development/libraries/librasterlite2 {
-    inherit (darwin.apple_sdk.frameworks) ApplicationServices;
-  };
-
-  librealsense = darwin.apple_sdk_11_0.callPackage ../development/libraries/librealsense { };
+  librealsense = callPackage ../development/libraries/librealsense { };
 
   librealsenseWithCuda = callPackage ../development/libraries/librealsense {
     cudaSupport = true;
@@ -12844,15 +11916,10 @@ with pkgs;
       inherit modules;
     };
 
-  nushell = darwin.apple_sdk_11_0.callPackage ../shells/nushell {
-    inherit (darwin.apple_sdk_11_0) Libsystem;
-    inherit (darwin.apple_sdk_11_0.frameworks) AppKit Security;
-  };
+  nushell = callPackage ../shells/nushell { };
 
   nushellPlugins = recurseIntoAttrs (
     callPackage ../shells/nushell/plugins {
-      inherit (darwin.apple_sdk.frameworks) Security;
-      inherit (darwin.apple_sdk_11_0.frameworks) IOKit CoreFoundation Foundation;
     }
   );
 
@@ -12864,34 +11931,17 @@ with pkgs;
 
   nftables = callPackage ../os-specific/linux/nftables { };
 
-  noah = callPackage ../os-specific/darwin/noah {
-    inherit (darwin.apple_sdk.frameworks) Hypervisor;
-  };
+  noah = callPackage ../os-specific/darwin/noah { };
 
   open-vm-tools-headless = open-vm-tools.override { withX = false; };
 
-  gdlv = callPackage ../by-name/gd/gdlv/package.nix {
-    inherit (darwin.apple_sdk_11_0.frameworks)
-      AppKit
-      CoreGraphics
-      Foundation
-      Metal
-      ;
-  };
-
-  gotop = callPackage ../tools/system/gotop {
-    inherit (darwin.apple_sdk.frameworks) IOKit;
-  };
+  gotop = callPackage ../tools/system/gotop { };
 
   odin = callPackage ../by-name/od/odin/package.nix {
-    inherit (pkgs.darwin.apple_sdk_11_0) MacOSX-SDK;
-    inherit (pkgs.darwin.apple_sdk_11_0.frameworks) Security;
     llvmPackages = llvmPackages_18;
   };
 
-  okapi = callPackage ../development/libraries/okapi {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  okapi = callPackage ../development/libraries/okapi { };
 
   pam =
     if stdenv.hostPlatform.isLinux then
@@ -12940,9 +11990,7 @@ with pkgs;
 
   sddm-sugar-dark = libsForQt5.callPackage ../data/themes/sddm-sugar-dark { };
 
-  sdrangel = qt6Packages.callPackage ../applications/radio/sdrangel {
-    stdenv = if stdenv.hostPlatform.isDarwin then overrideSDK stdenv "12.3" else stdenv;
-  };
+  sdrangel = qt6Packages.callPackage ../applications/radio/sdrangel { };
 
   sgx-sdk = callPackage ../os-specific/linux/sgx/sdk { };
 
@@ -13036,9 +12084,7 @@ with pkgs;
     withoutInitTools = true;
   };
 
-  trinsic-cli = callPackage ../tools/admin/trinsic-cli {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  trinsic-cli = callPackage ../tools/admin/trinsic-cli { };
 
   # Upstream U-Boots:
   inherit (callPackage ../misc/uboot { })
@@ -13440,9 +12486,7 @@ with pkgs;
 
   ### APPLICATIONS / GIS
 
-  grass = callPackage ../applications/gis/grass {
-    stdenv = if stdenv.hostPlatform.isDarwin then overrideSDK stdenv "11.0" else stdenv;
-  };
+  grass = callPackage ../applications/gis/grass { };
 
   qgis-ltr = callPackage ../applications/gis/qgis/ltr.nix { };
 
@@ -13454,9 +12498,7 @@ with pkgs;
     wxGTK = wxGTK32;
   };
 
-  whitebox-tools = callPackage ../applications/gis/whitebox-tools {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  whitebox-tools = callPackage ../applications/gis/whitebox-tools { };
 
   zombietrackergps = libsForQt5.callPackage ../applications/gis/zombietrackergps { };
 
@@ -13500,9 +12542,7 @@ with pkgs;
 
   masterpdfeditor4 = libsForQt5.callPackage ../applications/misc/masterpdfeditor4 { };
 
-  master_me = callPackage ../applications/audio/master_me {
-    inherit (darwin.apple_sdk.frameworks) Cocoa;
-  };
+  master_me = callPackage ../applications/audio/master_me { };
 
   inherit
     ({
@@ -13538,9 +12578,7 @@ with pkgs;
 
   antimony = libsForQt5.callPackage ../applications/graphics/antimony { };
 
-  apkeep = callPackage ../tools/misc/apkeep {
-    inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration;
-  };
+  apkeep = callPackage ../tools/misc/apkeep { };
 
   apngasm = callPackage ../applications/graphics/apngasm { };
   apngasm_2 = callPackage ../applications/graphics/apngasm/2.nix { };
@@ -13550,9 +12588,7 @@ with pkgs;
 
   arelle = with python3Packages; toPythonApplication arelle;
 
-  asuka = callPackage ../applications/networking/browsers/asuka {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  asuka = callPackage ../applications/networking/browsers/asuka { };
 
   astroid = callPackage ../applications/networking/mailreaders/astroid {
     vim = vim-full.override { features = "normal"; };
@@ -13565,9 +12601,7 @@ with pkgs;
 
   bambootracker-qt6 = bambootracker.override { withQt6 = true; };
 
-  schismtracker = callPackage ../applications/audio/schismtracker {
-    inherit (darwin.apple_sdk.frameworks) Cocoa;
-  };
+  schismtracker = callPackage ../applications/audio/schismtracker { };
 
   ausweisapp = qt6Packages.callPackage ../applications/misc/ausweisapp { };
 
@@ -13621,13 +12655,6 @@ with pkgs;
 
   blender = callPackage ../by-name/bl/blender/package.nix {
     python3Packages = python311Packages;
-    inherit (darwin.apple_sdk.frameworks)
-      Cocoa
-      CoreGraphics
-      ForceFeedback
-      OpenAL
-      OpenGL
-      ;
   };
 
   blender-hip = blender.override { hipSupport = true; };
@@ -13666,9 +12693,7 @@ with pkgs;
 
   cbconvert-gui = cbconvert.gui;
 
-  cddiscid = callPackage ../applications/audio/cd-discid {
-    inherit (darwin) IOKit;
-  };
+  cddiscid = callPackage ../applications/audio/cd-discid { };
 
   cdparanoia = cdparanoiaIII;
 
@@ -13684,15 +12709,6 @@ with pkgs;
 
   chuck = callPackage ../applications/audio/chuck {
     inherit (darwin) DarwinTools;
-    inherit (darwin.apple_sdk.frameworks)
-      AppKit
-      Carbon
-      CoreAudio
-      CoreMIDI
-      CoreServices
-      Kernel
-      MultitouchSupport
-      ;
   };
 
   cligh = python3Packages.callPackage ../development/tools/github/cligh { };
@@ -13706,7 +12722,6 @@ with pkgs;
   clipgrab = libsForQt5.callPackage ../applications/video/clipgrab { };
 
   cmus = callPackage ../applications/audio/cmus {
-    inherit (darwin.apple_sdk.frameworks) AudioUnit CoreAudio VideoToolbox;
     libjack = libjack2;
   };
 
@@ -13721,14 +12736,7 @@ with pkgs;
 
   cpeditor = libsForQt5.callPackage ../applications/editors/cpeditor { };
 
-  csound = callPackage ../applications/audio/csound {
-    inherit (pkgs.darwin.apple_sdk.frameworks)
-      Accelerate
-      AudioUnit
-      CoreAudio
-      CoreMIDI
-      ;
-  };
+  csound = callPackage ../applications/audio/csound { };
 
   csound-qt = libsForQt5.callPackage ../applications/audio/csound/csound-qt { };
 
@@ -13742,9 +12750,7 @@ with pkgs;
     hamlib = hamlib_4;
   };
 
-  cubicsdr = callPackage ../applications/radio/cubicsdr {
-    inherit (darwin.apple_sdk.frameworks) Cocoa WebKit;
-  };
+  cubicsdr = callPackage ../applications/radio/cubicsdr { };
 
   cutecom = libsForQt5.callPackage ../tools/misc/cutecom { };
 
@@ -13755,14 +12761,6 @@ with pkgs;
   darktable = callPackage ../by-name/da/darktable/package.nix {
     lua = lua5_4;
     pugixml = pugixml.override { shared = true; };
-    stdenv =
-      if stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64 then
-        overrideSDK llvmPackages_18.stdenv {
-          darwinMinVersion = "10.14";
-          darwinSdkVersion = "11.0";
-        }
-      else
-        stdenv;
   };
 
   datadog-agent = callPackage ../tools/networking/dd-agent/datadog-agent.nix {
@@ -13812,9 +12810,7 @@ with pkgs;
     inherit (python3Packages) buildPythonApplication requests;
   };
 
-  dmtx-utils = callPackage ../tools/graphics/dmtx-utils {
-    inherit (darwin.apple_sdk.frameworks) Foundation;
-  };
+  dmtx-utils = callPackage ../tools/graphics/dmtx-utils { };
 
   inherit (callPackage ../applications/virtualization/docker { })
     docker_25
@@ -13869,9 +12865,7 @@ with pkgs;
 
   eclipses = recurseIntoAttrs (callPackage ../applications/editors/eclipse { });
 
-  ecpdap = callPackage ../development/embedded/fpga/ecpdap {
-    inherit (darwin.apple_sdk.frameworks) AppKit;
-  };
+  ecpdap = callPackage ../development/embedded/fpga/ecpdap { };
 
   electrum = libsForQt5.callPackage ../applications/misc/electrum { };
 
@@ -13908,23 +12902,15 @@ with pkgs;
       pkgs' = pkgs; # default pkgs used for bootstrapping the emacs package set
     };
 
-  epick = callPackage ../applications/graphics/epick {
-    inherit (darwin.apple_sdk.frameworks) AppKit;
-  };
+  epick = callPackage ../applications/graphics/epick { };
 
   espeak-classic = callPackage ../applications/audio/espeak { };
 
-  espeak-ng = callPackage ../applications/audio/espeak-ng {
-    inherit (darwin.apple_sdk.frameworks) AudioToolbox AudioUnit CoreAudio;
-  };
+  espeak-ng = callPackage ../applications/audio/espeak-ng { };
   espeak = res.espeak-ng;
 
   espeakedit = callPackage ../applications/audio/espeak/edit.nix { };
 
-  espflash = callPackage ../by-name/es/espflash/package.nix {
-    inherit (darwin.apple_sdk.frameworks) CoreServices Security SystemConfiguration;
-  };
-
   evilpixie = libsForQt5.callPackage ../applications/graphics/evilpixie { };
 
   greenfoot = callPackage ../applications/editors/greenfoot {
@@ -13959,13 +12945,9 @@ with pkgs;
   fetchmail = callPackage ../applications/misc/fetchmail { };
   fetchmail_7 = callPackage ../applications/misc/fetchmail/v7.nix { };
 
-  finalfrontier = callPackage ../applications/science/machine-learning/finalfrontier {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  finalfrontier = callPackage ../applications/science/machine-learning/finalfrontier { };
 
-  finalfusion-utils = callPackage ../applications/science/machine-learning/finalfusion-utils {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  finalfusion-utils = callPackage ../applications/science/machine-learning/finalfusion-utils { };
 
   firewalld-gui = firewalld.override { withGui = true; };
 
@@ -13977,7 +12959,7 @@ with pkgs;
 
   fmit = libsForQt5.callPackage ../applications/audio/fmit { };
 
-  fnc = darwin.apple_sdk_11_0.callPackage ../applications/version-management/fnc { };
+  fnc = callPackage ../applications/version-management/fnc { };
 
   focuswriter = qt6Packages.callPackage ../applications/editors/focuswriter { };
 
@@ -13987,14 +12969,7 @@ with pkgs;
 
   fritzing = qt6Packages.callPackage ../applications/science/electronics/fritzing { };
 
-  ft2-clone = callPackage ../applications/audio/ft2-clone {
-    inherit (darwin.apple_sdk.frameworks)
-      CoreAudio
-      CoreMIDI
-      CoreServices
-      Cocoa
-      ;
-  };
+  ft2-clone = callPackage ../applications/audio/ft2-clone { };
 
   fvwm = fvwm2;
 
@@ -14004,11 +12979,9 @@ with pkgs;
     };
   };
 
-  gaucheBootstrap = darwin.apple_sdk_11_0.callPackage ../development/interpreters/gauche/boot.nix { };
+  gaucheBootstrap = callPackage ../development/interpreters/gauche/boot.nix { };
 
-  gauche = darwin.apple_sdk_11_0.callPackage ../development/interpreters/gauche {
-    inherit (darwin.apple_sdk_11_0.frameworks) CoreServices;
-  };
+  gauche = callPackage ../development/interpreters/gauche { };
 
   gazelle-origin = python3Packages.callPackage ../tools/misc/gazelle-origin { };
 
@@ -14022,9 +12995,7 @@ with pkgs;
   };
   gnuradioPackages = lib.recurseIntoAttrs gnuradio.pkgs;
 
-  grandorgue = callPackage ../applications/audio/grandorgue {
-    inherit (darwin.apple_sdk.frameworks) Cocoa;
-  };
+  grandorgue = callPackage ../applications/audio/grandorgue { };
 
   greetd = recurseIntoAttrs (
     {
@@ -14064,7 +13035,6 @@ with pkgs;
   welle-io = qt6Packages.callPackage ../applications/radio/welle-io { };
 
   wireshark = qt6Packages.callPackage ../applications/networking/sniffers/wireshark {
-    inherit (darwin.apple_sdk_11_0.frameworks) ApplicationServices SystemConfiguration;
     libpcap = libpcap.override { withBluez = stdenv.hostPlatform.isLinux; };
   };
   wireshark-qt = wireshark;
@@ -14079,15 +13049,13 @@ with pkgs;
 
   fclones = callPackage ../tools/misc/fclones { };
 
-  fclones-gui = darwin.apple_sdk_11_0.callPackage ../tools/misc/fclones/gui.nix { };
+  fclones-gui = callPackage ../tools/misc/fclones/gui.nix { };
 
   feh = callPackage ../applications/graphics/feh {
     imlib2 = imlib2Full;
   };
 
-  filezilla = darwin.apple_sdk_11_0.callPackage ../applications/networking/ftp/filezilla {
-    inherit (darwin.apple_sdk_11_0.frameworks) CoreServices Security;
-  };
+  filezilla = callPackage ../applications/networking/ftp/filezilla { };
 
   buildMozillaMach =
     opts: callPackage (import ../applications/networking/browsers/firefox/common.nix opts) { };
@@ -14229,16 +13197,7 @@ with pkgs;
       inherit buildPythonApplication;
     };
 
-  foxotron = callPackage ../applications/graphics/foxotron {
-    inherit (darwin.apple_sdk.frameworks)
-      AVFoundation
-      Carbon
-      Cocoa
-      CoreAudio
-      Kernel
-      OpenGL
-      ;
-  };
+  foxotron = callPackage ../applications/graphics/foxotron { };
 
   freedv = callPackage ../by-name/fr/freedv/package.nix {
     codec2 = codec2.override {
@@ -14262,7 +13221,6 @@ with pkgs;
 
   gimp3 = callPackage ../applications/graphics/gimp {
     lcms = lcms2;
-    inherit (darwin.apple_sdk.frameworks) AppKit Cocoa;
   };
 
   gimp3-with-plugins = callPackage ../applications/graphics/gimp/wrapper.nix {
@@ -14279,7 +13237,6 @@ with pkgs;
   gimp = callPackage ../applications/graphics/gimp/2.0 {
     autoreconfHook = buildPackages.autoreconfHook269;
     lcms = lcms2;
-    inherit (darwin.apple_sdk.frameworks) AppKit Cocoa;
   };
 
   gimp-with-plugins = callPackage ../applications/graphics/gimp/wrapper.nix {
@@ -14371,9 +13328,7 @@ with pkgs;
 
   q4wine = libsForQt5.callPackage ../applications/misc/q4wine { };
 
-  qrencode = callPackage ../development/libraries/qrencode {
-    inherit (darwin) libobjc;
-  };
+  qrencode = callPackage ../development/libraries/qrencode { };
 
   googleearth-pro = libsForQt5.callPackage ../applications/misc/googleearth-pro { };
 
@@ -14429,9 +13384,7 @@ with pkgs;
     inherit (python3Packages) pygments;
   };
 
-  hors = callPackage ../development/tools/hors {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  hors = callPackage ../development/tools/hors { };
 
   hovercraft = python3Packages.callPackage ../applications/misc/hovercraft { };
 
@@ -14614,9 +13567,7 @@ with pkgs;
     libde265Support = false;
   };
 
-  imagemagick6 = callPackage ../applications/graphics/ImageMagick/6.x.nix {
-    inherit (darwin.apple_sdk.frameworks) ApplicationServices Foundation;
-  };
+  imagemagick6 = callPackage ../applications/graphics/ImageMagick/6.x.nix { };
 
   imagemagick6Big = imagemagick6.override {
     ghostscriptSupport = true;
@@ -14648,7 +13599,6 @@ with pkgs;
 
   imagemagick = lowPrio (
     callPackage ../applications/graphics/ImageMagick {
-      inherit (darwin.apple_sdk.frameworks) ApplicationServices Foundation;
     }
   );
 
@@ -14676,7 +13626,7 @@ with pkgs;
     callPackages ../applications/graphics/inkscape/extensions.nix { }
   );
 
-  inlyne = darwin.apple_sdk_11_0.callPackage ../applications/misc/inlyne { };
+  inlyne = callPackage ../applications/misc/inlyne { };
 
   ion3 = callPackage ../applications/window-managers/ion-3 {
     lua = lua5_1;
@@ -14711,9 +13661,7 @@ with pkgs;
 
   jalv-qt = jalv.override { useQt = true; };
 
-  jameica = callPackage ../applications/office/jameica {
-    inherit (darwin.apple_sdk.frameworks) Cocoa;
-  };
+  jameica = callPackage ../applications/office/jameica { };
 
   js8call = qt5.callPackage ../applications/radio/js8call { };
 
@@ -14789,8 +13737,7 @@ with pkgs;
 
   ktimetracker = libsForQt5.callPackage ../applications/office/ktimetracker { };
 
-  kubectl-evict-pod = callPackage ../applications/networking/cluster/kubectl-evict-pod {
-  };
+  kubectl-evict-pod = callPackage ../applications/networking/cluster/kubectl-evict-pod { };
 
   kubeval = callPackage ../applications/networking/cluster/kubeval { };
 
@@ -14800,9 +13747,9 @@ with pkgs;
   kubectl = callPackage ../applications/networking/cluster/kubernetes/kubectl.nix { };
   kubectl-convert = kubectl.convert;
 
-  kubectl-view-allocations = callPackage ../applications/networking/cluster/kubectl-view-allocations {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  kubectl-view-allocations =
+    callPackage ../applications/networking/cluster/kubectl-view-allocations
+      { };
 
   kubelogin-oidc = callPackage ../by-name/ku/kubelogin-oidc/package.nix {
     buildGoModule = buildGo124Module;
@@ -14941,22 +13888,16 @@ with pkgs;
     withFonts = true;
   };
 
-  libresprite = callPackage ../applications/editors/libresprite {
-    inherit (darwin.apple_sdk.frameworks) AppKit Cocoa Foundation;
-  };
+  libresprite = callPackage ../applications/editors/libresprite { };
 
   libutp = callPackage ../applications/networking/p2p/libutp { };
   libutp_3_4 = callPackage ../applications/networking/p2p/libutp/3.4.nix { };
 
-  littlegptracker = callPackage ../applications/audio/littlegptracker {
-    inherit (darwin.apple_sdk.frameworks) Foundation;
-  };
+  littlegptracker = callPackage ../applications/audio/littlegptracker { };
 
   ledger-web = callPackage ../applications/office/ledger-web { };
 
-  lighthouse-steamvr = callPackage ../tools/misc/lighthouse-steamvr {
-    inherit (darwin.apple_sdk.frameworks) AppKit;
-  };
+  lighthouse-steamvr = callPackage ../tools/misc/lighthouse-steamvr { };
 
   linphone = libsForQt5.callPackage ../applications/networking/instant-messengers/linphone { };
 
@@ -15018,9 +13959,7 @@ with pkgs;
 
   mbrola-voices = callPackage ../applications/audio/mbrola/voices.nix { };
 
-  mdzk = callPackage ../applications/misc/mdzk {
-    inherit (darwin.apple_sdk.frameworks) CoreServices;
-  };
+  mdzk = callPackage ../applications/misc/mdzk { };
 
   mediaelch = mediaelch-qt5;
   mediaelch-qt5 = libsForQt5.callPackage ../applications/misc/mediaelch { };
@@ -15032,24 +13971,11 @@ with pkgs;
     gconf = gnome2.GConf;
   };
 
-  menyoki = callPackage ../applications/graphics/menyoki {
-    inherit (darwin.apple_sdk.frameworks) AppKit;
-  };
+  menyoki = callPackage ../applications/graphics/menyoki { };
 
-  mercurial = callPackage ../applications/version-management/mercurial {
-    inherit (darwin.apple_sdk.frameworks) ApplicationServices;
-  };
+  mercurial = callPackage ../applications/version-management/mercurial { };
 
-  sapling = callPackage ../applications/version-management/sapling {
-    inherit (darwin.apple_sdk.frameworks)
-      Cocoa
-      CoreFoundation
-      CoreGraphics
-      CoreServices
-      Security
-      WebKit
-      ;
-  };
+  sapling = callPackage ../applications/version-management/sapling { };
 
   mercurialFull = mercurial.override { fullBuild = true; };
 
@@ -15064,17 +13990,11 @@ with pkgs;
 
   miniaudicle = qt6Packages.callPackage ../applications/audio/miniaudicle { };
 
-  minidsp = callPackage ../applications/audio/minidsp {
-    inherit (darwin.apple_sdk.frameworks) AppKit IOKit;
-  };
+  minidsp = callPackage ../applications/audio/minidsp { };
 
-  minicom = callPackage ../tools/misc/minicom {
-    inherit (darwin.apple_sdk.frameworks) IOKit;
-  };
+  minicom = callPackage ../tools/misc/minicom { };
 
-  minikube = callPackage ../applications/networking/cluster/minikube {
-    inherit (darwin.apple_sdk.frameworks) vmnet;
-  };
+  minikube = callPackage ../applications/networking/cluster/minikube { };
 
   minitube = libsForQt5.callPackage ../applications/video/minitube { };
 
@@ -15085,7 +14005,6 @@ with pkgs;
   };
 
   mmlgui = callPackage ../applications/audio/mmlgui {
-    inherit (darwin.apple_sdk.frameworks) Carbon Cocoa;
     libvgm = libvgm.override {
       withAllEmulators = false;
       emulators = [
@@ -15095,9 +14014,7 @@ with pkgs;
     };
   };
 
-  moc = callPackage ../applications/audio/moc {
-    inherit (darwin.apple_sdk.frameworks) CoreServices;
-  };
+  moc = callPackage ../applications/audio/moc { };
 
   monotone = callPackage ../applications/version-management/monotone {
     lua = lua5;
@@ -15147,7 +14064,6 @@ with pkgs;
     ;
 
   mpg123 = callPackage ../applications/audio/mpg123 {
-    inherit (darwin.apple_sdk.frameworks) AudioUnit AudioToolbox;
     jack = libjack2;
   };
 
@@ -15249,14 +14165,10 @@ with pkgs;
     protobuf = protobuf_21;
   };
 
-  p4 = callPackage ../applications/version-management/p4 {
-    inherit (darwin.apple_sdk.frameworks) CoreServices Foundation Security;
-  };
+  p4 = callPackage ../applications/version-management/p4 { };
   p4v = qt6Packages.callPackage ../applications/version-management/p4v { };
 
-  pc-ble-driver = callPackage ../development/libraries/pc-ble-driver {
-    inherit (darwin.apple_sdk.frameworks) IOKit;
-  };
+  pc-ble-driver = callPackage ../development/libraries/pc-ble-driver { };
 
   pcmanfm-qt = lxqt.pcmanfm-qt;
 
@@ -15288,8 +14200,7 @@ with pkgs;
 
   polyphone = qt6.callPackage ../applications/audio/polyphone { };
 
-  roxctl = callPackage ../applications/networking/cluster/roxctl {
-  };
+  roxctl = callPackage ../applications/networking/cluster/roxctl { };
 
   scx = recurseIntoAttrs (callPackage ../os-specific/linux/scx { });
 
@@ -15308,18 +14219,13 @@ with pkgs;
     softmaker-office-nx
     ;
 
-  synapse-bt = callPackage ../applications/networking/p2p/synapse-bt {
-    inherit (darwin.apple_sdk.frameworks) CoreServices Security;
-  };
+  synapse-bt = callPackage ../applications/networking/p2p/synapse-bt { };
 
   taxi-cli = with python3Packages; toPythonApplication taxi;
 
-  mpop = callPackage ../applications/networking/mpop {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  mpop = callPackage ../applications/networking/mpop { };
 
   msmtp = callPackage ../applications/networking/msmtp {
-    inherit (darwin.apple_sdk.frameworks) Security;
     autoreconfHook = buildPackages.autoreconfHook269;
   };
 
@@ -15336,15 +14242,12 @@ with pkgs;
     enableGL = false;
   };
 
-  muso = callPackage ../applications/audio/muso {
-    inherit (darwin.apple_sdk.frameworks) CoreServices;
-  };
+  muso = callPackage ../applications/audio/muso { };
 
   diffpdf = libsForQt5.callPackage ../applications/misc/diffpdf { };
 
   diff-pdf = callPackage ../applications/misc/diff-pdf {
     wxGTK = wxGTK32;
-    inherit (darwin.apple_sdk.frameworks) Cocoa;
   };
 
   mypaint-brushes1 = callPackage ../development/libraries/mypaint-brushes/1.0.nix { };
@@ -15373,9 +14276,7 @@ with pkgs;
     addThumbnailer = true;
   };
 
-  gnome-obfuscate = callPackage ../applications/graphics/gnome-obfuscate {
-    inherit (darwin.apple_sdk.frameworks) Foundation;
-  };
+  gnome-obfuscate = callPackage ../applications/graphics/gnome-obfuscate { };
 
   obs-studio = qt6Packages.callPackage ../applications/video/obs-studio { };
 
@@ -15398,7 +14299,6 @@ with pkgs;
 
   opencpn = callPackage ../applications/misc/opencpn {
     inherit (darwin) DarwinTools;
-    inherit (darwin.apple_sdk.frameworks) AppKit;
   };
 
   openimageio_2 = callPackage ../by-name/op/openimageio/2.nix { };
@@ -15417,7 +14317,7 @@ with pkgs;
     vm = callPackage ../applications/audio/open-music-kontrollers/vm.nix { };
   };
 
-  openrsync = darwin.apple_sdk_11_0.callPackage ../applications/networking/sync/openrsync { };
+  openrsync = callPackage ../applications/networking/sync/openrsync { };
 
   openscad = libsForQt5.callPackage ../applications/graphics/openscad { };
 
@@ -15427,9 +14327,7 @@ with pkgs;
 
   organicmaps = qt6Packages.callPackage ../applications/misc/organicmaps { };
 
-  owofetch = callPackage ../tools/misc/owofetch {
-    inherit (darwin.apple_sdk.frameworks) Foundation DiskArbitration;
-  };
+  owofetch = callPackage ../tools/misc/owofetch { };
 
   vivaldi = callPackage ../applications/networking/browsers/vivaldi { };
 
@@ -15465,8 +14363,7 @@ with pkgs;
     sed = gnused;
   };
 
-  pencil = callPackage ../applications/graphics/pencil {
-  };
+  pencil = callPackage ../applications/graphics/pencil { };
 
   petrifoo = callPackage ../applications/audio/petrifoo {
     inherit (gnome2) libgnomecanvas;
@@ -15517,9 +14414,7 @@ with pkgs;
 
   pokefinder = qt6Packages.callPackage ../tools/games/pokefinder { };
 
-  pomodoro = callPackage ../applications/misc/pomodoro {
-    inherit (darwin.apple_sdk.frameworks) Foundation;
-  };
+  pomodoro = callPackage ../applications/misc/pomodoro { };
 
   pothos = libsForQt5.callPackage ../applications/radio/pothos { };
 
@@ -15571,7 +14466,6 @@ with pkgs;
   eiskaltdcpp = libsForQt5.callPackage ../applications/networking/p2p/eiskaltdcpp { };
 
   qemu = callPackage ../applications/virtualization/qemu {
-    inherit (darwin.stubs) rez setfile;
     inherit (darwin) sigtool;
   };
 
@@ -15709,18 +14603,14 @@ with pkgs;
 
   rclone-browser = libsForQt5.callPackage ../applications/networking/sync/rclone/browser.nix { };
 
-  rdedup = callPackage ../tools/backup/rdedup {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  rdedup = callPackage ../tools/backup/rdedup { };
 
   reaper = callPackage ../applications/audio/reaper {
     jackLibrary = libjack2; # Another option is "pipewire.jack".
     ffmpeg = ffmpeg_4-headless;
   };
 
-  reddsaver = callPackage ../applications/misc/reddsaver {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  reddsaver = callPackage ../applications/misc/reddsaver { };
 
   rednotebook = python3Packages.callPackage ../applications/editors/rednotebook { };
 
@@ -15775,15 +14665,11 @@ with pkgs;
 
   rtl-sdr = rtl-sdr-blog;
 
-  rucredstash = callPackage ../tools/security/rucredstash {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  rucredstash = callPackage ../tools/security/rucredstash { };
 
   rusty-psn-gui = rusty-psn.override { withGui = true; };
 
-  rymdport = callPackage ../applications/networking/rymdport {
-    inherit (darwin.apple_sdk.frameworks) Carbon Cocoa;
-  };
+  rymdport = callPackage ../applications/networking/rymdport { };
 
   savvycan = libsForQt5.callPackage ../applications/networking/sniffers/savvycan { };
 
@@ -15864,20 +14750,14 @@ with pkgs;
 
   curaPlugins = callPackage ../applications/misc/cura/plugins.nix { };
 
-  prusa-slicer = darwin.apple_sdk_11_0.callPackage ../applications/misc/prusa-slicer {
+  prusa-slicer = callPackage ../applications/misc/prusa-slicer {
     # Build with clang even on Linux, because GCC uses absolutely obscene amounts of memory
     # on this particular code base (OOM with 32GB memory and --cores 16 on GCC, succeeds
     # with --cores 32 on clang).
-    stdenv =
-      if stdenv.hostPlatform.isDarwin then
-        overrideSDK llvmPackages.stdenv "11.0"
-      else
-        llvmPackages.stdenv;
+    stdenv = clangStdenv;
   };
 
-  super-slicer =
-    darwin.apple_sdk_11_0.callPackage ../applications/misc/prusa-slicer/super-slicer.nix
-      { };
+  super-slicer = callPackage ../applications/misc/prusa-slicer/super-slicer.nix { };
 
   super-slicer-beta = super-slicer.beta;
 
@@ -15897,9 +14777,7 @@ with pkgs;
 
   soulseekqt = libsForQt5.callPackage ../applications/networking/p2p/soulseekqt { };
 
-  sox = callPackage ../applications/misc/audio/sox {
-    inherit (darwin.apple_sdk.frameworks) CoreAudio;
-  };
+  sox = callPackage ../applications/misc/audio/sox { };
 
   spek = callPackage ../applications/audio/spek {
     autoreconfHook = buildPackages.autoreconfHook269;
@@ -15948,7 +14826,6 @@ with pkgs;
   inherit
     (callPackages ../applications/version-management/subversion {
       sasl = cyrus_sasl;
-      inherit (darwin.apple_sdk.frameworks) CoreServices Security;
     })
     subversion
     ;
@@ -15965,17 +14842,13 @@ with pkgs;
     git = gitMinimal;
   };
 
-  survex = callPackage ../applications/misc/survex {
-    inherit (darwin.apple_sdk.frameworks) Carbon Cocoa;
-  };
+  survex = callPackage ../applications/misc/survex { };
 
   supersonic-wayland = supersonic.override {
     waylandSupport = true;
   };
 
-  sylpheed = callPackage ../applications/networking/mailreaders/sylpheed {
-    inherit (darwin.apple_sdk.frameworks) Foundation;
-  };
+  sylpheed = callPackage ../applications/networking/mailreaders/sylpheed { };
 
   syncplay = python3.pkgs.callPackage ../applications/networking/syncplay { };
 
@@ -16002,16 +14875,7 @@ with pkgs;
     systemdSupport = true;
   };
 
-  synergy = libsForQt5.callPackage ../applications/misc/synergy {
-    inherit (darwin.apple_sdk_11_0.frameworks)
-      ApplicationServices
-      Carbon
-      Cocoa
-      CoreServices
-      ScreenSaver
-      UserNotifications
-      ;
-  };
+  synergy = libsForQt5.callPackage ../applications/misc/synergy { };
 
   synergyWithoutGUI = synergy.override { withGUI = false; };
 
@@ -16043,7 +14907,6 @@ with pkgs;
 
   inherit
     (callPackage ../applications/graphics/tesseract {
-      inherit (darwin.apple_sdk.frameworks) Accelerate CoreGraphics CoreVideo;
     })
     tesseract3
     tesseract4
@@ -16103,14 +14966,9 @@ with pkgs;
     timeshift-minimal
     ;
 
-  timidity = callPackage ../tools/misc/timidity {
-    inherit (darwin.apple_sdk.frameworks) CoreAudio;
-    inherit (darwin) libobjc;
-  };
+  timidity = callPackage ../tools/misc/timidity { };
 
-  tiny = callPackage ../applications/networking/irc/tiny {
-    inherit (darwin.apple_sdk.frameworks) Foundation;
-  };
+  tiny = callPackage ../applications/networking/irc/tiny { };
 
   tipp10 = qt6.callPackage ../applications/misc/tipp10 { };
 
@@ -16131,14 +14989,10 @@ with pkgs;
   transmission_3-qt = transmission_3.override { enableQt = true; };
   transmission_3_noSystemd = transmission_3.override { enableSystemd = false; };
 
-  # Needs macOS >= 10.14.6
-  transmission_4 =
-    darwin.apple_sdk_11_0.callPackage ../applications/networking/p2p/transmission/4.nix
-      {
-        inherit (darwin.apple_sdk_11_0.frameworks) Foundation;
-        fmt = fmt_9;
-        libutp = libutp_3_4;
-      };
+  transmission_4 = callPackage ../applications/networking/p2p/transmission/4.nix {
+    fmt = fmt_9;
+    libutp = libutp_3_4;
+  };
   libtransmission_4 = transmission_4.override {
     installLib = true;
     enableDaemon = false;
@@ -16169,9 +15023,7 @@ with pkgs;
 
   twinkle = qt5.callPackage ../applications/networking/instant-messengers/twinkle { };
 
-  terminal-typeracer = callPackage ../applications/misc/terminal-typeracer {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  terminal-typeracer = callPackage ../applications/misc/terminal-typeracer { };
 
   buildTypstPackage = callPackage ../build-support/build-typst-package.nix { };
 
@@ -16179,10 +15031,6 @@ with pkgs;
 
   ueberzug = with python3Packages; toPythonApplication ueberzug;
 
-  ueberzugpp = callPackage ../by-name/ue/ueberzugpp/package.nix {
-    stdenv = if stdenv.hostPlatform.isDarwin then overrideSDK stdenv "11.0" else stdenv;
-  };
-
   uefitoolPackages = recurseIntoAttrs (callPackage ../tools/system/uefitool/variants.nix { });
   uefitool = uefitoolPackages.new-engine;
 
@@ -16211,7 +15059,6 @@ with pkgs;
 
   vim = vimUtils.makeCustomizable (
     callPackage ../applications/editors/vim {
-      inherit (darwin.apple_sdk.frameworks) Carbon Cocoa;
     }
   );
 
@@ -16225,17 +15072,7 @@ with pkgs;
       }
     );
 
-  vim-full = vimUtils.makeCustomizable (
-    callPackage ../applications/editors/vim/full.nix {
-      inherit (darwin.apple_sdk.frameworks)
-        CoreServices
-        Cocoa
-        Foundation
-        CoreData
-        ;
-      inherit (darwin) libobjc;
-    }
-  );
+  vim-full = vimUtils.makeCustomizable (callPackage ../applications/editors/vim/full.nix { });
 
   vim-darwin =
     (vim-full.override {
@@ -16361,10 +15198,6 @@ with pkgs;
     callPackage ../by-name/vs/vscode-extension-update/vscode-extension-update-script.nix
       { };
 
-  vscode-js-debug = callPackage ../by-name/vs/vscode-js-debug/package.nix {
-    inherit (darwin.apple_sdk.frameworks) AppKit Security;
-  };
-
   vscodium = callPackage ../applications/editors/vscode/vscodium.nix { };
   vscodium-fhs = vscodium.fhs;
   vscodium-fhsWithPackages = vscodium.fhsWithPackages;
@@ -16375,17 +15208,10 @@ with pkgs;
 
   openvscode-server = callPackage ../servers/openvscode-server {
     nodejs = nodejs_20;
-    inherit (darwin.apple_sdk.frameworks) AppKit Cocoa Security;
   };
 
   code-server = callPackage ../servers/code-server {
     nodejs = nodejs_20;
-    inherit (darwin.apple_sdk.frameworks)
-      AppKit
-      Cocoa
-      CoreServices
-      Security
-      ;
   };
 
   whispers = with python3Packages; toPythonApplication whispers;
@@ -16443,7 +15269,6 @@ with pkgs;
   wrapWeechat = callPackage ../applications/networking/irc/weechat/wrapper.nix { };
 
   weechat-unwrapped = callPackage ../applications/networking/irc/weechat {
-    inherit (darwin) libobjc;
     inherit (darwin) libresolv;
     guile = guile_3_0;
   };
@@ -16476,9 +15301,7 @@ with pkgs;
 
   wofi-pass = callPackage ../../pkgs/tools/security/pass/wofi-pass.nix { };
 
-  wordnet = callPackage ../applications/misc/wordnet {
-    inherit (darwin.apple_sdk.frameworks) Cocoa;
-  };
+  wordnet = callPackage ../applications/misc/wordnet { };
 
   worldengine-cli = python3Packages.worldengine;
 
@@ -16547,7 +15370,7 @@ with pkgs;
     inherit (gnome2) libglade GConf;
   };
 
-  xournalpp = darwin.apple_sdk_11_0.callPackage ../applications/graphics/xournalpp {
+  xournalpp = callPackage ../applications/graphics/xournalpp {
     lua = lua5_3;
   };
 
@@ -16578,9 +15401,7 @@ with pkgs;
 
   libxpdf = callPackage ../applications/misc/xpdf/libxpdf.nix { };
 
-  xmp = callPackage ../applications/audio/xmp {
-    inherit (darwin.apple_sdk.frameworks) AudioUnit CoreAudio;
-  };
+  xmp = callPackage ../applications/audio/xmp { };
 
   xygrib = libsForQt5.callPackage ../applications/misc/xygrib { };
 
@@ -16602,9 +15423,7 @@ with pkgs;
     pnpm = pnpm_10;
   };
 
-  youtube-tui = callPackage ../applications/video/youtube-tui {
-    inherit (darwin.apple_sdk.frameworks) CoreFoundation Security AppKit;
-  };
+  youtube-tui = callPackage ../applications/video/youtube-tui { };
 
   yt-dlp-light = yt-dlp.override {
     atomicparsleySupport = false;
@@ -16653,9 +15472,7 @@ with pkgs;
 
   ### BLOCKCHAINS / CRYPTOCURRENCIES / WALLETS
 
-  alfis = callPackage ../applications/blockchains/alfis {
-    inherit (darwin.apple_sdk.frameworks) Cocoa Security WebKit;
-  };
+  alfis = callPackage ../applications/blockchains/alfis { };
   alfis-nogui = alfis.override {
     withGui = false;
   };
@@ -16692,9 +15509,7 @@ with pkgs;
 
   cryptop = python3.pkgs.callPackage ../applications/blockchains/cryptop { };
 
-  electrs = callPackage ../applications/blockchains/electrs {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  electrs = callPackage ../applications/blockchains/electrs { };
 
   elements = libsForQt5.callPackage ../applications/blockchains/elements {
     withGui = true;
@@ -16716,11 +15531,6 @@ with pkgs;
 
   fulcrum = libsForQt5.callPackage ../applications/blockchains/fulcrum { };
 
-  go-ethereum = callPackage ../by-name/go/go-ethereum/package.nix {
-    inherit (darwin) libobjc;
-    inherit (darwin.apple_sdk.frameworks) IOKit;
-  };
-
   gridcoin-research = libsForQt5.callPackage ../applications/blockchains/gridcoin-research {
     boost = boost179;
   };
@@ -16736,9 +15546,7 @@ with pkgs;
 
   ledger-agent = with python3Packages; toPythonApplication ledger-agent;
 
-  monero-cli = callPackage ../applications/blockchains/monero-cli {
-    inherit (darwin.apple_sdk.frameworks) CoreData IOKit;
-  };
+  monero-cli = callPackage ../applications/blockchains/monero-cli { };
 
   monero-gui = libsForQt5.callPackage ../applications/blockchains/monero-gui { };
 
@@ -16748,9 +15556,7 @@ with pkgs;
 
   pycoin = with python3Packages; toPythonApplication pycoin;
 
-  snarkos = callPackage ../applications/blockchains/snarkos {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  snarkos = callPackage ../applications/blockchains/snarkos { };
 
   inherit (callPackages ../applications/blockchains/teos { })
     teos
@@ -16765,13 +15571,10 @@ with pkgs;
   };
 
   zcash = callPackage ../applications/blockchains/zcash {
-    inherit (darwin.apple_sdk.frameworks) Security;
     stdenv = llvmPackages.stdenv;
   };
 
-  polkadot = callPackage ../applications/blockchains/polkadot {
-    inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration;
-  };
+  polkadot = callPackage ../applications/blockchains/polkadot { };
 
   samplv1 = qt6.callPackage ../applications/audio/samplv1 { };
 
@@ -16802,9 +15605,7 @@ with pkgs;
 
   drumkv1 = libsForQt5.callPackage ../applications/audio/drumkv1 { };
 
-  eureka-ideas = callPackage ../applications/misc/eureka-ideas {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  eureka-ideas = callPackage ../applications/misc/eureka-ideas { };
 
   phonemizer = with python3Packages; toPythonApplication phonemizer;
 
@@ -16867,9 +15668,7 @@ with pkgs;
   amoeba = callPackage ../games/amoeba { };
   amoeba-data = callPackage ../games/amoeba/data.nix { };
 
-  anki = callPackage ../games/anki {
-    inherit (darwin.apple_sdk.frameworks) AVKit CoreAudio;
-  };
+  anki = callPackage ../games/anki { };
   anki-bin = callPackage ../games/anki/bin.nix { };
   anki-sync-server = callPackage ../games/anki/sync-server.nix { };
 
@@ -16892,10 +15691,7 @@ with pkgs;
 
   beancount-share = callPackage ../applications/office/beancount/beancount_share.nix { };
 
-  bugdom = callPackage ../games/bugdom {
-    stdenv = if stdenv.hostPlatform.isDarwin then overrideSDK stdenv "11.0" else stdenv;
-    inherit (darwin.apple_sdk_11_0.frameworks) IOKit Foundation OpenGL;
-  };
+  bugdom = callPackage ../games/bugdom { };
 
   cataclysmDDA = callPackage ../games/cataclysm-dda { };
 
@@ -16969,20 +15765,14 @@ with pkgs;
     d2x-rebirth-full
     ;
 
-  easyrpg-player = callPackage ../games/easyrpg-player {
-    inherit (darwin.apple_sdk.frameworks) Foundation AudioUnit AudioToolbox;
-  };
+  easyrpg-player = callPackage ../games/easyrpg-player { };
 
-  exult = callPackage ../games/exult {
-    inherit (darwin.apple_sdk.frameworks) AudioUnit;
-  };
+  exult = callPackage ../games/exult { };
 
   fallout-ce = callPackage ../games/fallout-ce/fallout-ce.nix { };
   fallout2-ce = callPackage ../games/fallout-ce/fallout2-ce.nix { };
 
-  flare = callPackage ../games/flare {
-    inherit (darwin.apple_sdk.frameworks) Cocoa;
-  };
+  flare = callPackage ../games/flare { };
 
   fltrator = callPackage ../games/fltrator {
     fltk = fltk-minimal;
@@ -17018,9 +15808,7 @@ with pkgs;
 
   factorio-utils = callPackage ../by-name/fa/factorio/utils.nix { };
 
-  ferium = callPackage ../games/ferium {
-    inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration;
-  };
+  ferium = callPackage ../games/ferium { };
 
   flightgear = libsForQt5.callPackage ../games/flightgear { };
 
@@ -17113,8 +15901,7 @@ with pkgs;
     guile = guile_2_0;
   };
 
-  liquidwar5 = callPackage ../games/liquidwar/5.nix {
-  };
+  liquidwar5 = callPackage ../games/liquidwar/5.nix { };
 
   maptool = callPackage ../games/maptool {
     # MapTool is fussy about which JRE it uses; OpenJDK will leave it hanging
@@ -17147,7 +15934,6 @@ with pkgs;
 
   mudlet = libsForQt5.callPackage ../games/mudlet {
     lua = lua5_1;
-    inherit (darwin.apple_sdk_11_0.frameworks) AppKit;
   };
 
   blightmud = callPackage ../games/blightmud { };
@@ -17170,9 +15956,7 @@ with pkgs;
 
   openloco = pkgsi686Linux.callPackage ../games/openloco { };
 
-  openmw = libsForQt5.callPackage ../games/openmw {
-    inherit (darwin.apple_sdk.frameworks) CoreMedia VideoDecodeAcceleration VideoToolbox;
-  };
+  openmw = libsForQt5.callPackage ../games/openmw { };
 
   openmw-tes3mp = libsForQt5.callPackage ../games/openmw/tes3mp.nix { };
 
@@ -17187,9 +15971,7 @@ with pkgs;
 
   openra = openraPackages.engines.release;
 
-  openspades = callPackage ../games/openspades {
-    inherit (darwin.apple_sdk.frameworks) Cocoa;
-  };
+  openspades = callPackage ../games/openspades { };
 
   openttd = callPackage ../games/openttd {
     zlib = zlib.override {
@@ -17248,15 +16030,7 @@ with pkgs;
 
   quake3hires = callPackage ../games/quake3/content/hires.nix { };
 
-  quakespasm = callPackage ../games/quakespasm {
-    inherit (darwin.apple_sdk.frameworks)
-      Cocoa
-      CoreAudio
-      CoreFoundation
-      IOKit
-      OpenGL
-      ;
-  };
+  quakespasm = callPackage ../games/quakespasm { };
   vkquake = callPackage ../games/quakespasm/vulkan.nix { };
 
   rogue = callPackage ../games/rogue {
@@ -17273,15 +16047,7 @@ with pkgs;
     openjdk = openjdk17;
   };
 
-  scummvm = callPackage ../games/scummvm {
-    inherit (darwin.apple_sdk.frameworks)
-      Cocoa
-      AudioToolbox
-      Carbon
-      CoreMIDI
-      AudioUnit
-      ;
-  };
+  scummvm = callPackage ../games/scummvm { };
 
   inherit (callPackage ../games/scummvm/games.nix { })
     beneath-a-steel-sky
@@ -17342,27 +16108,17 @@ with pkgs;
 
   stuntrally = callPackage ../games/stuntrally { boost = boost183; };
 
-  superTuxKart = darwin.apple_sdk_11_0.callPackage ../games/super-tux-kart {
-    inherit (darwin.apple_sdk_11_0.frameworks)
-      Cocoa
-      IOKit
-      OpenAL
-      IOBluetooth
-      ;
-  };
+  superTuxKart = callPackage ../games/super-tux-kart { };
 
   synthv1 = libsForQt5.callPackage ../applications/audio/synthv1 { };
 
   the-powder-toy = callPackage ../by-name/th/the-powder-toy/package.nix {
     lua = lua5_2;
-    inherit (darwin.apple_sdk.frameworks) Cocoa;
   };
 
   tbe = libsForQt5.callPackage ../games/the-butterfly-effect { };
 
-  teeworlds = callPackage ../games/teeworlds {
-    inherit (darwin.apple_sdk.frameworks) Cocoa;
-  };
+  teeworlds = callPackage ../games/teeworlds { };
   teeworlds-server = teeworlds.override { buildClient = false; };
 
   tengine = callPackage ../servers/http/tengine {
@@ -17393,17 +16149,12 @@ with pkgs;
 
   vessel = pkgsi686Linux.callPackage ../games/vessel { };
 
-  vvvvvv = callPackage ../by-name/vv/vvvvvv/package.nix {
-    inherit (darwin.apple_sdk.frameworks) Foundation IOKit;
-  };
-
   warsow-engine = callPackage ../games/warsow/engine.nix { };
 
   warsow = callPackage ../games/warsow { };
 
   wesnoth = callPackage ../games/wesnoth {
     boost = boost186;
-    inherit (darwin.apple_sdk.frameworks) Cocoa Foundation;
     # wesnoth requires lua built with c++, see https://github.com/wesnoth/wesnoth/pull/8234
     lua = lua5_4.override {
       postConfigure = ''
@@ -17442,7 +16193,6 @@ with pkgs;
 
   inherit
     (callPackage ../games/quake2/yquake2 {
-      inherit (darwin.apple_sdk.frameworks) Cocoa OpenAL;
     })
     yquake2
     yquake2-ctf
@@ -17569,12 +16319,6 @@ with pkgs;
         pyxdg
         wrapPython
         ;
-      inherit (darwin.apple_sdk.frameworks)
-        CoreLocation
-        ApplicationServices
-        Foundation
-        Cocoa
-        ;
       geoclue = geoclue2;
     })
     redshift
@@ -17627,13 +16371,9 @@ with pkgs;
 
   ### SCIENCE/BIOLOGY
 
-  ants = callPackage ../applications/science/biology/ants {
-    inherit (darwin.apple_sdk.frameworks) Cocoa;
-  };
+  ants = callPackage ../applications/science/biology/ants { };
 
-  blast = callPackage ../applications/science/biology/blast {
-    inherit (darwin.apple_sdk.frameworks) ApplicationServices;
-  };
+  blast = callPackage ../applications/science/biology/blast { };
 
   blast-bin = callPackage ../applications/science/biology/blast/bin.nix { };
 
@@ -17717,14 +16457,7 @@ with pkgs;
 
   cantor = libsForQt5.cantor;
 
-  clblas = callPackage ../development/libraries/science/math/clblas {
-    inherit (darwin.apple_sdk.frameworks)
-      Accelerate
-      CoreGraphics
-      CoreVideo
-      OpenCL
-      ;
-  };
+  clblas = callPackage ../development/libraries/science/math/clblas { };
 
   labplot = libsForQt5.callPackage ../applications/science/math/labplot { };
 
@@ -17990,7 +16723,7 @@ with pkgs;
   };
   isabelle-components = recurseIntoAttrs (callPackage ../by-name/is/isabelle/components { });
 
-  killport = darwin.apple_sdk_11_0.callPackage ../tools/misc/killport { };
+  killport = callPackage ../tools/misc/killport { };
 
   lean3 = lean;
   mathlibtools = with python3Packages; toPythonApplication mathlibtools;
@@ -18118,7 +16851,6 @@ with pkgs;
     {
       opencv4 = opencv4WithoutCuda; # Used only for image loading.
       blas = openblas;
-      inherit (darwin.apple_sdk.frameworks) Accelerate CoreGraphics CoreVideo;
     }
     // (config.caffe or { })
   );
@@ -18194,9 +16926,7 @@ with pkgs;
 
   ns-3 = callPackage ../development/libraries/science/networking/ns-3 { python = python3; };
 
-  rink = callPackage ../applications/science/misc/rink {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  rink = callPackage ../applications/science/misc/rink { };
 
   spyder = with python3.pkgs; toPythonApplication spyder;
 
@@ -18208,9 +16938,7 @@ with pkgs;
 
   ### SCIENCE / PHYSICS
 
-  applgrid = callPackage ../development/libraries/physics/applgrid {
-    inherit (darwin.apple_sdk.frameworks) Cocoa;
-  };
+  applgrid = callPackage ../development/libraries/physics/applgrid { };
 
   hepmc3 = callPackage ../development/libraries/physics/hepmc3 {
     python = null;
@@ -18248,9 +16976,7 @@ with pkgs;
 
   brgenml1lpr = pkgsi686Linux.callPackage ../misc/cups/drivers/brgenml1lpr { };
 
-  clinfo = callPackage ../tools/system/clinfo {
-    inherit (darwin.apple_sdk.frameworks) OpenCL;
-  };
+  clinfo = callPackage ../tools/system/clinfo { };
 
   cups = callPackage ../misc/cups { };
 
@@ -18359,9 +17085,7 @@ with pkgs;
 
   hplipWithPlugin = hplip.override { withPlugin = true; };
 
-  hyperfine = callPackage ../tools/misc/hyperfine {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  hyperfine = callPackage ../tools/misc/hyperfine { };
 
   hjson = with python3Packages; toPythonApplication hjson;
 
@@ -18384,8 +17108,6 @@ with pkgs;
 
   jack2 = callPackage ../misc/jackaudio {
     libopus = libopus.override { withCustomModes = true; };
-    inherit (darwin.apple_sdk.frameworks) AudioUnit CoreAudio Accelerate;
-    inherit (darwin) libobjc;
   };
 
   libjack2 = jack2.override { prefix = "lib"; };
@@ -18419,9 +17141,7 @@ with pkgs;
     ;
   kops = kops_1_29;
 
-  lighthouse = darwin.apple_sdk_11_0.callPackage ../applications/blockchains/lighthouse {
-    inherit (darwin.apple_sdk_11_0.frameworks) CoreFoundation Security SystemConfiguration;
-  };
+  lighthouse = callPackage ../applications/blockchains/lighthouse { };
 
   lilypond = callPackage ../misc/lilypond { };
 
@@ -18454,7 +17174,6 @@ with pkgs;
     callPackage ../tools/package-management/nix {
       storeDir = config.nix.storeDir or "/nix/store";
       stateDir = config.nix.stateDir or "/nix/var";
-      inherit (darwin.apple_sdk.frameworks) Security;
     }
   );
 
@@ -18476,7 +17195,6 @@ with pkgs;
     callPackage ../tools/package-management/lix {
       storeDir = config.nix.storeDir or "/nix/store";
       stateDir = config.nix.stateDir or "/nix/var";
-      inherit (darwin.apple_sdk.frameworks) Security;
     }
   );
 
@@ -18596,16 +17314,12 @@ with pkgs;
   nix-derivation = haskell.lib.compose.justStaticExecutables haskellPackages.nix-derivation;
   nix-diff = haskell.lib.compose.justStaticExecutables haskellPackages.nix-diff;
 
-  nix-du = callPackage ../tools/package-management/nix-du {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  nix-du = callPackage ../tools/package-management/nix-du { };
 
   nix-info = callPackage ../tools/nix/info { };
   nix-info-tested = nix-info.override { doCheck = true; };
 
-  nix-index-unwrapped = callPackage ../tools/package-management/nix-index {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  nix-index-unwrapped = callPackage ../tools/package-management/nix-index { };
   nix-index = callPackage ../tools/package-management/nix-index/wrapper.nix { };
 
   nix-linter = haskell.lib.compose.justStaticExecutables (haskellPackages.nix-linter);
@@ -18631,10 +17345,6 @@ with pkgs;
 
   nix-visualize = python3.pkgs.callPackage ../tools/package-management/nix-visualize { };
 
-  nixci = callPackage ../by-name/ni/nixci/package.nix {
-    inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration IOKit;
-  };
-
   nixfmt-classic = haskellPackages.nixfmt.bin;
 
   nixpkgs-manual = callPackage ../../doc/doc-support/package.nix { };
@@ -18673,9 +17383,7 @@ with pkgs;
 
   resp-app = libsForQt5.callPackage ../applications/misc/resp-app { };
 
-  stork = darwin.apple_sdk_11_0.callPackage ../applications/misc/stork {
-    inherit (darwin.apple_sdk_11_0.frameworks) Security;
-  };
+  stork = callPackage ../applications/misc/stork { };
 
   pgadmin4 = callPackage ../tools/admin/pgadmin { };
 
@@ -18685,9 +17393,7 @@ with pkgs;
 
   philipstv = with python3Packages; toPythonApplication philipstv;
 
-  pjsip = darwin.apple_sdk_11_0.callPackage ../applications/networking/pjsip {
-    inherit (darwin.apple_sdk_11_0.frameworks) AppKit CoreFoundation Security;
-  };
+  pjsip = callPackage ../applications/networking/pjsip { };
 
   pyupgrade = with python3Packages; toPythonApplication pyupgrade;
 
@@ -18708,7 +17414,7 @@ with pkgs;
 
   qtrvsim = libsForQt5.callPackage ../applications/science/computer-architecture/qtrvsim { };
 
-  rbspy = darwin.apple_sdk_11_0.callPackage ../development/tools/rbspy { };
+  rbspy = callPackage ../development/tools/rbspy { };
 
   pick-colour-picker = python3Packages.callPackage ../applications/graphics/pick-colour-picker {
     inherit
@@ -18727,9 +17433,7 @@ with pkgs;
     inherit (ocamlPackages) sail;
   };
 
-  timeloop =
-    pkgs.darwin.apple_sdk_11_0.callPackage ../applications/science/computer-architecture/timeloop
-      { };
+  timeloop = callPackage ../applications/science/computer-architecture/timeloop { };
 
   mfcj470dwlpr = pkgsi686Linux.callPackage ../misc/cups/drivers/mfcj470dwlpr { };
 
@@ -18763,9 +17467,7 @@ with pkgs;
     hasktags = haskellPackages.hasktags;
   };
 
-  spacenavd = callPackage ../misc/drivers/spacenavd {
-    inherit (darwin.apple_sdk.frameworks) IOKit;
-  };
+  spacenavd = callPackage ../misc/drivers/spacenavd { };
 
   tellico = libsForQt5.callPackage ../applications/misc/tellico { };
 
@@ -18795,16 +17497,12 @@ with pkgs;
 
   vaultenv = haskell.lib.justStaticExecutables haskellPackages.vaultenv;
 
-  vaultwarden = callPackage ../tools/security/vaultwarden {
-    inherit (darwin.apple_sdk.frameworks) Security CoreServices SystemConfiguration;
-  };
+  vaultwarden = callPackage ../tools/security/vaultwarden { };
   vaultwarden-sqlite = vaultwarden;
   vaultwarden-mysql = vaultwarden.override { dbBackend = "mysql"; };
   vaultwarden-postgresql = vaultwarden.override { dbBackend = "postgresql"; };
 
-  veilid = darwin.apple_sdk_11_0.callPackage ../tools/networking/veilid {
-    inherit (darwin.apple_sdk.frameworks) AppKit Security;
-  };
+  veilid = callPackage ../tools/networking/veilid { };
 
   vimUtils = callPackage ../applications/editors/vim/plugins/utils/vim-utils.nix { };
 
@@ -18812,10 +17510,6 @@ with pkgs;
 
   vimb = wrapFirefox vimb-unwrapped { };
 
-  vips = callPackage ../by-name/vi/vips/package.nix {
-    inherit (darwin.apple_sdk.frameworks) ApplicationServices Foundation;
-  };
-
   vivisect = with python3Packages; toPythonApplication (vivisect.override { withGui = true; });
 
   vokoscreen = libsForQt5.callPackage ../applications/video/vokoscreen {
@@ -18824,7 +17518,7 @@ with pkgs;
 
   wacomtablet = libsForQt5.callPackage ../tools/misc/wacomtablet { };
 
-  wamr = darwin.apple_sdk_11_0.callPackage ../development/interpreters/wamr { };
+  wamr = callPackage ../development/interpreters/wamr { };
 
   wasmer = callPackage ../development/interpreters/wasmer {
     llvmPackages = llvmPackages_18;
@@ -18908,11 +17602,7 @@ with pkgs;
     openssl = openssl_1_1;
   };
 
-  xhyve = callPackage ../applications/virtualization/xhyve {
-    inherit (darwin.apple_sdk.frameworks) Hypervisor vmnet;
-    inherit (darwin.apple_sdk.libs) xpc;
-    inherit (darwin) libobjc;
-  };
+  xhyve = callPackage ../applications/virtualization/xhyve { };
 
   xsane = callPackage ../applications/graphics/sane/xsane.nix { };
 
@@ -18937,13 +17627,9 @@ with pkgs;
 
   zncModules = recurseIntoAttrs (callPackage ../applications/networking/znc/modules.nix { });
 
-  bullet = callPackage ../development/libraries/bullet {
-    inherit (darwin.apple_sdk.frameworks) Cocoa OpenGL;
-  };
+  bullet = callPackage ../development/libraries/bullet { };
 
-  bullet-roboschool = callPackage ../development/libraries/bullet/roboschool-fork.nix {
-    inherit (darwin.apple_sdk.frameworks) Cocoa OpenGL;
-  };
+  bullet-roboschool = callPackage ../development/libraries/bullet/roboschool-fork.nix { };
 
   dart = callPackage ../development/compilers/dart { };
 
@@ -19105,9 +17791,7 @@ with pkgs;
 
   inherit (callPackage ../applications/misc/zettlr { }) zettlr;
 
-  fac-build = callPackage ../development/tools/build-managers/fac {
-    inherit (darwin.apple_sdk.frameworks) CoreServices;
-  };
+  fac-build = callPackage ../development/tools/build-managers/fac { };
 
   zrythm = callPackage ../applications/audio/zrythm {
     inherit (plasma5Packages) breeze-icons;
@@ -19127,10 +17811,6 @@ with pkgs;
 
   yaziPlugins = recurseIntoAttrs (callPackage ../by-name/ya/yazi/plugins { });
 
-  yazi-unwrapped = callPackage ../by-name/ya/yazi-unwrapped/package.nix {
-    inherit (darwin.apple_sdk.frameworks) Foundation;
-  };
-
   animdl = python3Packages.callPackage ../applications/video/animdl { };
 
   dillo = callPackage ../by-name/di/dillo/package.nix {
diff --git a/pkgs/top-level/darwin-aliases.nix b/pkgs/top-level/darwin-aliases.nix
index b5517f216eec..ceec048d845f 100644
--- a/pkgs/top-level/darwin-aliases.nix
+++ b/pkgs/top-level/darwin-aliases.nix
@@ -44,9 +44,69 @@ let
   mapAliases = lib.mapAttrs (
     n: alias: removeDistribute (removeRecurseForDerivations (checkInPkgs n alias))
   );
+
+  # Old Darwin pattern stubs; remove these by 25.11.
+
+  mkStub = pkgs.callPackage ../os-specific/darwin/apple-sdk/mk-stub.nix { };
+
+  warnStub =
+    prefix:
+    lib.warn "${prefix} these stubs do nothing and will be removed in Nixpkgs 25.11; see <https://nixos.org/manual/nixpkgs/stable/#sec-darwin> for documentation and migration instructions";
+
+  apple_sdk_11_0 = warnStub "darwin.apple_sdk_11_0.*:" (
+    pkgs.callPackage ../os-specific/darwin/apple-sdk-11.0 { }
+  );
+
+  apple_sdk_12_3 =
+    warnStub
+      "darwin.apple_sdk_12_3.*: add `apple-sdk_12` to build inputs instead to use the macOS 12 SDK."
+      (pkgs.callPackage ../os-specific/darwin/apple-sdk-12.3 { });
+
+  apple_sdk = apple_sdk_11_0;
+
+  stubs =
+    {
+      inherit apple_sdk apple_sdk_11_0 apple_sdk_12_3;
+    }
+    // lib.genAttrs [
+      "CF"
+      "CarbonHeaders"
+      "CommonCrypto"
+      "CoreSymbolication"
+      "IOKit"
+      "Libc"
+      "Libinfo"
+      "Libm"
+      "Libnotify"
+      "Librpcsvc"
+      "Libsystem"
+      "LibsystemCross"
+      "Security"
+      "architecture"
+      "cf-private"
+      "configd"
+      "configdHeaders"
+      "darwin-stubs"
+      "dtrace"
+      "eap8021x"
+      "hfs"
+      "hfsHeaders"
+      "launchd"
+      "libclosure"
+      "libdispatch"
+      "libmalloc"
+      "libobjc"
+      "libplatform"
+      "libpthread"
+      "mDNSResponder"
+      "objc4"
+      "ppp"
+      "xnu"
+    ] (name: warnStub "darwin.${name}:" (mkStub "11.0" name));
 in
 
-mapAliases ({
+stubs
+// mapAliases ({
   ### A ###
 
   apple_sdk_10_12 = throw "darwin.apple_sdk_10_12 was removed as Nixpkgs no longer supports macOS 10.12; see the 25.05 release notes"; # Added 2024-10-27
@@ -63,8 +123,6 @@ mapAliases ({
   cctools-llvm = pkgs.cctools; # added 2024-07-01
   cctools-port = pkgs.cctools; # added 2024-07-17
 
-  cf-private = throw "'cf-private' has been renamed to 'apple_sdk.frameworks.CoreFoundation'.";
-
   ### D ###
 
   discrete-scroll = pkgs.discrete-scroll; # added 2024-11-27
@@ -78,7 +136,13 @@ mapAliases ({
   ### L ###
 
   libauto = throw "'darwin.libauto' has been removed, as it was broken and unmaintained"; # added 2024-05-10
+  libresolvHeaders = lib.warn "darwin.libresolvHeaders: use `lib.getInclude darwin.libresolv`; this will be removed in 25.11" (
+    lib.getDev self.libresolv
+  ); # added 2025-04-20
   libtapi = pkgs.libtapi; # 2024-08-16
+  libutilHeaders = lib.warn "darwin.libutilHeaders: use `lib.getInclude darwin.libutil`; this will be removed in 25.11" (
+    lib.getDev self.libutil
+  ); # added 2025-04-20
 
   ### M ###
 
@@ -90,4 +154,21 @@ mapAliases ({
 
   ### P ###
   postLinkSignHook = throw "'darwin.postLinkSignHook' has been removed because it is obsolete"; # added 2025-02-23
+  print-reexports = throw "'darwin.print-reexports' has been removed as it was unused"; # added 2025-04-20
+
+  ### R ###
+
+  rewrite-tbd = throw "'darwin.rewrite-tbd' has been removed, as it was unused and replaced by `llvm-readtapi(1)`"; # added 2025-04-20
+
+  ### S ###
+
+  stdenvNoCF =
+    lib.warn "darwin.stdenvNoCF: use `stdenv` or `stdenvNoCC`; this will be removed in 25.11"
+      (
+        pkgs.stdenv.override {
+          extraBuildInputs = [ ];
+        }
+      ); # added 2025-04-20
+  stubs = throw "'darwin.stubs.*' have been removed as they were unused"; # added 2025-04-20
+  swift-corelibs-foundation = throw "'darwin.swift-corelibs-foundation' has been removed, as it was broken and is no longer used"; # added 2025-04-20
 })
diff --git a/pkgs/top-level/darwin-packages.nix b/pkgs/top-level/darwin-packages.nix
index 5c2fd1618e81..9d656d33c338 100644
--- a/pkgs/top-level/darwin-packages.nix
+++ b/pkgs/top-level/darwin-packages.nix
@@ -11,19 +11,6 @@
 }:
 
 let
-  # Prefix for binaries. Customarily ends with a dash separator.
-  #
-  # TODO(@Ericson2314) Make unconditional, or optional but always true by
-  # default.
-  targetPrefix = lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform) (
-    stdenv.targetPlatform.config + "-"
-  );
-
-  # Bootstrap `fetchurl` needed to build SDK packages without causing an infinite recursion.
-  fetchurlBoot = import ../build-support/fetchurl/boot.nix {
-    inherit (stdenv) system;
-  };
-
   aliases =
     self: super:
     lib.optionalAttrs config.allowAliases (import ../top-level/darwin-aliases.nix lib self super pkgs);
@@ -39,13 +26,10 @@ let
           pkg
       ) (old.extraBuildInputs or [ ]);
     });
-
-  mkStub = pkgs.callPackage ../os-specific/darwin/apple-sdk/mk-stub.nix { };
 in
 
 makeScopeWithSplicing' {
   otherSplices = generateSplicesForMkScope "darwin";
-  extra = spliced: spliced.apple_sdk.frameworks;
   f = lib.extends aliases (
     self:
     let
@@ -57,73 +41,14 @@ makeScopeWithSplicing' {
         directory = ../os-specific/darwin/apple-source-releases;
       };
 
-      # Compatibility packages that aren’t necessary anymore
-      apple-source-headers = {
-        libresolvHeaders = lib.getDev self.libresolv;
-        libutilHeaders = lib.getDev self.libutil;
-      };
-
       # Must use pkgs.callPackage to avoid infinite recursion.
       impure-cmds = pkgs.callPackage ../os-specific/darwin/impure-cmds { };
-
-      # macOS 11.0 SDK
-      apple_sdk_11_0 = pkgs.callPackage ../os-specific/darwin/apple-sdk-11.0 { };
-
-      # macOS 12.3 SDK
-      apple_sdk_12_3 = pkgs.callPackage ../os-specific/darwin/apple-sdk-12.3 { };
-
-      apple_sdk = apple_sdk_11_0;
-
-      stubs =
-        {
-          inherit apple_sdk apple_sdk_11_0 apple_sdk_12_3;
-          libobjc = self.objc4;
-        }
-        // lib.genAttrs [
-          "CF"
-          "CarbonHeaders"
-          "CommonCrypto"
-          "CoreSymbolication"
-          "IOKit"
-          "Libc"
-          "Libinfo"
-          "Libm"
-          "Libnotify"
-          "Librpcsvc"
-          "Libsystem"
-          "LibsystemCross"
-          "Security"
-          "architecture"
-          "configd"
-          "configdHeaders"
-          "darwin-stubs"
-          "dtrace"
-          "eap8021x"
-          "hfs"
-          "hfsHeaders"
-          "launchd"
-          "libclosure"
-          "libdispatch"
-          "libmalloc"
-          "libplatform"
-          "libpthread"
-          "mDNSResponder"
-          "objc4"
-          "ppp"
-          "xnu"
-        ] (mkStub apple_sdk.version);
     in
 
     impure-cmds
     // apple-source-packages
-    // apple-source-headers
-    // stubs
     // {
 
-      stdenvNoCF = stdenv.override {
-        extraBuildInputs = [ ];
-      };
-
       inherit (self.adv_cmds) ps;
 
       binutils-unwrapped = callPackage ../os-specific/darwin/binutils {
@@ -174,15 +99,6 @@ makeScopeWithSplicing' {
 
       DarwinTools = callPackage ../os-specific/darwin/DarwinTools { };
 
-      print-reexports = callPackage ../os-specific/darwin/print-reexports { };
-
-      rewrite-tbd = callPackage ../os-specific/darwin/rewrite-tbd { };
-
-      checkReexportsHook = pkgs.makeSetupHook {
-        name = "darwin-check-reexports-hook";
-        propagatedBuildInputs = [ pkgs.darwin.print-reexports ];
-      } ../os-specific/darwin/print-reexports/setup-hook.sh;
-
       libunwind = callPackage ../os-specific/darwin/libunwind { };
 
       sigtool = callPackage ../os-specific/darwin/sigtool { };
@@ -204,8 +120,6 @@ makeScopeWithSplicing' {
 
       openwith = callPackage ../os-specific/darwin/openwith { };
 
-      stubs = pkgs.callPackages ../os-specific/darwin/stubs { };
-
       trash = callPackage ../os-specific/darwin/trash { };
 
       inherit (self.file_cmds) xattr;
@@ -266,12 +180,6 @@ makeScopeWithSplicing' {
         propagatedBuildInputs = [ pkgs.pkgsBuildHost.openssl ];
       } ../os-specific/darwin/xcode-project-check-hook/setup-hook.sh;
 
-      # Formerly the CF attribute. Use this is you need the open source release.
-      swift-corelibs-foundation = callPackage ../os-specific/darwin/swift-corelibs/corefoundation.nix { };
-
-      # As the name says, this is broken, but I don't want to lose it since it's a direction we want to go in
-      # libdispatch-broken = callPackage ../os-specific/darwin/swift-corelibs/libdispatch.nix { };
-
       # See doc/packages/darwin-builder.section.md
       linux-builder = lib.makeOverridable (
         { modules }:
diff --git a/pkgs/top-level/haskell-packages.nix b/pkgs/top-level/haskell-packages.nix
index c363055c4734..f1a73afa4beb 100644
--- a/pkgs/top-level/haskell-packages.nix
+++ b/pkgs/top-level/haskell-packages.nix
@@ -25,6 +25,7 @@ let
     "ghc8107Binary"
     "ghc924Binary"
     "ghc963Binary"
+    "ghc984Binary"
     # ghcjs
     "ghcjs"
     "ghcjs810"
@@ -98,6 +99,10 @@ in
         llvmPackages = pkgs.llvmPackages_15;
       };
 
+      ghc984Binary = callPackage ../development/compilers/ghc/9.8.4-binary.nix {
+        llvmPackages = pkgs.llvmPackages_15;
+      };
+
       ghc8107 = callPackage ../development/compilers/ghc/8.10.7.nix {
         bootPkgs =
           # the oldest ghc with aarch64-darwin support is 8.10.5
@@ -342,8 +347,10 @@ in
       };
       ghc984 = callPackage ../development/compilers/ghc/9.8.4.nix {
         bootPkgs =
-          # For GHC 9.6 no armv7l bindists are available.
-          if stdenv.buildPlatform.isAarch32 then
+          if stdenv.buildPlatform.isAarch64 && stdenv.buildPlatform.isMusl then
+            bb.packages.ghc984Binary
+          else if stdenv.buildPlatform.isAarch32 then
+            # For GHC 9.6 no armv7l bindists are available.
             bb.packages.ghc963
           else if stdenv.buildPlatform.isPower64 && stdenv.buildPlatform.isLittleEndian then
             bb.packages.ghc963
@@ -414,8 +421,13 @@ in
       ghc912 = compiler.ghc9122;
       ghcHEAD = callPackage ../development/compilers/ghc/head.nix {
         bootPkgs =
-          # No suitable bindist packaged yet
-          bb.packages.ghc9101;
+          # No armv7l bindists are available.
+          if stdenv.buildPlatform.isAarch32 then
+            bb.packages.ghc984
+          else if stdenv.buildPlatform.isPower64 && stdenv.buildPlatform.isLittleEndian then
+            bb.packages.ghc984
+          else
+            bb.packages.ghc984Binary;
         inherit (buildPackages.python3Packages) sphinx;
         # Need to use apple's patched xattr until
         # https://github.com/xattr/xattr/issues/44 and
@@ -496,6 +508,12 @@ in
         compilerConfig = callPackage ../development/haskell-modules/configuration-ghc-9.6.x.nix { };
         packageSetConfig = bootstrapPackageSet;
       };
+      ghc984Binary = callPackage ../development/haskell-modules {
+        buildHaskellPackages = bh.packages.ghc984Binary;
+        ghc = bh.compiler.ghc984Binary;
+        compilerConfig = callPackage ../development/haskell-modules/configuration-ghc-9.8.x.nix { };
+        packageSetConfig = bootstrapPackageSet;
+      };
       ghc8107 = callPackage ../development/haskell-modules {
         buildHaskellPackages = bh.packages.ghc8107;
         ghc = bh.compiler.ghc8107;
diff --git a/pkgs/top-level/lua-packages.nix b/pkgs/top-level/lua-packages.nix
index 5e682627d109..e5272950b292 100644
--- a/pkgs/top-level/lua-packages.nix
+++ b/pkgs/top-level/lua-packages.nix
@@ -251,7 +251,6 @@ rec {
 
   nfd = callPackage ../development/lua-modules/nfd {
     inherit (pkgs) zenity;
-    inherit (pkgs.darwin.apple_sdk.frameworks) AppKit;
   };
 
   vicious = callPackage (
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 55c34edbdfac..087745078bc6 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -118,9 +118,7 @@ let
 
         bitwuzla-cxx = callPackage ../development/ocaml-modules/bitwuzla-cxx { };
 
-        bjack = callPackage ../development/ocaml-modules/bjack {
-          inherit (pkgs.darwin.apple_sdk.frameworks) Accelerate CoreAudio;
-        };
+        bjack = callPackage ../development/ocaml-modules/bjack { };
 
         bls12-381 = callPackage ../development/ocaml-modules/bls12-381 { };
         bls12-381-gen = callPackage ../development/ocaml-modules/bls12-381/gen.nix { };
@@ -145,9 +143,7 @@ let
 
         ca-certs-nss = callPackage ../development/ocaml-modules/ca-certs-nss { };
 
-        cairo2 = callPackage ../development/ocaml-modules/cairo2 {
-          inherit (pkgs.darwin.apple_sdk.frameworks) ApplicationServices;
-        };
+        cairo2 = callPackage ../development/ocaml-modules/cairo2 { };
 
         calendar = callPackage ../development/ocaml-modules/calendar { };
 
@@ -561,45 +557,24 @@ let
         ffmpeg = callPackage ../development/ocaml-modules/ffmpeg { };
         ffmpeg-av = callPackage ../development/ocaml-modules/ffmpeg/ffmpeg-av.nix {
           ffmpeg = pkgs.ffmpeg_6;
-          inherit (pkgs.darwin.apple_sdk.frameworks) AudioToolbox VideoToolbox;
         };
         ffmpeg-avcodec = callPackage ../development/ocaml-modules/ffmpeg/ffmpeg-avcodec.nix {
           ffmpeg = pkgs.ffmpeg_6;
-          inherit (pkgs.darwin.apple_sdk.frameworks) AudioToolbox VideoToolbox;
         };
         ffmpeg-avdevice = callPackage ../development/ocaml-modules/ffmpeg/ffmpeg-avdevice.nix {
           ffmpeg = pkgs.ffmpeg_6;
-          inherit (pkgs.darwin.apple_sdk.frameworks)
-            AppKit
-            AudioToolbox
-            AVFoundation
-            Cocoa
-            CoreImage
-            ForceFeedback
-            OpenGL
-            VideoToolbox
-            ;
         };
         ffmpeg-avfilter = callPackage ../development/ocaml-modules/ffmpeg/ffmpeg-avfilter.nix {
           ffmpeg = pkgs.ffmpeg_6;
-          inherit (pkgs.darwin.apple_sdk.frameworks)
-            AppKit
-            CoreImage
-            OpenGL
-            VideoToolbox
-            ;
         };
         ffmpeg-avutil = callPackage ../development/ocaml-modules/ffmpeg/ffmpeg-avutil.nix {
           ffmpeg = pkgs.ffmpeg_6;
-          inherit (pkgs.darwin.apple_sdk.frameworks) AudioToolbox VideoToolbox;
         };
         ffmpeg-swresample = callPackage ../development/ocaml-modules/ffmpeg/ffmpeg-swresample.nix {
           ffmpeg = pkgs.ffmpeg_6;
-          inherit (pkgs.darwin.apple_sdk.frameworks) VideoToolbox;
         };
         ffmpeg-swscale = callPackage ../development/ocaml-modules/ffmpeg/ffmpeg-swscale.nix {
           ffmpeg = pkgs.ffmpeg_6;
-          inherit (pkgs.darwin.apple_sdk.frameworks) VideoToolbox;
         };
 
         fiber = callPackage ../development/ocaml-modules/fiber { };
@@ -717,9 +692,7 @@ let
           inherit (pkgs) gsl;
         };
 
-        gstreamer = callPackage ../development/ocaml-modules/gstreamer {
-          inherit (pkgs.darwin.apple_sdk.frameworks) AppKit Foundation;
-        };
+        gstreamer = callPackage ../development/ocaml-modules/gstreamer { };
 
         ### H ###
 
@@ -1018,6 +991,8 @@ let
 
         jingoo = callPackage ../development/ocaml-modules/jingoo { };
 
+        jose = callPackage ../development/ocaml-modules/jose { };
+
         js_of_ocaml = callPackage ../development/tools/ocaml/js_of_ocaml { };
 
         js_of_ocaml-compiler = callPackage ../development/tools/ocaml/js_of_ocaml/compiler.nix { };
@@ -1088,9 +1063,7 @@ let
 
         lablgtk3-sourceview3 = callPackage ../development/ocaml-modules/lablgtk3/sourceview3.nix { };
 
-        labltk = callPackage ../development/ocaml-modules/labltk {
-          inherit (pkgs.darwin.apple_sdk.frameworks) Cocoa;
-        };
+        labltk = callPackage ../development/ocaml-modules/labltk { };
 
         lacaml = callPackage ../development/ocaml-modules/lacaml { };
 
@@ -1450,9 +1423,7 @@ let
 
         ocaml_gettext = callPackage ../development/ocaml-modules/ocaml-gettext { };
 
-        ocaml_libvirt = callPackage ../development/ocaml-modules/ocaml-libvirt {
-          inherit (pkgs.darwin.apple_sdk.frameworks) Foundation AppKit;
-        };
+        ocaml_libvirt = callPackage ../development/ocaml-modules/ocaml-libvirt { };
 
         ocaml-lsp = callPackage ../development/ocaml-modules/ocaml-lsp { };
 
@@ -1614,6 +1585,8 @@ let
 
         ohex = callPackage ../development/ocaml-modules/ohex { };
 
+        oidc = callPackage ../development/ocaml-modules/oidc { };
+
         ojs = callPackage ../development/ocaml-modules/gen_js_api/ojs.nix { };
 
         omd = callPackage ../development/ocaml-modules/omd { };
@@ -2083,15 +2056,7 @@ let
 
         trie = callPackage ../development/ocaml-modules/trie { };
 
-        tsdl = callPackage ../development/ocaml-modules/tsdl {
-          inherit (pkgs.darwin.apple_sdk.frameworks)
-            AudioToolbox
-            Cocoa
-            CoreAudio
-            CoreVideo
-            ForceFeedback
-            ;
-        };
+        tsdl = callPackage ../development/ocaml-modules/tsdl { };
 
         tsdl-image = callPackage ../development/ocaml-modules/tsdl-image { };
 
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 4590a9b3fd36..b1543f44f992 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -13,7 +13,6 @@
   lib,
   buildPackages,
   pkgs,
-  darwin,
   fetchurl,
   fetchpatch,
   fetchpatch2,
@@ -20056,7 +20055,6 @@ with self;
       url = "mirror://cpan/authors/id/W/WY/WYANT/Mac-Pasteboard-0.103.tar.gz";
       hash = "sha256-L16N0tsNZEVVhITKbULYOcWpfuiqGyUOaU1n1bf2Y0w=";
     };
-    buildInputs = [ pkgs.darwin.apple_sdk.frameworks.ApplicationServices ];
     meta = {
       description = "Manipulate Mac OS X pasteboards";
       license = with lib.licenses; [
@@ -26609,6 +26607,7 @@ with self;
         artistic1
         gpl1Plus
       ]; # taken from EPEL
+      badPlatforms = lib.platforms.darwin;
     };
   };
 
@@ -32234,7 +32233,6 @@ with self;
         hash = "sha256-nCypGyi6bZDEXqdb7wlGGzk9cFzmYkWGP1slBpXDfHw=";
       })
     ];
-    buildInputs = lib.optional stdenv.hostPlatform.isDarwin pkgs.darwin.apple_sdk.frameworks.Carbon;
     doCheck = !stdenv.hostPlatform.isAarch64;
     meta = {
       description = "Perl extension for getting CPU information. Currently only number of CPU's supported";
@@ -32538,16 +32536,12 @@ with self;
       url = "mirror://cpan/authors/id/V/VK/VKON/Tcl-1.27.tar.gz";
       hash = "sha256-+DhYd6Sp7Z89OQPS0PfNcPrDzmgyxg9gCmghzuP7WHI=";
     };
-    propagatedBuildInputs =
-      [
-        pkgs.tclPackages.bwidget
-        pkgs.tcl
-        pkgs.tclPackages.tix
-        pkgs.tk
-      ]
-      ++ lib.optionals stdenv.hostPlatform.isDarwin [
-        darwin.apple_sdk.frameworks.CoreServices
-      ];
+    propagatedBuildInputs = [
+      pkgs.tclPackages.bwidget
+      pkgs.tcl
+      pkgs.tclPackages.tix
+      pkgs.tk
+    ];
     makeMakerFlags = lib.optionals stdenv.hostPlatform.isLinux [
       "--tclsh=${pkgs.tcl}/bin/tclsh"
       "--nousestubs"
diff --git a/pkgs/top-level/php-packages.nix b/pkgs/top-level/php-packages.nix
index c0589556bdbe..5fa6bf77e42b 100644
--- a/pkgs/top-level/php-packages.nix
+++ b/pkgs/top-level/php-packages.nix
@@ -31,7 +31,6 @@
   openldap,
   openssl_1_1,
   openssl,
-  overrideSDK,
   pam,
   pcre2,
   bison,
@@ -284,12 +283,7 @@ lib.makeScope pkgs.newScope (
 
         couchbase = callPackage ../development/php-packages/couchbase { };
 
-        datadog_trace = callPackage ../development/php-packages/datadog_trace {
-          buildPecl = buildPecl.override {
-            stdenv = if stdenv.hostPlatform.isDarwin then overrideSDK stdenv "11.0" else stdenv;
-          };
-          inherit (pkgs) darwin;
-        };
+        datadog_trace = callPackage ../development/php-packages/datadog_trace { };
 
         decimal = callPackage ../development/php-packages/decimal { };
 
@@ -328,9 +322,7 @@ lib.makeScope pkgs.newScope (
 
         memprof = callPackage ../development/php-packages/memprof { };
 
-        mongodb = callPackage ../development/php-packages/mongodb {
-          inherit (pkgs) darwin;
-        };
+        mongodb = callPackage ../development/php-packages/mongodb { };
 
         msgpack = callPackage ../development/php-packages/msgpack { };
 
@@ -387,9 +379,7 @@ lib.makeScope pkgs.newScope (
 
         smbclient = callPackage ../development/php-packages/smbclient { };
 
-        snuffleupagus = callPackage ../development/php-packages/snuffleupagus {
-          inherit (pkgs) darwin;
-        };
+        snuffleupagus = callPackage ../development/php-packages/snuffleupagus { };
 
         spx = callPackage ../development/php-packages/spx { };
 
diff --git a/pkgs/top-level/pkg-config/pkg-config-data.json b/pkgs/top-level/pkg-config/pkg-config-data.json
index 83885cd85cb5..4e67b0326326 100644
--- a/pkgs/top-level/pkg-config/pkg-config-data.json
+++ b/pkgs/top-level/pkg-config/pkg-config-data.json
@@ -726,11 +726,6 @@
         "openssl"
       ]
     },
-    "orte": {
-      "attrPath": [
-        "openmpi"
-      ]
-    },
     "panel": {
       "attrPath": [
         "ncurses"
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 4d1a941a6b64..a620853eb405 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -686,6 +686,7 @@ mapAliases ({
   ruff-lsp = throw "ruff-lsp has been deprecated, use `ruff server` instead"; # added 2025-04-21
   runway-python = throw "SDK has been deprecated and was archived by upstream"; # added 2023-05-03
   safe = throw "safe has been removed, it was unmaintained sinced October 2019"; # added 2024-07-28
+  sabyenc = throw "sabyenc has been removed, due to no updates since June 2019 and being superseded by sabyenc3"; # added 2025-05-03
   sampledata = throw "sampledata has been removed, it was unmaintained since 2017"; # added 2024-07-27
   sapi-python-client = kbcstorage; # added 2022-04-20
   scikitimage = scikit-image; # added 2023-05-14
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index cbe1e52e24ae..68ea496ad81d 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -81,9 +81,7 @@ self: super: with self; {
 
   adb-shell = callPackage ../development/python-modules/adb-shell { };
 
-  adblock = callPackage ../development/python-modules/adblock {
-    inherit (pkgs.darwin.apple_sdk.frameworks) CoreFoundation Security;
-  };
+  adblock = callPackage ../development/python-modules/adblock { };
 
   add-trailing-comma = callPackage ../development/python-modules/add-trailing-comma { };
 
@@ -1083,9 +1081,7 @@ self: super: with self; {
 
   audioread = callPackage ../development/python-modules/audioread { };
 
-  audiotools = callPackage ../development/python-modules/audiotools {
-    inherit (pkgs.darwin.apple_sdk.frameworks) AudioToolbox AudioUnit CoreServices;
-  };
+  audiotools = callPackage ../development/python-modules/audiotools { };
 
   auditok = callPackage ../development/python-modules/auditok { };
 
@@ -2958,9 +2954,7 @@ self: super: with self; {
 
   cryptodatahub = callPackage ../development/python-modules/cryptodatahub { };
 
-  cryptography = callPackage ../development/python-modules/cryptography {
-    inherit (pkgs.darwin.apple_sdk.frameworks) Security;
-  };
+  cryptography = callPackage ../development/python-modules/cryptography { };
 
   cryptolyzer = callPackage ../development/python-modules/cryptolyzer { };
 
@@ -2980,9 +2974,7 @@ self: super: with self; {
 
   css-html-js-minify = callPackage ../development/python-modules/css-html-js-minify { };
 
-  css-inline = callPackage ../development/python-modules/css-inline {
-    inherit (pkgs.darwin.apple_sdk.frameworks) Security SystemConfiguration;
-  };
+  css-inline = callPackage ../development/python-modules/css-inline { };
 
   css-parser = callPackage ../development/python-modules/css-parser { };
 
@@ -3198,7 +3190,6 @@ self: super: with self; {
   datadog = callPackage ../development/python-modules/datadog { };
 
   datafusion = callPackage ../development/python-modules/datafusion {
-    inherit (pkgs.darwin.apple_sdk.frameworks) Security SystemConfiguration;
     protoc = pkgs.protobuf;
   };
 
@@ -4547,9 +4538,7 @@ self: super: with self; {
 
   ete3 = callPackage ../development/python-modules/ete3 { };
 
-  etebase = callPackage ../development/python-modules/etebase {
-    inherit (pkgs.darwin.apple_sdk.frameworks) Security;
-  };
+  etebase = callPackage ../development/python-modules/etebase { };
 
   etelemetry = callPackage ../development/python-modules/etelemetry { };
 
@@ -6060,7 +6049,6 @@ self: super: with self; {
   gspread = callPackage ../development/python-modules/gspread { };
 
   gssapi = callPackage ../development/python-modules/gssapi {
-    inherit (pkgs.darwin.apple_sdk.frameworks) GSS;
     krb5-c = pkgs.krb5;
   };
 
@@ -7077,9 +7065,7 @@ self: super: with self; {
 
   jobspy = callPackage ../development/python-modules/jobspy { };
 
-  johnnycanencrypt = callPackage ../development/python-modules/johnnycanencrypt {
-    inherit (pkgs.darwin.apple_sdk.frameworks) PCSC;
-  };
+  johnnycanencrypt = callPackage ../development/python-modules/johnnycanencrypt { };
 
   josepy = callPackage ../development/python-modules/josepy { };
 
@@ -7693,9 +7679,7 @@ self: super: with self; {
 
   ledgercomm = callPackage ../development/python-modules/ledgercomm { };
 
-  ledgerwallet = callPackage ../development/python-modules/ledgerwallet {
-    inherit (pkgs.darwin.apple_sdk.frameworks) AppKit;
-  };
+  ledgerwallet = callPackage ../development/python-modules/ledgerwallet { };
 
   legacy-cgi = callPackage ../development/python-modules/legacy-cgi { };
 
@@ -8442,9 +8426,7 @@ self: super: with self; {
 
   manimgl = callPackage ../development/python-modules/manimgl { };
 
-  manimpango = callPackage ../development/python-modules/manimpango {
-    inherit (pkgs.darwin.apple_sdk.frameworks) AppKit;
-  };
+  manimpango = callPackage ../development/python-modules/manimpango { };
 
   manuel = callPackage ../development/python-modules/manuel { };
 
@@ -8520,8 +8502,6 @@ self: super: with self; {
 
   matplotlib = callPackage ../development/python-modules/matplotlib {
     stdenv = if stdenv.hostPlatform.isDarwin then pkgs.clangStdenv else pkgs.stdenv;
-    inherit (pkgs.darwin.apple_sdk.frameworks) Cocoa;
-    ghostscript = pkgs.ghostscript_headless;
   };
 
   matplotlib-inline = callPackage ../development/python-modules/matplotlib-inline { };
@@ -8823,7 +8803,6 @@ self: super: with self; {
 
   miniaudio = callPackage ../development/python-modules/miniaudio {
     inherit (pkgs) miniaudio;
-    inherit (pkgs.darwin.apple_sdk.frameworks) AudioToolbox CoreAudio;
   };
 
   minichain = callPackage ../development/python-modules/minichain { };
@@ -11460,9 +11439,7 @@ self: super: with self; {
 
   primer3 = callPackage ../development/python-modules/primer3 { };
 
-  primp = callPackage ../development/python-modules/primp {
-    inherit (pkgs.darwin.apple_sdk.frameworks) SystemConfiguration;
-  };
+  primp = callPackage ../development/python-modules/primp { };
 
   print-color = callPackage ../development/python-modules/print-color { };
 
@@ -11527,7 +11504,7 @@ self: super: with self; {
   proto-plus = callPackage ../development/python-modules/proto-plus { };
 
   # If a protobuf upgrade causes many Python packages to fail, please pin it here to the previous version.
-  protobuf = protobuf5;
+  protobuf = protobuf6;
 
   protobuf3-to-dict = callPackage ../development/python-modules/protobuf3-to-dict { };
 
@@ -11537,7 +11514,12 @@ self: super: with self; {
   };
 
   # Protobuf 5.x
-  protobuf5 = callPackage ../development/python-modules/protobuf/default.nix {
+  protobuf5 = callPackage ../development/python-modules/protobuf/5.nix {
+    protobuf = pkgs.__splicedPackages.protobuf_29;
+  };
+
+  # Protobuf 6.x
+  protobuf6 = callPackage ../development/python-modules/protobuf/6.nix {
     inherit (pkgs.__splicedPackages) protobuf;
   };
 
@@ -11595,11 +11577,7 @@ self: super: with self; {
 
   psrpcore = callPackage ../development/python-modules/psrpcore { };
 
-  psutil = callPackage ../development/python-modules/psutil {
-    stdenv =
-      if pkgs.stdenv.hostPlatform.isDarwin then pkgs.overrideSDK pkgs.stdenv "11.0" else pkgs.stdenv;
-    inherit (pkgs.darwin.apple_sdk.frameworks) CoreFoundation IOKit;
-  };
+  psutil = callPackage ../development/python-modules/psutil { };
 
   psutil-home-assistant = callPackage ../development/python-modules/psutil-home-assistant { };
 
@@ -12364,9 +12342,7 @@ self: super: with self; {
 
   pygame = callPackage ../development/python-modules/pygame { };
 
-  pygame-ce = callPackage ../development/python-modules/pygame-ce {
-    inherit (pkgs.darwin.apple_sdk.frameworks) AppKit;
-  };
+  pygame-ce = callPackage ../development/python-modules/pygame-ce { };
 
   pygame-gui = callPackage ../development/python-modules/pygame-gui { };
 
@@ -12809,9 +12785,7 @@ self: super: with self; {
 
   pymumble = callPackage ../development/python-modules/pymumble { };
 
-  pymunk = callPackage ../development/python-modules/pymunk {
-    inherit (pkgs.darwin.apple_sdk.frameworks) ApplicationServices;
-  };
+  pymunk = callPackage ../development/python-modules/pymunk { };
 
   pymupdf = callPackage ../development/python-modules/pymupdf { };
 
@@ -13305,9 +13279,7 @@ self: super: with self; {
 
   pyscaffoldext-travis = callPackage ../development/python-modules/pyscaffoldext-travis { };
 
-  pyscard = callPackage ../development/python-modules/pyscard {
-    inherit (pkgs.darwin.apple_sdk.frameworks) PCSC;
-  };
+  pyscard = callPackage ../development/python-modules/pyscard { };
 
   pyscf = callPackage ../development/python-modules/pyscf { };
 
@@ -14234,14 +14206,7 @@ self: super: with self; {
 
   python-roborock = callPackage ../development/python-modules/python-roborock { };
 
-  python-rtmidi = callPackage ../development/python-modules/python-rtmidi {
-    inherit (pkgs.darwin.apple_sdk.frameworks)
-      CoreAudio
-      CoreMIDI
-      CoreServices
-      Foundation
-      ;
-  };
+  python-rtmidi = callPackage ../development/python-modules/python-rtmidi { };
 
   python-sat = callPackage ../development/python-modules/python-sat { };
 
@@ -14385,7 +14350,6 @@ self: super: with self; {
         libXmu
         libXext
         ;
-      inherit (pkgs.darwin.apple_sdk.frameworks) Cocoa;
     }
   );
 
@@ -15328,9 +15292,7 @@ self: super: with self; {
 
   rtfunicode = callPackage ../development/python-modules/rtfunicode { };
 
-  rtmidi-python = callPackage ../development/python-modules/rtmidi-python {
-    inherit (pkgs.darwin.apple_sdk.frameworks) CoreAudio CoreMIDI CoreServices;
-  };
+  rtmidi-python = callPackage ../development/python-modules/rtmidi-python { };
 
   rtmixer = callPackage ../development/python-modules/rtmixer { };
 
@@ -15394,8 +15356,6 @@ self: super: with self; {
 
   sabctools = callPackage ../development/python-modules/sabctools { };
 
-  sabyenc = callPackage ../development/python-modules/sabyenc { };
-
   sabyenc3 = callPackage ../development/python-modules/sabyenc3 { };
 
   sacn = callPackage ../development/python-modules/sacn { };
@@ -15578,9 +15538,7 @@ self: super: with self; {
 
   scrypt = callPackage ../development/python-modules/scrypt { };
 
-  scs = callPackage ../development/python-modules/scs {
-    inherit (pkgs.darwin.apple_sdk.frameworks) Accelerate;
-  };
+  scs = callPackage ../development/python-modules/scs { };
 
   scspell = callPackage ../development/python-modules/scspell { };
 
@@ -15941,9 +15899,7 @@ self: super: with self; {
 
   skein = callPackage ../development/python-modules/skein { };
 
-  skia-pathops = callPackage ../development/python-modules/skia-pathops {
-    inherit (pkgs.darwin.apple_sdk.frameworks) ApplicationServices OpenGL;
-  };
+  skia-pathops = callPackage ../development/python-modules/skia-pathops { };
 
   skidl = callPackage ../development/python-modules/skidl { };
 
@@ -15973,9 +15929,7 @@ self: super: with self; {
 
   skytemple-icons = callPackage ../development/python-modules/skytemple-icons { };
 
-  skytemple-rust = callPackage ../development/python-modules/skytemple-rust {
-    inherit (pkgs.darwin.apple_sdk.frameworks) Foundation;
-  };
+  skytemple-rust = callPackage ../development/python-modules/skytemple-rust { };
 
   skytemple-ssb-debugger = callPackage ../development/python-modules/skytemple-ssb-debugger { };
 
@@ -17129,7 +17083,6 @@ self: super: with self; {
     in
     callPackage ../development/python-modules/tensorflow {
       inherit (pkgs.config) cudaSupport;
-      inherit (pkgs.darwin.apple_sdk.frameworks) Foundation Security;
       flatbuffers-core = pkgs.flatbuffers;
       flatbuffers-python = self.flatbuffers;
       cudaPackages = compat.cudaPackagesTF;
@@ -18325,9 +18278,7 @@ self: super: with self; {
 
   ua-parser-rs = callPackage ../development/python-modules/ua-parser-rs { };
 
-  uamqp = callPackage ../development/python-modules/uamqp {
-    inherit (pkgs.darwin.apple_sdk.frameworks) CFNetwork CoreFoundation Security;
-  };
+  uamqp = callPackage ../development/python-modules/uamqp { };
 
   uarray = callPackage ../development/python-modules/uarray { };
 
@@ -18365,9 +18316,7 @@ self: super: with self; {
 
   ufoprocessor = callPackage ../development/python-modules/ufoprocessor { };
 
-  uharfbuzz = callPackage ../development/python-modules/uharfbuzz {
-    inherit (pkgs.darwin.apple_sdk.frameworks) ApplicationServices;
-  };
+  uharfbuzz = callPackage ../development/python-modules/uharfbuzz { };
 
   uhi = callPackage ../development/python-modules/uhi { };
 
@@ -18575,9 +18524,7 @@ self: super: with self; {
 
   uvicorn = callPackage ../development/python-modules/uvicorn { };
 
-  uvloop = callPackage ../development/python-modules/uvloop {
-    inherit (pkgs.darwin.apple_sdk.frameworks) ApplicationServices CoreServices;
-  };
+  uvloop = callPackage ../development/python-modules/uvloop { };
 
   uwsgi-chunked = callPackage ../development/python-modules/uwsgi-chunked { };
 
@@ -18841,9 +18788,7 @@ self: super: with self; {
 
   watchdog-gevent = callPackage ../development/python-modules/watchdog-gevent { };
 
-  watchfiles = callPackage ../development/python-modules/watchfiles {
-    inherit (pkgs.darwin.apple_sdk.frameworks) CoreServices;
-  };
+  watchfiles = callPackage ../development/python-modules/watchfiles { };
 
   watchgod = callPackage ../development/python-modules/watchgod { };
 
diff --git a/pkgs/top-level/qt5-packages.nix b/pkgs/top-level/qt5-packages.nix
index dabc79018316..2fab1e0d8527 100644
--- a/pkgs/top-level/qt5-packages.nix
+++ b/pkgs/top-level/qt5-packages.nix
@@ -191,21 +191,12 @@ makeScopeWithSplicing' {
         liblastfm = callPackage ../development/libraries/liblastfm { };
 
         libopenshot = callPackage ../development/libraries/libopenshot {
-          stdenv =
-            if pkgs.stdenv.hostPlatform.isDarwin then pkgs.overrideSDK pkgs.stdenv "11.0" else pkgs.stdenv;
           python3 = pkgs.python311;
         };
 
         packagekit-qt = callPackage ../tools/package-management/packagekit/qt.nix { };
 
-        libopenshot-audio = callPackage ../development/libraries/libopenshot-audio {
-          inherit (pkgs.darwin.apple_sdk.frameworks)
-            Accelerate
-            AGL
-            Cocoa
-            Foundation
-            ;
-        };
+        libopenshot-audio = callPackage ../development/libraries/libopenshot-audio { };
 
         libqglviewer = callPackage ../development/libraries/libqglviewer { };
 
@@ -250,8 +241,6 @@ makeScopeWithSplicing' {
         pulseaudio-qt = callPackage ../development/libraries/pulseaudio-qt { };
 
         qca = callPackage ../development/libraries/qca {
-          stdenv =
-            if pkgs.stdenv.hostPlatform.isDarwin then pkgs.overrideSDK pkgs.stdenv "11.0" else pkgs.stdenv;
           inherit (libsForQt5) qtbase;
         };
         qca-qt5 = self.qca;
@@ -262,9 +251,7 @@ makeScopeWithSplicing' {
 
         qjson = callPackage ../development/libraries/qjson { };
 
-        qmltermwidget = callPackage ../development/libraries/qmltermwidget {
-          inherit (pkgs.darwin.apple_sdk.libs) utmp;
-        };
+        qmltermwidget = callPackage ../development/libraries/qmltermwidget { };
 
         qmlbox2d = callPackage ../development/libraries/qmlbox2d { };
 
@@ -282,11 +269,7 @@ makeScopeWithSplicing' {
 
         qtinstaller = callPackage ../development/libraries/qtinstaller { };
 
-        qtkeychain = callPackage ../development/libraries/qtkeychain {
-          stdenv =
-            if pkgs.stdenv.hostPlatform.isDarwin then pkgs.overrideSDK pkgs.stdenv "11.0" else pkgs.stdenv;
-          inherit (pkgs.darwin.apple_sdk.frameworks) CoreFoundation Security;
-        };
+        qtkeychain = callPackage ../development/libraries/qtkeychain { };
 
         qtmpris = callPackage ../development/libraries/qtmpris { };
 
diff --git a/pkgs/top-level/qt6-packages.nix b/pkgs/top-level/qt6-packages.nix
index 30a88e32bdb8..d7f144f0d5df 100644
--- a/pkgs/top-level/qt6-packages.nix
+++ b/pkgs/top-level/qt6-packages.nix
@@ -82,7 +82,7 @@ makeScopeWithSplicing' {
 
       maplibre-native-qt = callPackage ../development/libraries/maplibre-native-qt { };
 
-      qca = pkgs.darwin.apple_sdk_11_0.callPackage ../development/libraries/qca {
+      qca = callPackage ../development/libraries/qca {
         inherit (qt6) qtbase qt5compat;
       };
       qcoro = callPackage ../development/libraries/qcoro { };
@@ -96,9 +96,7 @@ makeScopeWithSplicing' {
 
       qtforkawesome = callPackage ../development/libraries/qtforkawesome { };
 
-      qtkeychain = callPackage ../development/libraries/qtkeychain {
-        inherit (pkgs.darwin.apple_sdk.frameworks) CoreFoundation Security;
-      };
+      qtkeychain = callPackage ../development/libraries/qtkeychain { };
 
       qtpbfimageplugin = callPackage ../development/libraries/qtpbfimageplugin { };
 
diff --git a/pkgs/top-level/release.nix b/pkgs/top-level/release.nix
index 621e81acb548..31fe8fb38e13 100644
--- a/pkgs/top-level/release.nix
+++ b/pkgs/top-level/release.nix
@@ -251,11 +251,7 @@ let
             jobs.tests.stdenv.hooks.patch-shebangs.x86_64-linux
           */
         ]
-        # FIXME: the aarch64-darwin stdenvBootstrapTools are broken
-        #  due to some locale impurity changing in macOS 15.4
-        ++ release-lib.lib.filter (j: j.system != "aarch64-darwin") (
-          collect isDerivation jobs.stdenvBootstrapTools
-        )
+        ++ collect isDerivation jobs.stdenvBootstrapTools
         ++ optionals supportDarwin.x86_64 [
           jobs.stdenv.x86_64-darwin
           jobs.cargo.x86_64-darwin
diff --git a/pkgs/top-level/stage.nix b/pkgs/top-level/stage.nix
index 96725dd966bf..7bca60a4caa5 100644
--- a/pkgs/top-level/stage.nix
+++ b/pkgs/top-level/stage.nix
@@ -396,6 +396,7 @@ let
               super'.stdenv.cc.defaultHardeningFlags
               ++ [
                 "shadowstack"
+                "nostrictaliasing"
                 "pacret"
                 "trivialautovarinit"
               ]